ComplyLayer sits in front of a transaction and returns a verdict against rules a compliance officer wrote, tested and approved themselves — with no engineer, no pull request and no deploy.
The rule is written by the person accountable for it.
Not translated by an engineer into code the officer cannot read, review or verify.
Compliance rules are written by compliance officers and implemented by engineers, and the gap between those two is where controls quietly stop working. A rule ships as code the officer cannot read, changes go through a deploy queue, and an approval is a diff of red and green lines in which one character moves and nobody notices.
It returns a verdict; your own system enforces it. Every response carries the rules that matched, the regulation each one cites, and a customer-facing message the compliance team wrote.
That boundary is load-bearing. A total compromise of ComplyLayer — every key stolen, every row rewritten — cannot move a naira. The worst an attacker achieves is a wrong verdict, which is why the degradation behaviour is specified per severity rather than left to chance.
It is also not a fraud-scoring product. There is no model and no score — only rules a person wrote and can explain six months later.
The same text the officer wrote is the text that runs, and the text an auditor reads.
TXN-DEMO-1 small transfer ₦500 → allow (3 rules evaluated, 0 matched, 15 ms) TXN-DEMO-2 above the tier limit ₦50000 → block (3 rules evaluated, 1 matched, 5 ms) rul_92f1346e "Above the tier 1 daily limit" CBN AML/CFT §4.2.1 customer: "This transfer is above your daily limit." TXN-DEMO-3 → flag rul_1d80660f CBN AML/CFT §6.1
| Transaction | Verdict | Why |
|---|---|---|
| small transfer ₦500 | allow | 3 rules evaluated, 0 matched, 15 ms |
| above the tier limit ₦50,000 | block | CBN AML/CFT §4.2.1 — with a message the customer can read |
| the sixth transfer this hour | flag | CBN AML/CFT §6.1 — more than five in a rolling hour |
The builder asks questions in the language of the regulation and writes the expression as the officer answers.
Whatever their role. The approval is a second person, always.
The change is shown in the unit a person thinks in — direction, magnitude, the regulation it claims, and what it would have done to recorded history.
Not restricted — absent. A rule cannot produce a float, because 100% reproducibility and floating point do not sit together.
And carries a customer-facing message the compliance team wrote, not a stack trace.
What happens when a dependency is down is defined per severity, rather than discovered during the incident.
make up && make demo
POST /v1/decisions