Every expectation your regulator publishes, and your answer to each one.
Hold your firm's compliance position expectation by expectation, keep it dated against the rules that were in force at the time, and produce the whole thing as a pack on the day somebody asks for it.
Not sure the framework applies to you?Work through the scope test. No account, and what you write stays in your browser.
Built on the regulator's own published material
Three things, kept in one record
Most firms hold this in documents, shared drives and inboxes. That works until somebody asks what you attested three years ago, and what the rules said at the time.
Kept in one record
- Every expectation, and what you wrote against it279 of them, each citing its source, and a record of which you have answered
- Regulatory change, caught when it happensRare, and expensive to miss. Approved by a person before it reaches you
- Quantum readiness, classifiedEach algorithm labelled against the published standards, never scored
What the record is worth depends on how it was made
A compliance tool is only useful if a sceptical reader can check it. Four rules the system holds itself to.
- ✓Every regulatory event cites its sourceA recorded event carries the link it was found at, taken from the page that was actually read. The system has no path that lets it record an event it cannot point at.
- ✓Nothing changes your record for youWhen something published may affect evidence you hold, you are told which principle and why. Your compliance status is never altered automatically. The judgement stays with the firm and its regulator.
- ✓Rules resolve to the version in forceFrameworks get amended and restated. Each principle carries the date it took effect, so evidence written in one year is never displayed against a rule introduced later. Old answers stay attached to the rules they answered.
- ✓A person approves every changeMonitoring drafts proposals; it cannot publish them. Approval is deliberate and takes two steps, and an ambiguous finding goes to a daily digest rather than into the approval queue.
Why quantum readiness sits alongside compliance
Encrypted data taken today can be stored until it becomes readable. For a business holding keys or client assets that makes the question current rather than distant, and supervisors have started asking it.
The hard part is never the cryptography. It is the inventory: which systems use which algorithms, and whose software are they. Most firms have never had that written in one place, and it is the first thing asked for.
Each entry is labelled against the NIST publication that settles it. There is no readiness percentage, because a number like that is an opinion wearing precision.
655a6cd9One record, and three ways it stays true
The evidence you write, the change that reaches it, and the cryptography underneath it are one record rather than three tools. They are priced together because separately each answers less than it appears to.
The question you have whether or not anything changes
Your regulator may publish nothing for two years. Your firm will not stand still for two weeks. A product line launches, a custody arrangement changes, the MLRO leaves, a vendor is swapped. The rule still applies, and what you wrote about how you meet it is quietly no longer true.
So the question is not only what changed at the regulator. It is which of their published expectations your firm has actually written against, and which have nothing recorded at all.
Marked by you, never inferred. Whether a paragraph adequately answers a supervisory expectation is a judgement for your firm and ultimately your regulator, so the system records what you assert and counts what is missing. It does not grade you.
Then hand the whole thing over
One pack per attestation period: every principle, who is answerable for it, what your firm wrote, what it attached, and which expectations carry a record. Printed straight from the record, so what you file is what the screen showed.
And it says what it is not
The pack states in the document that it is your own record on a date, carries no score, and has not been reviewed by your regulator. A document that reaches a board without that gets read as an assessment.
Nothing reaches your record until a person agrees it should
Regulatory change is detected automatically, and that is where the automation stops. What is found is written down as a proposal carrying the link it was found at, and a person reads it before it becomes something your firm is told.
It is the slowest part of the system and the reason the output is worth putting in front of a supervisor. A record that assembles itself is a record nobody can stand behind.
Start with your own evidence
Nothing is published anywhere, and nothing is shared with a regulator.