1.8 ComplianceGate

1. Bot Identity

Operational profile

2. Purpose

ComplianceGate enforces Polymarket's terms-of-service access policy on every OrderIntent before it reaches execution. It validates (1) that the originating wallet has completed Polymarket onboarding, (2) that the user's jurisdiction is not on the blocked list, (3) that the wallet address does not appear on OFAC or other configured sanctions lists, and (4) that the target market is eligible for trading (not restricted by category policy). When any check fails the order is rejected outright; for geopolitical markets the bot applies NegRisk-aware category rules before passing. ComplianceGate is fail-closed: any inability to verify policy results in a hard reject.

3. Why This Bot Matters

• Sanctioned-address order submitted

  Allowing a wallet on an OFAC or other sanctions list to trade exposes the operator to regulatory and legal liability, and may result in asset freezing or platform shutdown.

• Blocked-jurisdiction user bypasses geo check

  Trading from a restricted jurisdiction violates Polymarket's terms and applicable law; unchecked this can lead to regulatory action against the platform.

• Non-onboarded wallet places order

  Polymarket's KYC/AML process has not been completed; the user has not accepted terms and the platform has no identity verification for the account.

• Market category restriction not enforced

  Certain market categories (e.g. restricted financial instruments, region-specific political events) may not be available to all users; ignoring category eligibility creates unequal treatment and compliance gaps.

• Fail-open on policy-service outage

  If compliance checks succeed silently during a data outage, ineligible users can trade undetected. ComplianceGate must fail-closed to prevent this.

4. Required Polymarket Inputs

5. Required Internal Inputs

6. Parameter Guide

7. Detailed Parameter Instructions

{ "require_polymarket_onboarded": true }

if (require_polymarket_onboarded && !user.polymarket_onboarded) return reject('COMPLIANCE_GATE_NOT_ONBOARDED');

{ "blocked_jurisdictions": ["US", "GB", "IR", "KP", "SY", "CU"] }

if (blocked_jurisdictions.includes(user.country_code)) return reject('COMPLIANCE_GATE_JURISDICTION_BLOCKED');

{ "sanctions_list_source": "OFAC_SDN" }

const hit = sanctionsScreener.check(intent.wallet, params.sanctions_list_source); if (hit) return reject('COMPLIANCE_GATE_SANCTIONS_HIT');

{ "close_only_on_violation": false }

if (policyFailed && params.close_only_on_violation && isCloseOrder(intent)) return reshape({ close_only: true });

8. Default Configuration

{
  "bot_id": "risk.compliance_gate",
  "version": "2.0.0",
  "mode": "hard_guard",
  "defaults": {
    "require_polymarket_onboarded": true,
    "blocked_jurisdictions": [
      "US",
      "GB",
      "IR",
      "KP",
      "SY",
      "CU"
    ],
    "sanctions_list_source": "OFAC_SDN",
    "close_only_on_violation": false
  },
  "locked": {
    "require_polymarket_onboarded": {
      "min": true
    },
    "sanctions_list_source": {
      "allowed": [
        "OFAC_SDN",
        "CHAINALYSIS",
        "ELLIPTIC",
        "COMBINED"
      ]
    }
  }
}

9. Implementation Flow

1. Receive OrderIntent from Strategy layer including market_id, wallet address, and user metadata.
2. Check KillSwitch active flag; if active, return REJECT with KILL_SWITCH_ACTIVE immediately.
3. Screen the originating wallet address against the configured sanctions list (OFAC SDN + additional providers). On any match, return HARD_REJECT with COMPLIANCE_GATE_SANCTIONS_HIT — this check cannot be bypassed by close_only_on_violation.
4. Check user jurisdiction against blocked_jurisdictions. If blocked and close_only_on_violation=false, return HARD_REJECT with COMPLIANCE_GATE_JURISDICTION_BLOCKED. If blocked and close_only_on_violation=true and this is a close/reduce order, return RESHAPE with constraints.close_only=true.
5. If require_polymarket_onboarded=true, verify the wallet's onboarding status from the internal onboarding cache. If not onboarded, return HARD_REJECT with COMPLIANCE_GATE_NOT_ONBOARDED.
6. Fetch target market metadata from Gamma API to determine category and negRisk flag. If the market category is restricted for this user (e.g. geopolitical events in certain jurisdictions), return HARD_REJECT with COMPLIANCE_GATE_MARKET_INELIGIBLE.
7. Check the admin-configurable market eligibility override map. If market is explicitly blacklisted, return HARD_REJECT with COMPLIANCE_GATE_MARKET_INELIGIBLE.
8. All checks passed — return APPROVE with inputs_used list and checked_at timestamp.

10. Reference Implementation

Runs four sequential policy gates — KillSwitch, sanctions screening, jurisdiction check, and market eligibility — before emitting a RiskVote. All gates are fail-closed: any data-source error produces HARD_REJECT.

Pseudocode is language-agnostic. FETCH = read input. EMIT = produce output. Translate to TS/Python/Go/Rust.

FUNCTION evaluateCompliance(intent):
  // --- 0. KillSwitch gate ---
  ks = FETCH internal.killswitch.status
  IF ks.active:
    EMIT RiskVote(decision=HARD_REJECT, reason=KILL_SWITCH_ACTIVE)
    RETURN

  // --- 1. Sanctions screening ---
  sanctionsResult = FETCH internal.sanctions.check(intent.wallet, params.sanctions_list_source)
  IF sanctionsResult IS NULL:
    EMIT RiskVote(decision=HARD_REJECT, reason=COMPLIANCE_GATE_DATA_UNAVAILABLE)
    RETURN
  IF sanctionsResult.hit:
    EMIT RiskVote(decision=HARD_REJECT, reason=COMPLIANCE_GATE_SANCTIONS_HIT)
    RETURN

  // --- 2. Jurisdiction check ---
  user = FETCH internal.user.profile(intent.user_id)
  IF user IS NULL:
    EMIT RiskVote(decision=HARD_REJECT, reason=COMPLIANCE_GATE_DATA_UNAVAILABLE)
    RETURN
  IF params.blocked_jurisdictions.contains(user.country_code):
    IF params.close_only_on_violation AND isCloseOrder(intent):
      EMIT RiskVote(decision=RESHAPE_REQUIRED,
                    reason=COMPLIANCE_GATE_JURISDICTION_CLOSE_ONLY,
                    constraints={close_only: true})
    ELSE:
      EMIT RiskVote(decision=HARD_REJECT, reason=COMPLIANCE_GATE_JURISDICTION_BLOCKED)
    RETURN

  // --- 3. Onboarding check ---
  IF params.require_polymarket_onboarded:
    onboarding = FETCH internal.onboarding.status(intent.wallet)
    IF onboarding IS NULL:
      EMIT RiskVote(decision=HARD_REJECT, reason=COMPLIANCE_GATE_DATA_UNAVAILABLE)
      RETURN
    IF NOT onboarding.completed:
      EMIT RiskVote(decision=HARD_REJECT, reason=COMPLIANCE_GATE_NOT_ONBOARDED)
      RETURN

  // --- 4. Market eligibility check ---
  market = FETCH gamma.getMarketByConditionId(intent.market_id)
  IF market IS NULL:
    EMIT RiskVote(decision=HARD_REJECT, reason=COMPLIANCE_GATE_DATA_UNAVAILABLE)
    RETURN
  override = FETCH internal.market_eligibility_overrides.get(intent.market_id)
  IF override == 'BLOCKED':
    EMIT RiskVote(decision=HARD_REJECT, reason=COMPLIANCE_GATE_MARKET_INELIGIBLE)
    RETURN
  IF isCategoryRestrictedForUser(market.category, market.negRisk, user):
    EMIT RiskVote(decision=HARD_REJECT, reason=COMPLIANCE_GATE_MARKET_INELIGIBLE)
    RETURN

  // --- 5. All checks passed ---
  EMIT RiskVote(decision=APPROVE,
                inputs_used=['internal.sanctions', 'internal.user.profile',
                             'internal.onboarding', 'gamma.market'],
                checked_at=now_iso())

SDK calls used

• gamma.getMarketByConditionId(market_id)
• internal.sanctions.check(wallet, provider)
• internal.onboarding.status(wallet)
• internal.user.profile(user_id)
• internal.market_eligibility_overrides.get(market_id)
• internal.killswitch.status()

Complexity: O(1) — constant number of policy checks per intent, each backed by in-memory cache with periodic refresh

11. Wire Examples

Input — what arrives on the wire

OrderIntent from strategy — user in blocked jurisdiction — internal

{
  "intent_id": "int_c1d2e3f4a5b6c7d8",
  "market_id": "0x7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a",
  "side": "BUY",
  "outcome": "YES",
  "size_usd": 500,
  "price": 0.55,
  "wallet": "0xDeAdBeEf1234567890AbCdEf1234567890AbCdEf",
  "user_id": "usr_9a8b7c6d",
  "generated_at_ms": 1746780000000
}

User profile snapshot — internal

{
  "user_id": "usr_9a8b7c6d",
  "country_code": "GB",
  "polymarket_onboarded": true,
  "profile_fetched_at_ms": 1746779950000
}

Output — what the bot emits

RiskVote — HARD_REJECT (jurisdiction blocked)

{
  "guard_id": "risk.compliance_gate",
  "decision": "HARD_REJECT",
  "severity": "HARD",
  "reason_code": "COMPLIANCE_GATE_JURISDICTION_BLOCKED",
  "message": "Wallet jurisdiction GB is on the blocked list. Order rejected per platform compliance policy.",
  "constraints": {},
  "inputs_used": [
    "internal.sanctions.OFAC_SDN",
    "internal.user.profile",
    "internal.onboarding.status",
    "gamma.market.category"
  ],
  "checked_at": "2026-05-09T10:22:01Z"
}

RiskVote — APPROVE (all checks pass)

{
  "guard_id": "risk.compliance_gate",
  "decision": "APPROVE",
  "severity": "INFO",
  "reason_code": "COMPLIANCE_GATE_PASS",
  "message": "All compliance checks passed for wallet 0xAb12...Cd34.",
  "constraints": {},
  "inputs_used": [
    "internal.sanctions.OFAC_SDN",
    "internal.user.profile",
    "internal.onboarding.status",
    "gamma.market.category"
  ],
  "checked_at": "2026-05-09T10:22:01Z"
}

12. Decision Logic

13. Standard Decision Output

This bot returns a RiskVote object. See RiskVote schema.

{
  "guard_id": "risk.compliance_gate",
  "decision": "HARD_REJECT",
  "severity": "HARD",
  "reason_code": "COMPLIANCE_GATE_JURISDICTION_BLOCKED",
  "message": "Wallet jurisdiction GB is on the blocked list. Order rejected.",
  "constraints": {},
  "inputs_used": [
    "internal.user.jurisdiction",
    "internal.sanctions.OFAC_SDN",
    "internal.onboarding.status",
    "gamma.market.category"
  ],
  "checked_at": "2026-05-09T10:22:00Z"
}

14. Reason Codes

15. Metrics & Logs

Metrics emitted

Alerts

Dashboards

• Grafana — Risk overview / ComplianceGate
• Grafana — Compliance audit / jurisdiction and sanctions breakdown

16. Developer Reporting

{
  "bot_id": "risk.compliance_gate",
  "decision": "HARD_REJECT",
  "reason_code": "COMPLIANCE_GATE_JURISDICTION_BLOCKED",
  "inputs_used": [
    "internal.user.jurisdiction",
    "internal.sanctions.OFAC_SDN"
  ],
  "metrics": {
    "wallet": "0xaabbcc...redacted",
    "jurisdiction": "GB",
    "sanctions_hit": false,
    "onboarded": true,
    "market_category": "politics",
    "negrisk": false
  },
  "checked_at": "2026-05-09T10:22:00Z"
}

17. Plain-English Reporting

18. Failure-Mode Block

19. Failure-Injection Recipes

20. State & Persistence

Cold-start recovery

On cold start, all caches are empty. First evaluation per wallet/market triggers a blocking fetch. If the fetch fails, the order is rejected fail-closed until the cache is populated.

21. Concurrency & Idempotency

22. Dependencies

Depends on (must run first)

Emits to (downstream consumers)

Sibling bots (same OrderIntent)

External services

23. Security Surfaces

Abuse vectors considered

• VPN / proxy use to circumvent jurisdiction detection
• Presenting a freshly created wallet not yet on sanctions lists
• Timing attack: submitting order during sanctions-list refresh window when cache has just expired

Mitigations

• Jurisdiction check uses platform-side geo signal, not user-declared location
• Sanctions list refresh is asynchronous with overlap: old list is held until new list is fully loaded
• Fail-closed policy: expired or unavailable cache → HARD_REJECT, never APPROVE

24. Polymarket V2 Compatibility

API surfaces declared

Networks supported

25. Versioning & Migration

Migration history

26. Acceptance Tests

Unit Tests

Integration Tests

Property Tests

27. Operational Runbook

ComplianceGate incidents typically involve a data-source outage causing fail-closed mass rejections, or a sanctions-list staleness alert. Any COMPLIANCE_GATE_SANCTIONS_HIT in production must be escalated to the compliance team immediately and never silently cleared.

On-call actions

Manual overrides

• —
• —

Healthcheck

GET /internal/health/compliancegate → 200 if all data source caches (sanctions, onboarding, market eligibility) are within TTL and last successful refresh < 3600s ago; red if any cache is expired or last refresh attempt failed, or evaluation latency p99 > 100ms.

28. Promotion Gates

A bot does not advance to the next readiness state until every gate below is green. Gates are observable from production data — no subjective sign-off.

Promote to Shadow

Promote to Limited live

Promote to General live

29. Developer Checklist

Ready-to-ship score: 27/27 sections complete · 100%