Compliance that does the work.
AEGIS watches the regulators, your controls and your deadlines around the clock, drafts the casework before anyone opens the case, and puts every step on a ledger a regulator can replay. Your team makes the calls.
Compliance is not one job. AEGIS is not one tool.
Twelve things a regulated firm has to run, one system underneath them, and one thread from every obligation to the evidence that its control ran. No sound.
The product as it runs today
Six views of the dashboard from a demonstration firm, captured on the date shown. Every register, pack and ledger view opens onto the evidence behind it. Nothing here is a mock-up.
Most of the compliance week is assembly. AEGIS does it.
That work has to happen before any judgement can be applied to it, and it falls on the most experienced people in the team. AEGIS takes the assembly and leaves the judgement with them.
Assembly
Writing the artefact, chasing the evidence, building the pack. It is most of the week and none of the judgement.
More every quarter
A consultation a week, returns to more than one regulator, and a control library nobody has read end to end.
Hiring
The officers who could carry the load are the hardest to recruit, and the budget is already mostly salaries.
When the FCA moves a rule, AEGIS moves first
This is the platform's own loop, replayed. It spots the change, works out which obligations and controls it touches, drafts the amendments, runs them through the quality gates, and applies them with the audit trail attached. If a gate fails, the package is downgraded to escalate and a person decides.
Detect
Diagnose
Repair
Verify
Apply
Agents draft the casework. People sign it.
Governed agents draft the routine work from your own records: complaint responses, KYC and KYB review packs, SAR narratives, STOR sections, forbearance letters, regulator replies, breach notifications. The overnight run works ahead of the deadline, so a case opens with its draft and its provenance already attached. A named person reviews and signs every one. Under all of them the platform runs 194 named, governed agent identities, each writing its decisions to the same ledger, and a build check rejects any new model call added outside that path. A few older assistive calls predate the substrate and are still being moved onto it.
Tamper evident substrate
E·02Decision explainer
E·03Agent eval harness
E·04Evidence packs
E·05Four eyes approval
E·06Audit log explorer
E·07SAR narrative drafter
E·08Sentinel overnight brief
E·09AEGIS OS cross-module dispatch
E·10DDQ · Drafting · Vault
E·11Strategic report generator
E·12Agent autonomy gate
E·13Human verdict queue
E·14Regulator correspondence triage
E·15Complaint cluster detection
E·16Examination rehearsal
E·17Board narrative with claim anchors
No agent starts trusted
An agent begins able only to propose. With no policy on file it cannot act at all. It earns more on its record, and the actions that matter most cannot be promoted by anyone, whatever an administrator sets.
- Accepting or rejecting a proposal is recorded against the agent that made it
- Golden-case evaluations score the decision the agent actually made, not its latest one
- Reviewers label outcomes helpful or harmful, and one harmful label blocks promotion
- Material and external actions stay under four eyes. That is a ceiling in the registry, not a setting
Thirteen domains, one ledger
177 modules, and every one of them writes to the same audit ledger.
Work that gets done while the team is offline
Scheduled runs sweep every firm on the platform, so nothing waits for someone to press a button. Each run writes its result to the audit ledger, and the night's work is evidenced by morning.
Sources checked as they change
Control checks run through the day against connected systems. Regulator feeds are read several times a day, and statutory clocks and service levels are swept every few hours.
Hits raised overnight
Sanctions lists are reloaded and existing customers rescreened. Transaction monitoring alerts are raised from payment records, and client money is reconciled.
The day's work, ready by morning
A deadline agent opens tasks for what is due, with a draft attached where one can be prepared, and an overnight regulatory brief is waiting for the team.
Packs that build themselves
The board pack builds from live data each period. Returns and examination dossiers assemble from the same registers, with the provenance of each figure attached instead of a screenshot.
Every figure walks back to a hashed row
Click a number on a board pack and AEGIS shows the ledger rows behind it. Each row is content hashed with SHA-256 and re-checked when it is read. Change one and the platform says so.
- A tamper evident audit ledger under every workflow
- Evidence trails on obligations, tasks and closures
- Evidence packs cut on demand for an obligation, a regulatory change or a task
- A post-deploy probe that rolls the release back if the chain fails to verify
What is true today
There are no customer logos yet, so none are shown. There is a licence, a practitioner, a check that runs on every release, and a rule about what ships.
Licensed in the DIFC
Hu Technology Solutions Ltd holds a DIFC Innovation Licence and sits inside the Innovation Hub, where DFSA-regulated firms and their vendors meet.
Built by a practitioner
The founder is a Chartered Fellow of the CISI in Compliance. The product is built the way a compliance officer would want to be audited.
Verified on every release
A post-deploy probe replays the audit chain from a sample and rolls the release back if a single hash fails to match.
Live statusNothing ships unsigned
Regime content is versioned, effective dated and signed off by a person before it reaches a tenant. A pack that is pending says so in the product.
Ten regulatory packs, each in its regulator's words
Every pack carries versioned, effective dated content: citations, currencies, debt-ratio conventions, market practice. Where a rulebook has not been reviewed, the platform withholds the assessment and says so, instead of inferring one.
United Kingdom
Consumer Duty (PRIN 2A), CONC creditworthiness and forbearance, vulnerability guidance (FG21/1).
European Union
Directive-level baseline: CCD2 creditworthiness and forbearance plus EBA guidelines. National transpositions vary and are not claimed per state.
Australia
Responsible lending under NCCP s128 to 131 and RG 209, with the financial-hardship framework.
Singapore
TDSR and unsecured-credit limits (MAS Notices 635 and 825), Fair Dealing Guidelines, debt-consolidation routes.
Hong Kong
Debt-servicing-ratio assessment with stress, Code of Banking Practice, Treat Customers Fairly Charter.
Malaysia
Responsible Financing Guidelines, DSR against verified net income, hardship routes via AKPK.
UAE · Onshore
DBR-based affordability and loan-restructuring content where every citation is a CBUAE instrument. The free zones are separate regimes, never blended in.
UAE · DIFC
Conduct regime: client classification, suitability, client agreements, complaints, promotions, sanctions systems and prudential returns via EPRS. The DFSA sets no retail credit-affordability rule, so that assessment is withheld as not applicable rather than borrowed from onshore.
UAE · ADGM
Regime identified; rule content drafted and awaiting sign-off. Until then, assessments against it are withheld or explicitly caveated, never inferred.
Pending sign-offUAE · Dubai VA
Virtual-asset regime with reviewed VA content. VARA's lending rulebook has not yet been reviewed, so credit assessments are withheld as an unreviewed gap, not a reviewed absence.
Credit rules pendingRegime content ships only after human sign-off, and a pending pack says so in the product as well as here. A pack never answers with another regulator's rule. An onshore figure is never applied to a free-zone firm, and a missing rulebook produces a stated gap rather than a guess. Module names follow the pack too: the customer outcomes module is Consumer Duty for a UK firm, and takes each other regulator's own term as that pack is built.
Connect
SSO, data feeds and regulator sources are wired in during onboarding. Registers arrive by import, API or document intake.
Set up
Jurisdictions, modules and risk appetite are set for your firm type. Regime content is versioned and signed off by a person before it ships.
Run
AEGIS watches, detects, drafts and evidences on its own schedule. Your team reviews, signs and decides.
Start with a pilot. Expand if it earns it.
Pilot
Operator
Platform
Enterprise
What people ask first
Is this production-ready, or a prototype dressed up?
What does AEGIS actually automate?
How is this different from using ChatGPT for compliance?
What stops an AI agent from acting on its own?
Will this replace my compliance team?
How would a regulator audit a decision made by AEGIS?
Start with a pilot on your own registers
Twelve weeks of AEGIS doing real work on your own registers, with your compliance officer making every call. You keep what it produces. If you carry on, the fee comes off the first year.
Book a pilot conversation