The compliance work regulators ask about, in one system
RegulaTrust brings your compliance programme, your suppliers and your audits together, where every answer, approval and file is attributed and kept. For regulated firms in the UAE, the UK and the EU.
Product screens show fictional firms and example data.
Small regulated firms run compliance on Word, Excel and email
The risk assessment
A Word file, with no link to the controls that reduce each risk.
Policies
Shared folders, with no record of which version was approved, or when.
Suppliers
Questionnaires and certificates in someone’s inbox, chased by hand.
Evidence
Scattered across all of them when an inspector asks for it.
RegulaTrust brings that work into one system, where every answer, approval and file is attributed and kept.
One system, three parts
Compliance
Know what you are assessed against, answer it in plain language, and keep the evidence where an inspector will look for it.
- Frameworks and controls
- Business-wide risk assessment
- Policies and deadlines
- Incident reporting clocks
Third-party risk
Know every supplier you depend on, check it in proportion to the risk it brings, and keep the decision on record.
- Onboarding with one link
- Screening and risk rating
- Second-person approval
- Reviews, renewals and the DORA register
Audit
Prove that the programme works: test it, show nothing was rewritten, and tell clients what you do.
- Audits and independent reviews
- Tamper-evident audit trail
- Evidence from cloud accounts (in pilot)
- Public trust page
The three parts share one record: a supplier finding can feed your own risk register, and a control answered once counts for every law that asks for it. Switch on only the parts you use.
Built for both ends of the market
A gold and jewellery dealer in Dubai
Three shops, cash at the counter, one AML law. Its suppliers are a refinery, an armoured cash carrier, cleaners, caterers and guards — and a cleaner is not asked what a refinery is asked.
A payments firm in the UK and Ireland
EU AMLR, UK Money Laundering Regulations, DORA, ISO 27001 and GDPR, with cloud, card-processing and identity suppliers and an ICT register to file.
Examples are the fictional firms shown in the product screens.
What is different
Answer once, count everywhere.
AML obligations come from the same international standards, so one control answers the UAE, UK and EU laws at once. A firm under three regimes does the work once.
Plain language.
Each control is a plain question with why it matters and what good evidence looks like. The formal wording and its source are one click away.
Proportionate.
The supplier’s risk decides the depth of checks. A cleaning company gets a short set of questions; a gold refinery gets the full set.
A second person on every decision that matters.
Approvals, closing a finding, accepting a risk and approving a policy need someone other than the person who asked.
A record that shows nothing was rewritten.
Every change is in an audit trail chained by hash; you or your auditor can re-verify it at any time.
Your methodology, not ours.
The risk model, questionnaires and approval workflow are your own, versioned and approved by a second person. A change never rewrites a decision already made.
AI assistance, when you want it
It reads requirements, evidence, contracts and supplier documents, and suggests. A named person accepts or rejects every suggestion.
- Explain a control in plain words beside its formal text.
- Review uploaded evidence against a control.
- Ask questions about your own records.
- Read a supplier’s documents for dates, issuer and issues.
- Pull the clauses that matter from a contract or assurance report.
- Summarise a screening match.
- Draft a due-diligence summary.
- Off unless your firm turns it on, feature by feature
- Runs in your data’s region
- Only ever suggests: a named person accepts or rejects
- Every suggestion is recorded
Assess yourself against the laws and standards that apply to you
Every requirement cites its source text. Content still under review is marked as draft. RegulaTrust is not legal advice.
You can also build and version your own frameworks, for internal standards or contracts.
AML/CFT
- UAE AML/CFT/CPF
- ADGM FSRA AML and Sanctions Rulebook
- UK MLR 2017 & POCA 2002
- EU AMLR (Regulation 2024/1624)
- Pakistan AML Act 2010 & FBR DNFBP Regulations (draft)
Operational resilience and security
- DORA
- NIS2
- ISO/IEC 27001:2022
- PCI DSS v4.0.1
- SOC 2
- NIST CSF 2.0
- NIST SP 800-53
- NIST SP 800-171
- EU AI Act
- UAE Information Assurance Regulation
- ADHICS
- Saudi NCA ECC, CCC and OTCC
- SAMA Cyber Security Framework
- Germany BSI C5
- FINMA Circular 2023/01
- India RBI IT Governance
- Italy ACN
- France ANSSI
Data protection
- GDPR
- UAE PDPL
- DIFC Data Protection Law
- ADGM Data Protection Regulations
- Saudi PDPL
- Qatar PDPPL
- Bahrain PDPL
- Kuwait CITRA
- Swiss FADP
- India DPDPA
- France CNIL
How your data is protected
Your region.
Your data is held in the region your firm chose, and the system refuses to serve it from anywhere else.
Your keys.
Records and files are encrypted under keys specific to your organization.
Your record.
The audit trail is chained by hash and can be re-verified by you or your auditor.
Your decisions.
Approvals need a second person. AI assistance is off unless your firm turns it on, runs in your data’s region, and only ever suggests: a person decides.
Two-step sign-in, single sign-on (OpenID Connect and SAML), custom roles with separation of duties, and need-to-know by operating company.
See it with your own frameworks and suppliers.
We onboard a small number of firms each month, personally.
Or write to hi@regulatrust.com