Systems — RÉCOR
RÉCOR
Status: Pre-deployment
RÉCOR is a sovereign beneficial-ownership registry designed for Cameroon, built to satisfy FATF Recommendations 24 and 25 and to export to the Beneficial Ownership Data Standard (BODS v0.4). It was fully demonstrated to, and acknowledged by, Open Ownership on 1 July 2026.
At a glance
| System name | RÉCOR |
|---|---|
| Category | Sovereign beneficial-ownership registry |
| Status | Pre-deployment |
| Operating model | Designed for institutional operation under consortium governance |
| Designed for | Cameroon |
| Standards | FATF R.24, FATF R.25, BODS v0.4 |
| Export format | BODS v0.4 JSON |
| Portal languages | French / English / Cameroonian Pidgin |
| Source code | Kept strictly private; not published or distributed |
The problem
Opaque company ownership lets illicit finance move unseen and holds a jurisdiction back from meeting international standards. A beneficial-ownership registry makes real ownership legible — but only if the data is trustworthy, the audit trail is tamper-evident, and citizens' rights over their own data are respected.
What RÉCOR does
A declaration of ownership passes a nine-stage verification pipeline before it is published and exported. Each stage either confirms, flags, or refers the declaration; nothing is published on trust alone. RÉCOR is designed to be governed by a consortium of Cameroonian institutions with international observers, and its declarant portal is trilingual: French, English, and Cameroonian Pidgin.
The nine stages, in detail
Schema parity and signed attestation
Every declaration arrives as a fixed, canonical byte sequence signed in the declarant’s own browser. This stage checks that the structure is complete, that ownership shares sum to exactly 100 per cent, that no owner appears twice, and that the Ed25519 signature verifies against those exact bytes. A failed signature or malformed declaration is refused outright — the pipeline fails closed rather than proceeding on doubt.
Identity gates
Each named beneficial owner is checked against official civil-identity sources, so a declaration cannot rest on an invented person. When every owner resolves, the declaration gains a measured degree of confidence — never proof. When none resolve, a strong falsity signal is raised; when the identity source is unreachable, the stage records insufficient evidence rather than silently passing.
Sanctions screening (UN / EU / OFAC, plus ICIJ offshore-leaks data)
Declared names are screened against the UN, EU and OFAC sanctions lists and the ICIJ Offshore Leaks data, using tiered fuzzy matching that quantifies how close each candidate match is. A near-certain match flags the declaration for the strictest scrutiny; a weak match records uncertainty for a human analyst; and the stage is designed to refuse to conclude from stale list data.
Politically-exposed-person screening
The same screening machinery asks a different question: is any declared owner a politically exposed person, or a close associate of one? A match is treated as a risk signal, not an accusation — it raises the weight of scrutiny rather than blocking the declaration, and confirmed exposure routes the file toward human review.
Adverse-media review
Retrieved public reporting about each owner is assessed by a deliberately conservative automated reviewer that must return a verdict, a confidence level, and citations for its claims. Adverse findings with high confidence flag the declaration; anything ambiguous is recorded as insufficient evidence. The stage is designed never to convert an absence of information into a clean result.
Graph and machine-learning pattern detection
Ownership structures are analysed as a graph for known concealment patterns — circular ownership, nominee arrangements, and clusters of entities sharing one address. Each detected pattern carries a severity weight: the more suspicious the structure, the heavier its contribution to the fused risk picture. Where no pattern score exists, the stage records that fact rather than inventing a signal.
Dempster-Shafer cross-source fusion
Evidence from every prior stage — and from independent government and institutional sources — is combined using Dempster-Shafer belief theory, which can say “we do not know” instead of forcing a probability. Sources that agree reinforce belief; sources that contradict each other — one official source showing an entity active while another shows it dissolved — raise a flag on their own.
Stakeholder review
Declarations the machine cannot clear or condemn go to human reviewers from the operating institutions. A pending review never resolves itself: the file waits. A reviewer’s decision requires a written justification, is recorded in an append-only log, and carries decisive weight in the final outcome — so that a person, not a model, settles the hard cases.
Public consultation
The final gate is public scrutiny. RÉCOR is designed to accept discrepancy reports on any entry — anonymously, if the reporter prefers — and to log each report in an append-only record for institutional triage. A substantiated challenge is designed to send a declaration back to stakeholder review, so the public functions as a standing check on the register.
Data model and what is published
A declaration names the legal entity or arrangement it concerns and lists every natural person who ultimately owns or controls it. For each person it records the exact share held — stored as integer basis points, so 99.99% and 100.00% remain arithmetically distinct — the kind of interest (equity, voting rights, family or proxy arrangements, contractual control, or other), any nominee status and the person behind the nominee, and the legal basis of control where ownership alone does not explain it. The declarant signs the whole record in their own browser, together with a formal claim that it is adequate, accurate, and up to date — the wording of FATF Recommendation 24, carried into the data itself.
What the public sees is deliberately smaller than what the institution holds. The public record is designed to show five fields per beneficial owner — name, nationality, role, ownership percentage, and control percentage — and nothing else: no residential address, no date of birth, no national identity number. The full declaration, its evidence, and its verification history remain with the operating institution, accessible only to authorized reviewers under access controls that are themselves logged.
For interoperability, RÉCOR exports to the Beneficial Ownership Data Standard (BODS) v0.4, an open, statement-based format: separate statements describe each person, each entity, and each ownership-or-control relationship, with typed interests such as shareholding and voting rights. Because the format is an open standard, the data can be read by any BODS-compatible tool and is not locked to RÉCOR itself. The export mapping is self-declared by SIGIL; it has not been certified by any third party.
Personal-data minimisation runs through the design: publication is limited to the five public fields, log lines are redacted before they are written, and anonymous public feedback requires no contact details. When a record must be erased, deletion rights are designed to be honoured by cryptographic shredding — destroying the key that makes the record readable — so erasure is real without breaking the integrity of the audit chain.
Threat model
A beneficial-ownership registry is a target: for those who would feed it lies, and for those who would quietly rewrite what it remembers. RÉCOR is engineered against specific classes of attack, and each class is answered by a named mechanism rather than by policy alone.
| Attack class | Answering mechanism |
|---|---|
| Falsified declarations | Nine verification stages stand between submission and publication; the declaration’s Ed25519 attestation is verified against the exact signed bytes, and a failed signature is refused outright. |
| Insider tampering | The declaration log is append-only at the database level — updates and deletes are refused regardless of role — and a triple-witnessed, Merkle-anchored audit chain makes every change tamper-evident. |
| Silent record edits | Every change is an event in the audit chain, and a record’s cryptographic proof is designed to be re-verifiable by anyone — so an edit that bypasses the chain becomes detectable rather than invisible. |
| Coerced deletion | Erasure is designed to be honoured by cryptographic shredding — the key is destroyed, the audit chain’s integrity survives — so a deletion can never silently rewrite history. |
| Vendor lock-in | The register exports to BODS v0.4, an open standard; the operating institution can take its data elsewhere at any time. |
| Data exfiltration | The declarant’s signing key never leaves the browser; platform and custody keys remain with the operating institution; services run under default-deny network rules, and logs are redacted before they are written. |
Interfaces and languages
The declarant portal is trilingual — French, English, and Cameroonian Pidgin — because a declaration obligation that cannot be read is not an obligation, it is a trap. French is the legal-primary language and the fallback for every interface string: a missing translation renders in French rather than as an error. The portal generates the declarant’s signing key in the browser, walks the declarant through the declaration, and returns a cryptographic receipt.
Around the declarant portal sit the institutional surfaces: a public search interface limited to the minimal published record, review consoles for the stakeholder-review stage of the pipeline and for institutional supervision, an operations dashboard whose consequential actions are designed to require two people rather than one, a self-service surface through which declarants and data subjects exercise their access, rectification, and restriction rights, and a controlled export interface for BODS v0.4 data. An anonymous reporting channel accepts public tips without requiring identity, and is designed to retain no personally identifying network data.
Standards and conformance
RÉCOR is built to satisfy FATF Recommendations 24 and 25 and to export to the Beneficial Ownership Data Standard (BODS) v0.4. It was fully demonstrated to Open Ownership on 1 July 2026, and Open Ownership acknowledged the demonstration.
RÉCOR is built to the Beneficial Ownership Data Standard (BODS v0.4) and was fully demonstrated to, and acknowledged by, Open Ownership on 1 July 2026. This is a technical demonstration, not an endorsement.
Sovereignty guarantees
| Guarantee | How RÉCOR delivers it |
|---|---|
| Data residency | Designed to run on national infrastructure; the register and its evidence stay in-country. |
| Key custody | Each declaration is signed in the declarant’s own browser with a key only the declarant holds; platform and custody keys remain with the operating institution. |
| Citizen data rights | Deletion rights are designed to be honoured by cryptographic shredding — destroying the key that makes a record readable. |
| Audit chain | A triple-witnessed, Merkle-anchored audit chain makes every change tamper-evident. |
| Open standard | Exports to BODS v0.4, so the data is portable and not locked to one vendor. |
| Source code | Kept strictly private; not published or distributed. |
Questions institutions ask
Does RÉCOR meet FATF Recommendations 24 and 25?
RÉCOR is designed to satisfy FATF Recommendations 24 and 25 and to export to the Beneficial Ownership Data Standard. It was fully demonstrated to Open Ownership on 1 July 2026, and Open Ownership acknowledged the demonstration.
How are citizens' data-deletion rights handled?
Deletion rights are designed to be honoured through cryptographic shredding: when a record must be erased, the key that makes it readable is destroyed, rendering the data unrecoverable while the audit chain's integrity is preserved.
Is the ownership data portable?
Yes. RÉCOR exports to the Beneficial Ownership Data Standard (BODS) v0.4, an open standard, so the data is not locked to a single vendor.
Is RÉCOR's source code available?
No. All RÉCOR source code is kept strictly private. It is not published, mirrored, or distributed.
How is a declaration verified before it is published?
Never on trust alone. The declarant signs the declaration in their own browser; nine verification stages then check its structure and signature, the identity of every named owner, sanctions and politically-exposed-person exposure, adverse media, and concealment patterns in the ownership graph, before Dempster-Shafer fusion weighs all of the evidence together. Hard cases go to human reviewers, and the public can challenge any entry. Only then is a declaration published and exported.
What does the BODS v0.4 export enable?
The Beneficial Ownership Data Standard is the open format in which ownership data becomes comparable across borders and usable by tools the register’s operator did not build — analysis platforms, journalism tooling, and other jurisdictions’ systems. RÉCOR exports to BODS v0.4, and was fully demonstrated to, and acknowledged by, Open Ownership on 1 July 2026. This is a technical demonstration, not an endorsement. The demonstration is listed in the record.
How is the consortium governance designed?
RÉCOR is designed to be governed by a consortium of Cameroonian institutions with international observers, not by any single administrator. Consequential operations are designed to require a cryptographic quorum of consortium members, sensitive administrative actions require two people rather than one, and every decision leaves a signed, auditable trace. This follows SIGIL’s standing rule: the institution holds the keys; the data stays under the institution’s control; every consequential action is authorized, bounded, and proven.