Compliance API overview

Submitting compliance information is a necessary prerequisite to performing operations via Bastion. The verification process is a one-time step facilitated via the Submit Compliance Data endpoint.

​

Identities and accounts

Bastion operates on an identity-based system, where an identity can have multiple associated accounts. You submit compliance data at the identity level rather than per account. There are two types of identities: Individual identities – Requires KYC (Know Your Customer) verification. Business identities – Requires KYB (Know Your Business) verification. All accounts underneath a given identity inherit the type of identity.

​

Types of checks

When Bastion receives a Submit Compliance Data request, it performs two types of checks:

• Sanctions checks – Determines whether the identity is a sanctioned entity or linked to one.
• Jurisdiction checks – Confirms whether the identity is in a jurisdiction supported by Bastion.

To interact with fungible assets through the Bastion platform, an identity must pass both checks. If an identity is permitted to transact in fungibles, all associated accounts can.

​

Data requirements

Compliance data submissions must contain specific required fields based on the identity type. Complete and accurate information ensures timely processing and compliance review. For detailed schema definitions and required fields, refer to the Submit Compliance Data API.

​

Compliance submission example

Submitting compliance data to Bastion is a simple two-step process:

1. Create the identity
2. Submit compliance data on behalf of the identity

​

Submission outcomes

There are three possible outcomes when submitting compliance data:

1. Failed sanctions check – If the identity fails the sanctions check, all associated accounts are frozen and blocked from interacting with the Bastion platform without manual intervention.
2. Failed jurisdiction check – If the identity passes the sanctions check but fails the jurisdiction check, its associated accounts cannot interact with fungible assets. If a jurisdiction later becomes supported, Bastion will automatically re-evaluate affected identities.
3. Successful compliance check – If the identity passes both sanctions and jurisdiction checks:
   • For individual accounts, they are permitted to transact with fungible assets.
   • For business accounts, they are permitted to transact with fungible assets.

​

Understanding compliance status

To check the compliance status of an identity, call GET identity. The response will include a compliance_status field, which will indicate whether the identity is undergoing KYC or KYB, depending on its type. This status provides the following key information:

• Sanctions check results – Whether the identity passed or failed sanctions checks. If it failed, the response will include a reason for failure.
• Jurisdiction status – Whether the identity passed the jurisdiction check. If it failed, the response will include a failure reason.
• Fungible transaction eligibility – Whether the identity is permitted to transact in fungible assets.

By retrieving this status, users can determine whether they have passed sanctions and jurisdiction checks and if they are permitted to transact in fungibles.

​

Fiat operations eligibility

To determine whether an identity is eligible for fiat operations via a partner, call GET identity. The response includes the fiat_operations_enabled field:

• fiat_operations_enabled: true – The identity is eligible to convert fiat to stablecoins and vice versa
• fiat_operations_enabled: false – The identity does not have access to fiat operations.

​

Additional checks

Bastion performs additional compliance checks on non-Bastion addresses that users interact with:

• At the time of transaction submission - if a given transaction is determined to be at a high risk of interacting with a sanctioned entity, Bastion may reject the transaction submission to prevent the end user from potentially violating sanction laws by interacting with a sanctioned entity.
• When a Bastion user receives an on-chain deposit - if a given deposit is determined to be at a high risk of originating from a sanctioned entity, Bastion will freeze that user’s account and conduct a compliance review of the deposit in question.

​

Sandbox testing notes

In the sandbox environment, Bastion simulates compliance checks using specific test values to help you validate behavior without triggering live sanctions or jurisdiction checks. To test compliance outcomes, use the following conventions:

​

Sanctions check

To pass, use the business name Corporation (for KYB) or a personal name like John Smith (for KYC). To fail, use watchlist hit as a business name (for KYB), or use Osama Bin Laden (for KYC) as a personal name.

​

Jurisdiction check

Use an address from a Bastion-supported jurisdiction to pass. Use an unsupported region (e.g. certain countries or U.S. states) to simulate failure. Note: All email addresses must be unique, including for any associated beneficial owners (UBOs).