Industry · RegTech, Healthcare & Compliance
We build the systems compliance runs on.
Sanctions screening, KYC, transaction monitoring, case management, agentic AI inside audit-grade platforms. Engineering discipline that survives regulator inspection, not a licensed product with your name on the login page. Compliance owns the workflow at the end. You own the code.
The gap we fill
Between advisory and vendor.
Advisory firms tell you what to do. Vendors sell you a product to do part of it. In between is the systems engineering that turns policy into a running platform. That is what we do.
Advisory
Deloitte, PwC, boutiques
Target operating model, policy, control framework, vendor recommendation. They do not write code.
Systems engineering (us)
Concept to Cloud
The platform your policy lives inside. Custom where custom is right, vendor integrations where they are, audit-grade throughout, handed over to your team.
Vendor product
Actimize, ComplyAdvantage, others
Licensed product covering one slice of the workflow. Great in the slice, poor at the seams.
What we build
Platforms that hold up under audit.
Sanctions screening
Match logic, list ingest, false-positive tuning, escalation workflow. Auditable decision trail, model-versioned for defence.
KYC and onboarding
Identity verification orchestration, risk scoring, enhanced due diligence workflow, refresh cycles. Vendor-agnostic on the underlying identity providers.
Transaction monitoring
Rules engine, behavioural models, alert triage, SAR filing pipelines. Regulator-defensible model governance built in.
Case management
Investigation workflow, evidence handling, decision documentation, disposition tracking. Analyst UX that reflects how the work actually gets done.
Agentic AI in production
LLM-backed features inside the compliance workflow: summarisation, evidence extraction, first-pass triage. Evaluation harnesses, human-in-the-loop, audit trail on every model call.
Data lineage and reporting
End-to-end lineage for regulator submissions. Consolidated reporting, immutable audit history, retention policy enforced at the storage layer.
Beyond financial crime
Healthcare and life sciences run on the same discipline.
Regulated data is regulated data. The audit-grade engineering that holds up under a financial regulator holds up under clinical and research governance too: the same lineage, retention, and access controls, applied to life-sciences and healthcare data.
Pharma and market access
For MMIT and Kythera Labs we replaced a manual-and-automated scraping patchwork with an autonomous, scalable extraction platform for the pharmaceutical intelligence market.
Clinical and cancer research
We have delivered research-grade data infrastructure for Roswell Park Cancer Institute, where data provenance and access control are not optional extras.
Anchor engagement
A sanctions-compliance platform live across 20+ financial institutions.
Compliance · Global advisory (NDA)
Excel-driven analyst workflow replaced with a configurable, audit-ready platform.
A global financial-crime and compliance advisory needed to move highly manual analyst work into a configurable software platform running across multiple client engagements. We built it in three months against a hard licence-expiry deadline. A 50-person delivery organisation, one codebase, now live across 20+ financial institutions.
Read the case study
Engagement models
Three ways in. All start with a technical read.
10 days · $15K-$25K
Platform, model, and audit-trail read of an existing compliance system. Board- or regulator-ready gap analysis and quantified remediation plan.
See the Read3-6 months · $120K-$500K
Replatform a legacy compliance system, or build a new one from scratch. Phased, milestone-reviewed, zero-downtime cutover, regulator-defensible from day one.
See Modernise8-12 weeks · from $40K
Add LLM-backed features to an existing platform: summarisation, evidence extraction, first-pass triage. Evaluation harness, audit trail, human-in-the-loop scoped in.
See AI engagementCompliance-buyer questions
The honest answers before you commit.
- Are you a RegTech vendor?
- No. We build the systems compliance runs on, we do not sell a product. That means no license fees on the platform we ship you, no vendor allegiance shaping the architecture, and no incentive to widen scope past what you actually need. The output is your codebase, your infrastructure, and your team owning both.
- How is this different from a Big-4 compliance consultancy?
- Big-4 sells advisory and change-management on top of a vendor rollout. We do the engineering. A Deloitte-style engagement will hand you a target operating model and a vendor recommendation. We hand you a running platform with the SLAs, audit trails, and analyst workflow already tested. If your build calls for a vendor product, we integrate it. If it calls for custom, we build it.
- Do you help with a regulator response or an enforcement remediation?
- Sometimes. If the remediation is 'the technology has to change' (data lineage, screening logic, case management, retention) we take that on. If the remediation is a control-framework or policy rewrite, you need a compliance advisory firm and we happily work alongside one.
- Can you handle Model Risk Management (SR 11-7 / OCC 2011-12) requirements?
- For the model-lifecycle side, yes. Model inventory, versioning, retraining triggers, performance monitoring, and the technical evidence packaging that goes into a regulator submission. We defer to your MRM function or an external validator on independent effective challenge; we build the systems that make it defensible.
- What about international regulators? UK FCA, EU MiCA, Singapore MAS?
- We have shipped platforms with FinCEN, EU AMLA, and multi-jurisdiction regulatory reporting in scope. The engineering discipline transfers; the specific evidence and audit-trail requirements get baked into the data model at the start, not bolted on after go-live.
- Do you work with financial-crime advisories or investigative firms directly?
- Yes. Some of our best work is the platform layer under a compliance advisory or investigative firm. They bring the domain expertise and the client relationships; we bring the engineering. The sanctions-compliance platform in the case study is exactly that model.
Further reading
Before you decide build or buy.
Two guides for compliance leaders and the boards they report to. Free, no email required.
Pillar · Ungated
Build vs Buy Sanctions Screening
Framework, five-year TCO comparison, decision rubric.
Pillar · Ungated
Operating Partner's Technology Playbook
If your firm is PE-owned, this is the diligence to expect.
Free checklist · PDF
Pre-Acquisition Tech Diligence Checklist
Audit-ready due-diligence, eight sections, 40 questions, sorted live in the browser.
Audience hub
For Private Equity
Diligence, modernisation, and fractional cover for portcos.
Send Tom a few lines about the compliance problem.
The regulator, the platform, the workflow. A senior engineer will write back honestly about whether we are the right team, and if we are not, we will point you to one.
Talk to a compliance engineer