The governance work a regulator expects, held in one place.

Regulatory horizon scanning

Continuous monitoring across regulatory, enforcement and news sources, drafted into a weekly briefing by AI and written against your own open risks and outstanding tasks — not a generic newsletter. Reviewed and published by your own super admin or second line before it reaches your inbox.

Risk register

A structured register covering inherent and residual exposure, treatment plans, and periodic review. Every risk has an owner, a signed-off assessment, and a clear connection to the controls that mitigate it.

Compliance monitoring

Recurring assessments mapped to the frameworks that apply to your licence and jurisdiction. Questions are structured to surface genuine gaps rather than generate compliance-theatre paperwork.

Incidents and near misses

A register for reporting, investigating and closing incidents, with a direct link to the underlying risk. Patterns across reporting periods become visible rather than buried in individual files.

Policy library

Versioned policies with named owners, scheduled review dates, and a record of staff acknowledgements you can produce on request.

Third-party register

Suppliers catalogued and tiered by criticality, with due diligence requirements that scale to the tier. A supplier handling customer data is assessed considerably more rigorously than a stationery supplier.

Annual assessments

Risk maturity, compliance, and a business-wide financial crime risk assessment following the FATF Recommendation 1 methodology, which is what regulators look for.

Board reporting

A board pack assembled from your live data, with follow-up actions tracked to closure. Produced from the same records rather than retyped from them.

Full audit trail

A complete record of who changed what and when, visible to your own administrators. This includes any access by our own staff, so you are never asked to take our word for it.

Geographies

Institutions overseen by regulators such as the Central Bank of Kenya (CBK), Office of Data Protection Commissioner (ODPC), Communications Authority of Kenya (CA), Financial Reporting Centre (FRC), Office of the Registrar of Companies (BRS) and Kenya Revenue Authority (KRA), and their equivalents in Uganda. Questionnaires are jurisdiction-aware: a Kenyan institution is not assessed against Ugandan rules, and the annexes relevant to one jurisdiction appear only where they apply. Coverage in Tanzania and Rwanda is on the near-term roadmap.

Institution types

Digital Credit Providers (DCPs), SACCOs, credit-only microfinance institutions, and other non-deposit-taking financial institutions. Sized for institutions of up to 500 staff, held to bank-equivalent regulatory standards without bank-equivalent headcount.

Three lines of defence

Access is organised the way an institution's governance already is. Internal audit has read access it cannot write through, first line sees its own business unit, and the separation is enforced in the database rather than only in the interface.

• Two-step sign-in required for every user, without exception
• Role-based access along the three lines of defence, enforced at database level
• Tenant isolation verified by an automated test suite against the live database

• Encrypted in transit and at rest
• Append-only audit log covering access and configuration change
• Data hosted in the European Union (Frankfurt). EU data-protection standards apply throughout. For institutions in Kenya or Uganda, transfers are supported by equivalent safeguards and standard contractual arrangements; the nature of data typically held in the platform means data-localisation requirements are unlikely to be triggered, though we confirm the position for each institution before contracting.

• Staff access to your data requires a time-boxed session opened with a recorded reason
• That access is written into your organisation's own audit log, not only into an internal record you would have to request from us
• Retention configurable to your regulator's requirement
• Every register exportable on demand as a single workbook — your data is portable whenever you need it, not held hostage to keep you subscribed