Written for someone who will never read the code. It explains what BGADD reads,
where it reads it, how the screening works, what was thrown out during review, and — most
importantly — what none of this can prove. If a number cannot be traced to a public document,
it is not on the deck.
The one rule. A number never appears without a receipt: the source, the day it was read,
and a sentence saying what it does not prove. Where there is no receipt, the field says
not collected instead of showing a zero. A blank we admit to is worth more than a number
we invented.
What we read
Eight public sources. All are official registers, public APIs, or the organisations' own published
material. Nothing is scraped from behind a login.
Sanctions registers ×5OFAC · UN · UK · EU
on each build
Five official designation lists: the US Treasury's SDN and Consolidated lists, the
UN Security Council consolidated list, the UK OFSI list, and the EU Financial Sanctions Database.
Every member's legal names are screened against every record.
What it cannot tell youThis is a name screen against
designated entities. It does not trace fund flows, wallet addresses or counterparties.
A clean result means no member's legal name appears on a designation list — it is not
evidence that no sanctioned money touches a member's network. That requires on-chain
attribution we do not perform.
Court recordsCourtListener (RECAP)
monthly + review
US federal civil dockets are searchable in public. We search the case-name field for
each member's legal names, then a person reads every candidate and decides whether it actually
names the member.
What it cannot tell youCivil only — criminal, state and non-US proceedings
are not covered. A docket naming an entity is not a finding: being sued is not misconduct, and
the outcome of each case has not been reviewed.
EU crypto licenceESMA MiCA register
weekly
Europe's markets regulator publishes every firm authorised under MiCA: legal name,
register number (LEI), licensing authority, permitted services, and the countries it may serve.
What it cannot tell youA missing row is not a breach. The licence may sit
with a subsidiary we did not match, or the firm may not serve European clients at all.
Public codeGitHub API
weekly
For each member with a public organisation we read repository counts, last-push dates
and commit history across two equal 90-day windows, plus how concentrated those commits are
among authors.
What it cannot tell youA foundation's GitHub page is not its workforce.
Core code often sits with a partner org — Sui's sits with Mysten Labs, Polkadot's moved to a
different account. Low activity there is not a finding.
Value locked on-chainDeFiLlama
daily
How much money is locked in the public network a member anchors.
What it cannot tell youThis is the size of the surface, not money the
foundation holds or guarantees. It is called exposure for that reason — never “funds at
risk”, which would imply a threat we have not established.
The member's own sitepublic pages
monthly
We check whether the member publishes five things a counterparty would want to read:
a sanctions/AML statement, a privacy policy, a human-rights or conduct position, a complaints or
whistleblower channel, and legal-entity/terms disclosure.
What it cannot tell youPresence of a page is a fact. Whether the policy is
any good, or is followed, is not assessed. This is not an ethics score and must not be read as one.
Official publicationsRSS feeds
weekly
Where an organisation publishes a feed, we count posts in the last 30 days and record
the date of the most recent one.
What it cannot tell youCadence is not candour. A quiet feed can mean a quiet
organisation or a moved blog. Where no feed resolves, the field stays empty.
Web archiveWayback CDX
planned
Team and governance pages, snapshotted quarterly, so leadership changes can be
diffed over time.
What it cannot tell youNot yet in the deck. Snapshots show what a page said,
not why someone left, and staff changes are personal data — role changes only will be published.
How a screening works
- Fetch and keep. Each register is downloaded whole and kept with its retrieval date.
Nothing is read from a page a human could have edited in between.
- Normalise. Names are stripped of punctuation, accents and legal suffixes, so
“Payward, Inc.” and “PAYWARD INC” collapse to the same key.
- Resolve the entity. A brand is not a legal entity. The exchange everyone calls “Kraken”
appears on the EU register as Payward Europe Solutions Limited. Matching the brand alone
would report a licensed firm as unlicensed.
- Split exact from fuzzy. An exact match on the normalised legal name is a finding. A token
overlap is only a lead — it never reaches the deck as a match.
- Review by hand. Every lead is read by a person and recorded as confirmed or dismissed,
with a reason. That review file ships with the build.
Why step 5 matters. On this dataset the raw screening produced 74 litigation candidates.
Review reduced that to 30 confirmed and 44 dismissed. Cardano's 19 candidates were
people surnamed Cardano; FLock.io's 287 were people surnamed Flock; Web3 Foundation's were
companies called Smocked Polkadot and Pink Polkadot. Publishing the raw counts
would have accused members of matters that do not involve them.
Three mistakes we found, and avoided
A word search inflates lawsuits fifty-fold
"Kraken": 1,169 court records · case-name field: 23
Full-text court search matches briefs, exhibits and unrelated companies. Even the case-name field
still returned Kraken Box LLC and Kraken Dice. Only entity review separates a
mention from a party.
A moving repository looks like a mass resignation
Web3 Foundation's repo: 0 commits in 90 days
The code had moved to a different account. A naive turnover metric would have announced that the
foundation lost all of its developers. We now detect repo moves and publish commit counts and
concentration instead of a fabricated retention percentage.
A brand is not the licensed company
"Kraken" → no entry · "Payward Europe Solutions Ltd" → authorised, 30 countries
Registers are keyed to legal entities. Checking only the brand would have reported one of the
group's most regulated members as unlicensed — precisely backwards.
What we never do
No scraping behind a loginNo LinkedIn, no member-only portals, no paywalled pages.
No personal data on individualsRole changes, not named people. Privacy law applies to due
diligence too — and to court records about private individuals.
No inferring from silence“No record found” carries zero weight in either direction.
No AI judging conductEthics fields need two independent human reviewers with evidence.
A model reading a website cannot assess conduct.
No score on thin dataA substance index appears only when at least 3 of its 4 components
are measured and 9 fields are evidenced. Otherwise the card shows no score.
No accusation by implicationNo “fraud”, “insolvent” or “non-compliant”. A register result
is reported as a register result, with its date.
Can I check your work?
Yes — that is the point. Open any member card. Every field shows its source, the date it was read,
and a link where one exists. The review decisions for every litigation candidate are recorded with
reasons. If a number and its source disagree, the source wins and we want to know.
As of —: — organisations,
— evidenced fields, — sanctions designations screened,
— members flagged, — candidates dismissed on review.
What this still cannot see
- Fund flows. The single biggest limitation. A name screen cannot tell you where money went.
Detecting sanctioned or illicit funds moving through a member's network needs wallet-level
attribution from a chain-analytics provider, and a policy for what to do with a hit. We have not
built that, so we make no claim about it either way.
- Criminal and non-US proceedings. CourtListener covers US federal civil dockets. A criminal
indictment or a case in Singapore, Abu Dhabi or Switzerland would not appear here.
- Outcomes. We record that a docket names an entity, not whether it was dismissed, settled
or won. Every litigation flag says so on its face.
- Beneficial ownership. Who ultimately controls a member is a registry question across many
jurisdictions; we have not resolved it for any member.
- Terms of reference. The group's membership criteria and conflict-of-interest policy are not
published on the launch page. That document would tell us which questions matter most.
Corrections and right of reply
Any organisation named here may respond to any claim. A response is appended to the field with a
timestamp and is never deleted. Substantive corrections change the underlying record, and the change
is logged. Nothing here is a conclusion about an organisation's conduct — it is a record of what
public documents said on a given day.