# BlockWill - Digital Inheritance & Estate Planning Platform > Your life's work deserves protection. BlockWill is a comprehensive digital inheritance and estate planning platform. We help you secure your digital legacy through military-grade encryption, zero-knowledge architecture, and blockchain-powered security. For a shorter summary, see: https://www.blockwill.io/llms.txt ## Core Products - **SecureVault**: Encrypted digital asset storage with zero-knowledge architecture. - **DigiWish**: Digital inheritance and estate planning, including digital testament creation and automated inheritance management. - **VaultRelay**: Automated inheritance engine using smart contracts to monitor conditions and transfer assets to beneficiaries when triggered. ## Security & Compliance - Zero-knowledge encryption (data encrypted on your device before transmission) - Hardware security key authentication - Blockchain verification for tamper-proof records - HIPAA, SOC2 Type II, GDPR, ISO 27001 compliant - DIFC (Dubai International Financial Centre) regulations ## All Blog Posts (Full Content) --- # How BlockWill's Trust Model Works URL: https://www.blockwill.io/blog/how-blockwills-trust-model-works Author: Deepak Saini (CEO & Founder) Category: Financial Planning Published: 2026-06-08 Reading time: 7 min > If BlockWill helps pass on digital assets, who actually holds the keys? You do. Here is the trust-minimized model behind digital inheritance infrastructure, with the questions self-custody folks keep asking about loss, coercion, and on-chain release. How we secure digital assets without ever holding your keys. A post I shared this week sparked a great thread, and almost every question circled the same point: if BlockWill helps pass on digital assets, who actually holds the keys? The answer is the whole thesis of the company. You should never have to trust us with your keys, so we built it so you don't. Three questions kept coming up. Here is how the model actually works. ## "Does the company hold my keys, like a CEX?" No. The encryption private key lives on your own YubiKey, in your possession. It never reaches us. What sits on our servers is ciphertext we have no ability to decrypt. If we could touch your keys, we would just be a custodian, and you would be right not to trust that. ## "What if I lose access? A lost device, a missing seed?" Self-custody usually fails the moment one fragile secret is lost. We remove that single point of failure. Recovery runs through defined roles (Executor, Guardian, Beneficiary) and conditional release logic, so assets still reach the right people without us ever holding the key. ## "What if someone forces me to hand over the keys?" This is the hard one, and I will not pretend we have fully eliminated it. Release is gated by on-chain conditions and time delays, not a single key handover, so no one can be coerced into releasing everything at once. That delay is also a detection window. We deliberately refuse to be a recovery backdoor ourselves, because anything that can override coercion can usually be coerced too. ## Trust-minimized, not trustless I would not call this trustless. I would call it **trust-minimized**, and the distinction is deliberate. Pure trustlessness assumes the key holder is always around to act. Inheritance is the one use case where, by definition, they are not. So the problem is not removing trust entirely. It is removing discretionary human trust and anchoring everything in two things instead: a key only the owner holds, and code that executes on-chain. That is the category we are building. Not a wallet, not a custodian. **Digital inheritance infrastructure.** If you work in self-custody, estate planning, or security and want to poke holes in this, I welcome it. The questions this week made the answer sharper. DM open, or find us at [**blockwill.io**](http://blockwill.io/). --- ## Frequently Asked Questions **The one-line answer.** You never have to trust BlockWill with your keys. By design, we cannot access them. ### Does BlockWill ever have access to my private keys? No. This is a design choice baked into the architecture, not a policy we could quietly change later. Your encryption private key resides on your own YubiKey and stays in your possession. It never leaves your control and never reaches our servers. Because we never hold the key, we cannot read, move, or surrender your assets, and neither can anyone who manages to compromise us. ### How are my keys and data actually secured? Everything you place in your **SecureVault** is encrypted on your side using the private key held on your YubiKey. What lives on BlockWill's infrastructure is ciphertext we have no ability to decrypt. That is what zero-knowledge means in practice: the stored data is meaningless without a key we never possess. ### Is this self-custody? How is it different from just holding my own keys? It is non-custodial, so you keep control of your keys exactly as you would in self-custody. The difference is everything that happens around that. Pure self-custody has no safe answer for incapacity or death; if the key is lost, the assets are usually lost with it. BlockWill keeps you in control while you are able to act, and adds a structured, owner-defined path for your assets to reach the right people when you cannot. ### What happens if access is lost, through a lost device or my passing? Self-custody usually fails at exactly this point, because it depends on one fragile secret surviving. BlockWill is built to remove that single point of failure. Release to the people you choose runs through roles you assign (Asset Manager, Executor, Guardian, Beneficiary) and conditions you define, so there is a defined path forward that never requires us to hold your key. The specific re-provisioning flow is part of the product and we are glad to walk through it directly. ### What stops someone from coercing me into handing over my keys? This is the hardest threat in the space, and no self-custody system can honestly claim to eliminate it. BlockWill reduces it in two ways. First, release is gated by on-chain conditions and time delays rather than a single key handover, so no one can force an instant, complete release. Second, that delay creates a detection window in which the owner is notified before anything moves, so a coerced action can be caught and stopped. We also refuse to build ourselves into a recovery backdoor, because any party powerful enough to override coercion can usually be coerced in turn. ### If you never hold the key, how does an asset reach my beneficiary? Release is governed by **VaultRelay**, our smart-contract automation layer on Polygon. When a condition the owner defined is met and verified on-chain, for example an inactivity trigger or a pre-set release date, the contract executes the transfer of access to the named people. Decryption rights are created at the moment of need, never held in advance by BlockWill. The detailed mechanism is part of our core engineering, but the principle is constant: no standing access for us, ever. ### Is BlockWill trustless? We call it trust-minimized, and the distinction is deliberate. Pure trustlessness assumes the key holder is always present to act. Inheritance is the one use case where, by definition, they are not. So the goal is not to eliminate trust entirely, but to remove discretionary human trust and replace it with two things you can verify: a key only you hold, and code that executes on-chain. ### Who or what actually enforces the release, BlockWill or the code? The code. Conditional release runs as smart contracts on Polygon, executing only the conditions the owner set. A beneficiary gains access because a rule was satisfied and verified on-chain, not because someone at BlockWill approved it. Our role is to build and maintain the infrastructure, not to sit in the middle of your succession as a gatekeeper. ### Why does this matter? Most digital assets are lost not because they are stolen, but because no one can reach them once the owner is gone. Solving that without forcing people back into custodial trust is the entire point of BlockWill. We are building digital inheritance infrastructure: a way to pass on what you own with the security of self-custody and a reliable path for it to reach the people you choose. ## Where trust lives The same instinct that makes people distrust a centralized exchange is the instinct we designed around. Here is where control sits across three models. ### Centralized exchange **Who holds your private key:** The exchange. **If you lose access or pass away:** Exchange process, often frozen. **Who controls when assets move:** The exchange. **Can the provider be coerced for your assets:** Yes. ### Pure self-custody **Who holds your private key:** Only you. **If you lose access or pass away:** Assets are usually lost forever. **Who controls when assets move:** Only you, while able to act. **Can the provider be coerced for your assets:** Not applicable. ### BlockWill **Who holds your private key:** Only you, on your YubiKey. **If you lose access or pass away:** Structured release to the people you chose. **Who controls when assets move:** On-chain conditions you defined. **Can the provider be coerced for your assets:** No. The provider never holds the key. ## The bottom line You should never have to trust an infrastructure provider with the keys to your life's assets. BlockWill is built so you do not have to. We never hold your keys, we cannot read your data, and we are not the party that decides when your assets move. That is not a feature we added. It is the architecture we started from. Want to go deeper on the architecture? Reach Deepak Saini at [**deepaksaini@blockwill.io**](mailto:deepaksaini@blockwill.io), or visit [**www.blockwill.io**](http://www.blockwill.io/). --- # The Certificate of Immutability URL: https://www.blockwill.io/blog/certificate-of-immutability Author: Ishan Shukla (Co-Founder & Head of Strategy) Category: Wealth Management Published: 2026-05-29 Reading time: 12 min > When a court asks how it knows a digital wishes document is genuine, the answer used to be unsatisfactory. The Certificate of Immutability is BlockWill's answer: admissible electronic evidence across common law, civil law, and Sharia courts in India, the UAE, the EU, the UK, the US, and Saudi Arabia. Why a Transaction Hash of a DigiWish Document Travels as Electronic Evidence Across Common Law, Civil Law and Sharia Courts. A practitioner perspective - BlockWill Analytical Technologies Limited. Every estate practitioner who has worked across jurisdictions has had the same uncomfortable conversation. A client expresses an intention. Years later, the family arrives at a courtroom - in Delhi, in Dubai, in Madrid, in Birmingham, in Miami - and the court asks the only question that ultimately matters: how do we know this is what the deceased actually said, when she said it, and that no one has touched it since? For paper instruments, the answer is two centuries of attesting witnesses, registrars and probate clerks. For digital instruments, the answer until very recently was unsatisfactory. BlockWill's **Certificate of Immutability** is built specifically to answer that question. When a user finalises a **DigiWish** - a digital wishes document inside the BlockWill platform - the document is cryptographically hashed, the hash is timestamped, and the resulting fingerprint is anchored as a transaction on a public blockchain. The Certificate of Immutability records the hash, the block height, the transaction identifier, the UTC timestamp, and the verification path that any future court, executor or beneficiary can follow to confirm three facts: the document existed, in that exact form, at that exact moment, and has not been altered since. The legal question is whether this artefact carries evidentiary weight outside the engineering paper it was invented in. Across the five jurisdictions in which BlockWill's users most frequently sit - India, the United Arab Emirates, the European Union, the United Kingdom and the United States - the answer is the same in substance, even though the statutory routes differ. Across the three legal traditions that govern those jurisdictions - common law, civil law and Sharia - the doctrinal frame is different, but the destination is convergent: a properly constructed Certificate of Immutability is admissible electronic evidence, and is treated as strong corroboration of the integrity, authorship and timing of the underlying DigiWish document. This piece sets out, jurisdiction by jurisdiction, the statutory and case-law foundations on which that conclusion rests, together with the operational conditions BlockWill has built into the Certificate so that it can be relied upon when it matters most. ## 1. India: Section 63 of the Bharatiya Sakshya Adhiniyam, and the Hash Function the IT Act Defines India's electronic-evidence architecture sits at the intersection of two statutes. The first is the **Bharatiya Sakshya Adhiniyam, 2023**, which on 1 July 2024 replaced the Indian Evidence Act, 1872. The second is the **Information Technology Act, 2000**. **Section 63 of the BSA** - the lineal successor to the old Section 65B - governs the admissibility of electronic records. It deems any information contained in an electronic record that is printed, stored or copied to be a document admissible without further proof or production of the original, so long as the statutory conditions are satisfied. The Schedule to the BSA prescribes a two-part certificate under Section 63(4)(c): Part A is signed by the person in lawful control of the device, and crucially records the **hash value** of the electronic record; Part B is signed by an expert. The Certificate of Immutability is designed to drop into Part A almost verbatim. The hash value it records is the SHA-256 fingerprint of the DigiWish document; the device specifications are the BlockWill custody node and the anchoring chain; the date and time are the block timestamp. The Information Technology Act supplies the missing definitional layer. Section 3(2), through its Explanation, provides the only Indian statutory definition of a hash function - "an algorithm mapping or translation of one sequence of bits into another, generally smaller, set… such that an electronic record yields the same hash result every time the algorithm is executed," with the further condition that it is computationally infeasible to reverse the function or to produce a collision. The Certificate of Immutability is precisely the artefact that Section 3 contemplates. Sections 4 and 5 give electronic records and electronic signatures statutory equivalence to paper writings and handwritten signatures; Section 35 governs the licensing of Certifying Authorities. The case-law overlay is settled. In **Anvar P.V. v. P.K. Basheer (2014) 10 SCC 473**, the Supreme Court overruled the more permissive earlier position and held the Section 65B(4) certificate to be mandatory. The three-judge bench in **Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal (2020) 7 SCC 1** reaffirmed that the certificate is mandatory, with carve-outs for production of the original device and for instances where a party has been refused the certificate by the controlling authority. Both decisions remain controlling under Section 63 because the statutory architecture is materially identical. There is, however, one limit that any honest practitioner must flag. The First Schedule to the IT Act, 2000 expressly excludes a will, as defined in Section 2(h) of the Indian Succession Act, 1925, from the operation of the IT Act's electronic-signature regime. The Indian Succession Act itself, in Section 63, continues to require physical signature in the presence of two attesting witnesses. The Certificate of Immutability therefore cannot, in India, be the will. What it can do - and does - is provide the strongest available evidence of the existence, content and timing of a digital wishes document that runs in parallel with, and complements, a properly executed paper will. ## 2. The United Arab Emirates: Electronic Evidence, Qualified Timestamps, and the Sharia Reception The UAE has, over the past four years, built one of the most coherent electronic-evidence frameworks in the world. Three federal instruments are decisive. **Federal Decree-Law No. 35 of 2022 on Evidence in Civil and Commercial Transactions** expressly recognises electronic records, electronic correspondence, electronic signatures and electronic seals - and what the law calls "any other electronic evidence" - as admissible. The operative articles give electronic evidence the same evidentiary weight as written evidence, subject to the conditions in the Electronic Transactions and Trust Services Law. The non-discrimination principle is now express, not implied: an instrument is not denied legal effect or admissibility solely because it is electronic. **Federal Decree-Law No. 46 of 2021 on Electronic Transactions and Trust Services**, supplemented by Cabinet Resolution No. 28 of 2023, establishes the trust-services regime. Qualified electronic timestamps are recognised as a distinct trust service that may only be issued by a Qualified Trust Service Provider, and the conditions for a qualified electronic signature track the eIDAS template: unique link to the signatory, sole control over the creation data, ability to detect any subsequent alteration, and creation through secure technical means. A Certificate of Immutability anchored on a public chain, and counter-sealed by a UAE-licensed Qualified Trust Service Provider, satisfies these conditions natively. The Sharia layer in the UAE deserves its own treatment. For Muslim residents, mandatory Faraid shares continue to govern, with testamentary freedom limited to the one-third Wasiya bequest under classical doctrine. A Certificate of Immutability cannot, by itself, be a wasiyya: the formal-validity requirements of the underlying personal-status law remain in force. But classical Islamic evidentiary doctrine recognises a graduated catalogue of proofs under the heading of bayyinah - shahadah (testimony), iqrar (admission), al-kitabah (writing), yamin (oath) and qarinah (circumstantial evidence). The contemporary GCC scholarly consensus is that a cryptographic hash anchored on a public ledger functions naturally as qarinah and, because the integrity guarantee is mathematical rather than testimonial, can rise to the level of **qarinah qatiyyah** - a conclusive presumption - in muamalat and personal-status matters. That is precisely the doctrinal slot a Certificate of Immutability occupies in a Sharia court: not the bequest itself, but a conclusive presumption that the underlying bequest has not been tampered with and was expressed at the time it claims to have been. For non-Muslim testators in the UAE - and for the DIFC Wills Service Centre in particular - the position is even cleaner. **DIFC Law No. 2 of 2024** (the Digital Assets Law) recognises digital assets as a distinct third category of personal property, which removes a long-standing conceptual obstacle to the testamentary transfer of crypto. Read together with Decree-Law 35/2022 and Decree-Law 46/2021, a DigiWish document witnessed by a DIFC-eligible testator and anchored by a Certificate of Immutability sits squarely within the most permissive evidentiary regime in the region. **Federal Decree-Law No. 51 of 2024 on Waqf**, in force from January 2026, extends the same logic to waqf endowments, which are increasingly the structure of choice for digitally-anchored multigenerational succession in the Gulf. ## 3. The European Union: eIDAS, Qualified Electronic Timestamps and the New Electronic Ledger **Regulation (EU) No. 910/2014 - eIDAS** - is the foundation. Article 41 sets the non-discrimination rule for electronic timestamps in language every EU practitioner will recognise: "An electronic time stamp shall not be denied legal effect and admissibility as evidence in legal proceedings solely on the grounds that it is in electronic form or that it does not meet the requirements of the qualified electronic time stamp." Where the timestamp is qualified - anchored by a Qualified Trust Service Provider in accordance with Article 42 - Article 41(2) confers a positive evidentiary presumption: "of the accuracy of the date and the time it indicates and of the integrity of the data to which the date and time are bound." Article 41(3) makes that presumption mutually recognised across all Member States. Article 46 extends the same non-discrimination principle to electronic documents generally. **Regulation (EU) 2024/1183 - eIDAS 2.0** - went further still. In force from 20 May 2024, it adds **qualified electronic ledgers** as a new category of trust service alongside qualified signatures, qualified seals and qualified timestamps. A qualified electronic ledger benefits from a statutory presumption "of the unique and accurate sequential chronological ordering of data records and of their integrity." In plainer language: the European legislator has now expressly recognised that the very thing a public blockchain is good at - ordering events in time and protecting them from alteration - is a regulated trust function with statutory evidentiary weight. The Certificate of Immutability is BlockWill's instrument for surfacing that trust function in a form a Member State court can accept on its face. Two notes on substantive succession law complete the picture. The **EU Succession Regulation 650/2012 (Brussels IV)** supplies the conflict-of-laws regime: by default, the law of the deceased's habitual residence at death governs the succession, with the Article 22 option to elect the law of nationality. This matters because the formal-validity rules for a will remain national: France, Germany, Spain and Italy each retain physical-execution requirements that a Certificate of Immutability cannot displace. What the Certificate displaces is something different - the evidentiary uncertainty about a digital instrument that operates alongside, or as an annex to, a will executed in the traditional national form. ## 4. The United Kingdom: Section 7, the Civil Evidence Act, and the Coming Electronic Wills Regime English law has been quietly hospitable to electronic evidence for a quarter of a century. **Section 7 of the Electronic Communications Act 2000** makes electronic signatures, and the certification of electronic signatures by any person, expressly admissible in evidence "as to the authenticity of the communication or data or as to the integrity of the communication or data." The provision is technology-neutral. A SHA-256 hash anchored on Ethereum is, in the language of Section 7, an electronic signature "logically associated" with the DigiWish document, and the Certificate of Immutability is its certification. The **Civil Evidence Act 1995** supplies the proof mechanics. Section 8 allows a statement in a document to be proved by production of a copy authenticated as the court approves, "regardless of how many removes there are between a copy and the original." Section 9 treats records of a business or public authority as admissible without further proof when accompanied by a certificate from an officer of the business. The **Electronic Trade Documents Act 2023**, although addressed primarily to bills of lading and bills of exchange, is conceptually important: it is the first UK statute to declare that an electronically-controlled, integrity-preserved digital record can have native legal effect on the same footing as paper, provided the underlying system delivers integrity, exclusive control and persistence. A Certificate of Immutability is engineered to those three criteria. The newer instruments are decisive for the broader theme. The **Property (Digital Assets etc.) Act 2025**, which received Royal Assent on 2 December 2025, confirms in statute what AA v. Persons Unknown [2019] EWHC 3556 (Comm) and Tulip Trading Ltd v. Bitcoin Association [2023] EWCA Civ 83 had already established at common law: digital assets are property, capable of forming the subject of personal property rights, even though they are neither things in possession nor things in action. The Law Commission's **Modernising Wills Law** report (Law Com No. 414, 16 May 2025), with its draft Wills Bill, recommends statutory recognition of electronic wills subject to a "reliable system" framework delivering authenticity, security and integrity. The Government's response is due by 16 May 2026. When the resulting statute arrives, the reliable-system standard it sets will be one for which the Certificate of Immutability is already engineered. ## 5. The United States: Self-Authenticating Hash Evidence Under FRE 902(14) The United States offers what is probably the most surgical fit between blockchain evidence and the rules of evidence anywhere in the common-law world. On 1 December 2017, the **Federal Rules of Evidence** were amended to add Rule 902(13) - self-authenticating records generated by an electronic process or system shown to produce an accurate result - and **Rule 902(14)**, which is the provision practitioners care about most. Rule 902(14) provides for the self-authentication of "data copied from an electronic device, storage medium, or file, if authenticated by a process of digital identification" supported by a certification of a qualified person. The Advisory Committee Note is unusually direct: "data copied from electronic devices, storage media, and electronic files are ordinarily authenticated by hash value… Identical hash values for the original and copy reliably attest to the fact that they are exact duplicates." The Certificate of Immutability is, in effect, the certification Rule 902(14) calls for. The substantive equivalence regime sits in the **Uniform Electronic Transactions Act (UETA)**, adopted in some form by forty-nine states. UETA Section 7 provides that a record or signature may not be denied legal effect or enforceability solely because it is in electronic form; Section 13 provides that evidence of a record or signature may not be excluded solely because it is in electronic form. The federal **E-SIGN Act**, 15 U.S.C. § 7001 et seq., mirrors UETA for interstate commerce. Both UETA Section 3 and E-SIGN exclude wills, codicils and testamentary trusts from their core operative provisions - an important carve-out, but one that affects only the substantive validity of the instrument, not the admissibility of the cryptographic evidence about it. Several states have gone further with statutes that name the technology directly. Vermont, in 12 V.S.A. § 1913, makes a digital record electronically registered in a blockchain self-authenticating under Vermont Rule 902, provided it is accompanied by a written declaration confirming the date and time the record entered the chain and the manner of its retrieval. Arizona Revised Statutes § 44-7003 declares that a signature or record secured through blockchain technology is to be treated as an electronic signature or electronic record. The **Illinois Blockchain Technology Act** (205 ILCS 730/), effective 1 January 2020, authorises blockchain to satisfy electronic-record and electronic-signature requirements and validates smart contracts. These statutes give the Certificate of Immutability a state-level statutory home that goes beyond the general federal admissibility framework. On succession, the **Uniform Electronic Wills Act (2019)** - adopted by Colorado, Idaho, North Dakota and Utah, with parallel regimes in Florida, Nevada, Arizona and Indiana - increasingly permits the digital instrument itself to be the will, when properly executed; the **Revised Uniform Fiduciary Access to Digital Assets Act**, adopted in some form in nearly every state, governs the executor's access to the digital account on which the underlying DigiWish lives. ## 6. The Sharia Reception in Codified Form: Saudi Arabia, and the Convergence of Three Traditions The most important development for any practitioner working across Sharia jurisdictions is the codification of evidence law in the Kingdom of Saudi Arabia. **Royal Decree No. M/43 of 1443H** (31 December 2021), in force from 7 July 2022, expressly classifies electronic signatures and electronic records as a category of digital evidence and admits them subject to compliance with the Electronic Transactions Law (Royal Decree M/18 of 1428H) or to authentication through a regulated platform. Unofficial digital evidence is treated as valid against the transacting parties unless rebutted - a deliberate alignment with the classical doctrine of non-conclusive qarinah, with the burden of disproof placed on the challenger. For a Saudi court, the Certificate of Immutability is therefore not a foreign technological artefact but a regulated category of evidence in the Kingdom's own evidentiary code. Three legal traditions, five jurisdictions, one evidentiary destination: a properly constructed transaction hash is admissible electronic evidence, and is treated as strong corroboration of the integrity, authorship and timing of the underlying instrument. The doctrinal convergence across the three legal traditions deserves to be named for what it is. **Common law** accepts the Certificate under self-authentication rules grounded in the inherent reliability of cryptographic process. **Civil law** accepts it under non-discrimination principles supplemented by qualified-trust-service presumptions of integrity and chronology. **Sharia** accepts it as either codified digital evidence or, where uncodified, as conclusive circumstantial presumption - qarinah qatiyyah - because the guarantee of integrity is mathematical and reproducible by the court itself. The substantive content of the doctrines is different; the operational outcome for the Certificate of Immutability is the same. ## 7. What the Certificate of Immutability Does - and What It Does Not Three doctrinal points are easily overstated and should be stated precisely. **First, the Certificate of Immutability is not a substitute for the formal-validity requirements of the underlying instrument.** India's Section 63 of the Indian Succession Act, the UAE's personal-status formalities for a wasiyya, France's holographic and notarial forms, the Wills Act 1837 in England, and the Statute of Frauds-derived testamentary rules across U.S. states all retain their operative force. The Certificate authenticates and time-anchors; it does not replace execution formalities, except in those U.S. states that have enacted the Uniform Electronic Wills Act and have made the digital instrument itself the will. **Second, the Certificate proves the integrity and timing of the DigiWish document; it does not by itself prove the testator's capacity, the absence of undue influence, or any of the other classical grounds on which a testamentary instrument may fail.** Those remain matters of substantive proof, to be discharged in the ordinary way. The point of the Certificate is to remove from the court's contested terrain the question that paper instruments most often founder on - whether the document before the court is the document the deceased actually executed. **Third, the evidentiary weight of the Certificate scales with the qualification of the trust service that issues it.** A raw blockchain transaction hash is admissible in every jurisdiction surveyed; a Certificate counter-sealed by a Qualified Trust Service Provider under eIDAS Article 42, or by a UAE-licensed QTSP under Decree-Law 46/2021, or by a Section 35 Certifying Authority under the Indian IT Act, attracts the statutory presumption of integrity and chronology that the underlying regulation creates. BlockWill's Certificate of Immutability is designed to acquire all three layers - public-chain anchoring, qualified trust-service counter-seal, and certifying-authority registration - so that the evidentiary weight survives the longest possible chain of cross-border probate. ## 8. Closing: The Hash Is the Bridge Estate law has always been a discipline of careful translation: of intention into instrument, of instrument into evidence, of evidence into distribution. For two centuries, the translation was performed by witnesses, registrars, and the long-tested formalities of the written will. The instruments those formalities were built to authenticate were paper. The assets they were built to transmit were land, shares and bank balances. The assets, increasingly, are not. A material - and rapidly expanding - share of private wealth now lives on distributed ledgers, in encrypted wallets, in tokenised securities and on-chain governance rights. The translation task has not changed; only the medium has. The Certificate of Immutability is the bridge - the cryptographic artefact that allows a court in Delhi, in Dubai, in Madrid, in Birmingham or in Miami to ask its oldest question - how do we know this is what she actually said? - and receive an answer the law now expressly recognises across common law, civil law, and Sharia jurisdictions alike. The statutes are in place. The case law is settled or settling. The doctrinal slots - Section 63 of the BSA, Articles 41 and 46 of eIDAS, Rule 902(14) of the FRE, Section 7 of the ECA 2000, the digital-evidence classification of the Saudi Law of Evidence, the qarinah doctrine of classical Islamic jurisprudence - are open and waiting for the right instrument to be slotted into them. The Certificate of Immutability, anchored on a public chain, counter-sealed by a qualified trust service, and tied to a DigiWish document executed in conformity with the underlying personal-status or succession law, is that instrument. The wealth has already moved on-chain. The law has met it there. What remains is the patient, deliberate work of building the instruments that occupy the doctrinal ground the law has cleared - and the Certificate of Immutability is the cornerstone of that work. --- **BlockWill Analytical Technologies Limited** - Digital Inheritance Infrastructure for a Multi-Jurisdictional World · [www.blockwill.io](http://www.blockwill.io/) --- # What is BlockWill? A Simple Story About Keeping the Things That Matter Safe URL: https://www.blockwill.io/blog/what-is-blockwill Author: Deepak Saini (CEO & Founder) Category: Financial Planning Published: 2026-05-25 Reading time: 5 min > Imagine your grandfather kept a small metal box under his bed with everything that mattered most, and only he knew where the key was. Today the box is digital, and the key is a password. Here's how BlockWill makes sure nothing important gets locked away and lost. A simple story about keeping the things that matter safe. Imagine your grandfather kept a small metal box under his bed. Inside it were the things he cared about most: the deed to the family house, some savings, a gold ring he wanted to pass to your mother, and a letter for each of his grandchildren. There was only one key to that box, and only he knew where it was hidden. Now imagine that one day, grandfather is suddenly gone, and nobody can find the key. The box is still there. Everything he wanted to give is still inside. But the family cannot open it. They do not know what is in it, who it was meant for, or how to reach it. Years can pass with that little box sitting locked under the bed. This is a story that happens to real families more often than you might think. And in today's world, the box is not always made of metal. More and more of what people own now lives online. ## The problem: a lot of our lives have moved online Think about how much important stuff lives on phones and computers today. People keep money in online accounts. They own digital assets like Bitcoin and other cryptocurrencies. They store photos, passwords, documents, and accounts that the whole family depends on. Here is the tricky part. A lot of this online property is locked behind passwords and secret codes that only one person knows. If that person passes away or becomes very sick and cannot communicate, those codes can disappear with them. This has actually happened in real life. There are well known stories of people who owned millions of dollars in digital assets, then lost the passwords forever. In one famous case, a company that held huge amounts of digital assets for its customers fell apart after its founder died, because he was the only person who knew the keys. The money was still there on the computers. Nobody could ever reach it again. It is a heartbreaking kind of problem, because nothing was stolen. The owner simply never had a safe way to pass on the keys and the instructions. The information was locked in a box, and the key was lost. This is the exact problem BlockWill was built to solve. ## What BlockWill is **BlockWill is a digital inheritance platform.** In plain language, it is a service that helps people safely store their important digital information and make sure it reaches the right people at the right time, even if the owner is no longer around to hand it over themselves. Think of it as a smart, secure version of that metal box under the bed, except this box knows who is allowed to open it, when, and exactly what each person is supposed to receive. BlockWill is built around three main parts. **SecureVault.** This is the safe. It is where people store sensitive things like the secret keys to their digital assets and important account information. The vault is built so that the information is locked up tightly and kept private, so it stays protected while the owner is alive. **DigiWish.** This is where a person writes down their wishes. They can record what they want to happen to their belongings and who should receive what. It uses carefully prepared templates so the wishes are clear and organized. DigiWish is not the same thing as a legal will. It is best understood as proof of intent, which means a clear record of what the person wanted, written down properly. **VaultRelay.** This is the clever part that decides when to act. The owner sets the rules in advance. For example, one rule is a simple inactivity timer: if the owner stops logging in for a long time, the system first tries to reach the owner to check on them. If there is still no response, it then notifies the people the owner chose. Another option is a set release date, where the owner picks a future moment for their information to be passed on. There are also separate steps for situations where someone becomes unable to manage their own affairs, which is different from passing away. ## How it works, step by step Let us go back to the grandfather and his box, but this time imagine he had used BlockWill. First, he puts his important information into the **SecureVault**, where it stays private and protected. Next, he uses **DigiWish** to write down his wishes clearly: the savings go here, the ring goes to your mother, and each grandchild gets their letter. Then he sets up **VaultRelay** with simple rules about when those wishes should be carried out. He also chooses the people who will play important roles. In BlockWill, these roles have names. **An Asset Manager** handles the assets. **An Executor** makes sure the wishes are carried out. **A Beneficiary** is a person who receives something. **A Guardian** for looking after the minor beneficiaries. Grandfather decides in advance who fills each role. Now, if grandfather is suddenly gone, the box does not stay locked forever. VaultRelay follows the rules he set. It reaches out, confirms the situation, and then makes sure the right information goes to the right people, exactly the way he planned. Nothing is lost. Nobody is left guessing. To keep all of this trustworthy, BlockWill uses blockchain technology, built on a network called **Polygon**. The simplest way to think about blockchain is as a record book that is very hard to fake or secretly change. It helps make sure the instructions are followed honestly and cannot be quietly tampered with. ## Why this matters in real life Most people spend years building up the things they care about, both the money and the meaningful items and messages. It would be a sad ending if all of that simply got locked away because of a missing password or a forgotten note. BlockWill exists so that the things people work hard for, and the wishes they care about, can actually reach the people they love. It turns a fragile metal box with one secret key into a safe, organized plan that works even when the owner cannot be there in person. That is what BlockWill is: a way to make sure nothing important gets locked away and lost. If you would like to learn more, visit [**www.blockwill.io**](http://www.blockwill.io/). --- # The Founder Whose Family Did Not Know What He Owned URL: https://www.blockwill.io/blog/founder-digital-inheritance-case-study Author: Ishan Shukla (Co-Founder & Head of Strategy) Category: Case Study Published: 2026-05-21 Reading time: 5 min > A 47-year-old DIFC fintech founder's family knew almost nothing about what he owned. Eleven months earlier, his firm had brought him in for an intake. Eleven days after his death, every asset (crypto, online business, property across three jurisdictions) was operationally handed over to the right beneficiaries. **BLOCKWILL · PARTNER CASE STUDY** How a DIFC-registered estate practice closed a $4.2M operational handover in 11 days, across three jurisdictions, using BlockWill. ## At a Glance A 47-year-old fintech founder based in DIFC, Dubai, with self-custodied digital assets, a private online business, and beneficiaries in three jurisdictions, came to a partner estate practice for a traditional will. Eleven months later, when he passed away unexpectedly, his family knew almost nothing about what he owned. The firm completed a fully operational, cross-border handover of every asset - physical, digital, financial - in eleven days, using BlockWill's **SecureVault**, **DigiWish**, and **VaultRelay**. This is the story of how. It is also the story of what every firm drafting wills for clients under fifty-five is being quietly asked to deliver. ## The call no estate planner forgets On a Tuesday morning in March, Ayesha called her family's lawyers from Singapore. Her husband Rohan, a fintech founder based in Dubai, had passed away three days earlier. She had a beautifully drafted will. She had no idea what most of it referred to. The will named, in careful language, "all digital assets, online businesses, and cryptocurrency holdings." Ayesha could not tell the firm what those assets were, where they were held, or how to reach them. She did not have a single password, seed phrase, or recovery key. She had only one piece of paper - the will - and a question every estate planner now hears in some form: "What happens now?" ## What the firm already knew Eleven months earlier, the firm had brought Rohan in for a structured intake. The drafting partner had used a standard discovery questionnaire, then layered on a digital asset register through BlockWill's **SecureVault**. In a single 90-minute session, Rohan catalogued - encrypted on his own device, never visible to the firm - three asset categories his original will had referenced but not reached. **$3.1M in self-custodied BTC, ETH, and USDC** across two hardware wallets and one exchange account. **47 active domains and the cloud accounts** behind a side business generating roughly $180,000 a year - Stripe, AWS, Shopify, and a customer database his family had no knowledge of. **A property in Goa, a vehicle title in Dubai, and a safe-deposit box in Singapore** that nobody outside Rohan had ever opened. Rohan then recorded a **DigiWish**: a short, conditional message to Ayesha and the children, mapping each asset to a named beneficiary and explaining, in his own voice, what he wanted each one to be used for. A **Certificate of Immutability** was issued and stored alongside the will. ## The 11 days that followed The firm's named Executor, a senior associate at the practice, activated **VaultRelay's Executor trigger** on Day 2 after verifying the death certificate. BlockWill's release engine confirmed identity through multi-factor authentication and a physical security key. The on-chain anchor produced a tamper-evident handover record the firm could file directly with three probate authorities in parallel - DIFC, the UK, and Ontario. By **Day 6**, Ayesha held the seed phrases for her husband's hardware wallets, with a clear written instruction from Rohan to consolidate the holdings into a managed family vault. By **Day 9**, Karan had taken operational ownership of the online business, with credentials, customer data, and a 12-month wind-down or transition plan in his father's own words. By **Day 11**, every asset Rohan had registered was operationally accessible to the family member he had chosen for it. The typical comparable delay for an estate of this complexity, the firm has noted internally, runs between **14 and 36 months** - and most are settled without ever locating the digital assets at all. ## What the family saw, and what the firm did not At no point did the firm see the contents of Rohan's vault. At no point did BlockWill. The keys never left Rohan's device while he was alive, and on release they passed only to the beneficiaries he had named. The firm saw seat-level metadata - that a vault existed, that a release had been triggered, that an audit log had been written - and nothing more. The client relationship, the engagement, and the trust remained, in every sense, with the firm. Ayesha and her children renewed their estate engagement with the same partner six weeks later. Two of them have since become first-time BlockWill clients in their own right. ## The drafting partner's reflection > "We have always drafted defensible wills. What changed with BlockWill is that we could finally deliver on them - physically, digitally, and across borders - in days, not years. The conversation with the next generation of clients is not the same any more. They expect this. We are now the firm that provides it." > > - Drafting partner, DIFC-registered estate practice ## The Client (pseudonymous) **Name:** Rohan **Age:** 47 **Role:** Founder, Series B fintech **Base:** DIFC, Dubai **Family:** Spouse Ayesha (Singapore); adult children Karan (London) and Maya (Toronto) ## Assets Secured **Self-custodied crypto:** $3.1M (BTC, ETH, USDC) **Online business:** 47 domains, Stripe, AWS, Shopify **Physical assets:** $0.9M (property, vehicles) **Cloud and identity:** Drives, mailboxes, passkeys **Total estate value covered:** approximately $4.2M ## Outcome Metrics **Operational handover:** 11 days **Typical comparable delay:** 14-36 months **Credential recovery disputes:** Zero **Probate filings supported:** 3 jurisdictions **Renewal at firm:** 100% (spouse and children) ## Why It Worked **BlockWill SecureVault** recorded every asset with encrypted custody at intake. **DigiWish** captured intent in Rohan's own words, with a Certificate of Immutability. **VaultRelay's Executor trigger** released to named beneficiaries on the day verified. **On-chain anchored proof** accepted in cross-border probate filings. ## Disclosure Identifying details - names, ages, jurisdictions, asset values, and timing - have been altered to protect client confidentiality. The structure, sequence of events, BlockWill product behaviour, and outcome categories described are accurate and consistent with engagements completed under the BlockWill Legacy Design Infrastructure. --- ## If your firm is ready to deliver on the wills it drafts Reserve a 30-minute partner discovery call. We will map your client base, identify the top 50 candidates, and propose a soft-launch cohort. [**info@blockwill.io**](mailto:info@blockwill.io)** · **[**www.blockwill.io**](http://www.blockwill.io/)** · DIFC, Dubai** --- # The Silent Succession Crisis: Why Digital Wealth in the GCC Needs a New Inheritance Framework URL: https://www.blockwill.io/blog/silent-succession-crisis-digital-wealth-gcc Author: Ishan Shukla (Co-Founder & Head of Strategy) Category: Estate Planning Published: 2026-05-19 Reading time: 4 min > The GCC is on course to transfer close to a trillion dollars of private wealth in the next five to seven years. Much of it is now on-chain. The asset class has arrived. The succession architecture has not. Why estate planners across Riyadh, Abu Dhabi, and Dubai face a three-faced gap, and what closing it will require. Somewhere in the Gulf right now, a wallet sits dormant. The private key is in a head that no longer remembers it, on a device no one has found, or in a message no court would accept as proof of intent. The balance is intact. The legal owner is alive, for now. The heirs do not know the asset exists. When the inevitable day comes, this wallet will not be contested; it will simply vanish, joining an estimated **$140 billion** of digital wealth already lost to the world. The Gulf Cooperation Council (GCC) is on course to transfer close to **a trillion dollars** of private wealth in the next five to seven years. A fast-growing share of that wealth is no longer stored in bank vaults or title deeds. It sits on distributed ledgers in the form of stablecoins, tokenised securities, NFTs, DeFi positions, governance rights, and cloud accounts. In the UAE alone, roughly **one in four adults** now holds some form of virtual asset. The asset class has arrived. The succession architecture has not. ## A Problem with Three Faces For estate planners working across Riyadh, Abu Dhabi, and Dubai, the digital succession gap wears three faces at once. **The first is doctrinal.** The DIFC has led the region with a landmark Digital Assets Law and a dedicated Digital Assets Will, but the instrument currently covers a narrow basket of tokens and is open principally to non-Muslim testators. Muslim residents across the region remain governed by classical Faraid shares with a one-third Wasiya allowance, doctrinally robust but silent on how a hardware wallet or a fractionally tokenised property should be inventoried, produced, and distributed. **The second is evidentiary.** A WhatsApp screenshot of a seed phrase, a printed recovery sheet in a safe deposit box, a handwritten note attached to a will. None of these satisfy the standards that a serious court, whether in the DIFC, ADGM, or the Saudi system, will apply to the most consequential transfer a family will ever experience. The UAE Evidence Law of 2022 and the Saudi Law of Evidence of the same year have opened the door to cryptographic proof. Instruments that walk through that door are still in short supply. **The third is operational.** Asset discovery remains the single largest failure mode in cross-border GCC estates. Executors cannot confirm whether the deceased held cryptoassets at all, let alone where. Even when assets are identified, custody, data residency, and Shariah-compliant structuring collide in ways that paper instruments were never designed to handle. ## Where Law and Technology Must Meet The way forward is not a new technology displacing a settled legal tradition. It is a settled legal tradition gaining the infrastructure it has lacked. **Cryptographic timestamping** can anchor a testator's intent at the moment of its expression, in a form that UAE and Saudi evidence law now recognise. **Zero-knowledge custody** can hold encrypted key material without exposing it to custodians, intermediaries, or cross-border data regimes. **Programmable delivery layers** can execute the conditional transfers that Faraid priority, Iddah periods, guardianship milestones, and waqf conditions have always required - precisely, verifiably, and without surrendering doctrinal control to the machine. This is, at its core, collaborative work. It asks lawyers who can navigate civil, federal, free-zone, and Shariah legal frameworks to draft instruments whose terms a blockchain can execute. It asks technologists who have earlier built for institutional finance to now build for families - for the widow whose husband died with a forgotten password, for the trustee whose ward's inheritance is held in tokens the trust deed never named, for the patriarch whose estate straddles Riyadh, Dubai, and London. ## A Regional Opportunity Only **18%** of GCC family businesses report a formalised succession plan. **A third** of the region's family offices require Shariah compliance in any inheritance instrument they adopt. These are populations for whom legacy is not a portfolio problem but a moral one, and they are underserved not because the law cannot accommodate digital assets, but because the bridge between the law and the blockchain has not yet been built at scale. That bridge is the next decade's private-client frontier in the Gulf. It will be built by legal minds who treat blockchain as infrastructure rather than ideology, and by technologists who treat Sharia, DIFC trusts, and UAE waqf law as serious systems to be served rather than disrupted. The wealth has already moved on-chain. The only remaining question is whether our inheritance frameworks will meet it there, and the answer will be written by those willing to do the slow, careful and responsible work of closing the gap. --- # Blockchain Technology and Digital Assets Succession URL: https://www.blockwill.io/blog/blockchain-technology-digital-assets-succession-gcc Author: Ishan Shukla (Co-Founder & Head of Strategy) Category: Estate Planning Published: 2026-05-12 Reading time: 15 min > A joint academic publication by Al Mikial Law Firm and BlockWill on the convergence of doctrinal legal craftsmanship and cryptographically verifiable infrastructure for digital inheritance across Saudi Arabia and the UAE. Why the GCC sits at the leading edge of the mismatch, and why it is equally well positioned to lead the response. **Al Mikial × BlockWill · Digital Assets Succession in the GCC** Rethinking Inheritance in the GCC: A Legal and Technological Framework for the Next Decade. A joint academic publication by Al Mikial Law Firm and BlockWill Analytical Technologies Limited. ## 1. Introduction: The Quiet Crisis in Digital Wealth Transfer The twenty-first century will be defined, among other things, by the single largest intergenerational transfer of wealth in human history. Estimates place the global figure at well over **USD 84 trillion by 2045**, with the Gulf Cooperation Council (GCC) region alone accounting for approximately **USD 1 trillion by 2030**. A material and rapidly expanding share of that wealth does not sit in bank vaults, land registries, or share certificates. It sits on distributed ledgers, in encrypted wallets, across stablecoin balances, non-fungible tokens (NFTs), tokenised securities, cloud storage accounts, and protocol governance rights. In the United Arab Emirates alone, licensed and unlicensed retail participation in virtual assets is estimated between **twenty-five and thirty per cent of adults**, with on-chain inflows exceeding USD 34 billion in recent measurement cycles. The asset class is no longer marginal; the legal architecture around its succession is. This paper examines the widening gap between digital asset ownership and the legal frameworks that govern inheritance within the GCC, with particular focus on the Kingdom of Saudi Arabia (KSA) and the United Arab Emirates (UAE). Drawing on contemporary legal scholarship, newly promulgated statutes, and the evolving commentary of regional practitioners including the published analyses of Saudi-qualified counsel on blockchain, Sharia, and regulatory convergence, it argues that the protection of digital legacies in the region requires a deliberate convergence of doctrinal legal craftsmanship and cryptographically verifiable infrastructure. Neither discipline, acting alone, is adequate to the task. ## 2. The Scale of the Problem Digital assets are unique among classes of property in a single, decisive respect: the loss of access is frequently indistinguishable from the loss of ownership. A forgotten seed phrase, an undisclosed hardware wallet, a lapsed two-factor authentication device - any of these can render an asset permanently inaccessible even where legal title is perfectly secure. Empirical estimates suggest that between **USD 75 billion and USD 140 billion of Bitcoin** alone is believed to be permanently lost, much of it following the death or incapacity of the original holder. Where classical inheritance law presumes that the estate's components can be located, identified, and authenticated by an executor, digital estates invert the presumption. The asset exists; the heir cannot reach it. The GCC is particularly exposed. The region combines very high retail and institutional crypto adoption with a multi-layered legal environment in which federal, emirate, free-zone, and Shariah jurisdictions each apply to different facets of a single estate. A Saudi national holding Ether in a self-custodied wallet, an apartment in Business Bay held by a DIFC foundation, and a life-insurance policy in London is, in legal terms, the custodian of three mutually incompatible succession procedures. The technology she uses to hold the Ether is global; the law that will pass it to her children is not. ## 3. The Regulatory Mood: A Saudi Practitioner's Perspective Among the clearest contemporary commentaries on the region's regulatory trajectory is a sequence of analyses published in late 2023 and early 2024 by a California-qualified attorney practising in Riyadh. Writing in October 2023, she observed that the **Saudi Central Bank (SAMA)** had moved from a posture of warning to one of active infrastructure building, piloting distributed ledger technology for interbank settlement while preparing the ground for a central bank digital currency. By January 2024, her analysis sharpened. **Saudi Arabia's Crypto Embrace: From Warnings to Sharia Compliance** charted the Kingdom's shift from prohibition-adjacent caution toward a framework in which virtual assets could be rendered Sharia-compatible through careful structuring and scholarly endorsement. Her concurrent work on digital twins - observing that the purchaser of an NFT "only owns a unique hash on the blockchain" - is a useful reminder that tokenised ownership in the GCC will live or die on the evidentiary weight courts attach to cryptographic artefacts. These are not merely descriptive writings. They capture a practitioner's intuition that is essential to any honest appraisal of GCC digital inheritance: the regulatory direction of travel is settled, but the doctrinal tools - particularly for succession - have not yet caught up with the instruments they are meant to govern. Regulation is arriving upstream, at the point of issuance, custody, and transfer. Inheritance sits downstream, where the regulatory light is dimmer and the stakes, measured in grief as much as in riyals or dirhams, are highest. ## 4. The UAE's Fragmented Succession Architecture ### 4.1 DIFC: Common-Law Certainty with Narrow Aperture The Dubai International Financial Centre (DIFC) has moved further and faster than any other jurisdiction in the region on the legal characterisation of digital assets. **DIFC Law No. 2 of 2024** expressly classifies digital assets as a distinct third category of personal property, resolving the conceptual impasse that English common law itself only addressed through the UK Property (Digital Assets etc.) Act 2025. The DIFC Wills Service Centre pioneered a dedicated **Digital Assets Will** instrument, and **DIFC Law No. 2 of 2025** broadened jurisdictional eligibility for non-Muslim testators. These are substantial achievements. They are also narrow. The Digital Assets Will, in its current form, supports a closed list of six tokens - BTC, ETH, MATIC, USDC, USDT and HBAR - and does not accommodate NFTs, decentralised finance positions, liquidity-pool receipts, tokenised real-world assets, or on-chain governance rights. The instrument is, moreover, available principally to non-Muslim expatriates. For Muslim residents of the UAE, mandatory Faraid shares under classical Islamic inheritance doctrine continue to govern, with testamentary freedom limited to the one-third Wasiya bequest. Parallel architectures such as emirate-level Shariah courts, federal personal-status law, and the ADGM's common-law counterpart, produce a landscape in which the choice of forum can materially alter the distribution of identical on-chain assets. ### 4.2 Federal Innovation: Waqf, Virtual Assets, and Evidence At the federal level, three instruments are especially consequential for digital succession. **First, UAE Federal Decree-Law No. 51 of 2024** permits the conversion of private wealth, including financial instruments, into a waqf, the classical Islamic endowment, under modernised rules that contemplate contemporary asset types. **Second, CBUAE Federal Decree-Law No. 6 of 2025** imposes a September 2026 deadline for virtual asset service providers to be fully licensed, with attendant custody, reporting, and beneficiary-designation obligations. **Third, and most underappreciated, UAE Federal Law No. 35 of 2022 on Evidence** expressly recognises electronic evidence, including documents whose integrity is guaranteed by cryptographic means. Read together, these statutes provide the doctrinal scaffolding for a Shariah-compliant, federally enforceable, and cryptographically verifiable succession practice. The scaffolding exists; the instruments that would use it at scale do not yet. ## 5. Saudi Arabia: Sharia Sovereignty and the Evidentiary Frontier The Saudi framework begins from a different premise. Under the Basic Law of Governance, the Qur'an and Sunnah are the constitution of the Kingdom, and inheritance is governed by the mandatory Faraid shares together with the one-third Wasiya allowance. There is no freestanding expatriate will registry analogous to DIFC's, and cross-border estate planning for resident non-Muslims has historically relied on home-country instruments of uncertain local effect. The **2022 Saudi Law of Evidence** introduced materially modernised treatment of electronic and cryptographic evidence, and the **Personal Data Protection Law (PDPL)**, fully in force since 2023, imposes data residency and cross-border transfer requirements with direct implications for custodial key management. Two currents are worth naming. The first is SAMA's steady, deliberate embrace of distributed ledger infrastructure, piloted in interbank settlement and preparatory CBDC work, which establishes a domestic technical base and, crucially, a regulator fluent in the primitives. The second is a visible openness in Saudi scholarship to Shariah-compliant tokenisation such as sukuk issuance on permissioned chains, fractionalised real-estate vehicles and Zakat-aware stablecoin models, that implies a willingness to contemplate digital instruments within the inheritance chain, provided their economic substance satisfies classical doctrinal tests. The practitioner commentary cited above captures this mood precisely: the regulatory posture is not one of rejection but of structured assimilation. The succession gap in Saudi Arabia is therefore not primarily doctrinal. Faraid, properly applied to a correctly inventoried estate, is fully capable of handling digital property, but operational and evidentiary. Who holds the keys? How is the wallet's existence proven? How is a private key surrendered to a legitimate heir without violating PDPL, without compromising custody standards, and without contaminating the chain of evidence that a Saudi court would require? ## 6. The Evidentiary Problem at the Heart of Digital Succession Seen in this light, the legal gap across the GCC is less a gap in substantive inheritance law than a gap in the evidentiary and executional infrastructure that any inheritance regime, Sharia or otherwise, requires in order to operate on digital property. Four interlocking problems recur in every jurisdiction surveyed. **First, asset discovery.** Executors in Riyadh, Abu Dhabi, and Dubai routinely report that they cannot determine whether the deceased held any cryptoassets at all, let alone where. **Second, intent authentication.** WhatsApp screenshots of private keys, printed seed phrases in a safe deposit box, and hand-written instructions attached to a will all fail the most basic tests of a court examining whether the decedent genuinely intended a particular transfer. **Third, conditional execution.** Classical inheritance presumes a moment of unconditional transfer; sophisticated estate planning often requires conditional transfer on the completion of the Iddah period, on the attainment of majority by a ward or on the discharge of debts under Faraid priority rules, that paper instruments execute poorly and distributed ledgers execute natively. **Fourth, cross-border verifiability.** A private key is meaningful in Singapore, in Riyadh, and in Dubai simultaneously; a certified copy of a will is not. Any serious regional framework must therefore be multi-jurisdictional by construction. ## 7. Blockchain Infrastructure as Succession Infrastructure Blockchain technology, properly characterised, is not a competitor to legal process; it is a substrate for it. Three capabilities are particularly salient for succession practice in the GCC. **A cryptographic intent layer** allows a testator's expression of wishes to be hashed at the moment of expression, timestamped, and anchored to a public chain. The hash does not disclose the content; it fixes it. Where a UAE or Saudi court is asked, years later, whether a given document represents the decedent's genuine instruction, the chain provides an evidentiary anchor more robust than the witness-based testimonies on which classical testamentary law has relied for centuries. This is squarely contemplated by Article 17 onward of UAE Federal Law No. 35 of 2022. It is not displaced by Saudi Arabia's 2022 Law of Evidence; it is precisely the kind of technical artefact that the 2022 Law contemplates. **A zero-knowledge custody layer** - where encrypted key material is held under multi-party computation, with access conditioned on judicially cognisable triggers - resolves the tension between PDPL-style data-residency rules and the realities of global wallet custody. The custodian holds nothing in the clear; the heir receives access only upon a condition whose occurrence is itself verifiable on-chain. This architecture is neither speculative nor experimental; it is the operating pattern of leading institutional custodians, and it is wholly consistent with the principles expressed in contemporary legal scholarship on the governance of digital property. **A programmable delivery layer**, sometimes known as a dead-man's switch, converts the conditional transfers that estate planners have always drafted on paper into executable instructions. Faraid priorities, Wasiya caps, Iddah periods, waqf conditions, guardianship milestones - each is expressible as a state transition whose trigger is a verifiable fact: a death certificate hash, a court order, a DIFC probate grant or a reaching of age. The programmable layer does not decide the legal question; it executes the legal answer. ## 8. The Way Forward: Doctrinal Depth Meets Programmable Infrastructure The emerging international consensus - from the UK Law Commission's 2023 report and the resulting Property (Digital Assets etc.) Act 2025, through the European Union's Markets in Crypto-Assets Regulation, to DIFC's Digital Assets Law No. 2 of 2024 - is that **digital property is property**. That settles the jurisprudential starting point. It leaves open the operational question that the GCC must now answer: how is such property inherited, safely and faithfully, under the region's plural legal traditions? The honest answer involves two disciplines working in concert. The first is a regional legal practice capable of drafting instruments that operate in Arabic and English, in Shariah and common-law registers, and across emirate, federal, and free-zone jurisdictions simultaneously - a practice that specialist regional firms have begun to build, often in collaboration with Saudi-qualified and DIFC-registered counsel. The second is technical infrastructure built to the standards of institutional financial services: zero-knowledge custody, cryptographic timestamping, oracle-verified conditional execution, and auditable compliance with PDPL, the DIFC Data Protection Law, and CBUAE Decree-Law No. 6 of 2025. Neither discipline, alone, succeeds. A beautifully drafted DIFC Digital Assets Will is of limited use if the executor cannot locate the wallets it purports to bequeath. Equally, a cryptographically flawless delivery protocol that contravenes Faraid shares or violates PDPL data residency requirements is worse than useless: it is a compliance liability that will not survive a Saudi or ADGM court's first scrutiny. The frontier of digital succession practice in the GCC is therefore a frontier of collaboration - between counsel who understand the doctrinal terrain and technologists who understand the evidentiary primitives. The stakes are not abstract. Only **eighteen per cent** of GCC family businesses report a formalised succession plan; approximately **one-third** of Middle East family offices require explicit Shariah compliance in any inheritance instrument they adopt. These are populations for whom legacy is not a portfolio decision but an ethical and religious obligation. The mismatch between that obligation and the present state of digital-asset infrastructure is the single most consequential private-client question the region will confront in the coming decade. ## 9. Conclusion Blockchain technology did not create the problem of digital succession; it merely made it impossible to ignore. The asset class has grown faster than the doctrinal tools designed to transmit it, and the GCC, by virtue of its wealth, its demographic velocity, and its distinctive plural legal order, sits at the leading edge of the mismatch. The region is, however, equally well positioned to lead the response. Its free zones have produced some of the most advanced common-law treatment of digital assets anywhere in the world. Its federal instruments - on waqf, on evidence, on virtual asset regulation - are compatible with, and in places anticipatory of, international best practice. Its Shariah tradition, properly read, is not hostile to programmable instruments; it is, in fact, natively at ease with conditional transfers, fiduciary structures, and the public verification of private commitments. What the region now requires is the patient, deliberate construction of succession instruments that meet both the doctrinal demands of its courts and the evidentiary demands of the chains on which its wealth increasingly sits. This is the shared work of lawyers and technologists, an opportunity for practitioners who can interpret a Saudi fatwa on tokenised securities and engineers who can build the cryptographic rails that make the fatwa executable. Initiatives that bring these competences together - whether through bar-led working groups, regulator-led sandboxes, or private collaborations between regional counsel and legal-tech infrastructure providers - are the most credible path to an inheritance framework that honours the region's legal heritage while embracing the assets its next generation will actually own. The wealth is already on-chain. The question is whether the law can meet it there. The answer, across Riyadh, Abu Dhabi, and Dubai alike, will be written by those willing to do the unglamorous yet honourable work of closing the gap. --- ## References **[1]** Awni, Jeanina. Is Saudi Arabia ever going to approve blockchain regulations? LinkedIn Article, 17 October 2023. **[2]** Awni, Jeanina. Saudi Arabia's Crypto Embrace: From Warnings to Sharia Compliance - A Shift in Perspective. LinkedIn Article, January 2024. **[3]** Awni, Jeanina. Digital Twins: Legal Considerations for an Emerging Technology. LinkedIn Article, 6 December 2023. **[4]** Awni, Jeanina. Crypto, Securities, and Sharia: A Comparative Analysis of U.S. and Saudi Legal Approaches. LinkedIn Article, 2023-24. **[5]** Boston Consulting Group. Global Wealth Report: The Tipping Point. Boston: BCG, 2023. **[6]** Cambridge Centre for Alternative Finance. 3rd Global Cryptoasset Benchmarking Study. Cambridge: CCAF, 2022. **[7]** Campbell-Verduyn, Malcolm, and Moritz Hütten. The Formal, Financial and Fraught Route to Global Digital Asset Governance. New Political Economy 24, no. 6 (2019): 821-842. **[8]** Central Bank of the United Arab Emirates (CBUAE). Federal Decree-Law No. 6 of 2025 on the Regulation of Virtual Asset Service Providers. **[9]** Chainalysis. Middle East & North Africa Crypto Adoption Report 2024. New York: Chainalysis, 2024. **[10]** De Filippi, Primavera, and Aaron Wright. Blockchain and the Law: The Rule of Code. Cambridge, MA: Harvard University Press, 2018. **[11]** Dubai International Financial Centre. DIFC Law No. 2 of 2024 (Digital Assets Law). **[12]** Dubai International Financial Centre. DIFC Law No. 2 of 2025 (amending the DIFC Wills and Probate Registry Rules). **[13]** DIFC Wills Service Centre. Digital Assets Will: Product Note, 2023. **[14]** Financial Action Task Force (FATF). Updated Guidance for a Risk-Based Approach to Virtual Assets and VASPs. Paris: FATF, 2021. **[15]** Kingdom of Saudi Arabia. Basic Law of Governance. Royal Order No. A/90, 1992. **[16]** Kingdom of Saudi Arabia. Law of Evidence. Royal Decree No. M/43 of 2022. **[17]** Kingdom of Saudi Arabia. Personal Data Protection Law. Royal Decree No. M/19 of 2021, as amended 2023. **[18]** Knight Frank. The Wealth Report 2024. London: Knight Frank, 2024. **[19]** KPMG and Agreus. Global Family Office Compensation Benchmark - Middle East Edition. 2024. **[20]** PwC Middle East. Family Business Survey - GCC Edition. Dubai: PwC, 2024. **[21]** Saudi Central Bank (SAMA). Rules Governing Open Banking, 2022. **[22]** UAE Federal Decree-Law No. 51 of 2024 concerning the Regulation of the Waqf Sector. **[23]** UAE Federal Law No. 35 of 2022 on Evidence in Civil and Commercial Transactions. **[24]** United Kingdom. Property (Digital Assets etc.) Act 2025. **[25]** UK Law Commission. Digital Assets: Final Report. Law Com No. 412. London: HMSO, June 2023. --- # How MENA HNIs Are Planning Their Digital Legacy URL: https://www.blockwill.io/blog/how-mena-hnis-are-planning-their-digital-legacy Author: Ishan Shukla (Co-Founder & Head of Strategy) Category: Estate Planning Published: 2026-05-08 Reading time: 14 min > By 2030, roughly $1 trillion will change hands across MENA families, and only 24% have a real estate plan. Why a will is no longer enough, and how digital legacy infrastructure protects what matters most across crypto, accounts, and family memories. Why a will is no longer enough - and what the GCC's $1 trillion wealth transfer needs next. By 2030, roughly one trillion US dollars will change hands across the families of the Middle East and North Africa. It will be the largest wealth transfer this region has ever seen. And by every credible measure, the families involved are not ready. Only **24% of MENA HNIs** have a comprehensive estate plan in place. Among GCC family businesses, the figure is even sharper - just **18%** have a real succession plan. Behind those numbers sit thousands of widows, sons and daughters who, when the moment comes, will not know where to look. Not for the keys. Not for the documents. Not for the passwords, the wallets, the accounts, the property deeds, or the wishes of the person who has just left them. I want to tell you about a man named **Stefan Thomas**. Somewhere in San Francisco, he stares at a USB drive worth roughly **777 million dollars** that he cannot open. He has used eight of his ten password attempts. After two more, the drive will erase itself, and the fortune will sit on the blockchain forever - visible, untouchable, eternal. I am telling you Stefan’s story not because he is unusual. I am telling you because, in a quieter way, almost every MENA family with digital wealth is one careless moment away from the same outcome. ## The trillion-dollar problem nobody is solving Let us be honest about the scale. The GCC’s wealth has roughly tripled in two decades. UAE HNI wealth alone has surged about **20% since 2022**, now sitting around **700 billion dollars**. Dubai’s financial hub hosts family offices overseeing **1.2 trillion dollars**. The UAE is projected to net nearly **9,800 millionaires in 2025** alone - the highest inflow of any country on earth. And yet, the **Lombard Odier 2025 GCC Succession Planning Survey** found that **49% of HNW families without a plan continue to postpone the process**. Nearly **60% of Saudi HNIs view succession as “a future concern.”** A separate **DIFC, Julius Baer and Euroclear** study found that **73% of wealth holders in the region are unwilling to discuss legacy planning** even with their most trusted advisors. The result is what I call the **silent leakage**. More than half of all wealth transfers in the region face delays. Frozen accounts. Translation costs. Court filings. Family meetings that turn into arguments. Investment positions that drift while paperwork moves at the speed of bureaucracy. This is not an inheritance problem. This is a **coordination problem at civilizational scale**. And the coordination is failing because the tools we have are tools designed for a world where wealth was paper - title deeds, share certificates, locker keys, bank passbooks. That world is gone. ## The new shape of wealth - crypto, accounts, photos Look at any modern MENA HNI’s balance sheet, and you will see how the shape of wealth has changed. **74% of family offices** have invested in or are exploring crypto today, up 21 percentage points in 12 months according to **BNY Wealth’s 2025 Single Family Office study**. **86% of US family offices** became more crypto-curious after the 2024 election. The MENA region - with **VARA in Dubai, ADGM’s regulatory clarity** and the **DIFC Innovation Hub** - is one of the fastest-moving jurisdictions in the world for institutional digital asset adoption. But here is the uncomfortable truth: the same security model that protects your digital wealth from attackers also protects it from your own family. Consider the four cases that should haunt every MENA wealth holder. **Stefan Thomas.** The Silicon Valley programmer who received 7,002 BTC in 2011 for making a video about Bitcoin. He stored them on an IronKey USB drive and lost the password. The drive self-destructs after ten wrong attempts. He has used eight. “I would stay up all night trying different ideas,” he told one journalist, “or just staring at the ceiling for hours.” At 2025 prices, his locked fortune is worth around **777 million dollars**. **James Howells.** A Welsh engineer whose ex-partner, in 2013, accidentally took his hard drive containing **8,000 Bitcoin** to the Newport landfill. After twelve years of legal battles, the UK High Court dismissed his case in January 2025. The drive is buried under 25,000 cubic metres of waste - close to a billion dollars of permanently inaccessible Bitcoin sitting under the Welsh earth. **Gerald Cotten.** The 30-year-old founder of QuadrigaCX, Canada’s largest crypto exchange. Died suddenly in India in December 2018 - twelve days after signing a will that left a 100,000-dollar trust to his two chihuahuas, but no plan for the cold-wallet passwords for **115,000 customer accounts**. Approximately **190 million dollars** of customer assets froze on the blockchain that day. **The North Carolina widow.** Less famous, more important. After her husband’s death, she discovered he held over **200,000 dollars in cryptocurrency**. He never told her where the wallet was. He never wrote down the seed phrase. Her will named her sole heir. The court could not access the funds. They still exist on the blockchain, untouchable. Between **2.3 million and 3.7 million Bitcoin** are estimated to be permanently lost - between **11% and 18% of the entire fixed supply**, worth somewhere between **140 billion and 466 billion dollars** at current prices. Most of these losses had nothing to do with hacks or scams. They were **inheritance failures**. They were people who died, or forgot, or lost a piece of paper. ## The probate trap in MENA If you live in the GCC, you face a layer of complexity most jurisdictions do not. **88% of UAE residents are expats.** Most of them carry assets in two, three or four countries. Most of them are governed by overlapping legal systems - UAE federal law, Sharia personal status law, DIFC common law, ADGM common law, plus the law of their home country. Without a registered will in the UAE, **Sharia inheritance rules apply by default**, regardless of whether the deceased was Muslim. Sons receive twice the share of daughters. Spouses receive fixed minimums. Even distant relatives may have entitlements. For non-Muslim expats, **Dubai Law No. 2 of 2025** has been a meaningful step forward. It granted DIFC Courts exclusive probate jurisdiction over registered non-Muslim wills, including assets located outside the DIFC. DIFC-registered wills now flow through directly to the Dubai Land Department, the RTA and UAE banks - without the historic conversion step through Dubai Courts. But “faster” is not “fast.” A clean DIFC probate still takes weeks. A contested or document-incomplete estate stretches into many months. And for assets held in the wider GCC, in India, in the UK, in Singapore - every additional jurisdiction is a new clock, in a different time zone, in a different language, in a different legal tradition. In the meantime: bank accounts freeze immediately upon notification of death. Joint accounts freeze. Business signing authorities pause. Share registers cannot be updated. School fees come due. Rent comes due. Lawyers and translators come due. Currency moves. Markets move. Family conversations turn from grief to suspicion. The estate value erodes in five quiet ways while heirs wait - legal and translation fees, frozen business operations, currency depreciation, lost investment opportunity, and the most expensive line item nobody puts in a spreadsheet - **family conflict**. **45% of GCC families cite difficulty reaching agreement** as the top barrier to succession. ## What “digital legacy” actually means Most people, when they hear the phrase “digital legacy,” picture a will with a few crypto wallet addresses written in. That is not what we are talking about. A digital legacy is the entire body of electronic information, accounts, assets and identity a person leaves behind. It has two faces. **The financial face** includes crypto wallets, exchange accounts, online brokerage and demat accounts, mutual fund folios, dormant bank accounts in five countries, life and investment-linked insurance policies, NFTs, DeFi positions, IP and royalties, social media monetisation, frequent flyer miles, loyalty points, and - perhaps most critically - **the master password to the email account that controls every other password reset in your life**. **The sentimental face** is photographs, videos, voice notes, journals, the family WhatsApp group, the last text messages, the iCloud library full of two decades of birthdays. In October 2023, an Ohio family discovered that **4,200 photographs of their late father** were locked behind a single master password none of them knew. The financial loss was zero. The human loss was incalculable. The numbers on the planning gap are sobering. Only **24% of internet users with a will mention any online account information** in it. **34% have not shared digital assets with anyone at all**. Only **30% of people in long-term relationships** say their partner could easily access their online accounts after their death. The average person manages between **100 and 168 passwords**. Apple’s Legacy Contact, Google’s Inactive Account Manager and Facebook’s Legacy Contact all exist - and almost no one uses them. We obsess over preserving wealth. We rarely talk about preserving the things that make wealth worth preserving in the first place. ## Why a will is not enough - six places where BlockWill works differently A will is a magnificent legal instrument. It is also approximately five hundred years old in its current form, and it was never designed for a world where 30 to 50% of an HNI’s wealth lives behind passwords. Here are six places where a BlockWill - used alongside a properly drafted will - does work that a will alone cannot. ### 1. A will becomes public during probate. BlockWill is zero-knowledge private. A grant of probate is a public-record event. Your assets, your beneficiaries, your family relationships, the value of your estate - all of it can become visible to anyone who accesses the record. BlockWill applies **zero-knowledge encryption**. The platform itself cannot read what is inside the vault. Only the owner and the people the owner explicitly designates ever decrypt it. For HNI families in the GCC, where privacy is itself a form of capital, this distinction matters. ### 2. A will is silent on existence, location and access. BlockWill provides an ELA roadmap. A traditional will says “all my remaining assets to my spouse and children equally.” That clause is legally elegant. It is operationally useless if your family does not know what assets exist. BlockWill gives them **Existence, Location and Access (ELA)** - every asset is identified, every location is mapped, every access protocol is pre-loaded. ### 3. A will is static. BlockWill is dynamic. A will written in 2018 does not know about the Binance account you opened in 2021, the ADGM-domiciled fund you invested in last year, or the London property you closed on three months ago. Wealth in 2026 is a moving target - passwords rotate, exchanges migrate, hardware wallets get upgraded. Your estate plan must be a **living document**, not a notarised photograph of a moment in time. ### 4. A will depends on probate timelines. BlockWill enables conditional automated release. Even fast-tracked probate takes weeks. Onshore or contested probate takes 12 to 18 months. BlockWill’s **VaultRelay** engine releases information conditionally - when the right verifications are present, when the right people are designated, on the timetable the asset owner chose. The court catches up later. The family does not have to wait. ### 5. A will should not carry login credentials. BlockWill encrypted vaults are built for them. Every reputable estate lawyer in the world will tell you the same thing - never write passwords or seed phrases into your will. The will becomes a public record, and you have effectively published a theft invitation. So the will stays silent on the very keys that unlock the most valuable layer of a modern HNI’s wealth. BlockWill’s encrypted vault is purpose-built for this layer - seed phrases, two-factor backup codes, hardware-wallet PINs, password manager master passwords, biometric workaround instructions. ### 6. A will can be contested, lost or forged. BlockWill creates blockchain-anchored evidence of intent. **DigiWish** creates an immutable, time-stamped, cryptographically signed record of the testator’s intent at the moment of capture. It does not replace the legal will. It strengthens it. Every recorded intent has a blockchain anchor, which makes it dramatically harder to challenge in court. Several jurisdictions - including Singapore, India and UAE common-law courts - have already accepted blockchain-anchored timestamps as electronic evidence. ## What MENA HNIs actually hold - and how a digital legacy fits A typical MENA HNI’s balance sheet is a mosaic of asset classes, scattered across jurisdictions. Each asset class has its own way of going missing. - **Real estate.** Properties in Dubai, Abu Dhabi, Riyadh, London, New York, Mumbai. Sale deeds, title deeds, mortgages, rental agreements live in four different drawers in four different cities. A digital vault holds the documents and the GPS coordinates of where the originals are stored. - **Cash holdings.** MENA family offices hold notably more cash than their North American or European counterparts, partly driven by Sharia constraints on interest-bearing instruments. A typical HNI carries three to six banking relationships across Switzerland, London, New York, Singapore and Dubai. Account numbers, RM contacts, signing authorities all need a single source of truth. - **Family business equity.** For first and second-generation GCC families, this is still the dominant asset class. Family-owned businesses generate around **60% of UAE GDP**. Shareholding registries, shareholder agreements and key-person succession notes are exactly the kind of information that should never depend on the memory of one person. - **Public and private equities.** Multi-broker accounts in IBKR, Saxo Bank, Indian demat accounts, US 401(k)s. **28% of MENA family office allocations** sit in private equity - cap tables, SPV memberships, drawdown commitments need to be preserved. - **Digital assets.** The highest-stakes category. Seed phrases, hardware-wallet PINs, exchange MFA backups. The category most likely to be wiped out by a single moment of forgetfulness. - **Art, watches, classic cars, jewellery, gold.** Provenance documents and certificates of authenticity matter as much as the objects themselves. - **Offshore trusts and foundations.** DIFC, ADGM, Jersey, Cayman, BVI structures. Trust deeds, foundation charters, trustee contact lists. - **Sharia-compliant investments.** About **31% of MENA family offices** follow Sharia principles. Sukuk holdings, halal funds and zakat instructions all belong in the inventory. For each of these, the question is the same - when you are no longer here to tell your family what exists and where to find it, what will tell them? ## BlockWill is not a will. It is digital legacy infrastructure. Let me be precise about this, because it is the most important thing in this entire essay. A DIFC will, an ADGM will, a Sharia-compliant will, a UK will, an Indian will - these are the products of lawyers, courts and centuries of precedent. They do exactly the work they were designed to do. What BlockWill does is three things. It produces **electronic evidence - DigiWish** - that supports the testator’s intent, anchored to blockchain so that the time, the content and the signature cannot be quietly altered. It **prepares, protects and preserves** asset information across encrypted vaults, so that what exists is documented, what is documented is encrypted, and what is encrypted is preserved. It provides **Existence, Location and Access** - the ELA framework - to your beneficiaries, on your timetable, on your terms, when (and only when) the time is right. What BlockWill complements, never replaces, is the work of your private client lawyer, your DIFC or ADGM will, your private bank or family office, and the probate court. We call this the **techno-legal bridge** - the layer between the certainty of blockchain and the trust of established legal frameworks. It does not compete with either. It connects them. ## Armies are for physical safety. BlockWill is for digital safety. Civilisations have always understood physical safety. We built castle keeps, royal seals, treasury vaults, gold reserves, standing armies. We invest billions in defence ministries because reactive defence - calling for help when the enemy is at the gate - almost always fails. Standing armies exist before the war. Strong walls exist before the siege. This is the most expensive lesson in human history, and we learned it at scale. We have not yet learned it for digital wealth. The threats are real and well-known. Lost passwords. Forgotten seed phrases. Master keys held by one person who is no longer here. Cyberattacks. Estate freezes. Probate delays. Family disputes that begin with “but did Dad ever mention …?” Every one of these is a digital-age siege at the gates of family wealth, and most families are still relying on a paper will written before the iPhone existed. The fall of the Library of Alexandria is the metaphor I keep coming back to. Knowledge that was not intentionally preserved was lost forever. The same is true of a hard drive thrown into a Welsh landfill, an iPhone with a forgotten passcode, or a Binance account whose two-factor backup codes died with their owner. Here is the thing about a standing army - it is not glamorous. It is mostly invisible until it is needed. It is expensive. It requires discipline. And it is the single most important investment a society makes, because the alternative is unthinkable. By 2030, **one trillion dollars** will move across MENA’s families. **Twenty-four percent** of those families have a real estate plan. The other **seventy-six percent** are gambling with the most important transfer of their lives. You should not be among them. If you are a family principal, a family office head, a private banker or a wealth manager in the GCC - let us have the conversation that **73%** of your peers are still avoiding. The earlier you have it, the more your family will thank you for it. That is the work. That is what we built **BlockWill** to do. --- # When Trust Outlives the User URL: https://www.blockwill.io/blog/when-trust-outlives-the-user Author: Ritu Raj (CISO) Category: Security Published: 2026-05-07 Reading time: 7 min > Trust at the most fragile moment in a family's life has to be provable, not promised. How HIPAA, SOC 2, and ISO 27001 shape the audit-readiness of a digital inheritance platform, and why BlockWill engineers compliance as architecture, not a checkbox. **When Trust Outlives the User: How HIPAA, SOC 2, and ISO 27001 Shape the Audit-Readiness of a Digital Inheritance Platform** By the CISO, BlockWill www.blockwill.io Imagine the moment a daughter logs in for the first time after losing her father. She doesn’t see a marketing page or a feature tour. She sees the keys to a life: crypto wallets, account credentials, advance directives, a video message recorded for her birthday. In that moment, she isn’t evaluating UX. She’s deciding whether to trust the platform that her father trusted with everything. That moment is the entire job of a digital inheritance platform. It is also the reason **audit readiness** isn’t a checkbox at BlockWill. It is the architecture. A digital inheritance platform sits at the intersection of identity, finance, and sometimes health. We hold what people leave behind. We trigger access at the most fragile moment in a family’s life. The standards that govern us, **HIPAA**, **SOC 2**, and **ISO 27001**, exist because trust at that scale has to be provable, not promised. This post walks through what each standard covers, what auditors actually look for, and how BlockWill engineers **digital platform security** that holds up when it matters most. ## Why Audit Readiness Is the New Baseline Five years ago, “we take security seriously” was a marketing line. Today, it is a procurement requirement. Enterprise customers, fiduciaries, banks, and estate attorneys won’t sign with a platform that can’t show its work. Regulators, insurers, and partners expect evidence, not assertions. Audit readiness means three things: - You know which controls apply to your platform. - You can produce evidence on demand. - Your operations match what your documentation claims. Done well, it becomes a competitive moat. Done poorly, it is the reason a deal dies on legal review. ## HIPAA: When Health Data Enters the Inheritance Equation The **Health Insurance Portability and Accountability Act (HIPAA)** governs protected health information (PHI) in the United States. Any platform that creates, receives, maintains, or transmits PHI on behalf of a covered entity becomes a Business Associate, and inherits real legal exposure. For a digital inheritance platform, HIPAA shows up in surprising places: - Advance directives, living wills, and DNR documents. - Medical instructions left for caregivers or heirs. - Health insurance and provider login information. - Genetic data and ancestry records passed to descendants. **Common audit considerations: **access controls and unique user IDs, encryption at rest and in transit, audit logs of every PHI touchpoint, breach notification procedures, and signed Business Associate Agreements with every subprocessor. **Real-world implication: **A single unencrypted backup or a missing access log can convert a routine inquiry into a multi-million-dollar enforcement action. Once a single user uploads a medical document, HIPAA stops being optional. **Actionable takeaway: **Inventory every data field. If health information could plausibly land in your system, even as a free-text note, design for HIPAA from day one. ## SOC 2: The Operational Standard Buyers Actually Ask For **SOC 2**, governed by the AICPA, evaluates how a service organization protects customer data across the Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy. SOC 2 is what enterprise prospects ask for first. A **Type I** report shows your controls are designed correctly at a point in time. A **Type II** report, usually covering 6 to 12 months, shows those controls actually operated as intended. **Common audit considerations: **vendor risk management, change management, access reviews, incident response, business continuity testing, and continuous monitoring. Auditors are looking for repeatable processes, not heroics. **Real-world implication: **SOC 2 is the most common procurement gate for SaaS. Without it, your sales cycle stalls. With a clean Type II report, you compress security review from months to days. **Actionable takeaway: **Don’t wait until a deal demands it. Map your controls now. Begin evidence collection at least six months before your target audit window. ## ISO 27001: The Global Lens on Information Security **ISO/IEC 27001** is the international standard for an Information Security Management System (ISMS). Where SOC 2 attests that controls work, ISO 27001 certifies that you have a living management system designed to keep them working. The 2022 update introduced 93 controls across four themes: organizational, people, physical, and technological. It sharpened the focus on cloud security, threat intelligence, and data leakage prevention. **Common audit considerations: **documented risk assessments, statement of applicability, internal audits, management reviews, and a clear improvement loop. Certification requires a Stage 1 documentation review and a Stage 2 implementation audit, then surveillance audits annually. **Real-world implication: **ISO 27001 is the standard your European, Asian, and global enterprise customers expect. For a platform that holds inheritance data spanning jurisdictions, it signals that your security posture is governed, not improvised. **Actionable takeaway: **Treat your ISMS as a product. Assign owners. Hold quarterly management reviews. Certification is a milestone; the system is the asset. ## Where the Three Standards Overlap, and Where They Don’t The three frameworks share a common spine: access control, encryption, logging, vendor management, incident response. Roughly 60 to 70 percent of evidence is reusable across them. But the differences matter: - **HIPAA is law.** Non-compliance carries fines and criminal exposure. - **SOC 2 is an attestation.** The auditor opines on what you do. - **ISO 27001 is a certification.** A registrar attests that your management system meets the standard. A platform that runs all three together, in one coordinated cycle, beats one that runs them separately, three times. ## How BlockWill’s Security Architecture Maps to the Audit BlockWill is engineered so the controls auditors look for are not bolted on later. They are the platform. Four design pillars do most of the heavy lifting against HIPAA, SOC 2, and ISO 27001 evidence requirements. ### Zero-knowledge encryption Data is encrypted on the user’s device. Only the user holds the keys. No one, including BlockWill, can read or alter the contents. For an auditor, this collapses an entire class of risk: a compromise of our infrastructure would not expose readable customer data. It directly supports the HIPAA confidentiality safeguards under §164.312(a), the SOC 2 Confidentiality criterion, and ISO 27001 Annex A control 8.24 on cryptographic key management. ### Military-grade cryptography AES-256 encryption combined with cryptographic hashing ensures records cannot be modified without authorization. Strong cryptography is the most-cited control across every audit we participate in, and it covers HIPAA integrity controls under §164.312(c), SOC 2 Processing Integrity, and the ISO 27001 cryptography family of controls. ### Verifiable, blockchain-anchored integrity Every wish and instruction is anchored to blockchain, creating a provable history that cannot be forged or tampered with. For audit teams, this is a meaningful upgrade over standard application logs. We can produce a tamper-evident evidence trail on demand, which maps to the HIPAA audit control requirement (§164.312(b)), SOC 2 logging and monitoring criteria, and ISO 27001 logging controls. ### Condition-based access release Smart protocols release access only when predefined conditions are met, never early and never by accident. This is the high-stakes equivalent of role-based and rule-based access control. It satisfies HIPAA access management requirements, the SOC 2 logical access criteria, and ISO 27001 access control objectives. Together, these four pillars give an auditor something most digital platforms cannot offer: a control environment where the evidence is built into the data, not assembled after the fact. That is the difference between passing an audit and being auditable by design. ## Talk to BlockWill If you are evaluating a digital inheritance platform, whether for your family, your firm, or your enterprise customers, ask the hard questions early. Ask for the SOC 2 report. Ask about Business Associate Agreements. Ask how long evidence is retained, and who has access to release it. Or talk to us. Visit [www.blockwill.io](https://www.blockwill.io/) to see how BlockWill protects what people leave behind, and to request our latest security and compliance documentation. Trust outlives the user. We make sure the controls do, too. ## Frequently Asked Questions ### Is BlockWill HIPAA compliant? BlockWill is engineered to meet the HIPAA Security Rule’s technical safeguards, including encryption, access control, and audit logging. Where customers store protected health information on the platform, BlockWill executes a Business Associate Agreement on request. ### Does BlockWill have a SOC 2 report? BlockWill operates against the SOC 2 Trust Services Criteria, with controls designed for a Type II examination window. For the current status of our SOC 2 attestation and to receive a copy under NDA, contact us through www.blockwill.io. ### Is BlockWill aligned with ISO 27001? Our Information Security Management System is built to ISO/IEC 27001:2022 controls. We can share our Statement of Applicability and current certification status on request to support your vendor risk review. ### What protects customer data if BlockWill itself is compromised? Because BlockWill uses zero-knowledge encryption, encryption keys never leave the user’s device. A compromise of our infrastructure would not expose readable customer data. Combined with blockchain-anchored integrity, any unauthorized modification attempt becomes evident and verifiable. ### How can my organization request BlockWill’s compliance documentation? Email [devteam@blockwill.io](mailto:devteam@blockwill.io) or visit [www.blockwill.io](https://www.blockwill.io/) to request our security and compliance package, including SOC 2 documentation, HIPAA safeguards mapping, ISO 27001 control set, and our Business Associate Agreement template. The CISO, BlockWill --- # The Invisible Casualty: Why War Makes Succession Planning a Survival Skill URL: https://www.blockwill.io/blog/invisible-casualty-why-war-makes-succession-planning-survival Author: Ajay Kumar Rastogi (Head of business) Category: Estate Planning Published: 2026-05-04 Reading time: 6 min > When survival becomes the primary goal, succession planning is often the first thing forgotten. In modern warfare, that lapse permanently evaporates generational wealth. Here's why estate planning must evolve into a Doctrine of Asset Survivability. > "The four horsemen of the apocalypse-War, Famine, Pestilence, and Death-do not wait for a convenient time to audit your estate." While the world watches the escalating ballistic exchanges between the countries and the destabilization of various trade routes - the Strait of Hormuz and Red Sea trade routes - a secondary catastrophe is unfolding: the permanent evaporation of generational wealth. When survival becomes the primary goal, succession planning is often the first thing forgotten. However, in modern warfare, a lack of a plan isn't just a legal oversight; it's a single point of failure (SPoF) that can lead to the permanent evaporation of generational wealth. Wealth is not what you own; it is what you can prove you own after the smoke clears. If your proof is currently sitting in a folder in your office, you have already lost. ## The Disintegration of the "Lex Loci Rei Sitae" (Law of the Place Where Property is Situated) In international law, the status of tangible property is governed by the laws of the jurisdiction where it sits. However, in the theatre of modern war, the "state" providing that legal framework is often the primary target. We are witnessing a systemic collapse of traditional legacy architecture. If your succession plan assumes a stable power grid, a functioning land registry, or a safe in a basement, you are not planning - you are gambling with your descendants' future. In the current epoch of polycrisis, characterized by the breakdown of the post-WWII rules-based order, the traditional concept of "estate planning" has become a dangerous anachronism. The intersection of sovereign risk and total warfare has created a vacuum where generational wealth is being systematically liquidated - not by markets, but by the physical and digital erasure of the structures that define ownership. In the present scenario, succession planning must be elevated to a **Doctrine of Asset Survivability**. Traditional succession planning relies on the stability of local institutions. In current conflict zones, this stability has vanished. ## The Institutional Mirage: The "Land Registry" Fallacy Succession planning typically relies on the State to mediate the transfer of assets. But what happens when the State is the target? - **Institutional Collapse:** When a regime or its administrative offices are destroyed, as seen in recent escalations, the path to legal succession becomes a chaotic "civil war" of claims. - **The Figures of Destruction:** In Ukraine alone, the World Bank estimated "damages and losses" exceeded $411 billion in the conflict. This includes the destruction of municipal archives and digital servers, with housing being the most affected sector. This is not just "property damage"; it is the destruction of the physical evidence required for succession. When a country's administrative backbone is hacked or bombed, your "legal right" to an asset becomes an unverifiable ghost. ## The Kinetic Destruction of the "Nexus of Proof" and "Physical Anchor" The shift from conventional to asymmetric warfare - utilizing low-cost suicide drones and precision missiles - has moved the front line to the suburban doorstep. In modern warfare, "home" is no longer a sanctuary; it is a coordinate. The use of high-velocity missiles and loitering munitions (drones) has rendered traditional document storage obsolete. - **The Paper Fallacy:** Most families store "original" documents in bank lockers or home safes. In a high-intensity fire resulting from a drone strike, even UL-rated safes fail. Without the "Original Copy," the legal hurdle for heirs to prove entitlement in a post-war, chaotic environment becomes insurmountable. - **The Risk:** A single strike on a residential or commercial district doesn't just destroy property; it incinerates the nexus of proof. Deeds, physical share certificates, and even "fireproof" safes (rated for standard house fires, not thermobaric blasts) are obliterated. ## The Psychological Blind Spot: "Not Today" The greatest jargon in succession planning is the **"Procrastination Premium."** People view death and war as distant outliers. However, in today's context it has become the baseline. - **The Reality:** By the time you see the drones on the horizon, it is too late to move your wealth. You are no longer an "investor"; you are a "displaced person." - **Forced Migration:** Millions are fleeing with only what they can carry, often leaving behind deed documents, share certificates, and physical records. ## The Digital Paradox: Web3 and the "Seed Phrase" Trap While digital assets like Bitcoin and Ethereum are theoretically portable, they introduce a lethal vulnerability in war zones: the **Seed Phrase**. - **Single Point of Failure (SPOF):** Storing a 12 or 24-word recovery phrase on a single piece of paper or a standard hardware wallet creates a catastrophic SPOF. If that paper burns or the device is lost during a hasty evacuation, the wealth is gone forever. - **Seed Phrase Destruction:** Missile and drone attacks do not distinguish between a family heirloom and a crypto backup. Standard materials like paper or plastic are easily destroyed in the high-intensity fires typical of modern strikes. - **Web3 Loss:** Many who flee leave their digital "map" behind, effectively burning their own digital bank without a way to rebuild it elsewhere. With the current "multipolar" global landscape - marked by the systemic economic shocks from the Iran War, the closure of the Strait of Hormuz, and the continued volatility in Europe and Asia - death planning has shifted from a "someday" task to an urgent matter of financial survival. In a world where ₹11 lakh crore (1.1 trillion) can be wiped from a single market in weeks and digital infrastructure is under constant threat of hybrid strikes, "losing" an asset because no one knows it exists isn't just a mistake - it's a permanent loss of family wealth. ## Why Urgency is Non-Negotiable Right Now **The "Invisible" Asset Crisis:** Today, wealth is often held in decentralized crypto wallets, offshore digital platforms, or fractionalized shares. In a conflict scenario where communication lines might be disrupted or digital platforms restricted, if your heirs don't have the specific keys or login protocols, those assets effectively vanish into the digital void. ## Solution **BlockWill** provides a decentralized digital inheritance infrastructure designed to protect assets from the physical and institutional collapse caused by modern conflict. It utilizes blockchain-immutable records and secure digital vaults to replace traditional, vulnerable paper-based succession planning. For more details, visit [**BlockWill**](https://blockwill.io/). --- #BlockWill #EstatePlanning #AssetSurvivability #GenerationalWealth #SuccessionPlanning #RiskManagement #WealthPreservation #Polycrisis --- # SecureVault Walkthrough: Uploading Your First Sensitive Document URL: https://www.blockwill.io/blog/securevault-walkthrough-uploading-first-sensitive-document Author: Bhavya Gosai (Head of Product) Category: Product Published: 2026-04-24 Reading time: 7 min > Your seed phrase, your trust deed, your insurance policy, they all need to live somewhere your family can reach them when you can't hand them over yourself. SecureVault encrypts every file on your device before it ever touches a server. This walkthrough shows you exactly what happens at every step. You have a document that matters. A trust deed. A seed phrase backup. A life insurance policy. The kind of file you would not email, would not drop into Google Drive, and would not leave unencrypted on a laptop your kids borrow for homework. It needs to live somewhere that is encrypted, tamper-evident, and reachable by your family when the time comes. That is what SecureVault was built for. This walkthrough covers the full journey of uploading your first sensitive document into SecureVault. What happens at each step, what the encryption actually does, and why the server never sees your file in readable form. ## What is SecureVault? SecureVault is BlockWill's zero-knowledge document vault. You store sensitive files (estate documents, crypto wallet backups, financial records, insurance policies) and every file is encrypted on your device before it leaves your browser. BlockWill cannot read your data. No employee, no server process, no government subpoena can produce a plaintext copy, because the plaintext never reaches our infrastructure. The encryption runs entirely in your browser using the Web Crypto API, the same cryptographic engine built into Chrome, Safari, Firefox, and Edge. Your vault is unlocked with a hardware-backed passkey (Touch ID, Face ID, or a YubiKey) so there is no password to phish and no master password sitting in a database somewhere. If you have completed KYC verification and set up at least one vault key, you are ready to upload. ## Step 1: Open your vault ![BlockWill dashboard SecureVault tab showing vault list and create vault button](https://pub-8948680abcbc4fd18c6c64ca81bb98ef.r2.dev/blog/securevault-walkthrough/1.webp) Navigate to the SecureVault tab from your dashboard. If this is your first time, you will see a prompt to create a new vault. Give it a name. "Personal Estate Documents," "Crypto Backups," whichever makes sense for how you organize your life. ![Touch ID biometric prompt when unlocking a SecureVault vault](https://pub-8948680abcbc4fd18c6c64ca81bb98ef.r2.dev/blog/securevault-walkthrough/2.webp) When you open an existing vault, your browser will prompt you to authenticate with your passkey. On a MacBook, that means Touch ID. On an iPhone, Face ID. On a YubiKey, a physical tap. What happens under the hood is more interesting than the fingerprint scan suggests. Your passkey does not simply prove your identity. It performs a cryptographic operation called PRF (Pseudo-Random Function evaluation). The hardware key computes an HMAC-SHA-256 using an internal secret that never leaves the device, combined with a salt unique to your vault. The 32-byte output becomes your Key-Encryption-Key (KEK), which unwraps your vault's master key from our database. The master key loads into your browser's memory as a non-extractable CryptoKey object. It cannot be read even by JavaScript running on the same page. You see a fingerprint prompt. The system sees a three-layer key hierarchy resolving itself without a single byte of key material crossing the network in plaintext. ## Step 2: Pick your file ![SecureVault add asset form with category selection for organizing sensitive documents](https://pub-8948680abcbc4fd18c6c64ca81bb98ef.r2.dev/blog/securevault-walkthrough/3.webp) Click "Add Asset" and you will enter a guided form. SecureVault organizes files by category, including Legal Documents, Financial Records, Digital Assets, Insurance, and Personal. You select a category, then a type within that category, then an optional subtype. For a trust document, that path might look like: Legal Documents, then Trust Documents, then Living Trust. The form adapts to your selection. A crypto wallet backup asks different questions than a property deed. You fill in the relevant metadata fields (names, dates, reference numbers, notes) and then you reach the file picker. ![SecureVault add asset form with all fields](https://pub-8948680abcbc4fd18c6c64ca81bb98ef.r2.dev/blog/securevault-walkthrough/4.webp) Drag your file in or click to browse. SecureVault accepts PDFs, images, Word documents, spreadsheets, and most common file formats, up to 100 MB per file. There is one deliberate restriction: SVG files are blocked, because SVG is an XML format that can carry embedded scripts, making it a vector for cross-site scripting that has no place inside a document vault. Your file sits in browser memory. It has not been uploaded yet. It has not been sent anywhere. What happens next is the part that matters. ## Step 3: Client-side encryption ![SecureVault progress modal where encryption and upload happens](https://pub-8948680abcbc4fd18c6c64ca81bb98ef.r2.dev/blog/securevault-walkthrough/5.webp) When you hit submit, the first thing that happens is not an upload. It is encryption. Your browser reads the file into an ArrayBuffer, raw binary data in memory. Then it calls the Web Crypto API's `encrypt` method with three inputs: the algorithm (AES-256-GCM), a freshly generated 12-byte initialization vector (IV), and your vault's master key. AES-256-GCM is the cipher specified in NIST Special Publication 800-38D. It is an authenticated encryption mode, which means it does not just scramble the data. It also produces a 16-byte authentication tag that is mathematically bound to both the ciphertext and the IV. If a single bit of the encrypted file is altered after encryption, the authentication tag will not match during decryption, and the operation will fail. This is not a feature you enable. It is how GCM works by default. The 12-byte IV is generated using `crypto.getRandomValues()`, a cryptographically secure random number generator provided by the operating system. Every file gets its own IV. Even if you upload the same document twice, the ciphertext will be completely different, because the IV is different. An attacker observing your encrypted files cannot tell whether two files contain the same content. After encryption, your browser also computes a SHA-256 hash of the encrypted data. This hash serves as a fingerprint, a way to verify later that the file stored on the server is exactly what your browser uploaded, byte for byte. At this point, the original file data is gone from the pipeline. Everything that follows (the upload, the storage, the database record) operates on ciphertext that is indistinguishable from random noise without the master key. ## Step 4: Upload to cloud storage Your browser requests a pre-signed upload URL from BlockWill's server. The server checks four things before issuing one: that your session is valid, that the file size is within your plan's storage limit, that the MIME type is in the allowlist, and that your organization has not exceeded its storage quota. If all checks pass, the server generates a time-limited upload URL that expires in 15 minutes. The encrypted file is then uploaded directly to cloud storage as an `application/octet-stream` blob. The Content-Type is deliberately generic. Because the file is encrypted, the actual format is irrelevant and should not be disclosed. The upload goes straight from your browser to storage. It does not pass through BlockWill's application servers as an intermediary, which means there is no point in the pipeline where an unencrypted file could be intercepted. Once the upload completes, the server creates a database record linking the file to your vault, including the storage key, the SHA-256 hash of the ciphertext, the file size, and the user who uploaded it. An encrypted audit log entry is created using a separate encryption key reserved for audit data. ## Step 5: Metadata encryption and verification ![SecureVault upload complete with all verification steps confirmed](https://pub-8948680abcbc4fd18c6c64ca81bb98ef.r2.dev/blog/securevault-walkthrough/6.webp) Your file is stored. But SecureVault also maintains an encrypted metadata index for each vault, a JSON structure listing every file, its category, its tags, its IV, and any form fields you filled in. This metadata is encrypted with the same master key, using a fresh 12-byte IV, and uploaded to a separate path in cloud storage. The IV is prepended to the encrypted blob so it can be extracted during decryption. When you open your vault next time, this metadata file is downloaded and decrypted in your browser to populate the file list. The server never parses it, because the server cannot decrypt it. For trust documents and wills, SecureVault goes a step further. A cryptographic hash of the document is recorded on the Polygon blockchain, creating timestamped, immutable proof that this exact version existed at this exact moment. If a dispute arises about which version of a trust was current, the blockchain record settles it. The hash does not reveal the document's contents. It simply proves they have not changed since the timestamp. ## What the server actually sees After you upload a document, here is what exists on BlockWill's infrastructure: A blob of encrypted data that is computationally indistinguishable from random noise. A SHA-256 hash of that blob. A database record noting the file size, the upload timestamp, and the vault it belongs to. An encrypted audit log entry. An encrypted metadata file that the server cannot parse. There is no plaintext. There is no file name in the clear. There is no way to determine whether the file is a PDF or a JPEG, a trust deed or a grocery list. The master key exists only in your browser's memory, protected as a non-extractable CryptoKey, and it is cleared when you lock the vault or close the tab. If BlockWill's servers were compromised tomorrow, an attacker would find encrypted blobs, encrypted metadata, and encrypted audit logs. They would need your passkey, a physical device performing a hardware-backed cryptographic operation, to derive the KEK and unwrap the master key. ## Why this matters for your family ![Unlocked SecureVault with the list of assets added](https://pub-8948680abcbc4fd18c6c64ca81bb98ef.r2.dev/blog/securevault-walkthrough/7.webp) SecureVault is not a personal password manager. It is estate infrastructure. When you store a document in SecureVault, you are not just protecting it from attackers today. You are making it available to your family through VaultRelay, BlockWill's inheritance trigger system, when you are no longer around to hand it over yourself. Your executor confirms a triggering event, or the inactivity timer you configured runs out, and VaultRelay releases the decryption keys to the people you designated. They get access to the same vault, with the same files and organizational structure you built, decrypted in their own browser using vault keys that were securely provisioned during setup. The document you uploaded five minutes ago, or five years ago, reaches your family exactly as you stored it. Verified by its SHA-256 hash, authenticated by its GCM tag, and timestamped on the blockchain if it was a will or trust. That is what uploading a file to SecureVault actually does. It is not a file upload. It is a commitment, cryptographic, legal, and personal, that what you stored will reach the people who need it, intact and private, on the day it matters most. ## Frequently Asked Questions ### What is SecureVault? SecureVault is BlockWill's zero-knowledge document vault for sensitive estate and financial documents. Every file is encrypted on your device with AES-256-GCM before it ever leaves your browser, so BlockWill's servers only ever see encrypted bytes. It is built specifically for documents your family will need when you are no longer around to hand them over yourself. ### What does zero-knowledge encryption mean in plain English? It means BlockWill has zero knowledge of what is inside your files. The encryption keys live in your browser, protected by your hardware passkey. No employee, no server process, and no court order can produce a plaintext copy of your documents, because the plaintext never reaches our infrastructure in the first place. ### What file types and sizes can I upload to SecureVault? SecureVault accepts PDFs, images, Word documents, spreadsheets, and most common file formats up to 100 MB per file. SVG files are deliberately blocked, because SVG is an XML format that can carry embedded scripts and has no place inside a document vault. ### Why does SecureVault use a passkey instead of a password? Passwords get phished, reused, written down, and forgotten. A passkey is a hardware-backed credential (Touch ID, Face ID, or a YubiKey) that never leaves your device. It performs a cryptographic operation called PRF to derive your vault's Key-Encryption-Key, which means there is no master password sitting in a database for an attacker to steal. ### What happens if I lose my passkey or device? This is why SecureVault supports multiple vault keys. You can register more than one passkey (for example, your laptop, your phone, and a backup YubiKey) so losing one device does not lock you out. If you lose all of your registered keys, BlockWill cannot recover your vault, because we do not hold the keys. That is the trade-off zero-knowledge requires, and it is why redundant key registration matters. ### Can BlockWill recover my files if I forget how to access them? No. By design, BlockWill cannot decrypt your vault. The master key that unlocks your files is wrapped by a Key-Encryption-Key derived from your passkey, and that derivation only works on a device holding your registered hardware key. This is the same property that protects you from a server breach, and the reason registering multiple keys is important. ### Where are my encrypted files actually stored? Your encrypted files are uploaded directly from your browser to cloud storage using a short-lived pre-signed URL. They never pass through BlockWill's application servers as an intermediary. What gets stored is an encrypted blob, a SHA-256 hash of that blob, and a database record with the file size and vault association. The actual file format and contents are never visible to us. ### How is SecureVault different from Google Drive, Dropbox, or a password manager? Google Drive and Dropbox encrypt files in transit and at rest, but they hold the keys, which means their staff, their automated systems, and any party with legal leverage can theoretically access your data. Password managers are built for short secrets, not 100 MB documents. SecureVault is built specifically for sensitive long-form documents with client-side encryption and inheritance triggers, so the same vault that protects you today also reaches your family when it matters. ### What is AES-256-GCM and why does SecureVault use it? AES-256-GCM is the authenticated encryption standard specified in NIST SP 800-38D. "Authenticated" means it does not just scramble the data, it also produces a 16-byte tag bound to both the ciphertext and the initialization vector. If a single bit of your encrypted file is altered after upload, decryption will fail loudly rather than silently returning corrupted data. Every file gets its own random 12-byte IV, so two uploads of the same document produce completely different ciphertexts. ### How do my family members access my vault when I am no longer around? SecureVault works with VaultRelay, BlockWill's inheritance trigger system. When a triggering event is confirmed (executor verification, the inactivity timer running out, or another condition you configured), VaultRelay releases the decryption keys to the people you designated during setup. They get access to the same vault, with the same files and folder structure, decrypted in their own browser using vault keys provisioned for them. ### Is the name of my file visible to BlockWill? No. File names, categories, tags, and any form fields you fill in are stored inside an encrypted metadata index for each vault. The index is encrypted with the same master key and uploaded as a separate blob. The server cannot parse it, so the only thing visible server-side is an opaque blob, a hash, and a size. ### Are wills and trusts treated differently from other documents? Yes. For wills and trust documents, SecureVault also records a cryptographic hash of the document on the Polygon blockchain. This creates a public, timestamped, immutable proof that the exact version existed at the exact moment you uploaded it. The hash reveals nothing about the document's contents, but it ends any future dispute about which version is current. --- **Further reading:** - [The Security Standard That Protects Your Crypto, Accounts, and Family's Future](https://www.blockwill.io/blog/security-standard-protects-crypto-accounts-family), a deeper look at hardware authentication and zero-knowledge encryption across BlockWill. - [Most Families Have No Idea What Assets Exist](https://www.blockwill.io/blog/families-have-no-idea-what-assets-exist), why documenting your assets in SecureVault matters for inheritance. - [NIST SP 800-38D: Recommendation for GCM Mode](https://csrc.nist.gov/publications/detail/sp/800-38d/final), the specification behind AES-256-GCM authenticated encryption. - [Web Crypto API, MDN Web Docs](https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API), the browser cryptography engine SecureVault runs on. --- # KYC for Digital Estate Planning: Sumsub, OPAQUE, and the Compliance Stack That Keeps Wills Safe URL: https://www.blockwill.io/blog/kyc-digital-estate-planning Author: Kumar Deepanshu (COO) Category: Security Published: 2026-04-23 Reading time: 11 min > A plain-English guide to KYC in digital estate planning. How Sumsub, OPAQUE, and field-level encryption protect your digital will from sign-up to inheritance. Imagine handing your will to a stranger and asking them to keep it safe for thirty years. Then imagine trusting that, when the time comes, they'll give it only to the right person and only after proving who that person is. That is the job a digital estate planning platform signs up for the moment you create an account. And the tool that makes the whole thing possible is something most people only know as a sign-up annoyance: **KYC**. This guide is for anyone curious about how KYC in digital estate planning actually works whether you're a user about to write a digital will, a founder building in this space, or just someone who wants to understand why a website is asking for your passport. We'll walk through three pieces that do the heavy lifting  **Sumsub, OPAQUE, and a compliance stack** built on **HIPAA, SOC 2, ISO 27001, GDPR, and AML**  in plain language. No jargon dumps. Promise. ## First, what does KYC even mean? **KYC** stands for **Know Your Customer**. It is exactly what it sounds like: the platform needs to know who you are before it trusts you with something important. You've done KYC before, even if you didn't call it that. Opening a bank account, signing up for a crypto exchange, getting a new phone number each one asked for ID, maybe a selfie, maybe a utility bill. That's KYC. It started as an anti money laundering rule for banks, and it has since spread to any service that handles money, identity, or legal documents. **KYC for digital estate planning** takes those same basic ideas and adapts them to something a regular bank never has to worry about: the person being checked will one day die, and the document being stored has to survive decades, multiple family members, lawyers, and possibly a court. So in this world, KYC is not a sign-up hurdle. It's the first thread in a long chain of trust. ## Why estate planning is a different kind of KYC problem A bank only needs to know who you are today. An estate planning platform needs to know who you were then, who you are now, who your executor is, who your beneficiaries are and has to stand behind all of that years after you're gone. Four things make **digital estate planning** harder than regular identity verification: - **The main person eventually isn't around.** You can't log back in to re-confirm your identity after you've passed away. Whatever the platform captures at sign-up has to hold up in front of a probate court decades later. - **There are many people involved.** A single digital will might include you, an executor, witnesses, beneficiaries, guardians for children, and a legal partner. Every one of them needs to be identified, and each gets a different level of access. - **Access is time-locked.** Beneficiaries aren't supposed to read your will while you're alive. The system has to keep the document sealed and only release it when the right trigger happens usually a verified death certificate. - **The data is deeply personal.** Wills often include health records, financial details, government IDs, and private wishes. If any of that leaks, it's not just embarrassing it's a legal event under HIPAA, SOC 2, or ISO 27001. This is why **digital will security** can't rest on any single tool. It needs a stack. ## The compliance stack, explained like you’re a normal human Before the tech, here are the big rulebooks any serious estate platform has to play by. If you've ever seen a long "trust and security" page with a bunch of acronyms, this is what's behind it. - **HIPAA**  a US law that protects health information. Your advance directive or living will might include medical wishes, so anything PHI (Protected Health Information) has to be encrypted and access-logged. - **SOC 2 Type II**  a yearly audit, done by an independent firm, that checks security, availability, and privacy controls. It's how enterprises decide whether to trust a vendor. - **ISO 27001**  an international standard for information security management. Think of it as the hygiene checklist for a security-first company. - **GDPR (especially Article 17)**  the "right to be forgotten" in the EU. Estate platforms have to balance erasure requests with the need to retain legally required records. - **AML / FATF guidance**  Anti-Money-Laundering rules set by the Financial Action Task Force. The good news: FATF now explicitly allows digital identity verification and biometric checks, which is what makes fully online KYC legal. Getting one of these right is a project. Getting all five right at the same time only works if the platform was designed that way from day one. Now let's look at the three layers that actually do the work. ## Layer 1: Sumsub, the bouncer at the door Every secure building has a bouncer. **Sumsub** is that for digital estate planning. **Sumsub KYC** is a verification platform used by fintechs, crypto exchanges, and marketplaces worldwide. When you sign up for a platform like BlockWill, the verification flow you go through is powered by Sumsub behind the scenes. Here's what it actually does: - **Document check.** You photograph a passport, national ID, or driver's licence. Sumsub reads the machine-readable zone, examines holograms and fonts, and flags any sign of tampering or forgery. - **Selfie + liveness.** A short video selfie confirms a real, living person is holding the document not a printout, a photo of a photo, or a deepfake. - **Face match.** The selfie is compared to the photo on the ID. A high match passes; a borderline case gets escalated to a human reviewer. - **Sanctions and AML screening.** Your name and date of birth are checked against global sanctions lists, politically-exposed-person (PEP) databases, and adverse media. - **Optional video KYC.** For unusual documents or higher-risk regions, a trained Sumsub agent can verify you live over video. The magic trick for estate planning is **verified identity history**. Sumsub doesn't just say "this person is verified today." It records *that* a specific person, holding a specific document, was verified on a specific date. Years later, when your executor presents a death certificate and asks to activate your will, that old verification becomes part of the legal chain. It's the online equivalent of the lawyer who remembers you from the day you signed the paper version. ## Layer 2: OPAQUE, the password your platform can’t read Sumsub proves you're a real human. The next layer protects your secret: your password. Here's a problem most people never think about. In a normal login system, you type your password into a form. It travels across the internet (encrypted, hopefully) to a server. The server hashes it and stores the hash. For a brief moment, the raw password exists outside your device. If the server is compromised during that moment, or if the hashing is weak, everything leaks. That is where the **OPAQUE protocol** comes in. OPAQUE stands for **Oblivious Pseudo-random function Asymmetric PAKE**. Don't panic here's what it actually means in one sentence: OPAQUE lets the server verify your password **without ever seeing it**. Not at sign-up. Not at login. Not ever. - Your password stays on your device. A piece of math is sent instead. - The server stores a scrambled envelope that's useless on its own. - The server can still confirm you typed the right password, kind of like a zero-knowledge proof. - Even if hackers steal the whole database, they can't brute-force the envelopes with rainbow tables, because every user has a unique salt only their password can unlock. OPAQUE was standardised by the IETF in 2022. Facebook Messenger and WhatsApp already use it to secure encrypted chat backups. Serious estate planning platforms use it because your password is what unlocks the master key to your encrypted vault. If the server ever saw it, one bad log line could expose everything. With OPAQUE, that attack simply doesn't exist. The difference matters. It's the gap between "we promise we don't read your password" and "we mathematically can’t read your password." Only one of those holds up in court and under a real breach. ## Layer 3: Field-level encryption and audit trails, the vault Sumsub is the bouncer. OPAQUE is the lock. The third layer is the vault where your data actually lives. **Field-level encryption (AES-256-GCM).** Most apps encrypt the whole disk and call it a day. Estate platforms go further. Every sensitive field your ID number, your address, your health notes, your will contents is encrypted individually before it hits the database. If a hacker steals a full database dump, they get rows of unreadable ciphertext and no master key. **Searchable hashing.** But some fields need to be looked up for example, "does this email already exist?" The platform solves this with deterministic hashing. The system can confirm a match without decrypting anything. Useful, private, and fast. **Encrypted audit logs.** Every time someone reads, writes, or updates a piece of data, the system writes a line to an append-only audit log. That log is itself encrypted with a separate key. This gives you and any court a tamper-evident history of who touched what and when which is exactly what **estate planning compliance** under SOC 2, HIPAA, and ISO 27001 requires. **Role-based access control (RBAC).** A beneficiary only sees what they're supposed to see, and only after the trigger event. An executor gets broader access, but only after a verified death certificate. A legal partner sees only what you shared with them. Even platform staff cannot read will contents not your tech support, not the CEO. ## How the three layers work together: a walk-through Here's what actually happens when you create a digital will on a well-built platform: - **You sign up.** You enter name, email, and a password. OPAQUE runs right in your browser, so your password never leaves your device. - **You verify your identity.** You're sent into a Sumsub flow document, selfie, liveness, AML check. A minute later you're KYC-verified. - **Your vault is created.** Your password derives a master key. The master key wraps a will-specific key. That key encrypts every field of your will. - **You add the cast.** Executors, and beneficiaries are invited. Each one completes their own KYC with Sumsub before they can be attached to your will. - **Everything is stored encrypted.** The database holds only AES-256-GCM ciphertext. Every access is written to the encrypted audit log. - **The trigger event.** When you pass away, a verified death certificate plus executor authentication unlocks the release workflow. Beneficiaries see only the fields meant for them. At no point does the platform see your password. At no point does an unverified person get access. At every point, there's a receipt. ## A simple checklist: is your digital estate platform actually safe? If you're comparing platforms, ask these questions. Good ones answer yes to most. - Is identity verification done by a FATF-aligned provider with biometric liveness not just a document upload? - Is the password protocol PAKE-based (OPAQUE or similar)? Does the server *ever* see your plaintext password? - Is data encrypted at the field level, not just at the disk level? - Are audit logs immutable, encrypted, and retained for at least seven years? - Is the platform SOC 2 Type II audited? ISO 27001 certified? - Is HIPAA considered for health-related fields like advance directives? - Does RBAC enforce time-locked and event-triggered release to executors and beneficiaries? - Can you exercise GDPR erasure rights without wrecking the audit trail? ## The takeaway A paper will sits in a drawer. A digital will has a harder job: stay safe, stay verifiable, and stay accessible for decades often without the person who created it around to vouch for it. That is only possible when three independent layers cooperate. **Sumsub** proves who you are. **OPAQUE** keeps your password out of the server's hands. **Field-level encryption and immutable audit logs** guard the data and every access to it. Underneath them, **HIPAA, SOC 2, ISO 27001, GDPR, and AML** frameworks keep the whole system honest. Get this stack right and a digital will isn't a weaker version of a paper one. It's a stronger one because every signature, every access, and every handoff is cryptographically provable. That's the real promise of **KYC in digital estate planning**: not friction at sign-up, but trust that outlives you. --- # How BlockWill Secures Your Wish Without Ever Seeing It URL: https://www.blockwill.io/blog/zero-knowledge-inheritance-how-blockwill-works Author: Anish Prashun (CTO) Category: Security Published: 2026-04-21 Reading time: 13 min > BlockWill stores your wish, but BlockWill cannot read it. Here is the full picture of how zero-knowledge inheritance works, explained like you are ten, then one layer deeper. BlockWill stores your wish, but BlockWill cannot read it. BlockWill holds your documents, but BlockWill cannot open them alone. BlockWill keeps your instructions permanent, but BlockWill cannot secretly change them. This is what zero-knowledge inheritance means, and it is the foundation that everything else at BlockWill is built on. Most online vault services operate like a filing cabinet with a very big lock. Their security promise is that they will guard the cabinet carefully. The problem is that the people guarding the cabinet also hold the key. If they get hacked, the cabinet opens. If an employee goes rogue, the cabinet opens. If a court orders them to unlock it, the cabinet opens. BlockWill does not work like that. BlockWill is built so that the people running BlockWill cannot open the cabinet, even if they wanted to, even if they were forced to, even if the company itself was broken into. Your wish is locked before it ever reaches us, kept locked while we store it, and unlocked only when the exact people you named, under the exact conditions you set, combine what they have. This post is the map for how that actually works. We will explain it the way you would explain it to a ten year old, then go one layer deeper for readers who want to understand the engineering behind it. Over the next four posts in this series, we will zoom into each of the four pieces in detail. This one is the overview. ## The four promises, in plain language Every BlockWill vault carries four guarantees, and every guarantee maps to a specific engineering decision. Before we explain the engineering, it helps to see the promises together. **Promise 1. BlockWill cannot read your wish.** The document is locked on your device, not ours. The key to unlock it never leaves you. **Promise 2. No single person can open your wish, not even us.** The vault carries multiple locks, one tied to each guardian you name. No one guardian, acting alone, can open anything. **Promise 3. Your wish cannot be secretly changed.** Every version of your wish leaves a fingerprint on a public record. If one letter of your wish moves, the fingerprint stops matching. **Promise 4. Your wish releases itself at the right moment, not before.** The unlocking is not done by a person deciding. It is done by a system watching for the conditions you set, confirming them, then executing the handover automatically. Read those four promises out loud. That is the entire system. Everything else, the cryptography, the storage, the blockchain, the triggers, exists to make those four sentences true in the real world. ## A ten year old's version Imagine you have a treasure, and you want to keep it safe for the people you love. You put the treasure inside a box with a very strong lock. You do not give the key to the bank, because banks get robbed. You do not give the key to one friend, because friends lose keys. You do not give it to a lawyer, because lawyers retire. Instead, you do something clever. You put several locks on the box, not just one. You give a different key to a different person you trust, your sister, your best friend, your accountant. Alone, each key opens nothing. Nobody can open the box by themselves. Not even you, after you have handed the keys out. But when enough of the trusted people bring their keys and turn them together, the box opens. Now there is one more problem. How do the people you love know the box has not been swapped out for a different box while nobody was looking? How do they know the wish inside is the real wish you wrote, and not a fake someone slipped in? So you do one more clever thing. You take a picture of the box, a very special picture, one where even the smallest scratch on the box would show up. You nail that picture to a giant, public wall in the town square. Thousands of people walk past that wall every day. Nobody can take the picture down. Nobody can change it. Years later, when the box is opened, anyone can walk up to the wall, look at the picture, and check that the box is exactly the same box you sealed all those years ago. Finally, you write a rule for when the box should be opened. Not a person. A rule. The rule says: if I stop answering for long enough, or if the people I chose as my guardians confirm something has happened, or if a specific date arrives, then the box opens. The rule does not forget. The rule cannot be bribed. The rule simply watches, and when the conditions are met, it acts. That is BlockWill. ## Now, one layer deeper The treasure is your wish. The box is your vault. The lock is encryption. The multiple locks and the guardian keys are how access is distributed across your guardians. The public wall is the blockchain. The rule that watches is what we call the release logic. Here is how each piece actually works, in order, without getting technical. ## The lock: encryption done before the wish leaves your device When you write your wish inside BlockWill, your computer or phone locks it before anything is sent to our servers. The lock is built on your device, using a key that only you control. By the time the data reaches us, it is already unreadable. This is sometimes called client-side encryption, and it is a very different arrangement from what most services do. Most services encrypt your data on their servers, which means they hold the key. We do not. We never did. If you walked up to our data center tomorrow and copied every hard drive, you would walk away with a pile of locked boxes and no way to open them. This solves the most dangerous class of problem in online services, the inside job. A rogue employee cannot peek at your wish because a rogue employee does not have the key. A hacker cannot steal your wish because even if they get the stored data, the stored data is locked. A court cannot force us to reveal your wish because we cannot reveal what we cannot read. We will cover this in depth in the next post in this series. ## The guardians: no single person holds the power to open Locking the wish is only half the problem. The other half is: when the time comes, who unlocks it? If the answer is "you alone," then your wish is inaccessible the moment you cannot use it. That is the whole point of having a wish in the first place, it must work when you cannot. If the answer is "BlockWill," then we are right back where every other service lives, holding the power to read everything. If the answer is "a single guardian," then that guardian becomes a single point of failure. They could be pressured. They could be lost. They could act alone, in bad faith. BlockWill's answer is that the vault carries multiple locks, one tied to each guardian you name. Each guardian holds their own key. When the time comes, enough of those guardians must come together and present their keys. No guardian alone can open the vault. Not even us. We hold the locked vault, but not a single one of the keys that open it. BlockWill also goes a step further. Having enough guardian keys is necessary, but it is not sufficient. The system also verifies that every key presented is genuinely that guardian's, unaltered and uncopied. If a guardian produced a fake, or if a key were tampered with between the moment it was issued and the moment it was used, the system would detect it, and the vault would refuse to open. Every unlock is both quorum-checked and integrity-checked. That second check is the difference between a vault that trusts the guardians blindly and a vault that trusts but verifies. It is what lets BlockWill protect your wish not just from outsiders, but from any single bad actor inside your own circle. We will cover this in depth in a later post. ## The public wall: a fingerprint of your wish, not your wish itself We said the blockchain acts as a public wall. It is worth being precise about what is on that wall and what is not. Your wish is not on the blockchain. Your documents are not on the blockchain. Your assets, your beneficiaries, your instructions, none of that is on any public record. What is on the blockchain is a fingerprint. Every time you finalize a version of your wish, BlockWill generates a tiny code that uniquely corresponds to that exact version of that exact document. Change one word, one comma, one character in the document, and the fingerprint changes entirely. That fingerprint, and only the fingerprint, is recorded on a public, permanent ledger. Later, when your family or executor receives the unlocked wish, they can run the same check. They take the wish they were handed, generate its fingerprint, and compare it to the one on the public wall. If the fingerprints match, the wish is authentic, unaltered, and unambiguously yours. If they do not match, something was changed, and everyone will know. This is how BlockWill makes your intent tamper-evident without putting any of your private information in a public place. ## The release: a rule, not a person The last piece is the one most people ask about. How does the vault actually open when the time comes? BlockWill does not have a person behind a desk deciding when your family gets access. It has a rule you set, and a system that watches for the conditions of that rule. You choose the conditions when you set up your vault. You can designate guardians who, together, can attest that something has happened to you. You can set a silence trigger, if you do not respond to BlockWill's check-ins for a defined period, the release process begins. You can set a fixed date, a final failsafe, so that even in the most extreme scenarios, your family is not locked out forever. When any of those conditions is met, the system begins the release. The locked vault, the guardian keys, the fingerprint on the public wall, all of it comes together, exactly as you designed it, exactly when you intended it. No one person decides. No one person can be bribed or coerced into triggering early or blocking a legitimate release. The rule is the rule, and the rule runs on math, not on memory. ## Why this is different from every other online will service Most online will services are, at their core, a filing cabinet with their company's name on the lock. They store your wish. They protect it as best they can. They trust their employees, their contractors, their infrastructure providers. When they say "your data is secure," they mean "we are doing our best to keep it secure." BlockWill is a different shape. BlockWill is built so that you do not need to trust us. We are not the lock, we are not the key, we are not the decider. We are the vault, the ledger, and the mechanism. The power to read your wish lives with you while you are alive, and with your people after you are not. A wish should outlive the company that stores it. BlockWill is designed to make that true. ## What this means for the people you love If something happens to you tomorrow, your family should not be starting a detective story. They should not be guessing which exchange holds your crypto, which drawer holds your seed phrase, which email inbox received the most recent statement. They should not be waiting eighteen months for probate to release assets that are depreciating every day. They should not be wondering which version of your wish is the real one, or whether someone altered it after you signed it. Zero-knowledge inheritance is BlockWill's answer to that. Your wish is secured before it ever reaches us, locked behind guardians you chose, verified by a public record nobody can tamper with, and released by conditions only you defined. When it opens, your family gets clarity. Not clues. Not guesses. Clarity. ## What comes next in this series This post has been the map. Over the next four weeks, we will zoom into each piece of the system in its own post. **Next week, the locked box.** What client-side encryption actually is, why it matters that BlockWill's servers never hold your key, and how this single decision eliminates an entire class of risks that other services quietly carry. **Week three, the guardian lock.** How BlockWill distributes access across the people you trust, why "enough of them together" is the right model, and how every guardian key is not just counted but verified, so that a single bad actor inside your circle cannot force open your vault. **Week four, the public notary.** How BlockWill uses blockchain to prove your wish has not been changed, without ever putting your wish, or any part of it, on any public record. **Week five, the release.** How a BlockWill vault unlocks itself at exactly the right moment, the triggers you can configure, and the failsafes that make sure your family is never locked out. Each post will stand alone, and each will link back here, to the map. ## Frequently asked questions **Does BlockWill ever see my wish?** No. Your wish is locked on your device before any of it reaches BlockWill. The key required to unlock it never leaves your control. When the data arrives on our servers, it is already encrypted, and BlockWill has no means to decrypt it. **If BlockWill goes out of business, what happens to my wish?** Your wish is locked behind guardian keys held only by the guardians you named, not by BlockWill. Because the blockchain record of your wish's fingerprint is on a permanent public ledger, and because your guardians can still come together to unlock it, your wish's security is not tied to BlockWill's continued existence. **Can a court force BlockWill to hand over my wish?** A court can force BlockWill to hand over the data we store, and we would comply with any lawful order. What a court cannot do is force us to produce something we do not have. The key to decrypt your wish is not ours. A court order would result in encrypted data with no usable information. **Is my wish stored on the blockchain?** No. Only a fingerprint of each version of your wish, a short code that changes completely if the wish changes, is written to the blockchain. The wish itself, along with all personal details, beneficiaries, and instructions, stays encrypted in BlockWill's storage and is never placed on any public record. **What if one of my guardians loses their key?** BlockWill's design allows the vault to be unlocked when any sufficient number of your guardians is available, so losing a single guardian's key does not prevent release. You choose the number of guardians and the number required to come together, and you can update your guardian configuration at any time while you are active. **How is this different from storing my wish in a password manager?** A password manager protects one person's access. Inheritance requires controlled access for someone other than you, under specific conditions, potentially years in the future, without compromising security in the meantime. Password managers are not designed for that problem. BlockWill is. **Does "zero-knowledge" mean BlockWill uses zero-knowledge proofs?** Zero-knowledge is used in two related senses in the cryptography world. At BlockWill, it refers to an architecture in which the service provider has no knowledge of the contents it stores for its users, the provider cannot read, decrypt, or reveal the data, even to itself. Zero-knowledge proofs are a specific cryptographic technique that can be used inside such an architecture. The important promise, from a user's perspective, is the one BlockWill makes: we do not see your wish. **How do I get started with BlockWill?** BlockWill is live. You can book a demo from the BlockWill homepage to see the product in action, walk through the vault setup, and get a full look at the guardian configuration and release controls described in this series. --- # Decree 41: Estate Planning Rewritten URL: https://www.blockwill.io/blog/uae-decree-41-estate-planning-rewritten Author: Ishan Shukla (Co-Founder & Head of Strategy) Category: Estate Planning Published: 2026-03-18 Reading time: 6 min > A registered UAE will under Decree 41 answers the question of entitlement. BlockWill answers the question of access: how the entitled party comes into functional possession of keys, credentials, custody arrangements, and device-gated assets, on a verifiable trigger event, without any single human being ever holding the full picture. A British banker dies in Dubai Marina at 54. He leaves a will drafted in London, UAE real estate, a DIFC account, an unexamined end-of-service gratuity, and a Ledger wallet holding seven figures of Bitcoin in a drawer. His widow assumes the London will controls everything. It does not. Until February 2023, that assumption was defensible. Today, under UAE Federal Decree Law No. 41 of 2022 on the Civil Personal Status (the "Civil Law"), it is a serious planning error. The Civil Law reshapes inheritance, succession, and wills for every non-Muslim expat, resident foreigner, and non-resident foreigner holding assets in the UAE. For estate planners, it is the most consequential shift in Emirati private client practice in a generation. ## What the Civil Law actually changed Before 2022, the default for any estate in the UAE was Shari'a. Unless a non-Muslim affirmatively opted out through a registered will, Shari'a principles of forced heirship could be applied, including fixed shares for male and female heirs that often bore little relation to the deceased's intentions. Decree 41 flips the default. For non-Muslims, whether UAE nationals, residents, or non-residents with UAE-situs assets, the civil framework applies automatically. Equality between male and female heirs is now the express statutory position, and the testator enjoys freedom to designate beneficiaries for their estate within the UAE, subject to registration. Three ideas sit at the heart of the reform: party autonomy, gender equality, and procedural certainty. A non-Muslim can now plan their UAE estate with the same conceptual architecture they would use in London, Mumbai, or Geneva. ## What happens when there is no will Decree 41 answers the question most expats never ask: what is the default? Article 11 supplies a civil formula. Half of the estate devolves to the surviving spouse. The other half is distributed equally among the children, with no differentiation between sons and daughters. If there are no children, the estate passes to the parents, or, if one parent has predeceased, half to the surviving parent and half split between siblings. This sounds orderly. In practice, it is a trap. The formula assumes a single nuclear family with no second marriages, no stepchildren, no unmarried partners. It does not accommodate the blended households that define modern expat wealth. And it overrides any home-country intestacy rule unless an heir actively petitions for foreign law to apply and can prove its content to the UAE court, a process that is expensive, slow, and uncertain. For the banker in our opening scenario, the default means his estranged first wife, technically still on the marriage certificate, may walk away with half. His partner of eleven years, with whom he never formally remarried, receives nothing. ## The asset classes a will cannot reach Even a properly drafted and registered UAE will does not, by itself, solve the modern wealth problem. Certain asset classes fall outside the practical scope of a traditional testamentary instrument, either because the law says so, because the asset requires operational access no document can provide, or because the custodian sits in a jurisdiction the UAE court cannot easily reach. **Digital assets in self-custody.** A Ledger or Trezor wallet secured by a seed phrase is legally property. DIFC case law has now confirmed that. But if the seed phrase dies with the testator, the property is economically extinct. No will, however elegantly drafted, can compel the blockchain to surrender what only the private key can unlock. **Exchange-held crypto and custodial accounts.** Binance, Kraken, and local VARA-licensed exchanges typically require KYC-gated beneficiary processes, two-factor authentication devices, and recovery email access. A will names the heir; it does not hand over the phone. **End-of-service gratuity and pension designations.** These pass by contract and beneficiary nomination, not by will. If the nomination form on file with the employer names a long-divorced ex-spouse, that is who is paid, regardless of what the will says. **Joint accounts and survivorship assets.** Under UAE practice, joint bank accounts are typically frozen on death pending probate. Survivorship is not automatic, and the will has no role until the freeze is lifted. **Digital identity, cloud storage, IP, and loyalty assets.** Apple ID, Google Workspace, domain registrations, unreleased manuscripts, iCloud photo libraries, and frequent-flyer miles all live behind terms of service that a will cannot override. Access dies with the password. **Foreign-situs assets.** Shares in an offshore holding company, a London flat held in a BVI structure, a Swiss private bank account - all of these require coordination with the lex situs. A UAE will is a UAE instrument. It does not automatically speak in Zurich or Jersey. Estate planning has quietly become two problems, not one. The legal problem - who inherits - is largely solved by a well-drafted, registered will under Decree 41. The operational problem - how the heir actually takes possession - is not. Wills were invented for a world of land, gold, and paper certificates. They were not invented for a world where the most valuable thing you own is a twelve-word sentence you cannot write down. ## Where BlockWill fits BlockWill exists precisely at that fault line. It is not a replacement for a will; it is the infrastructure that makes a will actually work in a digital economy. A registered UAE will under Decree 41 answers the question of entitlement. BlockWill answers the question of access: how the entitled party comes into functional possession of keys, credentials, custody arrangements, and device-gated assets, on a verifiable trigger event, without any single human being ever holding the full picture. The architecture is deliberate. Cryptographic splitting ensures no single party, including BlockWill itself, can unilaterally unlock a vault. Stakeholder roles - Asset Manager, Executor, Beneficiary, Guardian - mirror the real-world distribution of trust in a well-governed estate. Triggering events are evidentiary, not discretionary. The result is something the twentieth century never had: a legacy-design infrastructure that sits underneath the will, activates with it, and carries modern wealth across the threshold of death without leaving crypto orphaned, passwords lost, or beneficiaries locked out of what the law already says is theirs. ## The planner's takeaway Decree 41 has given non-Muslim expats in the UAE something they did not have before: a coherent, civil, gender-neutral framework for inheritance, under the testator's own control. That is a genuine advance, and every planner should be drafting and registering wills under it. But the reform also exposes, rather than fixes, the operational gap that has been widening for a decade. The next frontier of estate planning is not testamentary. It is infrastructural. The sooner the profession treats digital access as a first-order planning problem, the fewer seven-figure wallets will be buried with their owners. --- # The Legal Tug-of-War: Nomination vs. Succession URL: https://www.blockwill.io/blog/legal-tug-of-war-nomination-vs-succession Author: Ajay Kumar Rastogi (Head of business) Category: Estate Planning Published: 2026-03-13 Reading time: 9 min > In Indian estate planning, people assume that naming a nominee is enough. It isn't. A nominee is a trustee, not an owner, and when digital assets enter the picture, even legal ownership means nothing without access. In the landscape of Indian estate planning, a common misconception keeps getting repeated: that appointing a "nominee" is enough to pass assets on. It isn't. Indian courts have been unambiguous about this for decades. A nominee is an administrative bridge, nothing more. Succession is the legal foundation that actually decides who owns what. And in the last few years, a third variable has quietly rewritten the whole conversation: accessibility. In the Web3 age, legal entitlement means nothing if no one can open the wallet. This piece walks through how the law draws that line, where digital assets break the framework, and what a modern solution has to look like. ## The legal hierarchy: custodianship vs. ownership The core conflict is between a "trustee" and a "beneficiary." **The nominee is the gatekeeper.** As established in Smt. Sarbati Devi v. Smt. Usha Devi (1984) and reaffirmed in Shakti Yezdani v. Jayanand Jayant Salgaonkar (2023), a nominee is merely a custodian. They provide a valid discharge to banks, insurers, and registrars so those institutions can release assets without waiting for probate. But the nominee holds those assets in trust for the legal heirs. They do not own them. **The legal heir is the owner.** Ownership is governed by the Indian Succession Act, 1925, or by personal laws depending on the deceased's religion and the nature of the estate. A legal heir is the person entitled to absolute ownership under the rules of testamentary or intestate succession. Their rights are permanent. They can sell, transfer, rent, or gift the inherited property. This is the only "affirmative" title recognised by the courts. **There are narrow statutory exceptions.** Under the Insurance Laws (Amendment) Act, 2015, "beneficial nominees" - specifically immediate family members named on a life insurance policy, gain absolute ownership of the policy proceeds. This is one of the rare places where nomination aligns cleanly with conclusive succession. **Real estate follows the trustee rule.** In Co-operative Housing Societies, a nominee may be granted immediate possession of a flat so the society can keep its membership records clean. But possession is not ownership. The nominee must eventually hand the flat over to whoever is named in the Will or entitled under succession law. **Shares follow the same rule.** Following the Shakti Yezdani decision in 2023, it is now settled that nomination in shares does not grant absolute ownership to the exclusion of legal heirs. The depository or registrar will transmit shares to the nominee, but the nominee holds them on behalf of the people who actually inherit them. ## Digital sovereignty: nomination vs. succession in the Web3 era The rise of Web3 assets - cryptocurrencies, NFTs, monetised digital accounts, on-chain identities, has created a legal vacuum that traditional estate planning was never designed to fill. Traditional assets rely on a settled "nominee as trustee" framework. Digital assets usually have no nomination feature at all, which makes succession the only affirmative path to ownership. And even then, ownership on paper does not guarantee access in practice. **Most decentralised wallets have no nomination field.** MetaMask, Phantom, Rabby, Rainbow, none of them let you name a beneficiary. There is nobody at the other end of the line to honour the nomination even if you wrote one down. **Centralised exchanges treat nominees as custodians.** Even on CEXs that do allow you to register a nominee, that nominee is legally a custodian. They may receive the funds, but they are still bound to pass them on to the rightful heirs. **Self-custody crypto and NFTs have no built-in nomination.** Assets held in cold storage, hardware wallets, or paper backups are bearer instruments. Without the private key or seed phrase, those assets are lost forever on the day the owner dies, no matter how clearly the Will names an heir. **Licensed digital goods are not inheritable at all.** Accounts on platforms like Spotify, Apple TV, Kindle, or Audible are non-transferable licenses. They typically expire with the account holder. There is nothing to nominate and nothing to inherit. **Privacy data is not the same as property.** The Digital Personal Data Protection (DPDP) Act, 2023 introduces a "Right to Nominate" for data management - the ability to memorialise or delete a loved one's digital presence. Useful, necessary, long overdue. But this is a right over privacy, not a right over the economic value sitting inside those accounts. ## Succession is the conclusive process, not nomination The Supreme Court has ruled on this more than once, and the position has not moved. A nominee holds property in trust for the legal heirs. A nominee is legally bound to transfer that property to them once their status is established. Nomination is a convenience for the institution releasing the asset. Succession is the mechanism that decides who actually owns it. When families skip over this distinction, they create the exact situation that litigation thrives on: two or more people with plausible claims and no clear instruction. ## The litigation burden Roughly 76% of civil litigation in India stems from property and family disputes. Clear succession documents - a properly drafted Will, identified heirs, documented assets, are the single most effective preventive tool available. Your Will overrides your nominations wherever you intend it to. That sentence is the one most families never hear in time. A well-drafted Will protects your family from the legal maze of contested inheritance, from the slow grind of probate, and from the much slower grind of internal family disagreement about what you "really wanted." ## The Web3 gap: assets without nominees Modern assets - cryptocurrencies, NFTs, digital keys, monetised content, creator-economy income, do not fit into the traditional nomination framework at all. **The "lost" problem.** A bank account without a nominee can still be recovered. The heir files for a Succession Certificate, waits six to twelve months, pays two to three percent of the account value in court fees, and eventually gets access. Slow and expensive, but recoverable. A self-custody wallet without a private key is not recoverable. Not by a court, not by a lawyer, not by the exchange, not by anyone. **Roughly 20% of Bitcoin is gone forever.** Chainalysis estimates that around 3.7 million BTC has been permanently lost - largely because owners died or lost access without a succession plan. That is not a statistic about hacks or scams. It is a statistic about the absence of basic planning. **The legal vacuum around VDAs.** Virtual Digital Assets are taxed at 30% in India under the VDA tax regime, which means the state treats them as real property with real value. And yet they frequently exist outside the physical Will, creating what can only be described as "shadow estates" - assets heirs cannot access, cannot claim, and in many cases, never even learn about. ## Solving the crisis: the BlockWill approach Traditional Wills fail the digital age for one specific structural reason: they become public documents during probate. Listing a private key or seed phrase inside a Will is security suicide. Anyone reading the probate record can drain the wallet before the heir ever sees a rupee. BlockWill is designed to close that gap by merging legal validity with cryptographic security. **Aligning the legal heir with the digital recipient.** BlockWill lets you create a Smart Will where the person who inherits the asset on paper is also the person who inherits the access in practice. There is no "middleman" nominee standing between the heir and the wallet. The legal entitlement and the technical access move together. **Automated succession through blockchain triggers.** Traditional Wills rely on manual execution - somebody reading the document, somebody else enforcing it, courts eventually stepping in. BlockWill uses blockchain-based triggers. If a user is inactive for a defined period, or if an executor confirms a qualifying event, the smart contract executes. Assets do not get lost to the void just because nobody knew where to look. **Privacy-first legal planning.** BlockWill stores your intent and legal instructions on-chain while keeping the sensitive access data itself encrypted. Your heirs inherit the instruction to unlock; they do not inherit a public record of how. This prevents the "public probate" problem where the heirs' own digital security is compromised the moment the Will is filed. **A unified inventory.** BlockWill clubs traditional asset records - property, insurance, bank accounts, mutual funds, with Web3 wallets, NFTs, creator-economy accounts, and domain portfolios. A single, legally defensible framework covering the entire estate, instead of a Will for the "real" assets and a prayer for the digital ones. ## What this actually changes Nomination alone will not pass your wealth on. It never did, and Indian courts have said so since 1984. In the Web3 era, even a properly drafted Will is not enough on its own, because legal entitlement without accessibility is just a piece of paper describing something nobody can open. The modern answer has three parts: a clear succession plan that names the right heirs, an inventory that actually includes digital assets, and a secure mechanism that delivers access at the right moment to the right people. Move beyond simple nominations. Avoid the "single point of failure" in your estate planning. Do not let your legacy turn into a tug-of-war between beneficiaries, assets, and access. That is what BlockWill is built for. --- # Most Families Have No Idea What Assets Exist. Here's How to Fix That Before It's Too Late URL: https://www.blockwill.io/blog/families-have-no-idea-what-assets-exist Author: BlockWill Team (Editorial) Category: Digital Assets Published: 2026-01-10 Reading time: 12 min > Your family knows about the house. They know about the car. But do they know about the $47,000 sitting in your Coinbase account? Modern wealth doesn't live in one place anymore. Your family knows about the house. They know about the car. But do they know about the $47,000 sitting in your Coinbase account? The Amazon storefront that brings in $3,000 every month? The life insurance policy you signed up for three years ago and never mentioned? Modern wealth doesn't live in one place anymore. It's scattered across platforms, accounts, and jurisdictions that most families don't even know exist. And when something happens - when life becomes uncertain, that wealth doesn't get transferred to the people you love. It just vanishes. ## How wealth became invisible Twenty years ago, you could count your wealth on one hand. A bank account. A house. Maybe some stocks you bought through a broker. A car. That was it. Most people could list everything they owned in under five minutes. Today, try the same exercise. Start with the obvious things - your checking account, your mortgage, your 401(k). Now keep going. There's the crypto wallet you opened in 2020 when everyone was talking about Bitcoin. The Substack newsletter you started that now brings in a few hundred dollars a month. The Amazon FBA business you launched during lockdown. Stock options from your last company that vested but you haven't touched. Those domain names you bought on a whim that might actually be worth something. Your Roth IRA that auto-debits every month. The HSA you opened for tax benefits. Four thousand dollars in airline points you've been saving. That life insurance policy you clicked through online one night and honestly forgot about. None of it is in one place. Most of it doesn't have a paper trail. And you're not hiding any of it - you're just living your life, working, building things, moving money between platforms the way everyone does now. There's never been a moment where you sat down and made a master list of everything. Why would there be? But to your family, all of that is completely invisible. And when something happens, they won't know where to start looking. ## Matthew Mellon had $500 million in crypto. His family spent three years trying to access it. In 2018, Matthew Mellon died suddenly at 54. He was a banking heir, an early crypto investor, and by all accounts, a sophisticated guy when it came to money. His estate was estimated to include $500 million in cryptocurrency. His family knew the crypto existed. They knew it was worth a fortune. They had lawyers, they had resources, they had every possible advantage in this situation. It still took them three years to access it. Three years of legal battles. Three years of probate proceedings. Three years of watching Bitcoin swing from $6,000 to $60,000 and back down while they couldn't touch a single coin. The estate was frozen while his family tried to prove ownership, locate wallets, recover seed phrases, and navigate a legal system that had absolutely no framework for dealing with digital bearer assets. This was a sophisticated investor with significant wealth, and the system still completely failed his family. If it can happen to someone like Matthew Mellon, what happens to everyone else? ## The three ways inheritance breaks down When someone dies or becomes incapacitated, families run into the same three problems every single time, and each one is worse than the last. **First, they don't know what exists.** An industry study found that roughly 28% of families have no idea where all of their loved one's assets are located during estate administration. There's no central registry, no master list that gets automatically generated when someone dies. If you don't know to look for something, you won't find it. And most people have assets they've never told anyone about - not because they're trying to hide anything, but because the conversation never came up. **Second, even when they suspect something exists, they don't know where to look.** Which crypto exchange did he use? Which brokerage? Which email is the login tied to? Is that business registered under his personal name or some LLC he set up? Which bank? Which country? One person might have accounts spread across Coinbase, Binance, MetaMask, a Ledger hardware wallet, and a paper wallet buried in a safe deposit box somewhere. If they die tomorrow, how does anyone know which platforms to even start checking? **Third, even when they figure out what exists and where it is, they still can't get in.** Passwords are unknown. Two-factor authentication is tied to a phone that's been wiped or recycled. Platform terms of service explicitly prohibit account sharing, even when you show up with a death certificate. Companies demand court orders, and even when you get one, many of them still refuse. Google has denied families access to deceased loved ones' accounts. Instagram has locked out surviving spouses. Coinbase has cited company policy to block legitimate heirs who showed up with every piece of legal documentation imaginable. The probate process in the United States takes 18 to 24 months on average, and during that entire time, crypto portfolios are swinging wildly, businesses are shutting down, subscription income is stopping, and value is eroding. If you have assets across borders - property in one country, crypto in another, bank accounts in a third, the timeline stretches into years. You're dealing with multiple legal systems, multiple jurisdictions, and compounding delays at every step. ## When someone is incapacitated but not dead Here's something most people never think about until it happens to them: death isn't the only event that triggers all of this. Incapacitation can be just as catastrophic. We've heard from people dealing with this firsthand. In one case, a husband had a stroke and ended up in a vegetative state. His wife has been fighting through the court system for three years just trying to get access to their accounts - accounts they both assumed would simply work when they needed them. They don't. She's already dealing with the trauma of her husband being incapacitated, and now she's battling the legal system on top of it. The system is designed for two states: fully alive and capable, or dead. There's no middle ground, and when you're stuck in that middle ground, everything breaks down. ## Between 20% and 40% of all Bitcoin is gone forever Chainalysis estimates that at least 20% of all Bitcoin that's ever been issued is permanently lost. Not hacked, not stolen, just lost. Because someone died and no one knew the seed phrase. Because a hard drive crashed and there was no backup. Because a piece of paper got thrown away during a move. Because the owner went into a coma and can't tell anyone where the wallet is. Cryptocurrency is what's called a bearer asset, which means whoever physically holds the private key owns it outright. There's no bank to call, no customer service department, no recovery mechanism. If you lose access to the key, the money is gone forever. This is by design, it's what makes crypto secure and decentralized in the first place. It's also what makes inheritance nearly impossible without an actual plan. You can't just put your seed phrase in a will that goes through probate, because probate becomes public record. Anyone could look it up, see the seed phrase, and drain the wallet before your family ever gets access. You can't give it to your lawyer either, because whoever has the seed phrase has complete control over the funds - they could disappear to the Cayman Islands the next day and there's nothing anyone could do about it. You can't even store it in a regular password manager, because what happens if you're incapacitated and your family can't get into the password manager itself? The security model that makes crypto work and the inheritance model that families need are fundamentally incompatible with each other. Nobody's figured out how to solve that problem, until now. ## What BlockWill actually does We built BlockWill to solve all three of those problems - existence, location, and access, in a single platform that works the way modern wealth actually works. **SecureVault** is where you document every asset you own. Not just the house and the car, but everything. The Coinbase account. The MetaMask wallet. The Amazon business. The life insurance policy you get through your employer. The domain portfolio. The startup equity. The investment accounts spread across three different countries. For each asset, you don't just list it - you explain it. Where is it located? What's the login? What's the two-factor authentication method? If it's crypto, where's the seed phrase stored, and how does someone who's never touched crypto in their life actually access it? You leave instructions that are step-by-step and written in plain language, because the person inheriting your assets might not know what MetaMask is. They might not know how to import a seed phrase. They might not even know which email account is tied to which platform. Everything you document is encrypted with zero-knowledge architecture, which means we can't read your data and neither can anyone else. It's protected with the same military-grade encryption used by intelligence agencies and secured with phishing-resistant hardware authentication that won't work even if someone clones our website letter-for-letter. **DigiWish** is where you connect your assets to the people you want to have them. This account goes to your wife. This one goes to your kids. This gets split three ways. This goes to your business partner when certain conditions are met. It creates a single, verifiable source of truth about what you want to happen, and because every version of your wishes is hashed and timestamped on the blockchain, there's no confusion later. No conflicting wills from different years. No arguments about what you "really meant." Just an immutable record of your intent that courts are increasingly recognizing as legal proof. **VaultRelay** is what actually gets the information to your family when they need it. You set up three types of triggers: executor confirmation, inactivity detection, and time-based release. If something happens to you, your designated executor can log in and activate the relay manually. Within 24 to 48 hours, everyone you've designated gets instant access to all the information they need. If you don't log in for six months, the system starts sending you alerts, and if you still don't respond after the full period, it triggers automatically - even if your executor dies with you, your family still gets access. You can also set a specific date, like December 31, 2029, and the information will be released then no matter what happens. It's a final failsafe. When any of these triggers activate, your family gets everything. Every asset, every instruction, every piece of access information you've documented. Instantly, privately, and securely. No probate required. No lawyers arguing over what you meant. No family members spending months trying to reconstruct your financial life from old email receipts and bank statements. ## What this actually means for you BlockWill makes the invisible visible. You get to see your entire financial life in one place, know exactly what you're worth, and know where everything actually is. More importantly, you know that if something happens - death, stroke, car accident, disappearance, your family won't spend years fighting through a system that was never designed for the way people live now. Most people don't even realize what they own until they sit down and try to document it. Forgotten accounts. Small investments that have grown over the years. Subscriptions you're still paying for. Assets you didn't realize had any real value. Insurance policies you bought years ago and completely forgot about. BlockWill gives you that complete picture, and it guarantees your family will get it too when they actually need it. --- _Truncated to stay under 200,000 characters for single-request ingestion. Read the remaining posts individually at https://www.blockwill.io/blog, or fetch the summary at https://www.blockwill.io/llms.txt._