Early access is open — third-party risk, findings and risk acceptance are live. Lock in your price
RegulaTrust Logo
RegulaTrust/Compliance

Your compliance programme, ready for inspection

Know what you are assessed against, answer it in plain language, and keep the evidence where an inspector will look for it.

Get early access

Product screens show fictional firms and example data.

§ 1What it does
01

Start from where you stand

The question a board or supervisor asks first: how ready are we, and what is next?

  • Readiness across every framework you subscribe to, counted by control, so a control shared by several laws is one piece of work.
  • The next gap to close, and your open risks on a heat map.
  • Trends recorded every day, and an overview each person arranges around their own job.
02

Choose what you are assessed against

Frameworks are content, not code: a new law is added to the library and you subscribe to the ones that apply.

  • AML/CFT, operational resilience, security and data protection frameworks (see the list).
  • Every requirement cites its source text; content under review is marked as draft.
  • Build and version your own frameworks, imported from a spreadsheet, with a second person’s approval to publish.
03

Answer each control in plain language

Most small firms do not have a trained compliance team.

  • Answer yes, partly or no; “not sure” shows what good looks like instead of forcing a guess.
  • Attach evidence; files are encrypted under your organization’s own key and can be locked against deletion for your retention period.
  • Every answer is attributed to the person who gave it and kept in the control’s history.

One control: the plain-language question beside the formal requirement it comes from

04

Decide what applies, and say why

A Statement of Applicability records which controls apply. Nothing drops out of scope unconsidered.

  • Every control applies until someone records otherwise, with a reason.
  • Excluding a control removes it from that framework’s readiness only.
  • Export the statement for an auditor; the export is fingerprinted and recorded.
05

Run the business-wide risk assessment

Every AML regime asks for a documented assessment of the firm’s own risks.

  • Likelihood and impact on a five-by-five heat map, with an owner and a review date for each risk.
  • Link each risk to the controls that reduce it.
  • Serious findings about suppliers are suggested for the register; a person adds each one.
06

Keep policies approved and current

An inspector asks which version of a policy was in force on a date, and who approved it.

  • Every edit creates a new version; approval names the version that was read, so nobody approves words they did not see.
  • Review dates, owners and follow-up tasks on each policy.
  • Approved policies can be listed on your public trust page.

A policy with a new version waiting for approval

07

Never miss a deadline

Recurring obligations create their own tasks ahead of time.

  • Recurring duties — the annual risk assessment, monthly sanctions checks, staff training — each create a task before it is due.
  • Reminders and escalation follow your own policy.
  • A calendar of tasks, reviews and regulatory reporting deadlines, overdue first.

A calendar of tasks, reviews and regulatory reporting deadlines, overdue first

08

Report incidents on time

DORA, NIS2 and GDPR each set their own reporting clocks.

  • Every applicable clock runs from the moment the incident was detected, overdue first.
  • Add your own incident types for contracts or internal rules.
09

Hand the inspector one pack

  • An inspection pack per framework: each control’s status as the firm’s own assessment, the source of every requirement, who approved the content, and the audit trail’s verification result.
  • Fingerprinted, so the copy an inspector holds can be checked against the record.
  • It says plainly that it is a self-assessment, not a certification.
Inspection pack · one framework
Self-assessment
A self-assessment, not a certification.
  • Control status, as the firm’s own assessment
  • Source of every requirement
  • Who approved the content
  • Audit trail verification result
Fingerprinted
10

AI assistance, when you want it

  • Explain a control in plain words beside its formal text; review uploaded evidence against a control; ask questions about your own records.
  • Off unless your firm turns it on, feature by feature. It suggests; a named person accepts or rejects, and every suggestion is recorded.
§ 2Questions

What people ask

No product can. It helps you meet your obligations and evidence them; you and your supervisor decide whether they are met.

Third-party risk Onboarding, screening, rating, approval and review of suppliers.Audit Audits, a tamper-evident audit trail and a public trust page.Pricing Switch on only the parts you use.
Early access

See your own frameworks in RegulaTrust

We onboard a small number of firms each month, personally.

We’ll email you about early access only. Unsubscribe anytime. See our privacy policy.

Or write to hi@regulatrust.com