Akropolis Whitepaper

Saturday, February 20, 2021
Buy AKRO coin
Save for later
Add to list
Whitepaper.io is a project of OpenBook

DISCLAIMER This paper and any other documents published in association with this paper relate to the intended development and use of the Akropolis platform (“Akropolis platform”). They are for information purposes only and may be subject to change. • This paper describes a future project. This paper is draft, and subject to further legal and regulatory advice. It contains forward-looking statements that are based on the beliefs of Akropolis Decentralized Ltd, a company incorporated in Gibraltar (company number: 116430) (“Company” or “Akropolis”), as well as certain assumptions made by and information available to the Company. T The Akropolis platform, as envisaged in this paper is under development and is being constantly updated, including but not limited to key governance and technical features. The AKT and AIT tokens (“Tokens”) involve and relate to the development and use of experimental platforms (software) and technologies that may not come to fruition or achieve the objectives specified in this paper. If and when the Akropolis platform is completed, it may differ significantly from the network set out in this paper. No representation or warranty is given as to the achievement or reasonableness of any plans, future projections or prospects and nothing in this document is or should be relied upon as a promise or representation as to the future. AF Regulatory licences and/or approvals in respect of Akropolis platform are likely to be required in a number of relevant jurisdictions in which the Company intends to operate. It is not possible to guarantee, and the Company does not make any assurances, that any such licences or approvals will be obtained within a particular timeframe or at all. This means that the platform may not be available in certain markets, or at all. This could require fundamental restructuring of the platform and/or its unavailability. The Company intends to operate in full compliance with applicable laws and regulations and obtain the necessary licences and approvals in key markets. • No offer of regulated products. The Tokens are not intended to represent a security or any other regulated product in any jurisdiction. This document does not constitute an offer or solicitation of securities or any other regulated product, nor a promotion, invitation or solicitation for investment purposes. The terms of the purchase are not intended to be a financial service offering document or a prospectus of any sort. The Tokens do not represent equities, shares, units, royalties or rights to capital, profits, returns or income in the Akropolis platform or software or in the Company or any other company or intellectual property associated with the platform or any other public or private enterprise, corporation, foundation or other entity in any jurisdiction. • This paper is not advice. This paper does not constitute advice to purchase AKT tokens. It must not be DR relied upon in connection with any contract or purchasing decision. • Risk warning. The purchase of AKT tokens and participation in any token sale carries with it significant risks. Prior to purchasing AKT, you should carefully assess and take into account the risks, including those listed in any other documentation. • Views of the Company. The views and opinions expressed in this paper are those of Akropolis and do not reflect the official policy or position of any government, quasi-government, authority or public body (including but not limited to any regulatory body of any jurisdiction) in any jurisdiction. Information contained in this paper is based on sources considered reliable by the Company but there is no assurance as to their accuracy or completeness. • English is the authorised language of this paper. This paper and related materials are issued in English only. Any translation is for reference purposes only and is not certified by the Company or any other person. No assurance can be made as to the accuracy and completeness of any translations. If there is any inconsistency between a translation and the English version of this paper, the English version prevails. • No third party affiliation or endorsements. References in this paper to specific companies and platforms are for illustrative purposes only. The use of any company and/or platform names and trademarks does not imply any affiliation with, or endorsement by, any of those parties.

AKROPOLIS: A GLOBAL BLOCKCHAIN PENSIONS INFRASTRUCTURE ANASTASIA ANDRIANOVA, PAUL HAUNER, DR. KRISTIAN MCDONALD, DR. ADRIAN MANNING, AND MEHDI ZEROUALI [email protected] VERSION 1.0 T Abstract. Globally, the pension industry is in urgent need of serious reforms. The global deficit between pension assets held and existing liabilities is projected to grow rapidly in coming decades and risks triggering a pension-induced global financial (and social) crisis. Furthermore, workplace changes are increasingly atomising the modern workforce whilst legislative agendas are transferring the burden of managing the pension deficit back onto the individual. Complex fee structures that lack transparency are further eroding the performance of pension funds and exacerbating the problem. The Akropolis platform aims to leverage decentralised technologies to deliver a transparent, accountable and portable pension infrastructure that provides services to meet the needs of the modern workforce. Industry participants such as Pension Funds and Fund Managers can benefit from reduced regulatory overheads, access to new (token-based) mechanisms of engaging with clients, and AF marketing/promotional opportunities derived from new (verifiable) reputation and ranking systems. Individual users gain from the improved visibility, auditability and portability of a blockchain-engaged pension platform that acts as a single source of pension truth for the individual. Furthermore, protocols for accountability and transparency incentivise good behaviour by institutional participants and reward individuals and/or institutions that reveal bad behaviours. The challenges facing the pension industry are non-trivial and intricate, yet they must be addressed. Akropolis believes that leveraging new decentralised technologies to empower the community to unite and tackle the pension problem offers the best hope for both rectifying existing systemic failures and building a sustainable future. Akropolis (Greek, Ακροπολις): a citadel or fortress, of blockchain technologies, and the present understanding the defensive core of a city, a city within a city. of the problem. Acknowledgements 1. Introduction We would like to acknowledge Ian Grigg, Jason Dehni, and Peter Robertson for the many valuable discussions The state of the global pension industry is rapidly de- DR and expert industry advice which has helped shape this teriorating. Many pension programs around the globe work. are under-capitalised and are effectively drifting into in- solvency. A global discrepancy between pension assets held and existing liabilities looms large as a major eco- Preface nomic challenge, both for individuals, whose retirement will likely be under-funded, and the larger global econ- This paper introduces the first iteration of a novel omy, which must manage the fallout. Pension funds are solution to a complex problem. The authors’ goal was increasingly overburdened by the stresses of increased life to construct a document containing sufficient detail to expectancies [1], global decreases in voluntary pension con- enable an initial implementation-effort based on the con- tributions [2], and decreasing ratios of active employees to tent of the paper. However, it is understood that em- retirees [3]. The dire state of the global pension industry pirical testing and analysis undertaken throughout the is quantified by the global pension deficit, namely the gap implementation process will inevitably necessitate modifi- between existing pension liabilities and assets held. This cations to the envisioned specifications. Accordingly, one deficit is expected to grow faster than global GDP1 [4] anticipates deviations from the structures and methods and to reach $400 trillion (or five times global GDP) by detailed herein. As such, the mechanisms and processes 2050 [5]. The scale of this astounding discrepancy has described in this document should not be considered as the potential to create a full-blown global financial crisis, final nor binding — they represent a considered first iter- and some authors argue that the severity of this crisis ation, informed by the current capacities and limitations will exceed anything previously experienced [4, 5, 6, 7]. 1Gross Domestic Product. 1

AKROPOLIS: A GLOBAL BLOCKCHAIN PENSIONS INFRASTRUCTURE 2 The systemic issues plaguing the pension industry are From a technological perspective, there has been a intricate and complex, though some key requirements plethora of recent developments relating to distributed of candidate solutions are readily articulated. Any so- and decentralised systems. The advent and subsequent lution aimed at addressing the pension crisis will need interest in blockchain technology has radically altered the to support the current pension ecosystem, ensuring that spectrum of research and developmental possibilities re- upcoming retirees are not unduly punished for systemic lating to decentralised systems. In addition to Bitcoin [8], failures. In addition, a viable pension protocol must be the subsequent creation of Ethereum [9] ushered in the capable of supporting the growing needs of an aging pop- era of “Blockchain 2.0” technologies. ulation whilst simultaneously facilitating a global inter- Ethereum introduced the Ethereum Virtual Machine generational transition to a new, economically sustainable (EVM), which enabled arbitrary calculations to be per- T system. formed and verified on all nodes of a network, without the A new pension protocol must also recognize that need for a centralised governing body. This development workplaces and legislative agendas are rapidly changing. was not without limitations. As with most public, fully Whereas earlier generations could rely on the stability of decentralised systems, Ethereum suffers from (a) scala- a lifelong job within a single company or industry sector, bility issues which, in-turn, limit transaction speeds; (b) the modern worker must navigate a completely different game-theoretic incentives to break consensus;2 (c) envi- landscape. The workforce is being increasingly atomized, ronmental concerns stemming from the underlying Proof with workers frequently changing jobs (and even careers). of Work (PoW) consensus mechanism; and (d) limited Furthermore, the tendency towards freelancing and the privacy capabilities for concerned parties. A number AF sharing/gig economy has eroded many traditional mech- anisms for building pension savings. Workers are also increasingly mobile, having to move between geographi- cal locations and different legal jurisdictions, with very little, in the way of inter-jurisdictional support protocols, available to help the atomized worker accrue an adequate pension. Traditional pension structures, which rely on geographic or regional stability, and are often adminis- tered by the employer or state and lack the flexibility necessary to meet the modern worker’s pension needs. In addition, as the discrepancy between pension assets and liabilities grows, states are increasingly liberalising of ongoing projects are aiming to rectify these limita- tions. For example, Raiden [10] and Plasma [11] both aim to tackle the scalability issues, and the concept of sharding [12] also promises significant advancements on this front. Casper [13, 14] is a Proof of Stake (PoS) mechanism aiming to address shortcomings of the cur- rent PoW consensus approach. Research into partial and fully homomorphic encryption schemes [15, 16], along with Zero Knowledge systems [17, 18, 19],3 are being introduced to address the privacy limitations of public blockchains. This research is further supported by the so-called “Blockchain 3.0” technologies, which aim to link pensions and/or increasing the retirement age, to both multiple blockchains together to form a mesh-like net- reduce pension liabilities and shift the burden of funding work. Projects such as Polkadot [20], AION [21], and retirement back onto the individual. Thus, the pension Cosmos [22] fall into this category and show promise protocol of the future must be capable of accommodating for building a relaying infrastructure capable of unify- existing collective-based pension frameworks, in which ing various underlying blockchains. Despite their current individuals pool their resources collectively within state- limitations, these bleeding-edge technologies show great or employer-defined pools, whilst also ushering in the promise. Importantly, they have the potential to revolu- DR transition to an individually-oriented pension framework tionise many traditional industry sectors and the pension compatible with changing workplace and legislative agen- industry is no exception. In particular, the transparency, das. The modern worker requires a pension system that automaticity, and auditability of decentralized ledgers is compatible with the atomization imposed on workers offers new tools for juggling the competing demands of by both the modern state and workplace. workers, Pension Funds, and Fund Managers, whilst si- In addition to the excess costs brought about by ar- multaneously ensuring the flexibility, accountability, and chaic systems, the pension industry suffers from a number regulatory compliance required of a pension service. of systemic problems such as poor visibility around fund Akropolis is a new pension platform that aims to unify management, unnecessarily complicated (and often hid- recent technological advancements to create a long-term den) fee structures, stringent portability limitations due sustainable solution to the myriad of issues that plague the to geographically localised fund management, and vast existing pension industry. The Akropolis platform aims to compliance regulations which, at times, are manually facilitate the transition from existing pension structures enforced. Moreover, the incentive structures between end- to an atomized, individually tailored pension protocol user investors, the pension funds to which they contribute, capable of meeting the needs of the modern worker. De- and the fund managers who oversee the underlying assets, mands of both legislators and the modern workforce are are often egregiously misaligned. pressing individuals to bear greater responsibility for their own retirement outcomes. The Akropolis platform will 2External actors can spend resources to perform a 51% attack on the network, whilst shorting the internal currency to profit. 3The Ethereum community is actively working towards some Zero Knowledge solutions, which is evident by the cheapening of some elliptic curve operations in a recent hard fork to allow for their verification within a block.

AKROPOLIS: A GLOBAL BLOCKCHAIN PENSIONS INFRASTRUCTURE 3 provide a pension infrastructure capable of supporting industry it aims to remedy. The paper is organized as the modern worker throughout their individual journey in follows. Section 2 gives a high level overview of the an environment beholden to changing legislative demands Akropolis platform, detailing its major components and and workplace conditions. Akropolis will work directly, their connections, and highlighting the benefits of the and in conjunction with, current leading industry experts platform compared to current legacy systems. The sec- to iteratively design and build a platform that simulta- tions following, provide extended detail into selected core neously supports the current pension ecosystem whilst components of the Akropolis platform before concluding facilitating the much needed inter-generational transition with a brief summary of the project and its future direc- to a more robust retirement savings model. tion. A glossary of key terms and acronyms appears in Fundamentally, Akropolis is a global platform that the Appendix. T seamlessly connects everyday users with a diverse range of experienced pension funds and fund managers. The dis- tinguishing features of Akropolis include transparent fee 2. The Akropolis Platform structures, built-in regulatory compliance, stringent fund vetting and, most importantly, game-theoretic incentive structures that mitigate the excessive fees traditionally borne by users in the pension industry. 2.1. Overview Akropolis will leverage the unique characteristics and The ultimate aspiration of Akropolis is to develop a de- advantages of blockchain technologies to underpin its centralised pension platform (or more abstractly, protocol) AF technologically advanced pension platform. Specifically, Akropolis notes that (i) the blockchain’s public, im- mutable ledger will improve visibility and audit trails relative to existing pension funds, whilst permitting mech- anisms for maintaining a suitable level of privacy; (ii) the asymmetric key infrastructure utilised by blockchains for authentication will allow on-chain (off-platform) direct communication necessary to facilitate a global system (i.e., blockchain technologies readily support the global portability required of modern pension services); (iii) the blockchain’s decentralised processing capabilities permit the development of decentralised on-chain processes to that spans a variety of blockchains and delivers trustless retirement savings products. The goal is to leverage recent technological developments and offer transparent, account- able, and portable pension services for the modern worker. Due to the infancy of the technologies surrounding decen- tralised systems,4 this goal will necessarily be attained in progressive stages, paralleling technological advancements in the space. Consequently the initial implementation of the Akropolis protocol, as described in this white paper, will be a hybrid of decentralised components managed by a centralised trusted entity, which we refer to as the Akropolis Foundation. handle compliance and provide transparent fee structures, The platform will initially be built on Ethereum [9], as whilst also permitting the construction of crypto-economic this is the most appropriate currently-operational chain incentive mechanisms to re-align disjoint incentive struc- to supply the service features required of a pension plat- tures in traditional pension schemes. Finally, it is also form. However, the ultimate goal of Akropolis is to be noted that slower transaction times, often experienced a blockchain-agnostic pension provider that utilises the in a blockchain environment, are not problematic for a most efficient and appropriate technologies to deliver pension platform - typical transaction timescales in the the required services and features. This may entail non- DR pension sector do not possess the time-sensitivity of, e.g., Ethereum based decentralised chains such as EOS [23], infrastructure supporting high frequency trading algo- Cardano [24] and RSK [25]. The blockchain-agnostic goal rithms. aligns with the principles of various Blockchain 3.0 tech- The forthcoming pension crisis represents a complex nologies (such as Polkadot) which could ultimately be the and difficult problem. While the utilisation of blockchain core underlying technology used for a multi-chain Akropo- technology is not a cure-all for the industry, it is clear lis platform. It is probable that Ethereum will continue to that emerging technologies offer new solutions to the chal- play a role in the long-term implementation of Akropolis, lenges faced by the pension sector. Akropolis is partnering however, it is important to emphasise that Akropolis’ pri- with leading experts in the pension industry and leading ority is to deliver sustainable, reliable pension products. blockchain projects to tackle the global pension crisis as Accordingly, choices regarding specific technological im- a community. The goal of the Akropolis project is to plementations will necessarily be informed by the needs of leverage new technologies to develop a transparent, ac- pensioners rather than adherence to specific technologies. countable and portable pension infrastructure capable of Ultimately Akropolis is focused on delivering a product delivering sustainable pensions that meet the needs of the to the market that meets users’ needs and developmental modern workforce, while acknowledging and accommo- decisions will be made with this goal in mind. Nonethe- dating the realistic constraints imposed by existing legacy less, throughout this paper it is assumed that Ethereum systems. will underpin (at least) the early phases of Akropolis and This paper outlines the Akropolis platform, its vision future references to blockchain implementations in this for the future and the complications within the pension paper will assume Ethereum as the underlying chain. 4Specifically issues of scaling, availability of cost-effective decentralised oracles, and stability of decentralised stable coins.

AKROPOLIS: A GLOBAL BLOCKCHAIN PENSIONS INFRASTRUCTURE 4 T AF Figure 1. Institutional users access valuable data from the Akropolis system, while individual users are rewarded directly. Rewarding opportunities are created for both institutional funds and developers alike. The Akropolis platform provides an efficient gateway between both individual users and institutional pension funds, and the fund/asset managers who traditionally manage pension investments (as shown diagrammatically in Figure 1). The fund/asset manager’s conduct on the system is enforced through a number of incentive mecha- nisms to obtain an optimal outcome for all participants. FMs, who invest on behalf of individual and institutional privacy. Akropolis will seek to ensure that data owner- ship is rightfully granted to the individual user. However, given the capacity for users to leverage their data to ac- cess products that better suit their needs, or to acquire rewards (i..e., pension top-ups), the Akropolis platform will provide options that permit voluntary participants to allow agents of their choosing to access various aspect of their private data. Data can be exchanged for tokenised clients, build a portfolio of assets which are tokenised rewards that will further strengthen the individuals net on the blockchain and distributed to investors. Investors pension position. then maintain a global, portable, on-chain portfolio which In summary, the Akropolis platform is a hybridised represents their pension investments. The tokenisation trust/trustless system that acts as a gateway between of value within this system allows Akropolis to leverage users, Pension Funds and Fund Managers. The platform blockchain technologies to automatically enforce various seeks to re-align the incentive structures between agents compliance rules specialised to specific assets and geo- in the pension sector, while leveraging the accountability DR graphic regions. Incentive structures incorporated into afforded by blockchain technologies to deliver transparent the platform will also be built on-chain, though it will be pension products. necessary for dispute resolution mechanisms and proce- dures to initially be managed centrally by the Akropolis Foundation. This arrangement will act as a stepping stone 2.2. Platform Agents and future implementations will aim to decentralise these The present section details the main agents that par- dispute resolution components, to the extent that this is ticipate in the Akropolis system. An overview diagram compatible with regulatory demands. summarising the actors and their interactions appears in Importantly, although an individual user will have a Figure 2. single account that is tied to their identity, the totality of the user’s on-chain operations will not be tied directly to Individual User — The individual user (referred to a single identity/address/public key. Instead, the user’s in this paper simply as a user ) represents a singular, transactions will be pseudo-anonymous, similar to iden- non-institutional individual who uses the Akropolis plat- tities on various cryptocurrency systems, such that each form for their pension savings. More abstractly, when new transaction and/or class of transaction is tied to discussing elements on the blockchain, a user refers to a different addresses generated by a single seed5. Blockchain technologies are oft espoused for the privacy they afford users and Akropolis’ philosophy with regard to user’s data errs in favour of the individual’s right to 5Typically wallets of Unspent Transaction Output (UTXO) blockchains, such as Bitcoin, have this behaviour.

AKROPOLIS: A GLOBAL BLOCKCHAIN PENSIONS INFRASTRUCTURE 5 singular identity which is mapped to a collection of public 2.3. Benefits of the Akropolis Platform keys via a generating seed. The Akropolis platform provides benefits for individ- ual users, who create and manage pension accounts on Pension Funds (PFs) — Pension Funds are institu- the platform, and for Pension Funds (PFs), who manage tional entities that may (or may not) currently exist in the large numbers of pension accounts on behalf of individ- pension industry and who maintain their own platform ual clients. Fund Managers (FMs), who manage assets and collection of users. These institutional funds will act and supply pension products to PFs, also stand to reap similarly to individual users on the Akropolis platform. benefits by participating in the platform. The present section outlines the features and benefits of the Akropolis Fund Managers (FMs) — Fund Managers are institu- T platform for these different classes of participants. More tional entities charged with purchasing or acquiring assets details regarding these features are elaborated in the sec- on behalf of users and/or PFs. They must undergo strin- tions that follow. gent vetting processes to obtain access to the Akropolis platform and must regularly report on the assets under their management. 2.3.1. User Motivations Asset Tokenisers — Assets procured on the Akropolis From the perspective of individual users/workers, the platform must be tokenised in order for the decentralised motivation for Akropolis follows from three key observa- components of the system to function effectively. Asset tions: AF Tokenisers hold assets, either directly or through verifi- able third parties, whilst minting and distributing tokens which represent a share of the held asset. These are centralized entities that provide a source of truth to the blockchain layer (through the minting of tokens) and as such are key actors in the trust model of Akropolis. Developers — Developers are community members who contribute to the Akropolis platform, building ex- tended/advanced services for pension users. • Firstly, many PFs around the globe are under- capitalised relative to their liabilities. • Secondly, to avoid further amplifying the discrep- ancy between assets held and liabilities, state- and employee-operated pension schemes are increas- ingly pursuing systemic changes that transfer the liability for funding retirement expenses onto the individual (as manifest by, e.g., the tendency for pension liberalisation). • Thirdly, changes in workplaces and working con- ditions, as manifest by the sharing/gig economy, freelancing, and the increase in global workforce mobility, mean individuals are increasingly self- employed, engaged in short-term employment, and/or working transiently in geographic regions subject to varying regulatory requirements. These changes further exacerbate the problems with ex- isting pension models, which typically rely on DR employment and/or regional stability. Thus, the individual worker finds themselves increasingly responsible for navigating a career that involves a series of short-term employment engagements, often in geograph- ically diverse locations, while simultaneously bearing a greater responsibility for procuring adequate savings to fund a reasonable quality of life in retirement. The indi- vidual is now, more than ever, a global citizen who cannot rely upon their employer nor the state to guarantee a satisfactory quality of life in retirement. The individual requires a pension system allowing them to collect and assemble pension savings accrued from mul- tiple employers, in combination with voluntary contribu- tions, both of which may be obtained in diverse jurisdic- tions. If the individual is to be responsible for funding their own retirement, they require a system with (a) suffi- cient flexibility to easily function in accordance with the demands of their working life; (b) sufficient regulatory Figure 2. Akropolis component overview, detailing in- compliance to support this flexibility; and (c) sufficient formation and capital flow. transparency to permit informed fund allocation decisions,

AKROPOLIS: A GLOBAL BLOCKCHAIN PENSIONS INFRASTRUCTURE 6 despite the absence of traditional workplace/lifestyle sta- with the same tax benefits afforded to traditional bility, whilst minimising the mental transaction costs [26] pension investment assets. associated with proactive pension engagement. • In-built global automated compliance. The Akropolis platform is designed to meet these needs • Singular onboarding event. by delivering a flexible, regulatory compliant, transparent • Simplified proxy voting with end-to-end account- and accountable pension protocol. The goal is to con- ability. struct a central source of pension truth for the individual, • Certificate-like global standard of FMs. namely a single account, attached to their identity, which contains detailed information on their existing pension 2.3.3. Pension Fund Benefits accounts, manages their voluntary contributions, and pro- T vides options to allocate savings to PF products. All PFs PFs also benefit from joining the Akropolis platform. will be governed by strict transparency and accountabil- The current pension system is rife with regulatory and ity rules, enforced by blockchain-supported technologies. compliance overhead expenses, relating to auditing re- Future iterations of the platform will aim to support self- quirements, system development and administration and managed pension products (e.g., support direct user-FM monitoring of relationships with FMs. Furthermore, the engagement). This functionality is not an initial prior- relation between FMs and PFs is fraught with trans- ity, however, as only a tiny minority of individual users parency issues and often mediated by middlemen who are likely to possess the motivation and/or expertise to erode the value of pension returns. The Akropolis plat- self-manage their holdings. form will deliver the following benefits for PFs: In addition to the general features described above, the blockchain-based Akropolis platform will offer individ- ual users the following improvements relative to existing pension systems: AF 2.3.2. User Benefits • Secure and immutable pension records, transpar- ent record management and ease of auditing with real-time feedback. • A decentralized, portable, single source of pension • Easy verification of document authenticity by counterparties. • Singular onboarding event. • Able to engage multiple pre-vetted FMs, with full regulatory compliance, from a single platform (avoids burdensome regulatory overhead that is rampant in the present system). • Simplified internal administration and reduced reporting overheads. • Improved transparency in relationships with FMs. – Transparency of fee structures. truth. – Blockchain auditability. • Capacity to leverage smart contracts for secure – Well-defined terms/conditions of services, in- peer-to-peer lending (e.g., family members can dependently verifiable. send pension contribution coins to younger adults, • Reduced inefficiencies with platform integration which can be used to acquire pension products and middlemen. that remain locked within the platform for desig- – Eliminates intermediaries, allowing direct in- nated time periods). vestment in assets. • The ability for users to monetize their own data. – Unified infrastructure for frictionless engage- DR • Transparency of governance protocols and out- ment. comes (e.g., avoids difficulties with fund seizures – Blockchain-enabled triggering of direct pay- encountered in Poland, Hungary and Argentina). ment and asset movements. • Common protocols for fee and performance re- • Alleviates redundancies in IT infrastructure porting. across PFs and compliance expenses for engaging • Incentivised accountability and ranking mecha- new FMs. nisms for PFs to showcase good actors and filter – Blockchain-based common infrastructure out bad actors (acts to revert misaligned interests with access to pre-vetted FMs in the current system). • Tamper-proof data storage that provides an inde- • Modern products and services that meet the needs pendently verifiable source of truth. of a generation that is familiar with real-time data – Reduces costs of compliance reporting and and feedback (i.e., supersedes outdated legacy sys- the need for external audit trails. tems) • New capital pools, such as cryptocurrencies. 2.3.4. Fund Manager Benefits Users can incorporate cryptocurrency assets into their pension portfolio with options to time-lock The Akropolis platform also offers benefits to FMs: the assets within smart contracts until the user • Quality verification. Good actors will have a reaches a pension age. Akropolis will advocate source of truth to verify their good behaviour for regulatory changes that provide crypto-assets and the quality and reliability of products they (held in verifiable time-locked pension contracts) supply.

AKROPOLIS: A GLOBAL BLOCKCHAIN PENSIONS INFRASTRUCTURE 7 • Simplified onboarding. Joining the platform re- to monetise the data (i.e., receive rewards for delivering quires a single onboarding event. Thus, the need data access), for the users’ benefit (see Akropolis Plat- to establish regulatory-compliant relationships form Data for further details). Users that opt-in to share with each individual client PF and/or individual selected aspects of their data will be rewarded in AKTs. is ameliorated. Various incentive structures are outlined in the Incen- • Access to many clients. The single onboarding tive Structures section. These require the staking of a event provides FMs with access to multiple PFs value-store in order to incentivize good behaviours by and individuals to whom they can deliver services actors within the system. One could use the AKT as a and products. staking token, however, this exposes platform participants to unnecessary volatility risk - good actors, whose stake is T returned in full, may be punished if AKT market volatility 2.4. Akropolis Tokens pushes the value of AKTs in unfavourable directions on There are two main tokens within the Akropolis plat- timescales comparable to the staking period. An incen- form. The AKropolis external Token (AKT) and the tivization mechanism that unduly punishes good actors Akropolis Internal Token (AIT). The former primarily is unlikely to prove successful as many platform actors facilitates functions of external users participating with will be risk-averse. Thus, demanding that staking-based the system, whereas the latter abstractly represents a sta- incentivization mechanisms do not create undue volatility ble coin and accounting mechanism to track and record risk for good actors necessitates the introduction of a capital flow internally within the system. stable token. AF 2.4.1. The Akropolis External Token The Akropolis external token is a fixed-supply token whose value is subject to market forces. AKTs can be used for the following operations: • Onboarding and platform access (see Onboard- ing/Vetting) • Purchase premium services on the platform (see Premium Services) • Purchase platform data (see Akropolis Platform Data) 2.4.2. The Akropolis Internal Token The Akropolis Internal Token (AIT) is an indepen- dent token which abstractly represents an arbitrary stable coin. Due to the long-term nature of staking, this to- ken is required to give participants a volatile-free option when engaging the staking incentive mechanisms (i.e., staking in AKTs would subject a staking entity to undue volatility risks which would undermine the efficacy of the staking mechanism). AITs also serve as an accounting bookkeeping tool within the Akropolis system. User’s funds are represented digitally by AITs (i.e., users acquire • Stake in various platform incentive mechanisms AITs after depositing funds into the system) which can (see Incentive Structures) be converted to other tokens that represent ownership in A key function of the Akropolis External Token is to different asset classes. AITs can be exchanged for both serve as an onboarding utility token that allows partic- cryptocurrency and fiat deposits, and fundamentally act ipants to access the Akropolis platform. However, by as an internal accounting tool whose audit trail lies on default, the platform will operate on a freemium model, the public blockchain. meaning that individual users can interact with the system The AITs are entirely independent from the AKTs (i.e., DR without requiring AKT tokens. All underlying blockchain Akropolis uses a decoupled two-token system). Akropolis operations and system expenses relating to the basic op- opted for a decoupled two-token system as an investigation erations of the freemium model will be paid for by the of existing coupled two-token systems revealed inherent Akropolis Foundation. This model is adopted to ensure weaknesses. For example, some systems use two coupled that all individual users can access the platform, consis- tokens, with one (volatile) token used to access the plat- tent with Akropolis’ desire to develop a pension platform form, and a second (stable) token that is pegged to some to meet the needs of a global community of workers. Indi- real-world value store (like a fiat currency). Furthermore, vidual users will also have access to a number of extended the volatile access token is converted into stable tokens services offered on the platform (see Premium Services), upon entry into the system (i.e., stable tokens are gener- though access to the premium features will require AKTs. ated by conversion of volatile tokens, which ‘couples’ the We note that a mechanism is required to decouple the tokens). Any such coupling necessarily entails collaterali- price of the volatile AKT to the fixed stable cost of ser- sation of some form to mitigate against the volatility of the vices on the platform. In the initial implementation, a stable token. Collateralised coupled two-token systems trusted price oracle6 will perform this task. have an inherent risk relating to under-collateralisation in As the platform matures, users’ data will accrue both the event of strongly unfavourable moves in the value of on and off chain7. This data will be valuable to a va- the token. These risks are systemic, in the sense that the riety of external agencies and options will be available viability of a platform based on such a system could be 6A service that sets the price of AKTs relative to a fixed fiat currency which is used to statically price services (in fiat values) on the blockchain. 7For privacy concerns, see the Privacy section.

AKROPOLIS: A GLOBAL BLOCKCHAIN PENSIONS INFRASTRUCTURE 8 cast into doubt in the face of highly unfavourable volatility. • Fraud of various degrees Systemic volatility risks are unacceptable for a pension • Misleading or missing information regarding in- platform (and, one could argue, for other existing use vestment/asset status and/or management cases) and, accordingly, Akropolis adopted a decoupled To achieve these goals, a set of slashing conditions will model for AKTs and AITs. be employed, such that bad-actors of the system lose all or portions of their stake when any or all of the above 2.5. Incentive Structures behaviours are demonstrated. The exact set of conditions to enforce these behaviours requires careful analysis and A core economic principle of the Akropolis platform simulation. Such studies will be published as the project is to better align the incentives of all actors within the develops. T current pension system. Specifically, Akropolis attempts The size of the onboarding stake initially supplied by to converge on the idyllic case that fund managers act rep- FMs will be bound from below (i.e., a mandatory min- utably and reliably on behalf of investors while receiving imum stake size will be specified) and asymptotically a transparent and reasonable fee for their service. Three bound from above (i.e., a maximum stake), allowing the main mechanisms will be initially deployed in an effort to staker to select a value in between. It is anticipated that realise the idyllic scenario. the size of the stake provided by an FM will act as a quantitative measure of the FMs commitment to the prin- 2.5.1. Onboarding/Vetting ciples of transparent and accountable pension fund man- Pension products demand a certain type and calibre agement advocated by Akropolis. In essence, the stake AF of institutional fund management. This is one of the key properties that distinguishes a pension-related platform from an arbitrary marketplace of fund managers. As such, it is vital that the Akropolis onboarding and compliance processes, which dictate who is allowed to manage and advise users’ funds on the Akropolis platform, are not only thorough but also align with pension-based regulatory frameworks for relevant jurisdictions. Akropolis proposes an onboarding/vetting system that requires candidate FMs to stake AIT or AKT. The staked tokens will be held for the duration of the FMs engage- demonstrates the extent to which the FM “backs them self” to comply with the transparency requirements of the platform. Akropolis has a built-in reputation-based sys- tem (see Ranking and Reputation) which ranks/compares funds on offer. As such, the amount of stake a fund man- ager is willing to contribute will feed into the reputation system, in a transparent way, and reflect the FM’s degree of commitment to behaving reputably on the platform. More formally, SL ≤ S(ω) ≤ SU : 0 ≤ ω ≤ 1, ment with the Akropolis system. To be commercially with viable, it is envisioned that this stake should be propor- S(0) = SL , and S(1) = SU , tional to traditional cost funds must pay to adhere to standard compliance and regulatory demands during their where SL and SU denote the lower and upper fixed stak- engagements with clients; i.e., the FM stakes tokens once ing bounds, respectively, S(ω) denotes the stake a FM and gains access to multiple PFs and individual users, wishes to contribute, and ω ∈ [0, 1] serves as a quantita- alleviating the need to repeatedly incur administrative tive measure of the FM’s commitment to upholding the values of the Akropolis platform. Further, the parameter DR and regulatory overheads when engaging new clients. The overall goal of this staking mechanism is two-fold: ω can be fed into the ranking system. We expect S(ω) to be non-linear with respect to ω, taking a form akin to (1) To provide a barrier of entry for funds applying tanh(x), which should shift the FM distribution toward to participate in the system, to avoid excess costs a normal distribution. in vetting un-suitable fund applicants. (2) To enforce reputable behaviour once acting within 2.5.2. Asset Reporting the platform. As with traditional systems, fund managers will be The first point is intended to mimic the logic and be- required to regularly report on the state of their asset haviour of a token curated registry (see the Token Curated portfolio. The Akropolis platform will incorporate pro- Registries section). Although the initial implementation tocols to incentivise accountable reporting by FMs (see will be managed by a centralised Akropolis Foundation, it the Incentivised Accountability section). FMs will be able is anticipated that, as elements of the platform transition to stake tokens as part of the reporting process, with the to a more decentralised structure, this mechanism will be stake serving as a bounty for individuals/entities able to replaced by a suitable (proven) token curated registry. demonstrate falsities within the report. Similar to the The second point is to discourage participant FMs from onboarding stake, the amount staked by FMs during re- acting against the interests of pension holders in ways that porting may be optional but will serve to represent the may occur in traditional pension schemes. In particular, FMs confidence in, and commitment to, the validity of the onboarding system aims to actively discourage the their report. This information will naturally feed into the following behaviours: reputation and ranking system of the fund (see Ranking • Off-mandate investments and Reputation).

AKROPOLIS: A GLOBAL BLOCKCHAIN PENSIONS INFRASTRUCTURE 9 The staking mechanism is designed to encourage a new protocol. Thus, it will be necessary to tokenise various as- class of (potentially anonymous) actors who can profit by sets to provide a digital record of user’s pension holdings. demonstrating the existence of inconsistencies in a fund Initially, it is envisioned that users will acquire AITs report. These actors must provide supporting evidence to after depositing funds into the system. These AITs can verify their claims, either in the form of documentation be used to acquire tokens representing various pension that demonstrates wrongdoing (i.e., whistle-blowers) or a products provided by PFs. The initial phases will see a detailed analysis that demonstrates falsities in the report. small number of options available, aimed primarily at un- A more formal discussion of this mechanism is deferred sophisticated investors, with a greater range of products to the section titled Incentivised Accountability. The key being incorporated over time. point is that tokens staked by a fund during reporting Token ownership entitles a user to the underlying assets T will be partially dispersed to any actors able to prove but also gives access to services, features and products (more practically, convince a set of stakeholders) that the offered by PFs. For example, data feeds specifying as- report is misleading, inaccurate or invalid. Funds are set performance, marketing material related to the given incentivised to participate in the staking process as good asset class, or information regarding better-performing behaviour is rewarded by reputation points that can be assets, will be available to users (if they opt-in to receive used for marketing and promotional purposes within the it). Thus, the token permits new ways of client engage- platform (and, in principle, for external marketing). ment, such as reward schemes and other benefits, all of which can be accessed with a transparent, independently verifiable audit trail. 2.5.3. Ranking and Reputation AF Any actor managing funds/assets on the Akropolis platform must be extensively reviewed to comply with both internal platform standards and all relevant laws and regulations. In addition to ensuring platform users that all FMs engaged with the platform are regulatory compli- ant, Akropolis also provides a ranking system for FMs on the system. Expected performance, actual performance relative to expect performance and other measures allow the construction of a single overall ranking for all funds on the platform. Additionally, more-detailed rankings, that Future implementations of the Akropolis platform will include more options for sophisticated investors and indi- vidualised pension products, including a larger and diverse range of tokenised asset classes. Regulatory and practi- cal requirements will require different degrees of central oversight for the diverse range of asset classes, though Akropolis’ long-term vision is to decentralise as much of the process as possible (see the Future Directions section for more discussion). 2.7. Blockchain Wallet, Asset Ownership incorporate factors such as reputation, ethical policies, relative risk-profiles etc., will also be available, allowing and Identity users to categorize funds based on a variety of metrics Decentralised identity, key management, and recovery (see the Ranking section for an in-depth discussion). Ul- are very popular and active areas of research and devel- timately the ranking score will be representative of how opment in the blockchain community (an example of a reliable (i.e. How often a fund meets it’s own targets mature project in this space is uPort [27]). Akropolis and how much it’s willing to stake to be reputable) and intends to eventually integrate with decentralised identity trustworthy Funds are on the platform. platforms, such as UPort, however, due to the sensitive na- DR The overall rating given by Akropolis will likely feed ture of data that Akropolis will need to maintain, the ini- in a number of fundamental metrics, such as track record tial implementation will operate a traditional centralised of meeting expected returns, size of onboarding stake, database maintained by the Akropolis Foundation. amount staked during reporting periods and relative per- Identity and KYC8 information, along with all personal formance compared to other funds. Ultimately, it is en- data, will be stored off-chain and maintained by the cen- visaged that a high Akropolis rating could provide a type tralised Akropolis entity. User’s monetary transactions of universal gold-standard for pension-based fund/asset and asset holdings will be stored on-chain. Each user will managers. possess their own blockchain wallet (and associated pri- vate key(s)), which cryptographically verify ownership of all assets in their holdings. Technically, a user’s wallet will 2.6. Asset Tokenisation actually correspond to a collection of Ethereum addresses, A blockchain-engaged pension protocol offers new ways generated from a private seed, for new transactions on the to provide transparent auditing trails for pension holders, platform (see the Privacy section for further details). For PFs and FMs. Excluding cryptocurrency assets, value- KYC and AML9 purposes, each newly generated address stores held as part of a pension portfolio generally map to will be registered with the centralised Akropolis database. real-world assets such as precious metals, fiat currencies, Thus, Akropolis also maintains a database that maps properties, or businesses. Real-world assets need to be users to their public keys on the blockchain. We note tokenised in order to be represented within a blockchain 8Know Your Customer. 9Anti money laundering.

AKROPOLIS: A GLOBAL BLOCKCHAIN PENSIONS INFRASTRUCTURE 10 that this measure of pseudo-anonymity has many caveats be undertaken entirely off-chain (private) and the data whose discussion is left for the Privacy section. will be stored by the Akropolis Foundation10. Financial profiling data will be used to help users access funds and pension products that best suit their risk-profiles and 2.8. Key/Asset Recovery financial goals. No pension platform will be successful if it is possible Users’ monetary transactions and their portfolio, con- for a user to lose their life savings simply because they sisting of the past and present totals of the funds/assets forget/lose their authentication credentials. This topic that a user has accumulated, are abstractly stored on the poses some slight contention with the use of decentralised public blockchain. Further details appear in the Privacy systems, which typically offer no recourse against lost section. T keys. Akropolis gives users the ability to monetise this data. Akropolis will mitigate this issue. One possible res- Users can opt-in to add their profiling data and potentially olution is to offer users the ability to split their wallet elements of their on-chain data (maintaining anonymity) secret (more technically, the seed that generates the series to be marketed and sold in bulk by the Akropolis founda- of Ethereum private keys) into n pieces amongst friends tion to analysts and marketers. The resulting profits (in and family, such that k pieces are required to recover AKT) will be distributed evenly to the participants who the secret. Processes that facilitate this practice are well- chose to share their data. Ultimately, users are paid for known; for example, Shamir’s secret sharing [28], and the sharing their data. promising blockchain-focused project Tenzorum [29], offer possible implementations. AF Ultimately, and as a last resort, Akropolis can utilise the centralisation aspects of asset tokenisers to re-assign assets to new wallets for users who have unrecoverable wallets. Such a re-issuance is in principle feasible, as the Akropolis Foundation holds a central database of users’ asset holdings. In practice, Akropolis will not have the control/ability to re-assign assets but, as a trusted entity, Akropolis can submit requests to individual asset tokenis- ers to re-assign the specific assets/holdings to ensure a user’s account is entirely recoverable. 2.11. Regulatory Compliance The pension industry is heavily regulated, as appropri- ate for a core social and financial infrastructure intended to maintain the living standards of a nation’s citizenry in retirement. Though necessary to ensure a functioning pen- sion sector, the dense regulatory environment surrounding the pension industry provides one of many hurdles that PFs and FMs must navigate to ensure compliance in rele- vant jurisdictions. Akropolis aims to streamline regulatory compliance by leveraging features of the platform. Firstly, through the Onboarding/Vetting process, Akropolis will verify and check compliance for all FMs 2.9. Platform Developers participating in the system, ensuring they comply with The lifespan of the Akropolis platform will require all necessary standards, locally and globally (where ap- constant development as it transitions to its final decen- propriate). tralised state. For this reason, the Akropolis platform Secondly, it is often the case that the assets procured will retain a reserve fund of AKTs to incentivise com- by FMs will themselves be bound to specific geographic munity development. The contributing developers will regions and must therefore comply with regionally applica- DR assist with extending services and features available on ble rules and regulations. The asset tokenisation process the platform, through development on the underlying will allow specific regulatory and tax requirements to be blockchain layer, or, the application stack above. As such, built into the token itself. This will allow seamless global their contributions will be rewarded in AKTs from the on-chain compliance at the blockchain layer. For exam- reserved development fund. ple, consider an investment in Australian property. An individual property may be fractionalised into a set of asset tokens. Australian law prohibits certain volumes of 2.10. Akropolis Platform Data property being sold to foreign investors. Given that par- There are two major classifications of data that exist in ticipants in the Akropolis system have been KYC’d, it is the Akropolis platform. Data that is public (i.e., put on possible to programmatically ensure (with a verifiable au- the public blockchain and visible to the world, known as dit trail) that the tokenised assets can only be transferred “on-chain” data) and data that is private (i.e., stored pri- to accounts within the platform that are either Australian- vately and securely by the central Akropolis Foundation, owned or manifestly consistent with the demands of this known as “off-chain” data). A deeper classification and particular regulation. Similar automated compliance pro- discussion of these are given in the Data Model section tocols will be applicable, and readily implemented, for a below. wide range of assets. When users join the Akropolis system, they may opt-in Thirdly, the nature of pension investments often to complete a financial profiling questionnaire, which will requires time-locking of investment assets, to comply 10See Privacy for further details discussing privacy concerns.

AKROPOLIS: A GLOBAL BLOCKCHAIN PENSIONS INFRASTRUCTURE 11 with either regional regulatory policy or the specifi- would see the regulatory framework evolve to increasingly cations/requirements of the fund products themselves. respond to the demands of the modern workplace. For Compliance with time-locking requirements is another example, international trade agreements could include ef- area that can be easily automated using a decentralised forts to provide common unifying regulatory frameworks blockchain layer. Publicly verifiable locking of investments to steer global pension regulatory structures towards a for specific periods of time aids platform auditing and suitably homogeneous configuration. The Akropolis plat- ensures compliance with fund products and regulations. form is ideally suited to implement (and advocate for) To further this point, Akropolis will offer time-locked a global regulatory framework while incorporating rele- contracts, where users can opt to lock their funds for vant jurisdictional-unique regulatory demands. The same various periods of time, either for security, personal or applies for the current tax landscape, whose framework T regulatory reasons. We envisage that three such wallets is heavily localised to specific geographical regions. In will be regularly used; a retirement wallet (withdrawable fact, Akropolis intends to liaise with several regulatory after a certain age, e.g., after turning sixty-five), an inter- bodies of various countries to work towards recognizing mittent release wallet (withdrawable at regular intervals) the Akropolis platform as a pension fund structure (for and an emergency wallet (withdrawable after demonstrat- individual contributors), allowing users to benefit from ing an emergency, consistent with predefined standards). pension-specific tax treatments, including the tax relief These wallets are optional and can be designed to help on voluntary contributions. users manage their investments. As a general rule, how- It is emphasised that a perfectly homogeneous regula- ever, in order to comply with regulatory requirements tory environment is unlikely in the near future, though regarding taxation and access to pension funds, time- locking of (at least) some portion of a user’s funds is anticipated. Implementing such time-locking is, of course, a key advantage of blockchain-engaged systems such as Akropolis, which permit automated secure time-locking with full transparency. AF The issue of regulatory compliance, for a pension plat- form intending to facilitate the flexibility required of a mobile global workforce, is a non-trivial matter. It is important to emphasise that the above discussion does not intend to over-simplify the complexities of regulatory demands. Principally, there are two classes of regulatory regulatory homogeneity across regions such as, e.g., the Euro zone, offer some hope for such developments. The Akropolis platform will, in practice, be a provider of ser- vices that navigates a net of heterogeneous regulatory frameworks. Nonetheless, the larger goal of Akropolis is to design and advocate for a pension system that meets the needs of workers, as both the workplace and leg- islative agendas push greater responsibility for funding retirement onto the individual. Decentralised implemen- tations are perfectly suited for nudging pension regulatory frameworks towards the modernisation necessitated by the needs of global citizens. The capacity for technologically- demands that must be integrated into such a system. One driven efficient protocols to advance outdated regulatory set of requirements relates to the local or regional reg- frameworks is evidenced by advances in the sharing/gig ulatory requirements that apply to a citizen of a given economy and the development of new monetary systems state/jurisdiction. It is relatively easy to ensure that re- such as Bitcoin itself. Services such as Uber and Airbnb gional compliance is afforded by the Akropolis platform. both forced regulatory environments across the globe to KYC requirements ensure that users’ data is tied to a adapt to the modern era. Service-driven technological particular jurisdiction and the platform can automati- advances that better meet the needs of the population DR cally apply the relevant regulatory framework to a user’s can source the legislative change the population requires. account. Thus, Akropolis is focused on developing a pension plat- A more complicated issue relates to the global or total form for the future, a system that learns from the failures regulatory demands applicable for such a system. It is of the past, and leverages technological advances to meet trivial to reapply a new set of regulatory demands as an societal needs, while satisfying existing legislative require- individual updates their KYC information, thereby tran- ments and advocating for legislative changes that ensure sitioning the governing framework for the user’s account that users’ needs are met. to the newly applicable jurisdiction (when appropriate). Akropolis will need to consider and implement futuris- However, ultimately it is desirable that a (minimal) set tic developments, such as the notion of a universal basic of regulatory demands can be implemented on a global income, or related means of allocating basic resources to scale, reducing the friction experienced by modern work- ensure that individuals can meet their needs in a work- ers engaging with the demands of an atomized, transient place heading towards mass-automation. Akropolis does work environment. The changing demands of the modern not advocate a particular position on such issues. How- workforce, and the forces they impart upon the individual ever, Akropolis notes that the design of the Akropolis as they attempt to accrue an adequate pension, would platform, in which individuals possess a unique pension ideally be matched by an evolving regulatory framework account that is tied to their identity and acts as a portable that enables the global workforce to meet its needs. In source of pension truth, as the individual navigates the principle, a unified set regulatory demands could be ap- globe, is well suited to implement such futuristic pro- plied to part or all of an individual’s pension accounts, grams. and an idyllic vision for the future regulatory environment

AKROPOLIS: A GLOBAL BLOCKCHAIN PENSIONS INFRASTRUCTURE 12 2.12. Premium Services a deterrent to spamming and trolling attacks which can plague Token Curated Lists. The Akropolis platform is designed to help users tran- sition from existing pension infrastructures to a more Enterprise License Fees — In parallel to the public flexible, transparent and accountable system. As such, Akropolis platform, an enterprise solution shall exist for the platform adopts a freemium model, whereby users PFs to manage and track their investments across the can join and the base services are offered for free. In Akropolis platform (see the Enterprise Instances section). addition to the base-level services, there will be extended This enterprise solution will allow FMs to interface with (premium) services available on the platform. The range specific PFs who wish to use a private or permissioned of extended services will inevitably expand as the plat- blockchain implementation, mainly for data privacy rea- T form develops. To give the reader a sense of the expanded sons. A license fee to use and access the platform will services that may be offered, the following list contains be charged to FMs and PFs. These licence fees will help some examples: support and grow the Akropolis platform, both in the private and public domains. • Ability to add beneficiaries (family members, part- ners, friends, charities); Performance Fees — Performance fees are key in • Creation of Testament/Will Smart Contract (au- the Akropolis model to ensure that FMs are incentivised tomatically assign holdings to a beneficiary in to provide the best possible investment services to the case of death); Akropolis community. These fees will be based on trans- AF • Add a controller/manager (implement a program- matic power of attorney, allowing users to appoint a person or a group of people to manage invest- ments). • The platform will incorporate stress-testing fea- tures for users, providing analysis of sector alloca- tions and probable portfolio responses to extreme market/sector movements. It is envisioned that basic options will be available to all users (perhaps for a small fee) while more advanced stress-testing will be available as premium services. parent templates (see Templated Transparent Fund Fees) that will be released to FMs according to the performance of the assets under their management. This element can be automated on-chain using smart contracts, whereby fee withdrawals are permitted based on agreed values of the effective returns compared to an FMs expected/promised returns. 2.13.1. Templated Transparent Fund Fees Given that contributions and returns are represented • Cross-border assistance for expatriates, including on-chain in the form of AIT transactions, the fee struc- access to information regarding the pension sys- tures implemented by PFs and FMs can be implemented tem in new host countries and tools for navigating in smart contracts. Akropolis may issue a set of “stan- inter-jurisdictional transitions. dard” fee-templates as smart contracts. These contracts can be easily implemented by a fee-charging entity with their own variables (e.g., percentage fees, etc.), providing 2.13. Fees transparency to assure users that there are no hidden fees. All fees referred to in this section will be paid for in AKT These template fee contracts are reusable. Accordingly, DR tokens. it is reasonable to expend the requisite effort to ensure To combat the often complicated and hidden fee struc- that these templates are clearly explained and understood, tures in traditional pension systems, Akropolis will imple- providing a significant improvement over the obfuscated ment a transparent and sustainable fee structure that both and unnecessarily complex fee structures often used in encourages good behaviour and adequately remunerates the present environment. participants for their services. In the event that a fee-charging entity wishes/needs to There are four primary areas in which fees are taken implement their own fee-structure contract, the Akropolis within the Akropolis platform. Foundation will be required to white-list the relevant con- tract prior to acceptance onto the platform. During the Premium Service Fees — While Akropolis adopts a white-listing process, Akropolis may review the contract freemium model for basic services, Premium Services are and ensure that the fee structure is not unnecessarily offered at additional cost. These fees vary depending on complicated and accurately reflects promises made to the service offered. users. Onboarding Fees — FMs who wish to participate in 2.14. Summary the Akropolis ecosystem will need to be on-boarded and vetted in accordance with strict governance and regula- The present section gave an overview of important tory guidelines (cf. Onboarding/Vetting). A flat fee is elements of the Akropolis platform. Some mechanisms charged in this process to cover the platform’s cost in outlined above were intentionally communicated in a gen- undertaking the vetting process. This fee also acts as eral sense. Throughout the development of the Akropolis

AKROPOLIS: A GLOBAL BLOCKCHAIN PENSIONS INFRASTRUCTURE 13 platform, each aspect of the system will be carefully anal- (see details below) regarding the tenacity of the FUM sta- ysed and fine-tuned to ensure that the platform remains tus report. Two outcomes are possible at the conclusion commercially viable and technically feasible. Further of the judgement period: papers, detailing technical specifics for elements of the system, will be forthcoming after sufficient real-world • The FMs status report is deemed valid. In this testing is completed. case, the AIT staked by the FM is returned to The remaining sections of this document provide more- the FM after TS,A days have passed (i.e., the FM detailed discussion of key elements of the described sys- avoids punishment for bad behaviour). Further- tem. These sections aim to be relatively self-contained more, the FM gains positive reputation points, and, where applicable, appropriately general. which can be used for marketing purposes within T the platform to promote the quality of products offered by the FM (i.e., the FM receives rewards 3. Incentivised Accountability for good behaviour). • The FM status report is deemed invalid. In this The present section describes a general protocol for case, the staked AIT are forfeited and an amount incentivising good behaviour by participants in a market- of reputation points are subtracted from the FM place comprised of service providers and service users [30]. (i.e., the FMs bad behaviour is punished). This Incentivised Accountability Protocol (IAP) has im- mediate application within the Akropolis platform but can Initial implementations of the IAP will require the out- AF also be used in more-general marketplaces to incentivise good behaviour by participants. Participants who offer pension products on the Akropo- lis platform (either FMs of PFs, generically referred to as FMs in this section) will be required to inform the marketplace of the status and performance of their Funds Under Management (FUM). Akropolis will require FMs to deliver FUM status reports at regular specified periods as a condition for continued access to the platform. In order to (a) facilitate market transparency, (b) penalize bad actors, and (c) reward good actors, Akropolis will incorporate incentivisation mechanisms designed to hold come of the assessment process to be inputted by the owner of the staking contract. In the event of bad be- haviour by an FM, the seized AIT are used to reward the individual who submitted evidence demonstrating the falsity of the report and to reimburse any authorities engaged to assess the validity of the evidence. Specifi- cally, the staked AIT are split between the address that provided the hash of the evidence and an address that stores AITs used to fund the assessment process. A challenge to the validity of a FUM report begins once the smart contract receives a hash of the evidence of bad actions. When submitting a claim of falsity or mis- FMs accountable for claims made in FUM reports. leading conduct, the submitting entity (i.e., the claimant) The incentivisation process works as follows. Prior to may also be required to lodge a small amount of AIT in releasing a FUM report, FMs must lodge an amount of the staking contract. In the event that a ruling is made AIT within the Akropolis system. These AITs are staked in favour of the FM, the claimant forfeits the submitted as part of the accountability process. Once the stake is AITs, whereas the staked AIT is returned to the claimant received, the FM is authorized to release their report, a if a ruling is made in the claimant’s favour. Staking by hash of which is sent to the smart contract holding the claimants may not be enforced in all scenarios employing DR staked AIT. Upon receipt of the report hash, the smart the IAP on the Akropolis platform, though one envisions contract specifies that the stake is locked for a specified some scenarios where claimant staking will be necessary, period of TS,A days. During this period, the staked AIT from a game theoretic perspective, to disincentivise bad acts as a bounty that incentivises market participants to actions by claimants. In any case, it is anticipated that provide evidence indicating that the FUM status report claimant stakes will be relatively small, to allow genuine contains falsities. In principle, any interested individ- claimants to submit their case without undue burden, yet ual/entity can analyse publicly available FUM reports the claimant’s stake should also be sufficiently non-trivial and attempt to access the bounty, though two classes of to discourage repetitive bad action on behalf of claimants. market participants are clearly incentivised to verify the Two phases are envisioned for the decision-making pro- tenacity of reports: cess engaged to determine the tenacity of a claimant’s • Users invested in the product offered by the FM evidence (i.e., the evidence assessment process). In the are incentivised to verify the reported status of initial implementation of the IAP, oversight will be pro- assets held. vided by Akropolis, representatives of whom will act as • Individuals with inside knowledge of false report- the owner of the staking contract. The contract owner ing may wish to inform the marketplace of the must: FMs false claims (i.e., whistleblowers). To make a claim of false reporting, an individual must • Undertake a preliminary assessment of the evi- submit supporting evidence, a hash of which is submitted dence to ensure it is not clearly false. to the smart contract storing the staked AITs. Submitted • Initiate the evidence assessment process, in the evidence will be analysed and a judgement will be made event that the evidence appears reasonable.

AKROPOLIS: A GLOBAL BLOCKCHAIN PENSIONS INFRASTRUCTURE 14 • Input the outcome of the assessment into the the evidence and forming an opinion regarding the tenac- smart contract, at the conclusion of the evidence ity of the report can stake some AIT and participate in assessment process. the decision-making process. All parties participating in the evidence assessment process then vote as to the tenac- ity of the report. The outcome of the vote is recorded by the staking smart contract. All AITs staked by partici- pants that voted against the majority are forfeited and redistributed to participants within the majority. If the majority votes in favour of bad action by the FM, the AITs staked by the FM are included in the redistributed T AITs, modulo the percentage of the stake provided to the address that supplied the hash of the evidence. This provides a decentralized process for assessing the quality of FM reports. A couple of comments are in order. Firstly, there may be instances in which the FUM report, and the evidence of wrongdoing, are only made accessible to users hold- ing assets with the given FM. In such cases, only those users possessing tokens associated with the relevant in- AF vestment product could stake AIT and participate in the decision-making process (i.e., voting is only permitted by those with a vested interest in the tenacity of the report). Secondly, it is likely that the above decentralized IAP would still require some degree of central oversight. Given that assets and FUM are ultimately held exter- nally in the physical world, there may be instances in which legal authorities are required to take action against FMs. The decentralized accountability incentivisation mechanism would likely require central oversight to deter- mine whether it is appropriate to conduct the evidence assessment process in-house via Akropolis or whether the matter needs to be forwarded to legal authorities. The Figure 3. Sequence Diagram: A FM publishes a report aspiration of Akropolis is to construct a system that is that is found to contain falsities. maximally decentralized, while acknowledging the reality that the pension sector imposes inherent constraints that This initial implementation clearly requires a central will require some degree of central oversight. authority. Ideally, a future phase of the IAP would re- move the need for central oversight. The extent to which DR 3.1. General comment regarding this class the evidence assessment process can be decentralized de- of incentivisation models pends on the range of offences deemed punishable by the Akropolis system. It is beyond the scope of the present The above discussion describes an IAP for accountable document to analyse the legal complexities relevant for the reporting of product information by FMs. Ultimately this range of candidate bad actors, though it is evident that general mechanism can be used in a variety of contexts in cases of overt criminal behaviour it may be necessary within the Akropolis platform and the above discussion, to involve the relevant authorities. A sequence diagram which focused on the use case of FUM status reports, is summarising the IAP, for the case of a published report just one possibility. An alternative use case would relate that is found to contain falsities, appears in Figure 3. to product information and advertising material released Ideally, some components of the evidence assessment to Akropolis users by FMs. A similar incentivisation process could be decentralised by employing a staking structure would be possible - the FM submits an amount mechanism analogous to Augur [31]. The evidence assess- of staked AIT to a smart contract, along with a hash of ment process could use Augur itself or a purpose-built the product information, advertising material or product variant of such a system, constructed for internal users disclosure statements. Users could investigate the reliabil- of Akropolis. The decision-making process would work ity of claims made within the material, drawing attention roughly as follows. The staking smart contract receives a to unrealistic assumptions regarding anticipated returns hash of the FUM report and a hash of the evidence pur- on FUM or any other information which may reasonably portedly demonstrating false reporting. These documents be considered misleading. Akropolis users are incentivised are made publicly accessible, so that the relevant hashes to police the reliability of material posted by FMs, while can be verified. Any individuals interested in analysing FMs are incentivised by the receipt of positive reputation

AKROPOLIS: A GLOBAL BLOCKCHAIN PENSIONS INFRASTRUCTURE 15 points for marketing and informational material that has defining an estimated score for the players, defined as been vetted by the staking process and deemed void of 1 misleading information. Ei = , (1) Regarding the number of staked AITs required to im- 1+ 10(Ri −Rj )/D plement this mechanism, one possibility would be to allow where i, j ∈ {1, 2} with i = 6 j. Note that the estimated P2 FMs to decide on the amount of AITs they’re willing scores sum to unity, i=1 Ei = 1. The constant D is to stake when submitting material to the system. The chosen such that an advantage of D rating points over an number of positive reputation points awarded to the FM opponent translates into the player’s expected score being for good behaviour could be determined by the size of magnified by ten times, relative to the opponents expected the stake put forward by the FM to incentivise market score. At the games conclusion, the players actual score is T scrutiny - the stake size would represent the strength determined by a scoring function. For example, a suitable of the FMs conviction regarding transparent and open scoring function for chess is engagement with investors. Accordingly, an FM willing  to submit a larger stake should be rewarded with more  0 if player i loses positive reputation points. Similarly, FMs that submit Si = 1/2 if player i draws (2) 1 if player i wins,  a large stake that is ultimately forfeited due to bad be- haviour may lose less reputation points than FMs that and the players ranking is updated as: forfeit a smaller stake, with the loss of the stake itself considered an acceptable component of the punishment. Ri0 = Ri + K(Si − Ei .) (3) AF 4. Ranking Users of the Akropolis platform will benefit from rank- ing metrics that can aid fund allocation decision-making processes. Akropolis will provide multiple metrics for assessing the performance of PFs and/or FMs. One im- portant metric will be an overall ranking of raw fund Here K is a numerical factor that can be used to encode the relative impact of the outcome of the new game, on the player’s ranking; i.e., a “master,” with a large number of prior victories, may have a smaller value of K, such that the impact of a single loss is not severe, while a “beginner” may have a larger value of K, so that a single loss has a considerable impact on their ranking. The Elo rating system can be generalized to an n-player game by treating the n-player game as a set of games in which every player is competing against every other player. Thus, the single n-player game can be treated performance, i.e., a pure measure of fund returns, relative as n(n − 1)/2 two-player games. The players estimated to alternative funds on the market. Other measures will scores can be cast as assess the overall reputation of the fund provider, user   satisfaction, the clarity and transparency of marketing 1 X 1  material, and the FMs track record of meeting return Ei = × , (4) n(n − 1)/2  j6=i 1 + 10(Ri −Rj )/D  forecasts. where Pn once again the estimated scores sum to unity, DR 4.1. Relative Fund Rankings i=1 Ei = 1. The scoring function for the n-player game, for which the n participants are ranked from first to last, There are multiple ways to rank the relative perfor- can be written as mance of funds. One approach would be to employ a n−p generalized implementation of the Elo rating system [32]. Si,p = n(n−1)/2 , (5) Elo developed a rating system for two-player games that can be applied to, e.g., chess or video games. Participants where player i, who finishes in place p, receives the score begin with a specified amount of ranking points and gain Si,p . Player rankings are again calculated as: (lose) points, at the expense (benefit) of their opponent, Ri0 = Ri + K(Si,p − Ei ). (6) whenever they win (lose) a game. Over time, players receive a ranking that encodes their relative number of This generalized Elo rating system provides an exam- victories and losses (or draws), while also factoring in the ple for a method to rank fund performance on Akropolis. relative-ranking of opponents they have beaten/lost to. Fund performance would be ranked at some regular in- The relative ranking of two players also encodes the prob- terval, producing a relative ranking for all funds that ability that each would be expected to emerge victorious evolves with time. The constant K could start out being if they competed. equal for all funds, in the first phase of the Akropolis For present purposes, it may be necessary to generalize platform, and subsequently evolve to ensure that a fund the Elo rating system to games with n players (in the with a strong history of reliable performance is not unduly present case, players are individual funds). Denoting the penalized for a single bad year, while the volatility of the rankings of the players in a two-player game as Ri , with ranking for a new fund is more sensitive to the fund’s i ∈ {1, 2}, the two-player Elo rating system proceeds by yearly performance in its initial years.

AKROPOLIS: A GLOBAL BLOCKCHAIN PENSIONS INFRASTRUCTURE 16 4.2. Reputation Rankings DAO governing body, it is envisioned that a small, elected body of curators will still be required to oversee the plat- The Akropolis platform will provide additional classes form and rule on specific crowd-proposed issues. This of ranking measures for the benefit of users. The plat- body, hereafter referred to as the Akropolis Council, will form includes incentives to encourage accountability and coexist with the governing DAO and assist with various transparency of FMs and part of these mechanisms in- operational functionality. cludes the reward (or removal) of reputation points for The detailed implementation of any DAO requires care- good/bad actions. For example, funds that deliver their ful consideration of a number of issues. In particular, it promised returns can receive reputation points, and simi- is crucial that the decision-making process avails a le- larly funds that stake AITs to incentivize scrutiny of their gitimate and provably-fair framework for organisational T reports will be rewarded with reputation points in the governance. The present section explores existing re- event that their reports survive the scrutiny. It will also search on DAO governance models and considers possible be possible to acquire reputation for delivering transpar- DAO implementations that may be compatible with fu- ent and informative marketing and/or product material ture versions of the Akropolis platform. It is emphasised to the marketplace. Other sources of reputation mea- that the implementation of decentralised oversight within sures may also be possible. These alternative measures of Akropolis is a long-term vision. Initial implementations fund performance will be available for users to aid their of Akropolis will include central oversight by the Akropo- decision-making and will also serve as marketing tools for lis Foundation and no move to decentralisation will be funds on the platform. made without detailed consideration, rigorous testing, and The factor K that feeds into the overall fund rank- AF ing could also be given a sensitivity to the reputation measures derived by the platform, such as measures of user satisfaction and fund transparency and accountabil- ity. For example, if a fund has rp reputation points, and one takes K ∝ rp−1 , funds with a stronger reputation will be less sensitive to a poor performance than a fund with a poorer reputation. More generally, including the factor ω that quantifies the FMs commitment to the prin- ciples of transparent and accountable reporting (see The Akropolis Platform), the K factor may take the form K = K(ω, rp−1 , . . .), where the dots denote additional careful implementation. The motivation for decentralised oversight stems primarily from the view that individuals should be empowered to control their financial future, not only in terms of building a pension fund, but also by determining the rules governing the functionality of the systems that control and implement their pension decisions. As the platform evolves, the extent to which decentralisation is appropriate and desired by platform users will be assessed and serve as the basis for future platform planning; i.e., decentralisation will not be im- posed but will instead be utilised if it serves the needs of platform users. relevant dependencies. The platform will provide overall rankings both with and without the reputation sensitivity, allowing users 5.1. Immediate Challenges purely interested in returns to select funds based solely The immediate challenges that must be overcome for on that measure, while users applying other fund allo- a DAO implementation to be successful include the fol- cation strategies may utilise rankings that incorporate lowing: various reputation factors. It would also be possible to DR include reputation systems that rank funds according to Governance scalability — It can be extremely dif- ethical factors such as environmental impact, employee ficult to mobilise a community to achieve a quorum for conditions, gender equality in leadership, etc., allowing voting on organisational resolutions. The difficulty of users to apply various ethically-oriented fund allocation attaining this goal typically increases with the number of strategies. participants in the system. This issue is well known and was encountered in many votes that occurred within The DAO [33]. 5. Governance Governance resilience — Naive DAO implementa- Akropolis’ long-term objective is to maximise the de- tions often employ a majority vote, requiring more than gree of decentralised functionality available on the plat- 50% of participants to vote in unison to pass a resolution. form.11 Within the maximally decentralised vision for the Such systems can be vulnerable to 51% attacks - failure platform, the centralised oversight initially provided by to carefully design optimal DAO implementations can the Akropolis Foundation will be largely replaced by a allow malicious external actors to acquire 51% of votes Decentralised Autonomous Organisation (DAO). In prac- tice, the degree of decentralisation ultimately achieved will be subject to legal/regulatory requirements and the functional benefits for the platform. Furthermore, even after the Akropolis platform transitions to a system with a 11See the Future Directions section for further discussion.

AKROPOLIS: A GLOBAL BLOCKCHAIN PENSIONS INFRASTRUCTURE 17 and implement various attacks, such as stealing staked Council. This allows idle participants to deposits. contribute their voting power with minimal effort. Game-theoretic equilibrium — DAO implementa- • Token-holder individual sovereignty: tions that permit a wide range of voting proposals can – In the event that a token holder’s opinion be susceptible to attacks in which proposals that benefit contradicts the vote submitted by his/her del- the majority of participants are put forward and rapidly egate, Akropolis will allow for vote overrid- endorsed. Such proposals introduce bias into the voting ing, enabling token holders to express their system and can produce undesired outcomes. A triv- opinion at all times. This significantly miti- ial example would be a proposal that splits profits with gates the risk of coercion and collusion and T participants who vote yes. aids the prevention of cartels. Governance extensibility — Fully decentralised sys- Monetary incentives are not the only way to encour- tems can often be a double-edge sword. They provide a age good behaviour and/or discourage bad behaviour in trustless deterministic framework but issues can arise if DAO structures. The Akropolis reputation system (see the framework itself is flawed. Mechanisms should be im- Ranking and Reputation) can be integrated into many of plemented, within the governance framework itself, that the modular components that constitute the governance permit the governance framework to be extensible and protocol. Thus, reputation-based incentives can also be upgradeable. used to encourage the above behaviours. We explore this AF Dormant Tokens — Systems that do not offer key- recovery are susceptible to tokens/assets/votes gradually being lost and/or removed from circulation. If a system’s tokens are used for voting, the assumption that all tokens are capable voting becomes less accurate over time. This is known as the dormant token problem [34]. A success- ful DAO should account for dormant tokens and adjust internal variables accordingly. 5.2. Approach possibility in more detail in the following section. 5.3. Akropolis Reputation System Reputation-based incentivised governance models have been explored by the community (see Ref. [38] for an example). The present section considers the potential for incorporating the Akropolis reputation system into a decentralised governance model. A governance sys- tem that utilises governing members’ (or participants’) reputation must ensure that reputation points (which abstractly represent an increase in reputation) are non- Several authors have investigated governance issues for transferable. Furthermore, the system protocol must decentralised systems and organisations [35, 36, 37]. In clearly elucidate the ways in which reputation points are the present context, the modular design proposed and distributed amongst users. Below, a set of general guiding built by DAOStack [38] is of particular relevance. This rules for awarding reputation points, within the context design, coined the Operating System for DAOs, allows of decentralised governance models, are proposed. These for replacement/modification of individual components may serve as the basis for the development of a more that constitute the overall governance framework. It ad- fully-fledged reputation-based governance system. DR dresses many of the immediate challenges listed above and provides an extensible framework on which to build (1) Community-assigned reputation points: A pro- a governing protocol. cess whereby community members may submit In the design of an over-arching governing protocol, proposals for a given platform participant to be Akropolis will also include the following extended princi- awarded reputation points. The recommendation ples: is only enacted after the proposal is voted on. • Monetisation of attention: (2) Algorithmic reputation flow: A set of rules which – Incentivising voters to participate in impor- dictates a system for dynamic reputation-point tant votes by compensating voters for their assignment, including but not limited to: time. This could be achieved, for example, (a) Automatically assigning reputation points by remunerating voters using tokens from for the submission of approved proposals. the community-pool. (b) Automatically assigning reputation points – Attention can also be monetized via a for early votes in accordance with the major- reputation-based system: the more often a ity. member votes on proposals, the more repu- (3) Platform usage: Reputation points can be tation points they receive. awarded to users that actively/regularly partici- • Delegation: pate in the system, either as users or developers. – Passive/dormant token holders will have the Various metrics can be used to quantify a user’s ability to delegate their vote to other mem- level of participation, ranging from the amount bers of the network or to the Akropolis of pension assets stored within the platform, the

AKROPOLIS: A GLOBAL BLOCKCHAIN PENSIONS INFRASTRUCTURE 18 number of votes participated in, or the frequency The purpose of a token curated registry is to provide of platform activity. a decentralised, self-sustaining registry of elements that Similarly, a set of rules can be enforced to decrease the conform to some externally agreed-upon metric. Any en- reputation of specific participants. The rule-set could be tity interested in adding an element to the list is required based on events such as: to stake some monetary value as assurance that the el- ement confirms to the agreed upon metric. The wider (1) Submission of a rejected proposal. community may challenge the purported suitability of an (2) Inactivity (Dormant-tokens): Token holders who element and, if it is decided that the element does not do not delegate their voting power and do not conform to the metric, obtain the elements stake. participate in the last x proposals. This logic can be applied directly to realise a decen- T It seems fitting to decrease a user’s reputation to disin- tralised tool for constructing and maintaining a list of centivise the occurrence of these (and related) events. FMs on the Akropolis platform. In the event that the governing DAO issues challenges to FMs that (suppos- edly) don’t conform to some requirement, the Akropolis 5.4. Akropolis Council council could be tasked with performing the necessary Decentralised systems often require a core group of par- background checks to ensure that the requisite standards ticipants who are responsible for casting final rulings on are being met. At any given time, challenges against decisions initiated by the wider community of participants. listed FMs could be issued by token holders or external Such agents, referred to as curators, are often elected from pseudonymous/anonymous actors (see for example, the the participating community and given specific privileges Akropolis Council. AF on the system. In the present context, the curators of the decentralised Akropolis platform are referred to as the It is anticipated that the initial body of curators will be chosen from the founding Akropolis team and leading experts in the industry. This includes reputable figures with relevant experience, such as pension advisors and consultants, asset/fund onboarding specialists, investment managers with specific sector expertise, financial planners and regulators. The council of experts will be elected and maintained Fisherman-like protocol [20]). The Akropolis Council will likely be responsible for reviewing these challenges and de- ciding (through voting) if it is appropriate for the selected FM to remain on the token curated registry. As a final comment, it is noted that the well-known issue of passive token-holding, which leads to easier ex- ploitations of 51% attacks (majority validator attacks) can be mitigated in the event that Akropolis includes a voting-delegation mechanism. Such a scenario would, in principle, incentivise token-holders to either participate in the curation of the registry or delegate their vote. by the governing DAO. In the event of curator inactivity, the DAO may propose the removal of a member and elect 5.6. Voting Mechanism a replacement. At any point, proposals may be made to Voting mechanisms must be carefully developed and replace council members to mitigate centralisation and deployed in order to ensure that voting processes do not prevent council member misbehaviour. admit biases that can influence the outcome of votes. The responsibilities of the Akropolis council will in- If, for example, participants’ votes are public, the in- clude the maintenance of the FM registry, which functions formation can bias future votes cast by participants yet DR as a token curated registry (see the following subsection). to submit their vote. Here, a potential implementation Council members will act as the curators of the registry. is outlined which provides vote secrecy at the cost of greater user participation. It is based on the well-known partial-lock commit-reveal commitment scheme [42, 43]. 5.5. Token Curated Registries The basic strategy is outlined in the following steps Token curated registries have recently received much attention in the decentralised community. In particu- (1) Proposal submission: A token holder may sub- lar, a number of authors have explored the concept of mit a proposal to be voted on by the community. DAO-maintained token curated registries [39, 40, 41]. Votes are either in favour or against. Functionality of the Akropolis platform necessitates (2) Votes submission: that a list of vetted Fund Managers, who are authorised (a) Commit stage: users who wish to vote on to interact with contributors (individual contributors and the proposal submit a hash of their vote and pension funds), is maintained. Within the initial imple- a salt.12 mentation of the Akropolis platform, the list of vetted (b) Reveal stage: users reveal their votes by sub- platform participants will be maintained by the Akropolis mitting their choice (either yes or no) along Foundation. However, as the platform transitions to a with the salt used. more decentralised framework, it is anticipated that this (3) Proposal outcome: Once the reveal period has centralised aspect of the system will be converted to a ended, the result is automatically recorded by the DAO-maintained token curated registry. voting smart contract. 12A random bit of information that makes the hash unique.

AKROPOLIS: A GLOBAL BLOCKCHAIN PENSIONS INFRASTRUCTURE 19 5.7. Final Comments (such as a corporate network). The Akropolis protocol is intended to be blockchain agnostic, however, for initial The above discussion provides an overview of candidate implementation considerations, Akropolis functionality issues and solutions that are relevant for a decentralised will be designed to be compatible with the capacities of implementation of the Akropolis platform. The purpose the current public Ethereum “mainnet”. References to of the discussion is to provide a general sense of rele- “smart contracts” and related Ethereum-specific terms can vant considerations involved in the development of such be readily generalised and applied to other blockchains. a platform. As already mentioned, the move towards a It is not necessary to assume that the public database decentralised framework (or even features) will be care- consists of a single database — pre-existing bridging solu- fully considered and only implemented if it adds value tions between multiple Ethereum chains [44] would allow T and quality of services for platform users. The preferred a public database to span multiple Ethereum instances, goal of Akropolis is to embrace the community-oriented allowing the inclusion of low-fee and highly scalable proof- perspectives inherent in the decentralised developmental of-authority (PoA) chains. Furthermore, inter-protocol community and focus these perspectives to deliver optimal solutions [20, 21, 22] utilising an intermediary chain are pension products that protect individuals from regulatory showing progress and could allow for inclusion of multiple, uncertainty and centralised points of weakness, while em- disparate chains. powering individuals to secure their own financial future. To the extent that decentralisation serves the broader 6.1.1. Requirements Analysis goals of the Akropolis platform, Akropolis will investigate and embrace promising decentralised implementations. Selecting a public database (i.e., blockchain) is a priority. AF However, decentralisation will not be pursued purely for its own sake - ultimately the governance and functioning of the Akropolis platform must serve the interests of pen- sion holders, and developmental choices will reflect this 6. Data Model A guiding principle of the Akropolis project is to pro- vide transparency and accountability through the use of complex choice, involving more than a simple technical- requirements analysis, as used for a relatively static tech- nology such as a web server, and being more akin to se- lecting a long-term strategic business partner. Aspects of the economic and political factors involved in this decision (such as the viability of available consensus mechanisms and governance profiles) are discussed elsewhere. The present section focuses on technological requirements of the public database to determine the base level of required functionality. The public blockchain must provide data storage and distributed ledgers. However, it is important that this processing for the following features: objective is attained whilst simultaneously ensuring that • Account-keeping — maintaining a tamper- platform users maintain sovereignty over their private and proof ledger of value transfer around the Akropo- personal information. Akropolis will be required to handle lis system, with the specific goal of providing a sensitive information (e.g., during onboarding and vet- public view of fund performance. ting) and maintain records of (some of) this information. • Gate-keeping — providing mechanisms to pro- Storing such information in the present regulatory context tect users and institutions from malicious activity necessarily involves a private, permissioned database. DR by non-vetted entities. To achieve the competing goals of transparency and • Staking and voting — allowing users to par- privacy, it is helpful to envision splitting the Akropolis ticipate in decision-making and crowd-sourced data model into two broad categories, namely private processes by providing tamper-proof voting and and public data. Information on the public database is arbitrarily complex escrow functionality. assumed to be public to the Internet and as such must be non-sensitive or sufficiently encrypted. The private Given these requirements, any blockchain used as the database is expected to be fully-encrypted and only acces- public database should possess the following qualities: sible by Akropolis. Accordingly, it may contain personally • Turing-complete smart contracts — future identifiable and sensitive information. functionality should not be bounded by the lack This section outlines the requirements of the public of general computing capacities. and private databases and the entities involved in their • Unbounded storage — the public database main processes. The overall role of the private database should not impose artificial storage limits that is also briefly discussed. could impede the future development of the plat- form. • Open-source cryptography — all cryptogra- 6.1. Public Database phy should be open source and community tested. The public database is assumed to involve a blockchain, • Existing tool-sets — the chain should have an such as Ethereum [9]. Implementation considerations will actively maintained ecosystem of third-party and determine whether the public database is truly public to vendor-issued tool-sets. Examples include: block the Internet, or resides within a permissioned network explorers, open-source development tools (testing

AKROPOLIS: A GLOBAL BLOCKCHAIN PENSIONS INFRASTRUCTURE 20 and deployment suites, static analysis, UI tooling, etc.) and analysis tools. The following sections provide additional details re- garding the above-mentioned process. T 6.1.2. Account-keeping In its simplest form, the public database can be viewed as an account-keeping mechanism that tracks the allo- cation of funds in the Akropolis platform. As seen in Figure 4, this (somewhat simplified) overview involves the following objects: Figure 5. ORM: White-listing AF • Account — a native account object on the un- derlying blockchain (e.g., an externally-owned account on Ethereum). It is expected that a user will control multiple accounts. • Wallet — a smart contract providing functional- ity necessary to delegate funds to FMs/PMs and manage tokenised assets. • Delegate — an object that manages funds del- egated from a user wallet (PMs and FMs would fall into this category). 6.1.3. Gate-keeping To maintain a security and compliance, funds repre- sented by AITs are only transferable to individuals and institutions that have been vetted/KYC’d by Akropolis. Authorisation will be automated by the use of white-lists maintained by Akropolis. Figure 5 illustrates the entities involved in these gate-keeping interactions. New entities appearing in the figure include: • Akropolis — an authorised individual (account) • Asset — a tokenised asset. or group of individuals (multi-signature account) that is directly under the control of the Akropolis Foundation. • AKR Registry — a smart contract maintaining a mapping of addresses (externally-owned and smart contract addresses) to their white-list state. In its simplest form, the white-list state would be DR boolean, though this may become more complex in future iterations. • AIT Contract — the smart contract that main- tains the source-of-truth for AIT balances. This contract will need to refer to the AKR Registry for each token transfer. 6.1.4. Staking As described in Section 3, reports issued by delegates can be issued with a stake as part of the IAP. Bad ac- tions can result in forfeiture of the stake. This process is illustrated in Figure 5, which introduces the following entities: • Report — information published by a delegate (with an optional stake) which contains clear and concise statements about verifiable truths. • Dispute — a challenge to one or more statements in a report. • Whistleblower — a generic term for any en- Figure 4. ORM: Overview tity that contests a report and therefore creates

AKROPOLIS: A GLOBAL BLOCKCHAIN PENSIONS INFRASTRUCTURE 21 a dispute. A whistleblower does not need to be a databases, though these capabilities will no doubt evolve white-listed account and may be anonymous. as the underlying blockchain technologies advance. 7. Enterprise Instances The present paper has presented the Akropolis system as a singular, public-facing platform. However, an en- terprise version of the platform, which can be deployed on various private, permissioned blockchains, will also T be released. The purpose of such a system is to provide large PFs with the option to incorporate the improve- ments offered by the Akropolis platform into their own private and protected corporate networks. Existing pen- sion industry infrastructure and processes are likely to impose realistic constraints on the capacity of industry participants to transition to new systems. The Akropolis enterprise solution aims to provide a bridge that allows existing industry participants to engage with the Akropo- AF Figure 6. ORM: Staking 6.2. Private Database The initial requirements of a centralised Akropolis Foundation do not mandate that the private database lis platform, and benefit from new service features, whilst retaining familiar levels of control over internal infrastruc- ture and processes. The enterprise solution will reduce friction between PFs and FMs by allowing both parties to benefit from the vetting practices, reputation systems and incentive structures that Akropolis provides, whilst ensuring no commercially-sensitive information leaves the organisation. Instances of the Akropolis enterprise solution will pro- vide direct functionality between FMs, PFs and asset tokenisers. Private instances will also connect to the Akropolis core system (with read-only functionality) to involves a blockchain; in the current technological land- utilise the reputation and vetting registrars of the core scape it may be more efficient to implement a “traditional” system. AKTs and AITs may be present in any given database (e.g., PostgreSQL [45]). enterprise system but their use is not mandatory and The private database must store the following: their functionality may be altered: (1) Links between pseudonymous account addresses • AIT — the fiat-to-AIT (and vice-versa) conver- and personally-identifiable information. sion provided by Akropolis will not be required for (2) Personally-identifiable information collected dur- investments between PFs and FMs in enterprise DR ing the use of Akropolis services. instances. Instead, the managing entity of the (3) Identity documents collected during onboarding instance would ensure the ledger is updated with process. regards to capital flows between organisational (4) Sensitive corporate information. units within, and external to, the given entities. It is not anticipated that the structure of the private Thus, Akropolis will not be required to act as a database will be novel. Accordingly, it is not necessary “middleman” for each transaction on enterprise to present additional information here. networks. • AKT — functionality will match that of the public instance (e.g., used for staking and fee pay- 6.3. Summary ment, if required). AKT can be “forwarded” to The Akropolis platform will employ both traditional an enterprise instance using a bridging mecha- and blockchain data bases to achieve the combination of nism [44]. privacy and transparency required of a portable, reliable Assets in an enterprise environment may be issued pension service provider. The ratio between public and internally, or they may be transferred from the global private computing and storage structures will vary ac- public Akropolis system (akin to AKT) to allow asset cording to the functional requirements of a given service trading inside the enterprise environment. Thus, it will be and the extent to which decentralised governance and ac- possible to directly trade asset tokens (such as gold [46] countability protocols can be implemented. Functionality or fiat currencies [47]) within the enterprise environment. offered by the Ethereum blockchain provides the initial The user interface supplied for enterprise instances template for what is achievable with public blockchain would be tailored to suit the needs of enterprise clients.

AKROPOLIS: A GLOBAL BLOCKCHAIN PENSIONS INFRASTRUCTURE 22 Features such as reporting, performance analysis, and in- • Public — information that should be publicly tegration to existing corporate authentication structures, available; e.g., non-personally-identifiable trans- will be included. actions and public announcements. The underlying blockchain for enterprise instances of Confidential information should never be released and Akropolis will initially derive their design/functionality must therefore be stored in a private database exclusively features from the Ethereum blockchain, to ensure com- accessible by the Akropolis Foundation (as discussed in patibility with the initial implementation of the public the Private Database section). Public information is nat- Akropolis platform. Due to the private nature of the enter- urally public, however, specific privacy limitations still prise solution, the corresponding chains will likely require apply (see the GDPR section for GDPR considerations). a permissioned node discovery protocol and an altered Personal information is private by default but can be T consensus mechanism to that of the standard Ethereum revealed to a subset of individuals/entities at will. This is ETHash Proof of Work algorithm. Quorum [48] is a addressed by a simplistic pseudonymous scheme described likely candidate. Such chains will enable processing of the in the following section. Ethereum smart contracts already developed for the core public Akropolis platform, whilst facilitating the private 8.1.1. Pseudonymous Transactions and permissioned needs of a corporate pension fund. To allow personal information to be private-until- Enterprise instances will allow Akropolis to engage disclosed, Akropolis intends to implement a pseudony- with existing pension industry participants whilst gener- mous account/address scheme. In this scheme, all trans- ating revenue streams to facilitate future developmental actions exist on the public Ethereum ledger, yet the link AF ambitions. With regard to Akropolis’ long-term objec- tives, the enterprise instances will provide a bridge that allows Akropolis to navigate existing constraints, imposed by legacy pension systems and processes, whilst building partnerships to aid the realisation of Akropolis’ larger goals. 8. Privacy Any public blockchain-enabled system must deal with between Ethereum account(s) and the individual who owns them (the user’s wallet) is known only to the private Akropolis Foundation, the user and whomever they wish to disclose this link to. The initial scheme works simply by linking a wallet to a private seed which is used to generate new Ethereum private keys in each transaction. The wallet therefore consists of an arbitrary number of underlying Ethereum addresses. Schemes in which user wallets are comprised of multiple underlying addresses exist naturally in unspent transac- tion output (UTXO) ledgers such as Bitcoin [8]. Often wallets in UTXO blockchains intentionally create new ad- the serious issue of privacy on a public ledger. The Akropo- dresses with each transaction to aide anonymity through lis platform boasts transparency and accountability for obscurity of addresses in underlying blockchain layer. This interactions between users, PMs, FMs, and tokenised as- technique is not without issues. Data analysis strategies sets. However, the platform must also satisfy stringent such as address clustering [49, 50] can be used to group requirements for user privacy. It is imperative that the addresses back to singular identities in some cases. This dichotomy between transparency and privacy is managed particular strategy is only applicable to UTXO-based effectively within this system. ledgers. However, it is anticipated that other forms of DR The present section outlines the privacy model of the analysis (such as timing analysis) may be performed to system, describes eminently-feasible methods of imple- partially reconstruct user’s wallets from the underlying menting such a model in the current technological land- Ethereum accounts. scape (along with limitations), and discusses ways in Due to the trust which must be placed upon the which emerging technologies may provide more interest- Akropolis Foundation to meet regulatory requirements ing/robust solutions in the long-term. (e.g., KYC and vetting), the platform is afforded some ex- tra functionality that can avoid such analysis techniques 8.1. User Privacy and would otherwise be difficult to obtain in a fully trust- less environment like Bitcoin. Specifically: Information generated while using the Akropolis plat- Private entry and exit from AIT — issuance and form can be categorized into three broad categories: redemption of AIT is handled by Akropolis, who maintain • Confidential — information that should never a private mapping of accounts to user identities. This be publicly released, such as passports, identifi- means that no third-party exchanges are involved, localis- cation documents, passwords, and commercially- ing the trust requirements to Akropolis. sensitive information. Obscured inter-account transactions — consider • Personal — personally-identifiable information the case where a user, U , has revealed their primary ac- which may only be released to a third-party with count address, aU 1 , to a third party, T . If U decides they the permission of the user/organisation. For ex- do not wish to disclose further transactions to T , U could ample, account balances, personally-identifiable transfer their funds into an another account aU 2 . Unfor- transactions and contact information. tunately, this transfer would be visible to T who could

AKROPOLIS: A GLOBAL BLOCKCHAIN PENSIONS INFRASTRUCTURE 23 then link aU2 to U . To remove this public link between • Off-chain information — information stored by the two accounts, Akropolis can offer a “private transfer” Akropolis will be centrally managed, therefore tra- from one wallet to another, obfuscating not only the “to” ditional credential management solutions apply, address, but also the time and amount of transfer. This such as password authentication with multiple would allow U to transfer the funds via Akropolis, leaving factors (2FA) and password recovery through a no trace for T and trusting no other party than Akropo- proof-of-identity submission to Akropolis. lis. This is not dissimilar to a standard cryptocurrency • On-chain information — ownership of an ac- tumbler. count on a blockchain is generally 13 indicated by the possession of the private key corresponding to that address. Therefore maintaining knowledge of T that private key is critical to maintaining access 8.1.2. GDPR to that account. The following section details this The General Data Protection Regulation (GDPR) further. act [51] becomes active in May 2018 and Akropolis will undoubtedly need to adhere to its requirements. As such, 8.2.1. Cryptographic Key Management Akropolis is designed GDPR-native, avoiding the costs of dedicating resources and budget towards migrating legacy To reduce the burden on users of managing multiple systems [52]. private keys, Akropolis envisages the use of a system that Akropolis satisfies GDPR Article 25 [51], “data protec- derives keys from a seed recoverable from a mnemonic AF tion by design and default”, by ensuring that the highest level of privacy is enabled out-of-the-box and that encryp- tion and decryption are handled locally (following the European Union Agency for Network and Information Se- curity’s specification [53]). On-chain data is minimised to reduce user risk and overhead. Also mentioned in Article 25 and Recital 28 [51], on-chain data is made pseudony- mous to reduce risks to and protect the rights of users. Data portability (Article 20 [51]) is enabled through the use of blockchain — transactions on-chain are open to the public and may be translated and ported to another system without any action required of Akropolis. phrase [57]. Such phrases are commonly used in hard- ware [58, 59] and software [60, 61] wallets. Using such a system allows a user to, in effect, derive a limitless number of keys from a single phrase, without the risk that an opponent can feasibly imply a link between any of the addresses. A reasonable scenario exists in which a user completely loses access to their private keys, therefore losing the ability to transact their AIT and make other on-chain transactions. Such a scenario would be dire, especially if it resulted in the loss of a users entire pension savings. Fortunately, there are methods to mitigate the conse- A significant point of contention around GDPR require- quences of a user losing their private keys, as discussed ments is Article 17 [51], the “right to erasure” (“right to be in the Key/Asset Recovery section. forgotten”). The contention arises in that the erasure of a single record from a blockchain ledger will necessarily de- stroy the integrity of the ledger — data can be “removed” 8.3. Future Privacy Solutions from the current Ethereum state trie, however, a record The design proposed to obscure identities from the of its presence remains preserved within the blockchain’s underlying public blockchain transactions was opted-for DR history. Furthermore, irrespective of the integrity of the in the initial implementation due to its simplicity. It is ledger, once data has been published to a public network envisaged that this approach will serve as an interme- (such as the Ethereum network), seeking a guarantee of diary privacy measure whilst more-advanced techniques, erasure from an anonymous, decentralised network of com- capable of provably maintaining privacy at the blockchain puters is infeasible, if not impossible. Other projects in level, are developed and tested. the blockchain space are working actively on this prob- Recent homomorphic encryption techniques appear lem [54, 55] and Akropolis will continue to adapt and to be good candidates for ensuring user’s transactional iterate as the GDPR implications for blockchain become privacy at the blockchain level. Grin [16], which is in apparent. Regardless, Akropolis does not publish per- active development, leverages the homomorphic prop- sonal information to the blockchain — all transactions erty of elliptic curve keys under addition to verify fully published are done so directly by the user, at their discre- encrypted transactions in UTXO systems. This system al- tion. lows complete secrecy of the underlying values being trans- ferred. Similarly, zk-S(N/T)ARKS are being developed for Ethereum, in particular the Ethereum-focused frame- 8.2. Credential Management work ZoKrates [62] aims to simplify the creation of zero- Given that there are two separate data storage and knowledge systems for use on the Ethereum blockchain. processing mechanisms used in Akropolis (see the Data Methodologies such as these, once proven, could be used Model section), there are two distinct scenarios in which to provably mask user transaction data and replace the a user may manage their credentials: simplistic scheme currently proposed. 13This is exactly the case for Ethereum [9], Quorum [48] and Lisk [56].

AKROPOLIS: A GLOBAL BLOCKCHAIN PENSIONS INFRASTRUCTURE 24 Before concluding this section, some comments are dependence on underlying blockchains for data storage). offered regarding the fact that homomorphic encryption The transition to a fully-decentralised pension system is schemes are useful for anonymously providing aggregate dependent on the capacity of privacy-preserving technolo- data. When users opt-in to monetise their data (see the gies to facilitate such a system whilst maintaining user Akropolis Platform Data section), it is plausible that privacy. aggregated private information may be of value. Homo- morphic encryption is one means of providing aggregated data privately. For example, an external entity may wish 10. Conclusion to know how many properties in China are owned (in part or fully) by non-Chinese investors/participants. The par- The dire state of the global pension industry looms T ticipants could individually encrypt their totals and send large as a major economic issue for the coming years. A the information to the external agent, who performs addi- global discrepancy between pension assets held and ex- tion on the individual encrypted values. Once finished, a isting liabilities presents a significant economic challenge decryption key held (potentially in part) by the Akropolis both for individuals and the wider global economy. Trends Foundation could decrypt the final value, thereby ensur- such as increased life expectancies, decreased voluntary ing that only information about the aggregate value is contributions, and reduced ratios of workers to retirees all received by the external entity, whilst individual users’ exacerbate the stresses on the pension industry. The sys- data remains private. temic issues plaguing the pension sector are intricate and the complexity of addressing these challenges should not AF 9. Future Directions The previous sections described multiple current and fu- ture technologies that may be integrated into the Akropo- lis platform. The present section adds some additional points and highlights some important features that new technologies will bring to the Akropolis platform. The Akropolis platform utilises AITs, which abstractly represent an independent stable coin. In the initial im- plementation, this will likely be an Akropolis equivalent be understated. Yet action must be taken if the economy is to avoid a pension-induced global financial crisis. Any solution to the pension crisis must support the current pension ecosystem, to protect upcoming retirees, whilst also meeting the needs of an aging population and facilitating a global inter-generational transition to a new, economically sustainable system. This presents a complex, interrelated set of demands and constraints for any candi- date pension framework. A new pension protocol must also recognize that workplaces and legislative agendas are changing. The workforce is being increasingly atomized of Tether [47]. However, in the future, Akropolis may and the tendency towards freelancing and a sharing/gig incorporate an independent, proven, algorithmic stable economy has eroded traditional mechanisms for building coin,14 such as MakerDAO’s Dai [63], or develop its own pension savings. Furthermore, to re-assign responsibility version of an algorithmic stable coin if present coins are for the forthcoming challenges, states are increasingly deemed unsuitable. Adopting an independent stable coin liberalising pensions and shifting the burden of funding would alleviate the need for tokenising multiple distinct retirement onto the individual. Thus, the modern worker fiat currencies. requires a pension system capable of functioning alongside As discussed in the Governance section, Akropolis aims the atomization imposed on workers by both the modern DR to gradually decentralise its core components, to the ex- state and workplace. tent that regulatory and practical considerations permit. The pension industry also suffers from systemic issues It is envisaged that a DAO-like governing entity will (in- relating to poor visibility around fund management, un- part or fully) eventually replace the role of the Akropolis necessarily complicated (or hidden) fee structures, porta- Foundation. Based on existing research, it appears feasi- bility limitations, and compliance regulations which, at ble that the initial steps towards decentralisation could times, are enforced using outdated methodologies. Fur- utilise DAO-governed Token Curated Lists to partially thermore, misaligned incentive structures between pension decentralise the onboarding process of FMs. The over- investors, the funds to which they contribute, and the all decentralised picture is heavily dependent on future fund managers overseeing the underlying assets, further progress in decentralised governance models and will ul- strain existing pension systems and erode the benefits timately be subject to the needs and requirements of returned to pensioners. platform users. The Akropolis platform aims to unify a number of Finally, as discussed in the Privacy section, Akropolis recent technological advancements to develop and imple- aims to improve the blockchain layer’s privacy by in- ment a long-term sustainable solution to the numerous corporating future advancements in privacy-preserving challenges plaguing the pension industry. Akropolis seeks methodologies. Privacy functionality and features will be- to facilitate the transition from existing pension structures come increasingly important as the system transitions to to an atomized, individualised pension protocol capable a more decentralised state (which necessarily increases the of satisfying the needs of modern workers. The Akropolis 14A coin that is not 1-to-1 backed with a collateralised asset, but instead either algorithmically bound to a collateralised volatile token or has some algorithmic adjustable supply.

AKROPOLIS: A GLOBAL BLOCKCHAIN PENSIONS INFRASTRUCTURE 25 platform will deliver a portable pension infrastructure and new ways for Pension Funds and Fund Managers to capable of supporting the modern worker along their in- engage with clients. New classes of services are possible, dividual (global) journey in an environment beholden to ranging from the monetisation of user’s data (should they changing legislative demands and workplace conditions. opt-in), to the direct marketing and delivery of relevant, Fundamentally, the platform aims to leverage the trans- related pension products, through to the delivery of de- parency, automaticity, and auditability of decentralized centralised pension platforms with in-built accountability, ledgers to provide new tools that balance the competing transparency and governance protocols. demands of workers, Pension Funds, and Fund Managers, The utilisation of blockchain technologies is not a cure- whilst delivering the flexibility, accountability, and regula- all for the pension industry, yet it is clear that these de- tory compliance required of a pension service. Akropolis veloping technologies offer new solutions to the challenges T is a global platform and will connect everyday users with faced by the sector. Akropolis is partnering with leading a range of experienced pension funds, products and ser- experts in the pension industry and leading blockchain vices. Importantly, the Akropolis platform incorporates projects to tackle the global pension crisis as a community. game-theoretic incentive structures to mitigate against The goal of the Akropolis project is to develop a transpar- excessive fees (traditionally borne by users in the pen- ent, accountable and portable pension infrastructure that sion industry) while simultaneously fostering new levels can deliver pension services that meet the needs of the of transparency. modern workforce. Overcoming the challenges in existing Akropolis will act as a single source of pension truth for pension structures is a non-trivial task. Yet Akropolis the individual, collating their existing pension products, believes that leveraging new decentralised technologies, together with new pension products, collectively under a single account tied to the individual’s identity. The tokenisation of pension assets and products will enable new ways for individuals to engage with their holdings • AKR: Akropolis. AF to empower the community to come together and tackle the pension problem, offers the best hope for both rectify- ing existing systemic failures and building a sustainable future. Appendix A. Glossary and Acronyms • AKropolis external Token (AKT): A fixed-supply token whose value is subject to market forces. AKTs can be used for onboarding and platform access, to purchase services on the platform and in some staking processes. • Akropolis Internal Token (AIT): A stable token used within the Akropolis platform. Users (individual or institutional) obtain AITs when they transfer funds to the system. The AITs may be used to purchase pension products, access services or for staking purposes. A stable token is required to serve as an internal bookkeeping device and to remove volatility risks associated with staking mechanisms (which would otherwise undermine the staking process). • Akropolis Council: An elected body of curators that oversees the functionality of decentralised components DR of the Akropolis platform. The Council has some authority to work with and alongside the DAO. • Akropolis Foundation: Centralised body that oversees the operation and functioning of the Akropolis platform. The incorporation of decentralised elements within the platform will see the Foundation replaced by a DAO (in-part or fully, subject to regulatory constraints and functional objectives). • Asset Tokenisers: Entities that hold assets, either directly or through verifiable third parties, whilst minting and distributing tokens which represent a share of the held asset. Asset tokenisers are centralized entities that provide a source of truth to the blockchain layer (through the minting of tokens) and as such are key actors in the trust model of Akropolis. • Asset Tokenisation: Process of creating digital representation of assets, suitable for representing assets on a blockchain. • DAO: Decentralised Autonomous Organisation. • Developers: Community members who contribute to the Akropolis platform, building extended/advanced services for pension users. • EVM: Ethereum Virtual Machine. • Fund Managers (FMs): Institutional entities that purchase or acquire assets on behalf of users and/or PFs. They must undergo stringent vetting processes to obtain access to the Akropolis platform and must regularly report on the assets under their management. • FUM: Funds Under Management. • GDP: Gross Domestic Product. • GDPR: General Data Protection Regulation.

AKROPOLIS: A GLOBAL BLOCKCHAIN PENSIONS INFRASTRUCTURE 26 • Incentivised Accountability Protocol (IAP): A protocol for incentivising good behaviour (e.g., transparency and accountability) by actors on the Akropolis platform. An IAP typically requires that entities releasing information to the platform also stake AITs as part of the information-releasing process. The staked tokens serve as a bounty to incentivise agents external to the staking entity to verify the validity of the information. Staking entities that release valid information are rewarded with reputation points. • Individual User (or user): A singular, non-institutional individual who uses the Akropolis platform to manage their pension savings. When discussing elements on the blockchain, a user refers to a singular identity which is mapped to a collection of public keys via a generating seed. • KYC: Know Your Client. • ORM: Object-Relational Mapping. T • Pension Funds (PFs): Institutional entities that may (or may not) currently exist in the pension industry. These institutional funds act similarly to individual users on the Akropolis platform but control the pension products of multiple/many individuals. • PoS: Proof of Stake (consensus mechanism). • PoW: Proof of Work (consensus mechanism). • UTXO: Unspent Transaction Output. Appendix B. User Journey and Basic Options AF Aspects of the user journey and basic options/functions are described below. (1) Registration — Users sign up with an email and password. This initial interaction with the Akropolis platform incorporates a concise explanation of basic system features. Users are not initially burdened with blockchain specific actions like an account (keys) generation or transaction signing. Registration does not require but instead allows users to explore the application and gradually build up the trust needed to submit to a full screening process. (2) Verification — Users may upgrade their basic (initial) account to unlock investment options by uploading appropriate identification documents and certificates. The three categories of accounts are thus: • Basic Level — The default level, showcases the application/platform before a user is ready to create a full investment level account. • Investment Compliant — Available after identification documents are supplied. • Pension Fund Compliant — Relevant for institutional participants. (3) Feed data from legacy pension funds — Users may import data from legacy pension fund providers, thereby collating all their pension/savings information in a single place. Functionality will be similar to Pensions Dashboard [64]. (4) Saving Account Creation — Users may create a new pot or transfer an existing savings account from a different pension fund. New savings pots may be assigned as pensions savings (which imposes certain regulatory DR demands, such as time-locking requirements, and avails privileges such as tax relief) or as unrestricted savings (which act as a standard investment account). (5) Saving Pot Configuration — There will be three different modes of savings management: • Self-managed — The user is responsible for asset selection and trading. There are no management and performance fees. Recommended for advanced users with investment experience. • Advised — The user has control over, and responsibility for, their investments but receives personalised suggestions/advice regarding their current savings, risk level and investment horizons. Acting on the advice is straight forward, requiring users to click on an agree/decline button to trigger automatic execution (in some cases). Advisors may be ranked according to their past performance (as stored on-chain) and can charge fees for their service. • Pension Fund Operated — The user delegates investment responsibilities to an institutional pension fund. The fund is responsible for all investment decisions and may collect a fee based on performance or volume under custody. (6) Defining Contribution — Users may define an initial contribution and/or commit to periodic contributions to be debited from their account. Options for assigning employer contributions will also be available. (7) Assets trading — Users with self-managed portfolios are responsible for managing trades, otherwise trading activities are outsourced to a pension fund. A user may submit a buy/sell bid stating the desired price and wait for a counterparty to settle the deal. (8) Investment monitoring — Users can monitor the value of savings pot and obtain information about investment performance and fess incurred. Options for executing portfolio stress-testing will be available.

AKROPOLIS: A GLOBAL BLOCKCHAIN PENSIONS INFRASTRUCTURE 27 (9) Third-party add-ons — Pension funds and users may add tools and services provided by third party developers and software studios. Application producers may need to obtain a licence by staking AKTs. All applicants will undergo a verification/vetting process before being available to users. Developers may collect fees for application usage. (10) Benefits Payments — Users can individualise their benefit payment structures, subject to regulatory requirements. Appendix C. Technical Architecture T C.1. Overview To serve the long-term needs of the pension market, the Akropolis platform must adopt a number of key design principles to ensure it is resilient, fault tolerant, flexible, and relevant in an evolving technological landscape. Inevitably this will involve new blockchain architectures, oracles and third-party components that emerge and replace obsolete technologies. Furthermore, it is critical to create a platform architecture that can adapt and respond to new quantum resistant cryptographic security requirements, as appropriate. Given the immutable nature of smart contracts, these issues have to be carefully considered. AF C.2. Akropolis High Level Architecture Components The high-level architectural components of the Akropolis platform are shown in Figure 7. Web and mobile applications DR Figure 7. Backend Architecture will be produced, both relying on the REST API exposed by Akropolis backend microservices along with the requisite wallet and private key support. These applications will be secured with multiple layers of authentication. Design for UI/UX and specific architecture choices for the applications will derive from the business case and users’ needs.

AKROPOLIS: A GLOBAL BLOCKCHAIN PENSIONS INFRASTRUCTURE 28 C.3. Core Architectural Components C.3.1. Blockchain and Smart Contracts Institutional users may prefer to engage with a private blockchain solution for a variety of reasons, whilst the public chain will function in a more decentralised manner. The Akropolis platform will be protocol agnostic. As such, Akropolis will represent a network of public and private blockchains, with Ethereum being the primary protocol initially, followed by other blockchains as the platform evolves. The ratio of centralised to decentralised capabilities is anticipated to evolve with time, reflecting both general changes in inter-generational saving patterns and the pursuit of transparency and accountability gains that may be achieved by replacing a pension fund activity with smart contracts. Subject to marketplace capabilities and transaction T costs, Akropolis may seek to develop its own blockchain. This could provide cost advantages and enable more tightly integrated smart contract and protocol capabilities. Ultimately the platform will engage with multiple blockchains and as the number of blockchain protocols increases, the platform will need to flexibly manage a diverse range of smart contracts and their blockchain interactions. The platform’s core smart contract components act as the mediator of logic and validates the implementation of allocation actions. The initial version smart contract will be written in Solidity, a Turing-complete language that possesses sufficient flexibility to implement the required logic. Akropolis may also use other blockchains such as Adjoint.io’s uplink which contains a non-Turing-complete financial scripting language for some security sensitive transactions. To evolve smart contracts and meet future requirements, a “Factory model” will be used in which AF administrative contracts manage the introduction of new smart contract capabilities. C.3.2. Oracle Services Blockchain smart contracts cannot directly retrieve external data, necessitating intermediary services referred to as Oracles. Third party oracle services are agents that typically work by finding and verifying the required external data and then submitting or pushing this information into a target smart contract on the blockchain. An example of desired external data is financial asset price feed information. Oracle services will be required to provide users with up-to-date information regarding fund performance and asset pricing. Asset tokenisation provides new ways for asset holders to interact with oracle services and access blockchain-external data. C.4. Architecture Principles and Design Considerations C.4.1. Resilience, Scalability and Performance Blockchain networks are typically highly fault tolerant and resilient. However, they don’t scale well when time sensitive transactions are involved, given the inherent nature of consensus algorithms and numerous resource constraints of each participant. Consequently, for Akropolis capabilities that require scalable, time sensitive transactions or data feeds, such as asset pricing, a combination of high-speed exchange gateways and data oracles will be adopted. In the case of private or permissioned blockchains, this is addressed through a combination of CDN delivered shared assets DR and highly elastic and fault tolerant infrastructures for selected participants or clusters thereof, as shown in Figure 8. For key parts of the above core infrastructure, where the solution has to scale across dispersed geographies, an auto-scaling topology will be implemented allowing for transaction execution and data storage to dynamically respond to, and recover from, performance bottlenecks and faults. Containerised, stateless and non-snowflake design patterns are crucial to achieve resilience, scalability and performance objectives (for example, in the integration and gateway bridging services context). This is demonstrated in the above figure, with a Kubernetes orchestrated container application workload for a private-chain deployment. C.4.2. Security, APIs and Micro-services Secure, scalable and efficient microservices are an important part of the Akropolis service-oriented backbone. These microservices are critical to ensure that the end-to-end platform can operate seamlessly both within its own network and between networks and other third parties. This microservices architecture pattern is shown in Figure 9. The backend microservices plays the role of primary coordinator of business logic on the Akropolis platform andserves the following functions: • Implement identification and authorization, working in conjunction with the smart contracts. • Handle usage flows and logic for the Assets. • Receive the events raised by blockchains from the monitoring micro-service. There will be a RESTful web service for handling requests to the backend micro-service application layer. Where applicable, to satisfy various KYC and AML requirements, the management of digital identities, associated validation and access management will be performed using highly secure, end-to-end encryption mechanisms and

AKROPOLIS: A GLOBAL BLOCKCHAIN PENSIONS INFRASTRUCTURE 29 T AF Figure 8. Private Deployment Scenario multi-factor authentication methods. As existing cryptographic security algorithms gradually become obsolete (e.g., RSA and AES) and emerging quantum resistant ones mature (e.g., Ring-LWE and Merkle Hash Trees) Akropolis will adapt in turn. C.4.3. Data Platform DR Fundamental to the Akropolis data platform is the requirement to retain a wide variety of data such as asset information, fund data, oracle-provided information, blockchain and user events occurring throughout the platform, as well as broader platform related analytical data. The implementation must address various information and reporting needs as well as provide the ability to detect anomalies and help prevent malicious usage within the Akropolis platform. Given the variety of data that must be collected and managed with different data processing requirements, a hybrid data architecture stack will be adopted and collectively referred to as the “Akropolis Data Platform.” This data architecture will span blockchain storage, a highly available big data platform and other distributed storage technologies accessed through a supporting microservices layer. The high-level data architecture pattern is illustrated in Figure 10. C.4.4. Third Party Products, Platforms and Integrations To provide the highest possible levels of transparency, the platform will: • Publish approved exchange APIs to guard against the malfunction or hijacking of the Akropolis APIs themselves. • Publish summary statistics of activity on the platform, such as asset level operation matrices. • Employ access tokens to pay fees to operate PoA contracts and keep them alive. These can only be generated by locking AKT into the access token contract.

AKROPOLIS: A GLOBAL BLOCKCHAIN PENSIONS INFRASTRUCTURE 30 T AF Figure 9. Micro-services DR Figure 10. Architecture

AKROPOLIS: A GLOBAL BLOCKCHAIN PENSIONS INFRASTRUCTURE 31 References [1] Alex Zhavoronkov. Longevity expectations in the pension fund, insurance, and employee benefits industries. Psychology Research and Behavior Management, page 27, January 2015. DOI:10.2147/prbm.s75440. [2] Global Pension Statistics - OECD, 2017, Available: http://www.oecd.org/finance/private-pensions/globalpensionstatistics.htm. Accessed on March 2018. [3] Laurence J. Kotlikoff and Scott Burns. The Coming Generational Storm: What You Need to Know about America’s Economic Future. The MIT Press, 2004. ISBN:0262112868. [4] We’ll Live to 100 - How Can We Afford It? Technical report, World Economic Forum, May 2017. Available: http://www3.weforum.org/ docs/WEF_White_Paper_We_Will_Live_to_100.pdf. [5] Mark O’Byrne. Pensions and Debt Time Bomb In UK: £1 Trillion Crisis Looms. September 2017, Available: http://www.marketoracle. T co.uk/Article60291.html. [6] Attracta Mooney. US faces crisis as pension funding hole hits $3.85tn. Financial Times, May 2017. Available: https://www.ft.com/ content/f2891b34-3705-11e7-99bd-13beb0903fa3. [7] Richard Dyson. The £1 trillion pension crisis facing 11m (and they’re the lucky ones. The Telegraph, 2016. Available: https://www. telegraph.co.uk/pensions-retirement/news/the-1-trillion-pension-crisis-facing-11m-and-theyre-the-lucky-on/. [8] Satoshi Nakamoto. Bitcoin: A Peer-to-Peer Electronic Cash System. 2008. Available: https://bitcoin.org/bitcoin.pdf. [9] Gavin Wood. Ethereum: A secure decentralised generalised transaction ledger. Ethereum Project Yellow Paper, 2014. Available: http: //gavwood.com/paper.pdf. [10] Raiden. The Raiden Network. Website, Available: https://raiden.network/101.html. Accessed March 12, 2018. [11] Joseph Poon Vitalik Buterin. Plasma: Scalable Autonomous Smart Contracts. August 2017, Available: https://plasma.io/plasma.pdf. [12] Ethereum. Github: Sharding FAQ. Website, Available: https://github.com/ethereum/wiki/wiki/Sharding-FAQ. Accessed March 12, 2018. AF [13] Vitalik Buterin and Virgil Griffith. Casper the friendly finality gadget. Preprint:1710.09437v2. [14] Ameer Rosic. What is Ethereum Casper Protocol? Crash Course. blockgeeks, 2017, Available: https://blockgeeks.com/guides/ ethereum-casper/. [15] Guy Zyskind, Oz Nathan, and Alex Pentland. Enigma: Decentralized computation platform with guaranteed privacy. Preprint:1506.03471v1. [16] Introduction to MimbleWimble and Grin. Website, Available: https://github.com/mimblewimble/grin/blob/master/doc/intro.md. Accessed March 12, 2018. [17] Manuel Blum, Paul Feldman, and Silvio Micali. Non-interactive zero-knowledge and its applications. In Proceedings of the twentieth annual ACM symposium on Theory of computing. ACM Press, 1988. DOI:10.1145/62212.62222. [18] Eli Ben-Sasson Alessandro Chiesa Christina Garman Mathew Green Ian Miers Eran Tromer Madars Vizra. Zerocash: De- centralized anonymous payments from bitcoin (extended version). May 2014, Available: http://zerocash-project.org/media/pdf/ zerocash-extended-20140518.pdf. [19] Eli Ben-Sasson, Iddo Bentov, Yinon Horesh, and Michael Riabzev. Scalable, transparent, and post-quantum secure computational integrity. Cryptology ePrint Archive, Report 2018/046, 2018. https://eprint.iacr.org/2018/046. [20] Gavin Wood. Polkadot: Vision for a heterogeneous multi-chain framework. 2017, Available: https://github.com/polkadot-io/ polkadotpaper/raw/master/PolkaDotPaper.pdf. [21] Mathew Spoke Nuco Engineering Team. Aion: The third-generation blockchain network. July 2017, Available: https://aion.network/ downloads/aion.network_technical-introduction_en.pdf. [22] Jae Kwon Ethan Buchman. Cosmos: A network of distributed ledgers. 2017, Available: https://github.com/cosmos/cosmos/blob/ master/WHITEPAPER.md. [23] Eos.io : Technical white paper v2. Github, Available: https://github.com/EOSIO/Documentation/blob/master/TechnicalWhitePaper. md. (visited on March 2018). DR [24] Cardano settlement layer documentation. Website, Available: https://cardanodocs.com/introduction/. (visted March 2018). [25] Sergio Lerner. Rsk, November 2015, Available: https://uploads.strikinglycdn.com/files/ec5278f8-218c-407a-af3c-ab71a910246d/RSK% 20White%20Paper%20-%20Overview.pdf. [26] Nick Szabo. Micropayments and Mental Transaction Costs. 2001. Accessed March 27, 2018, Available: https://www.researchgate.net/ publication/2401801_Micropayments_and_Mental_Transaction_Costs. [27] Christian Lundkvist Rouven Heck Joel Torstensson Zac Mitton Michael Sena. Uport: A platform for self-sovereign identity. UPort, 2017, Available: https://whitepaper.uport.me/uPort_whitepaper_DRAFT20170221.pdf. [28] Adi Shamir. How to share a secret. Communications of the ACM, 22(11):612–613, November 1979. Available: https://dl.acm.org/ citation.cfm?id=359176. [29] Tenzorum: Key Management Protocols for the Decentralized Web. Website, Available: https://tenzorum.org/. Accessed March 12, 2018. [30] Akropolis Sigma Prime. An incentivised accountability protocol for decentralised marketplaces. In preparation, 2018. [31] Jack Peterson Joseph Krug Micah Zoltu Austin Williams Stephanie Alexander. Augur: A decentralized oracle and prediction market platform. February 2018, Available: http://augur.link/augur.pdf. [32] Arpad E. Elo. Logistic Probability as a Rating Basis, in The Rating of Chessplayers, Past & Present. Bronx NY 10453: ISHI Press International, 2008. ISBN:978-0-923891-27-5. [33] Peter Vessenes. The DAO Is Almost Totally Apathetic: It Should Stay That Way. Website, May 2016, Available: http://vessenes.com/ the-dao-is-almost-totally-apathetic-it-should-stay-that-way/. Accessed March 16, 2018. [34] DAOstack. Decentralized Governance Matters. Website, February 2018. Accessed March 16, 2018. [35] World Economic Forum. Realizing the Potential of Blockchain, June 2017, Available: http://www3.weforum.org/docs/WEF_Realizing_ Potential_Blockchain.pdf. Accessed March 16, 2018. [36] Henry M. Kim, Marek Laskowski, and Ning Nan. A first step in the co-evolution of blockchain and ontologies: Towards engineering an ontology of governance at the blockchain protocol level. Preprint:1801.02027v1. [37] Nic Carter. A Cross-Sectional Overview of Cryptoasset Governance and Implications for Investors. Master’s thesis, University of Edinburgh Business School, 2017. Available: https://coinmetrics.io/papers/dissertation.pdf.

AKROPOLIS: A GLOBAL BLOCKCHAIN PENSIONS INFRASTRUCTURE 32 [38] DAOstack. The Operating System for DAOs, October 2017. Accessed March 16, 2018. [39] Mike Goldin. Token-curated registries 1.0, September 2017, Available: https://docs.google.com/document/d/1BWWC__-Kmso9b7yCI_ R7ysoGFIT9D_sfjH3axQsmB6E/edit. Accessed March 16, 2018. [40] James Young Mike Goldin, Ameen Soleimani. The adchain registry, May 2017, Available: https://adtoken.com/uploads/white-paper.pdf. Accessed March 16, 2017. [41] Alexander Khoriaty Matus Lestan, Joe Urgo. district0x network - a cooperative of decentralized marketplaces and communities., September 2017, Available: https://district0x.io/docs/district0x-whitepaper.pdf. Accessed March 16, 2018. [42] O. Goldreich. Foundations of Cryptography: Volume 1, Basic Tools. Cambridge University Press, 2007. ISBN:9781139430234. [43] Karl Floersch. Learning solidity part 2: Commit-reveal voting, 2017, Available: https://karl.tech/learning-solidity-part-2-voting/. [44] Parity Technologies. parity-bridge source code repository, Available: https://github.com/paritytech/parity-bridge. Accessed March 16, 2018. T [45] PostgreSQL. Website, Available: https://www.postgresql.org/. Accessed March 20, 2018. [46] Anthony C. Eufemio Kai C. Chng Shaun Djie. Digix’s whitepaper: The gold standard in crypto-assets. 2016. Available: https: //dgx.io/whitepaper.pdf. [47] Tether.to. Tether: Fiat currencies on the bitcoin blockchain. 2014. Available: http://www.the-blockchain.com/docs/Tether% 20Whitepaper.pdf. [48] JP Morgan Chase. Quorum whitepaper v0.1, 2016, Available: https://github.com/jpmorganchase/quorum-docs/blob/master/Quorum% 20Whitepaper%20v0.1.pdf. Accessed March 15, 2018. [49] Sean Foley, Jonathan R. Karlsen, and Talis J. PutniÅĘs. Sex, drugs, and bitcoin: How much illegal activity is financed through cryptocurrencies? January 2018, Available: https://ssrn.com/abstract=3102645. [50] Fergal Reid and Martin Harrigan. An analysis of anonymity in the bitcoin system. Preprint:1107.4524v2. [51] THE EUROPEAN PARLIAMENT and THE COUNCIL OF THE EUROPEAN UNION. Regulation (eu) 2016/679 of the european parliament and of the council of 27 april 2016 on the protection of natural persons with regard to the processing of personal data AF and on the free movement of such data, and repealing directive 95/46/ec (general data protection regulation), 2016, Available: http: //eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679. [52] Chris Babel. The high costs of gdpr compliance, November 2017, Available: https://www.darkreading.com/endpoint/ the-high-costs-of-gdpr-compliance/a/d-id/1329263? Accessed March 15, 2018. [53] The European Union Agency for Network and Information Security (ENISA). Privacy and data protection by design, January 2015, Available: https://www.enisa.europa.eu/publications/privacy-and-data-protection-by-design. Accessed March 15, 2018. [54] Pillar Project A.G. Simplify GDPR Compliance. Website, Available: https://pillarproject.io/gdpr/. Accessed March 12, 2018. [55] BCDiploma. Whitepaper v2.1, January 2018, Available: https://www.bcdiploma.com/img/BCD-WhitePaper_last.pdf. Accessed March 15, 2018. [56] Lisk. The lisk protocol - security, Available: https://lisk.io/documentation/the-lisk-protocol/security. Accessed March 15, 2018. [57] Aaron Voisine Sean Bowe Marek Palatinus, Pavol Rusnak. Mnemonic code for generating deterministic keys, March 2013, Available: https: //github.com/bitcoin/bips/blob/master/bip-0039.mediawiki. Accessed March 18, 2018. [58] Satoshi Labs. Trezor developers guide - cryptography, Available: https://doc.satoshilabs.com/trezor-tech/cryptography.html. Accessed March 15, 2018. [59] Ledger. On which wallet can I restore my wallet if I lose my Ledger device?, Available: https://support.ledgerwallet.com/hc/en-us/ articles/115005297709-On-which-wallet-can-I-restore-my-wallet-if-I-lose-my-Ledger-device-. Accessed March 15, 2018. [60] Parity. Backing up and restoring, Available: https://wiki.parity.io/Backing-up-&-Restoring.html. Accessed March 14, 2018. [61] Mycrypto, Available: https://mycrypto.com. Accessed March 15, 2018. [62] Jacob Eberhardt. ZoKrates: A toolbox for zkSNARKS on Ethereum. Github, Available: https://github.com/JacobEberhardt. Accessed March 20, 2018. [63] Maker: Reference Implementation of the decentralized DAI Stablecoin issuance system. Website, Available: https://makerdao.com/ purple/. Accessed on March 20, 2018. DR [64] Pensions Dashboard. Prototype project, Available: https://pensionsdashboardproject.uk/. Accessed March 18, 2018.