Every obligation, scoped. Every change, caught.
When a rule changes in any of 24 jurisdictions, TrustSmart tells you which of your administered entities are newly caught, by when, and who owns the work — with a citation on every line. The rules ship into your environment. Your book never leaves it.
The pilot is paid — one regime family, delivered as a cited rule pack you join against your own book inside your own network — and the fee is credited if you proceed.
Economic substance — the first built cell — Economic Substance, Cayman Islands — runs on this family, including the nil-return duty that catches entities whether they are in scope or not. Built — walk it on a call.
Why Elevated: nil-return duty catches every entity, not only those in scope · penalty stack escalates to CI$100,000 in a second consecutive year, with possible strike-off · guidance reissued within the trailing 24 months.
Illustrative — in a live cell, every band lists its drivers and every driver resolves to an act section, regulation, guidance paragraph or dated regulator statement.
One rule changes. Your whole book is in scope for the question.
You are the licensed layer, so a compliance failure on an administered entity is yourregulatory failure. The record is public: CIMA fined Intertrust’s Cayman arm CI$4.23mfor AML failures it called a “pervasive and protracted history of non-compliance”; the GFSC’s largest-ever discretionary penalty, £1.96m, was announced in March 2026; Trident Trust was fined £266,000 — and three of its officers personally. Underneath, the per-entity mechanics compound: a missed Cayman economic-substance return runs CI$5,000 plus CI$500 a day. The tools for staying ahead of it:
The Thursday exercise
Export the entity master, filter by jurisdiction and type, argue about the edge cases, assign the re-determinations. Done by hand, every time a rule moves — and visible to your regulator when it goes wrong.
Entity-management software
Holds the records and tracks the deadlines your people already configured. It does not ingest regulatory change, and it does not re-scope the book when a definition moves.
Horizon-scanning feeds
“Cayman amended a regulation” — the same alert for every subscriber, mapped to a bank’s own policy stack. No entity book, no scope map, no owner.
Memos and retainers
Law-firm briefings and outsourced compliance support answer the question once, for a fee, and leave nothing standing behind them. The gap between memos is where the fine lands.
Fine amounts and penalty mechanics above are public regulator records — every figure on this page links to its source in the cell it comes from.
From a cell name to an owned piece of work.
Pick a cell
One obligation regime in one jurisdiction — Economic Substance in Cayman, CRS in Luxembourg, the UBO register in BVI. Roughly 200 live cells in the launch catalog.
Read the regime
Governing instrument and year, the scope test in one line, the deadline set, the statutory penalty stack, the supervisory record — from public primary sources, cited to the provision.
See who it catches
The scoping crosswalk maps entity types and attributes to in scope, out of scope, notification-or-claim-required, or determination-required — each cell of the matrix citing the provision that puts it there.
Join it to your book
The rule pack runs inside your network against your own entity master. Changes arrive as work orders with owners and dates; the calendar re-derives itself; every exception carries a disposition.
One cell. The whole scoping exercise, already done.
Cell dashboard — the supervisory attention band, the trajectory, and the drivers named in words — the one-glance answer to “do I need to open this one this quarter?”
Regime anchor cards — governing instrument and year, the scope test in one line, the deadline set, the statutory penalty headline. The facts every scoping exercise and inspection-prep file opens with.
Scoping crosswalk — entity types and attributes × in scope / out of scope / notification-or-claim-required / determination-required, each matrix cell citing the provision that puts it there.
Enforcement record, named — the public fines and regulator statements for this regime in this jurisdiction — each carrying a lag note (actions land 2–4 years after the conduct) and an attribution note (most span several regimes at once).
Supervisory pulse — thematic-review programmes, business-plan priorities, “Dear CEO” letters in force, inspection findings where the annual report discloses them — every tile wearing its own coverage badge.
Deadline & threshold map — the published date and threshold structure: classification deadlines, filing windows, refresh-cycle bounds, de minimis and exemption thresholds — every edge citing its instrument. No invented band edges, ever.
Practitioner’s notes — friction points, portal quirks, common misclassifications, what the last thematic review criticised. The page that reads like it was written by someone who has actually filed in this jurisdiction.
Exposure economics, two ledgers — the entity ledger (per-entity statutory penalty stacks, citable) kept strictly apart from the firm ledger (fines against your licence, mandated remediation, action against officers) — because conflating them hands a P&L owner an easy rebuttal.
Illustrative layout — live rows each resolve to their provision [§]. Note the two statuses that keep a calendar honest: nothing to determine still files, and a fact-dependent test goes to a person.
Five dimensions. Banded, not scored.
There is no composite 0–100 anywhere in this product, and that is a design decision rather than a gap. Two-digit precision across regimes as different as CRS classification and a UBO filing duty implies distinctions the underlying data doesn’t support — and no compliance head wants to defend “74 versus 61” to a risk committee. Each dimension carries a band and a written, cited basis, and they stay separate dials because heavy filing, harsh penalties and active inspection each demand a different control response.
Scope Breadth
Computed from the crosswalk — and banded per entity archetype, because a fund-administration book of SPVs and a private-wealth book of trusts have opposite scope profiles for the same cell. You pick your mix; there is no “typical book”.
Filing Burden
Cadence, forms, evidence, language, who may file, and whether nil returns still fall due. All statutory, all citable — and all subject to the quiet tightening a subscription exists to catch.
Penalty Severity
Statutory amounts, daily accruals, escalators and strike-off consequences. Published to the dollar, so this dimension is a citable table rather than a judgment.
Supervisory Activity
Thematic-review programmes, business-plan priorities, “Dear CEO” letters, inspection findings. Leading indicators first — a review announced this year tells you more than a fine published about conduct from 2021.
Regime Volatility
A counted trailing series of substantive changes to the regime. Churn is measurable, so we count it rather than characterise it.
One slot relabels per regime family— an AML refresh cell watches what an annual-return cell doesn’t. Same rubric, family-specific signal.
Where a regulator publishes nothing for a metric, the tile reads “not published by [regulator]” — a coverage statement, never an estimate wearing a confident label.
The scoping exercise, automated — without pretending to be you.
Every cell is versioned, so every regime change arrives as a diff against a known state. The diff is sorted into two classes, and the split is the whole point: one of them software can finish on its own, and one of them it must not.
A deadline moves. A fee changes. A form is replaced. A threshold is amended.
Fully automated, end to end.
The cell updates, every derived calendar re-derives itself, and the impact list emits with counts, dates and owner fields. Nothing here needs a meeting — the facts changed and the downstream objects follow.
A scope test is rewritten. A classification rule moves. A beneficial-ownership regime is replaced.
Emits a work order, not a number.
Cited before-and-after rule text, the list of entities requiring human re-determination, the test to apply, owner and deadline fields. It does not emit a confident re-scoping count — because when a definition changes, the stored classifications in your book are outputs of past determinations, and are exactly the thing that can no longer be trusted.
This is the renewal engine, and it is structural rather than promotional. Regulation never stops changing, so the product re-earns its fee at every legislative cycle — and the regulatory-change section of the board pack you already owe your risk committee each quarter comes out of the same machinery, exceptions-first and version-dated.
Two verdict layers. Neither fence-sits.
Index layer — describes the regime
Each cell carries a Supervisory Attention Band and a trajectory — Tightening, Stable or Easing — with every driver named in words and cited. The index states facts about regimes, never about anyone’s book: a deliberate liability firewall. And it grades the obligation’s supervisory reality, never the regulator’s quality — a supervisor may well be reading it too.
Calibrated layer — your book’s data against cited requirements
The two middle verdicts are invalid without a named object: Monitor must name its trigger and date, Remediateits deficiency and deadline. “No Exceptions Identified” is conjunctive — every dimension has to pass — and Structural is disjunctive, so a single red line fires it. That asymmetry is what keeps the middle narrow instead of letting it become the low-energy default.
Two things this layer will never write. It will not call an entity non-compliant— it writes “filing outstanding”, “classification refresh required”, “exception — see disposition”. And it will not tell you that anything is compliantor would satisfy an inspection. A generated breach finding is an inspection’s first exhibit; a generated assurance contradicted by findings is its second. “Structural” routes internally, to your own compliance leadership — the product never suggests engaging or self-reporting to a regulator.
Every exception must be dispositioned— actioned, accepted with a rationale, or disputed, with an owner and a date. Undispositioned flags are aged and tracked. This is a liability control rather than a feature: in a regulated firm, a timestamped exception list that sat un-actioned for six months is the inspection’s aggravating-factor exhibit. A flag you can’t disposition is more dangerous than no flag.
Every cell report ends with “what would change this verdict” — falsifiable, not oracular.
Standing, not one-off.
Every cell carries its own ledger — law as at, guidance version, last regime event, next known date — fed by a monitoring loop over legislation portals, gazettes, regulator guidance and enforcement registers. That ledger is not just a subscription heartbeat: it is the documented horizon-scanning process your rulebook already requires you to run, and can be shown to your regulator as exactly that.
Checkable, claim by claim.
Load-bearing claims resolve to an act section, a regulation, a guidance-note paragraph or a dated regulator statement — drawn from a source whitelist and rejected at generation time if they don’t resolve. Badges are computed from that coverage rather than asserted, and content that can’t be grounded doesn’t ship in the report body at all: in a document that sits next to your inspection file, an “estimated” line is a line you’d have to strip by hand.
Honest about what it can’t know.
Where a regulator publishes nothing, the tile says so. Where a conclusion needs your book, it sits in “Positions requiring your book”. Where a test turns on facts an entity master doesn’t carry, it sits in “Determinations requiring a human” with the cited test attached. Scarcity shown honestly is information; a confident answer over missing data is not.
Your obligation grid, already the way you keep it.
A compliance monitoring plan and a board pack are already organised as an obligation × jurisdiction grid — the cell is the unit you think in, given software. Cells sort by attention band, never by a score, and each one carries the next date it is keyed to. Where there is no such date, it says why.
the offshore centres, Crown Dependencies, EU fund domiciles and Asian hubs where CSPs hold licensed books
economic substance, CRS, FATCA, UBO registers, AML refresh, annual returns, regulated-entity filings, entity tax, CARF, DAC6
one regime in one jurisdiction = one cell; empty combinations are shown as empty, not padded
each banded, each with a written and cited basis — no composite score
Cell Index
Every obligation you carry, on one framework.
Illustrative data — the jurisdictions and regime families are the real catalog; bands, trajectories and dates are for demonstration only and don't reflect a live TrustSmart analysis. Two rows are doing honest work: an AML refresh cadence is set by your own risk framework within regulatory bounds, not derivable from public data, and DAC6 attaches to arrangements rather than entities — so that cell carries guidance and alerts, and no entity crosswalk at all.
24 jurisdictions. 10 regime families. One rubric.
Every combination is a cell, and every cell runs the identical rubric — which is what makes economic substance in Cayman and the UBO register in BVI comparable reads rather than two separately-written memos. Combinations where a regime doesn’t exist are shown as empty rather than padded, and a repealed regime stays visible as a retired cell, because “this obligation ended” is information too.
Caribbean & Atlantic
7The heartland of most administered books, and where the published penalty stacks bite hardest.
- Cayman Islands
- British Virgin Islands
- Bermuda
- Bahamas
- Barbados
- Curaçao
- Panama
Crown Dependencies & Gibraltar
4Where the fiduciary enforcement record is most public — the JFSC and GFSC publish their statements.
- Jersey
- Guernsey
- Isle of Man
- Gibraltar
Europe
8The EU fund domiciles plus the trust-office and trustee regimes of the Netherlands, Switzerland and Liechtenstein.
- Luxembourg
- Ireland
- Netherlands
- United Kingdom
- Malta
- Cyprus
- Switzerland
- Liechtenstein
Asia, Middle East & Indian Ocean
4Including the UAE, which is three separate regimes rather than one — DIFC, ADGM and mainland.
- Singapore
- Hong Kong
- United Arab Emirates
- Mauritius
United States
1The federal layer plus the Delaware, Nevada and Wyoming state layer, carried as separate cell sets.
- United States
Regime families
10One slot of the regime radar relabels per family — same rubric, family-specific signal. Sanctions is deliberately not a scored family: it is list-driven and daily, already served by screening tools, and survives here only as a watch-list overlay for reporting-duty changes.
- Economic substance
- CRS
- FATCA
- UBO & trust registers
- AML/KYC due diligence & refresh· cadence is firm-set within regulatory bounds
- Annual returns & statutory filings
- Regulated-entity filings
- Entity tax registrations & filings
- DAC8 / CARF
- DAC6 / MDR· arrangement-scoped — alerts and guidance, no entity crosswalk
Obligations attach by nexus, not only by domicile. An overseas entity holding UK land joins the Register of Overseas Entities and updates it annually; a non-UK trust can be caught by the UK’s trust register through land, a resident trustee or a UK tax charge. The catalog carries these as explicit overlay cells, and the attribute model treats “holds UK land” as a first-class field — because a private-wealth book is full of exactly those entities.
Don’t see one you run? The launch 24 are deliberately the well-lawyered jurisdictions, where the offshore firms publish free guides — which is what makes them fast to build and easy for you to verify. The long tail your mid-market book is also full of, where no free memo exists, is the expansion axis. Narrowing the index to the twelve you actually run is configuration, not a rebuild.
Go deeper — without going soft.
Extend any cell with on-demand research on the questions that decide a control response — and every dive shows its own working, including the parts that need your book rather than ours.
Regulator intelligence
Per supervisor — published priorities and business-plan themes, the thematic-review programme, “Dear CEO” letters, inspection cadence and published findings. Whether your firm’s profile is this year’s target, so you prepare for something specific.
Enforcement case autopsy
Per public action — what the firm’s programme lacked, what the regulator’s statement says it looked for, what would have defended, and the aftermath in licence conditions and remediation orders. The reading nobody has time to do across five regulators.
Entity-archetype profiles
Per archetype — fund SPV, private-wealth holdco, IP holdco, financing vehicle, trust or foundation — which cells bite it, the classification pitfalls, and the typical failure modes. “Our book is 60% fund SPVs” becomes a triage shortcut.
Cell risk register
Probability × impact × horizon, early-warning signals, mitigation and contingency tripwires — in the format your enterprise-risk reporting already uses, so it drops in rather than being retyped.
Implementation roadmap
The sequenced plan with real owners — Head of Compliance, MLRO, CoSec, client-facing administrators — plus dependencies, success criteria and the cost of skipping each step.
Only two badges exist here.Anything that can’t be grounded in a public primary source doesn’t appear in the report body — it moves to a clearly separated commentary annex, or it is cut.
CIMA fined a corporate-services licensee CI$4,232,607.50in May 2021 over customer due diligence, source of funds, beneficial-owner identification and ongoing monitoring, describing a “pervasive and protracted history of non-compliance”. Two things this card always states alongside the amount. Enforcement lands two to four years after the conduct, so a fine published this year describes a programme from several years ago. And actions almost never map to one neat regime — this one spans CDD, source of funds, monitoring and records at once, which is why the cell it appears in also names the others.
- Whether your refresh cycle reaches the entity population this action focused on — requires your book’s risk ratings and refresh dates.
- Whether the monitoring gap described here exists in your programme — requires your compliance monitoring programme and its testing results.
Illustrative rendering of a public enforcement record — live dives cite and date every claim, and name what they cannot conclude without your book.
Fewer verified claims beat more invented ones — the discipline is enforced at generation time, not promised in a footnote.
Built to be checked by someone who checks for a living.
This buyer verifies sources as a profession, and anything sitting next to an inspection file has to meet that evidentiary standard — so the product is designed around being audited rather than around being believed. TrustSmart is pre-launch: there are no customers to quote and we won’t pretend otherwise. What there is, is a first built cell — Economic Substance in the Cayman Islands — a synthetic 250-entity book, one real historical change-event work order, and a standard all three have to pass.
Does any claim marked Grounded fail to check out?
The first acceptance question, put to a practising compliance professional. Target: zero. Badges are computed from citation coverage, so a claim without a whitelisted primary source behind it cannot wear the Grounded label in the first place — and anything that can’t be grounded never reaches the report body.
Can you tell, unaided, what needs your book and what needs a person?
The second. Target: yes, without being told. Every cell report closes with two counted boxes — “Positions requiring your book” and “Determinations requiring a human” — so the limits of the public layer and of the attribute layer are stated rather than quietly papered over.
Do the diff and work-order screens match how a scoping exercise runs?
The third, and the one that decides whether this is a product or a demo. The answer we are looking for is “this is the exercise, automated — and it isn’t pretending to make my judgment calls”. Anything less means the change engine is modelling the wrong job.
And where the record is thin, the product says so — on purpose. Cayman publishes economic-substance enforcement guidelines but no register of ES fines, so that cell’s supervisory tiles read “not published by DITC” rather than estimating a number. The demo leads with that tile deliberately. You know your regulator’s style; a product that pretends absence of published enforcement means absence of enforcement loses you on page one.
Two runs that disagree are a bug, not a footnote. A consistency checker reconciles cover against body, cell report against deep dive, cell version against calendar entries, and — at the calibrated tier — work-order counts against your book totals, before anything exports. The arithmetic has to add.
Less than half an FTE. Across every jurisdiction you run.
The comparison a P&L owner actually makes is people and services, not adjacent software. A fully-loaded compliance officer in the Channel Islands or Cayman runs on the order of £80–120k — a practitioner estimate, not a published survey figure, and flagged as one wherever we use it. Against that, this is a fraction of a headcount, and it replaces the scoping exercise across all 24 jurisdictions at once.
The people who answer for the book.
Heads of Compliance & MLROs
Which of ours, by when, whose job — answered in a screen. Plus a timestamped, cited, dispositioned record that you ran a real process, which is worth having when the regulator asks.
COOs & P&L owners
The comparison that matters is people and services, not software. This costs less than half a compliance FTE and replaces the scoping exercise across 24 jurisdictions.
Group compliance, multi-office
One method applied across every licensed office, so eight offices stop keeping eight spreadsheets. Group licences are priced in per-office bands.
CoSec & administration teams
The practical filing profile — portals, forms, fees, extensions, who may file, grace periods, restoration costs — kept current, and a calendar that re-derives itself when a cell changes.
Two honest boundaries. This is built for books of roughly 500 to 10,000 entities — below that, an annual review genuinely suffices. And it never makes a determination for you: whether an entity conducts a relevant activity, or is a financial institution rather than a passive NFE, turns on facts no entity master carries. Those go to your people with the cited test attached, which is the opposite of what a tool claiming to scope them from a database would do.
Priced per book, because your industry prices everything per entity.
Pilot
one regime family, in your building
Where every engagement starts.
- A cited, machine-readable rule pack
- Joined against your book inside your network
- Three full cell reports
- One change-event work-order walkthrough
- Fee credited in full if you proceed
Index
all cells, monitored
The standing evidence layer.
- All ~200 cells across 24 jurisdictions
- Attention bands, trajectories, cited drivers
- The alert stream and change diffs
- Calendars per jurisdiction and entity type
- Version & refresh ledger per cell
Calibrated
priced in bands, trued up annually
For books that need verdicts, owners and dates.
- Instantiated calendar, per actual entity
- Per-cell verdicts with named objects
- Impact lists and work orders with owners
- Mandatory disposition workflow
- Board-pack, BRA and CMP section export
Enterprise
integrated and continuous
Multi-office groups and platform integration.
- Live integration with your administration platform
- Continuous re-scoping
- Multi-office, group licensing, SSO
- Security review and contractual SLAs
Entity counts are banded with an annual true-up, because books churn — incorporations, strike-offs, migrations. Group-owned firms: one licence across several licensed offices, priced in per-office bands. All figures indicative and confirmed in conversation.
The things buyers ask first.
Because the department is the buyer, not the competition. This doesn’t do your compliance; it does the scoping and watching layer your people currently do with spreadsheets and memo triage, and it produces the regulatory-change section of the board pack and the demonstrable horizon-scanning trail your regulator expects. Headcount stays. Thursday afternoons and inspection-prep panic go.
No, by construction. The index layer states facts about regimes — instruments, deadlines, penalties, published enforcement — with citations, and contains no opinion about any entity you administer. The calibrated layer reports your book’s data against cited requirements in exception-and-disposition language: it never writes “non-compliant” or “in breach”, and just as deliberately it never writes assurance either — no “compliant”, no “would satisfy inspection”. Every export states what it is (regulatory monitoring and scoping support) and what it is not (legal advice, a compliance determination, a filing).
No. The default architecture ships the rules and scoring into your environment and joins them against your book in-house, so your GC, vendor due diligence and outsourcing policy stay off the critical path. A hosted option exists for firms that prefer it, with the honest caveat that approval for any book-level extract at a regulated firm realistically takes months rather than weeks.
Every Supervisory Attention Band lists its drivers in words, each cited: a thematic review in progress, a business-plan priority, public statements in the trailing 24 months, a material regime change in force. There is no composite 0–100 because cross-family two-digit precision implies distinctions the data doesn’t support, and because “74 versus 61” is not defensible to a risk committee. The five radar dimensions stay separate, banded dials for the same reason.
They could — they own the entity book at hundreds of firms. Three counters. Their public materials show automation of known obligations and deadlines, not change-driven re-scoping. Plenty of the mid-market runs legacy or in-house systems that a client-side rule pack serves without any integration. And the Enterprise tier is designed to plug into that platform rather than replace it.
Feeds tell every subscriber the same thing: “Cayman amended a regulation.” This computes what the change means — which crosswalk rows moved, which entity types are newly caught, which entities need re-determination — and, calibrated, lands it on your book with counts, work orders, owners and dates. Alert → scope → verdict → disposition. Feeds stop at alert.
A wrong rule is a traceable data defect with a citation trail showing exactly what was misread — fixable, attributable, and covered by the liability and professional-indemnity answers in our procurement annex. Compare the status quo: a wrong row in a spreadsheet nobody versions. And the fact-dependent calls software shouldn’t make are routed to your people rather than gotten wrong confidently.
Nobody yet — TrustSmart is pre-launch and we won’t pretend otherwise. What exists is a first built cell, Economic Substance in Cayman, plus a synthetic 250-entity book and a real historical change-event work order you can walk end to end on a call. We’re looking for one design partner to take through at cost with named-reference rights.
Bring the last change that hit your book.
Walk the first cell — Economic Substance, Cayman — and follow any claim in it back to its source on the call. Then look at the work-order screen for a real historical change event and tell us whether it matches how the scoping exercise actually runs at your firm. Or start a paid rule-pack pilot: one regime family, joined against your own book inside your own network, fee credited if you proceed.