ZKC lets a user prove a compliance fact about themselves, that they are over 18, in a permitted jurisdiction, not sanctioned, accredited, without handing over the data behind it. Compliance becomes something you produce, not something the system extracts.
Compliance has always forced one of two bad choices. ZKC removes the choice.
Either the protocol enforces compliance directly, which means it sees identity, transaction patterns, and counterparties, so any leak or subpoena exposes everyone.
Or the protocol stays private and compliance happens entirely off-system, which leaves regulated venues unable to verify what they need without rebuilding identity infrastructure themselves.
The protocol stays identity-blind. The venue still gets cryptographic assurance that the predicate it cares about is satisfied. The user discloses exactly what is asked for and nothing else.
The proof reveals the truth of one fact, and not the credential, not the issuer, not the issuance date, not any other attribute behind it.
From the same KYC and attestation flows that already exist, ending in a signed credential you keep. No new identity rails.
It names the fact it needs (resident of a permitted jurisdiction, accredited, not sanctioned) and the issuers it trusts.
A zero-knowledge proof against your stored credential. The verifier checks it and learns only that the predicate holds.
Issuers can revoke a credential without de-anonymizing the holders of still-valid ones. Revocation changes who will transact with you, not what you hold.
An implementation claims a level, and a verifier knows exactly what that level guarantees. You climb only as far as your venue requires.
An orthogonal extension for automated compliance via an agent API, layered on whichever core level an implementation claims. It is a profile across the ladder, not a rung above Full.
The protocol carries proofs, not policy.
No issuer is canonical. No credential type is mandatory. No jurisdiction is hard-coded. Verifiers decide which issuers they trust and which predicates they require. Users decide which verifiers they engage with.
As regulatory requirements diverge across jurisdictions and venues, and they will, the protocol absorbs the variation without being rewritten. It cannot quietly drift into a single-issuer, single-jurisdiction, or surveillance-by-default posture later: that is fixed by the same Freedom Safeguards that bind the rest of the stack: six invariants every conforming implementation must satisfy, from open-source predicates to unconditional exit.
ZKC is the what gets proved. It binds to a settlement layer that handles the value, and rides the same federated transport as everything else.
The specification pins the credential set, the cryptographic primitives, the proof and verification interfaces, the conformance ladder, and the six Freedom Safeguards. Presentation profiles are anonymous, scoped, or consented-linkable, and every disclosure request is signed and receipted: the verifier authenticates what it asks for, and the holder keeps the receipt. It is reconciled with ZKA, so the two read as one stack.
The implementation roadmap and the issuer and verifier ecosystem are the next layers of work. The spec is what they build against.
ZKC is the mechanism. Its sharpest value is wherever a party must prove a figure qualifies (an exposure within a band, a threshold cleared) without revealing the figure itself.