A compliance platform for accounting firms: AML, PEP and GDPR in one place instead of spreadsheets and manual list checks

Context

An accounting firm serving dozens or hundreds of companies has to assess risk for each of them, check beneficial owners, sanctions lists and politically exposed person status, then repeat those checks and keep evidence. In practice this is done in spreadsheets, by hand and irregularly, and the knowledge of what was checked sits in one person's head.

We built an application that takes over this work: it guides the firm through the process, watches deadlines, repeats checks on its own and leaves a trail that can be shown to an inspector. This case differs from the others: not a client assignment but a product born from seeing the same gap in many firms.

Challenge

• Rules that keep changingSanctions lists, registers and interpretations are updated often. The application had to track sources, but apply rule changes only after human review, never automatically.
• Many firms' data in one systemEach firm sees only its own clients, and the platform administrator has operational visibility without access to content they do not need. On top of that: backups, recovery and a security policy at a level a firm would not build on its own.
• Simple for an accountant, not for an IT personThe user is a firm owner or an accountant, so every screen had to speak in full sentences, without codes and abbreviations, and handling a client had to take minutes.

What we did

1Analysing the firm's obligations and process

We wrote down what a firm must do when onboarding a client, periodically and when circumstances change, and what evidence it must keep. The in-app process came from that, not the other way round.

2Client screening in a single pass

Registry data fetched automatically, sanctions list check, PEP status, beneficial owners from the national register, risk assessment and client questionnaire. The result is stored with date and source.

3Automatic re-checks and reminders

Nightly jobs re-check the beneficial-owner register and sanctions lists, watch deadlines for questionnaires, agreements and access, and the firm receives a weekly digest: what changed and what needs action.

4Legal-source monitoring with a human in the loop

The application watches legal sources and proposes rule changes, but every proposal is read and approved by a person. No automation changes the rules the firm's compliance depends on.

5GDPR, agreements and documentation

Agreements with the firm's clients, consents and withdrawals, an access register and inspection-ready documents generated from data already in the system.

6IT security assessment module for the firm's clients

A firm can run a short IT assessment for its client and receive a result with recommendations. It is a natural link to Innowacje 4 IT's services for SMEs.

Under the hood

• Web application with per-firm data separation and user roles.
• PostgreSQL database with separate development and production environments; production in the cloud with automated backups.
• Scheduled automation: sanctions list import, beneficial-owner register re-checks, registry data refresh, reminders for questionnaires, agreements, PEP and access, weekly digests, service health monitoring.
• Free-text interpretation with an AI model only as a proposal; a person makes the decision.
• Content security policy with violation reporting, an application health endpoint, a change trail in the data.
• Outgoing mail in the test environment restricted to company addresses so no client ever receives test correspondence.

Result

• Screening a firm's client, which used to take an hour of manual work, happens in one pass with date, source and result recorded.
• Checks repeat on their own; the firm only gets a to-do list.
• Inspection documentation is produced from data in the system, not from a spreadsheet rebuilt at the last minute.
• Rule changes go through a person, so the firm knows why something changed.

Why this matters for other companies

This project shows the other side of our work: we not only maintain other people's systems, we can build from scratch an application that takes a regulatory burden off a company, and run it the way we demand from other vendors: with backups, monitoring, a security policy and human control over automation.

The platform is Innowacje 4 IT's own product and is made available to accounting firms. The trade name and terms are agreed with firms directly; this is not legal advice on AML or GDPR.