Open-source reference implementations for compliance automation, governed AI, financial-crime monitoring, KYC and regulatory change.
Three systems covering the parts of compliance tooling that are awkward to build well: holding on to the evidence behind a decision, keeping a named human accountable for it, and reconstructing it a year later for an audit or a dispute.
Each is a standalone service owning its own data. They integrate over versioned APIs and domain events, not a shared operational database.
Status: early. What follows is the intended architecture. The repositories are still being built out.
|
AI governance and decision control plane Registry and approval workflow for the models, prompts, rules and datasets behind automated compliance decisions, plus the monitoring and kill switch on top of them. Hard part: reconstructing which control version produced a given decision, months after it was made. |
Real-time AML and fraud decision engine Scores customer, merchant and payment events against versioned controls, correlates the resulting alerts and hands them to investigators as cases. Hard part: event-time correctness — out-of-order arrival, idempotent scoring, and replay that reproduces the original outcome. |
Regulatory change and KYC integration hub Tracks authoritative sources, detects when they change, drafts the resulting obligations with citations, and maps them to affected systems and owners. Hard part: grounding model output in cited source text, and degrading safely when a screening provider is slow or down. |
Responsibilities split three ways:
- ControlProof governs. Issues approved controls; receives evidence, quality signals, overrides and incidents back from the other two.
- ObligationGraph interprets. Turns regulatory, sanctions and screening changes into approved obligations and implementation actions.
- RiskPulse Stream decides. Evaluates live events, produces explainable outcomes, and returns case results.
Identity, observability, evidence storage, secrets and API/event contracts are shared across all three.
Decisions carry their evidence. A material decision retains its source data, the control and prompt versions that produced it, the machine output, and the human action and approval on top of it.
Humans hold the authority. Models classify, retrieve, summarise and recommend. High-impact decisions stay behind explicit roles, authority limits and reason codes.
Failures are not clearances. Timeout, unavailable, incomplete, malformed and no-match are five different outcomes. A dependency failing must never surface as a customer being cleared.
Each service owns its data. Stable published contracts, no shared databases, no cross-service writes as an integration shortcut.
Controls are measured, not assumed. Models and rules are evaluated against defined datasets and thresholds. Uptime is not evidence that a control works.
| Concern | Choice |
|---|---|
| Services and APIs | C# / .NET 10 |
| Analyst and governance UI | React, TypeScript |
| Model development and evaluation | Python |
| Operational data | PostgreSQL, service-owned schemas |
| Event processing | Kafka for high-throughput streams, RabbitMQ for integration workflows |
| Supporting data services | Redis, ClickHouse, OpenSearch, S3-compatible object storage |
| Governance and orchestration | Open Policy Agent, MLflow, durable workflow tooling |
| Identity | OIDC, policy-based access, managed secrets |
| Observability | OpenTelemetry — metrics, logs, traces |
| Delivery | Docker, Kubernetes, IaC, CI/CD gates |
- A bounded problem statement, an architecture overview and ADRs for the decisions that were close calls.
- Versioned API, event and data contracts.
- Synthetic data and scripted scenarios that run locally.
- Unit, integration, contract and resilience tests, plus evaluation results where a model is involved.
- Threat model, operating limits and documented failure semantics.
- A map from each claimed capability to the code and tests backing it.
These are engineering reference implementations, not legal advice, regulatory approval or a production screening service. All customer, merchant, beneficial-owner, transaction and investigation data is synthetic.