Before a regular account is created, a person or company obtains a credential from an approved identity provider. Personally identifiable information remains in the wallet and the providerâs system and is never placed on-chain, even in encrypted form. The wallet instead creates commitments and zero-knowledge proofs, so a user can prove a condition such as being over 18 without publishing a birth date. The legacy Desktop Walletâs provider-submitted initial account is a documented exception: its provider knows that initial account, while later regular accounts retain the separation-of-powers design.
The documented disclosure process works in two directions. Starting from an account, the authority sends the encrypted public holder identifier and court orders from the Privacy Guardiansâ jurisdictions to the guardians. Each guardian uses its own private decryption key to decrypt its share and returns that result to the authority. The authority combines two valid responses out of three to reconstruct the identifier for the identity providerâs record lookup. A provider in another jurisdiction requires an additional local court order. Starting from a person, providers first locate identity records under the relevant orders and send the records, including encrypted linking keys, to the authority. The authority sends those keys and the relevant jurisdictionâs court order to the guardians, who decrypt and return their shares. Two valid shares out of three let the authority reconstruct each linking key and retrieve the associated accounts. The guardians retain their own private decryption keys; the case-specific shares they return are not those private keys. Personal identity records remain with the providers and are disclosed to the authority through this process.
ConcordiumBFT orders and finalizes transactions through CCD-weighted validators. A validator currently needs 500,000 CCD; holders can delegate to a pool or use passive delegation without transferring custody. CCD is minted daily at a rate designed to produce 4% annual supply growth. Ninety percent of minted CCD and transaction fees goes toward validators and delegators, and 10% goes to the Foundation. Under the Protocol 7 rules restated in the February 2026 white paper, reduced or removed validator and delegator stake becomes inactive at the next pay day, earns no rewards and remains locked for seven days. Moving between a pool and passive delegation instead takes effect at the next pay day without cooldown.
The fee paid in CCD is derived from transaction energy, a EUR-per-energy parameter and a changing median CCD/EUR rate, so the token amount moves even when a basic transfer targets âŹ0.01. Protocol control follows a separate path. The Governance Committee recommends parameter and protocol changes; the Foundation Board approves them and retains final authority under the issuerâs published framework. Seven of nine committee seats were community-elected after the 2026 election, but holdersâ current direct on-chain role is still primarily electing those representatives. Authorized update keys and compatible validator software are then needed to enact protocol changes.
