> For the complete documentation index, see [llms.txt](https://docs.lumia.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.lumia.org/institutions/compliance-posture.md).

# Compliance posture

**Who this is for:** institutions, issuers, and their legal and compliance teams assessing how Lumia's architecture separates a permissionless base layer from a permissioned application layer that an issuer configures per asset. This page describes architecture only.

{% hint style="info" %}
**What this page does not say**

This page makes no claim that Lumia, or any asset issued on it, is compliant with, licensed under, registered in, supervised by, approved by, or exempt from any specific regulatory regime, licensing framework, or jurisdiction, hedged or otherwise. It does not state that Lumia is suitable for any particular class of investor. That is a deliberate editorial position across this whole documentation set, not a gap waiting to be filled: no page here makes a regulatory claim of any kind. Assessing your own position is a matter for you and your counsel.
{% endhint %}

### What is architectural, and can be described

Lumia separates two layers:

* **A permissionless base layer.** The chain itself does not gate who can transact, deploy a contract, or hold a token. That is a property of the chain, not a compliance guarantee.
* **A permissioned application layer, chosen per asset.** An issuer's own contracts enforce whatever compliance gate that asset needs. This is where a KYC, KYB, transaction-screening, or vendor-standing check actually runs.

This split makes a compliant configuration *implementable* per asset, chosen by the issuer. It is not, by itself, a statement that any given asset or issuer configuration meets a specific legal requirement. The full model and taxonomy (KYC, KYB, KYT, KYV) are documented at [`/lumia/compliance/compliance-model`](https://app.gitbook.com/s/chmhPiVNAafGw48c4oU2/ecosystem/lumia/compliance/compliance-model-overview) and [`/lumia/compliance/permissionless-base-permissioned-app-layer`](https://app.gitbook.com/s/chmhPiVNAafGw48c4oU2/ecosystem/lumia/compliance/permissionless-base-permissioned-app-layer). Read those pages directly rather than relying on a summary here.

### Independent security review

Two independent security firms are engaged around Lumia: Hacken and Halborn. Their engagements are Solidity smart-contract reviews covering the token, staking, governance and migration contracts. Scope and reports for each are at [`/lumia/chain-security/audits`](https://app.gitbook.com/s/chmhPiVNAafGw48c4oU2/ecosystem/lumia/chain-security/audits). Review them directly before citing either name to a counterparty.

### Talk to counsel, not just docs

Nothing on this page is legal advice, and it is not a substitute for your own counsel's review of your specific structure and jurisdiction. To start a conversation about your specific requirements: [`/institutions/talk-to-us`](https://app.gitbook.com/s/chmhPiVNAafGw48c4oU2/institutions/talk-to-us).