Compliance protocol clarifications - how is it enforced?

[roosmaa]

The compliance documentation leaves quite a few holes into how the actual protocol is expected to be uses in real world and/or enforced.

1. The documentation starts out that as a FI I want to know where the money is coming from. But the implementation kind of only provides a way to enforce getting information about where the money is going to. For example there is nothing stopping me to skip the auth part. After I've resolved the payment address to account id I could just send the payment and the receiver would be none the wiser regarding who actually sent it.

2. Is all wallet software expected to implement the compliance check to some extent?

3. When the sender requires proper compliance implementation, how is it handled when the user tries to send something directly to an account id. Will the home domain of the account be used for the compliance check?

4. Would being compliant also mean that depositing/withdrawing money from/to a non-managed account should be disabled by the wallet provided by the financial instutite? Otherwise all of this compliance layer becomes kind of uselesss. User A withdraws to non-managed account; sends to user B's non-managed account; User B deposits to their managed FI account.

[jedmccaleb]

The compliance protocol is intended to be used between FIs.
The way most FIs are doing their integration, they won't accept the payment unless the compliance protocol is used.

2. not normally. But you could potentially build a wallet that does this if you want to be able to payout to some of these FIs

3. most FIs don't have individual account IDs for their users.

[roosmaa]

I guess this also has the implication that the FIs tightly control people/entities that are allowed to use non-managed accounts on Stellar network to setup trade offers on the distributed exchange, etc. Since it's impossible for the average user to transfer money out to a random account.

[theaeolianmachine]

Closing this out, as there isn't anything sufficient to document.