Regulatory technology — KYC, AML and rule engines that survive their first audit.

A KYC vendor verifies an identity. KYC orchestration decides which vendor to use, sequences the verification steps, integrates with your customer journey, manages the evidence layer and gives you the flexibility to switch vendors later. Most firms buy the vendor and then build the orchestration anyway, but build it badly. The right pattern is to plan for orchestration from day one, even if you only use one vendor at launch.

A normalised verification model that covers the common cases (identity confirmed, identity inconclusive, identity rejected) plus a vendor-specific capability layer that surfaces vendor-unique features (e.g. Onfido’s facial similarity vs Trulioo’s data-source verification). The journey reads the normalised model by default; specialised flows can read the vendor-specific layer when they need to. Switching vendors then affects only the adapter and any specialised flows — not the main journey.

Three layers: a business-team-editable rule DSL with strong typing and validation; a governance layer that controls who can edit what (an analyst can propose a rule change; a compliance officer must approve it; the rule deploys via A/B); and an audit layer that retains every rule version, every change, every approval and the decisions produced by each rule version. Plus shadow-mode testing for new rules before they go live.

Tiered triage. The rule layer fires alerts; a model layer scores them; investigators see only the high-priority alerts. Lower-priority alerts get auto-closed with full audit trail, retained for periodic sampling and feedback into the model. The model is retrained on investigator outcomes so its scoring improves over time. The non-obvious thing is that the rule layer matters more than the model — overly broad rules create noise the model can’t fully filter, so investing in rule precision is usually higher-leverage than investing in model accuracy.

Three things consistently: (1) that the controls described in your policies are the controls actually running in production; (2) that every regulated decision can be reconstructed end-to-end from immutable evidence — what was verified, what data was used, what rule fired, who approved; and (3) that exceptions (rule overrides, manual approvals) are themselves audit-trailed and reviewed. The third is where most platforms fall short — exceptions get made and the audit trail records the override but not the reasoning.