The compliance engine

Rule types

Twenty-five types, each a small class in the engine with its own tests:

Exposure limits: maximum per issuer (share classes counted together), per sector, per single position, per country (or outside a country), per asset class, per security type and per market-cap bucket; top-N concentration; gross exposure (leverage).
Cash and holdings: cash minimum and maximum; minimum and maximum number of holdings.
Orders: maximum order size; liquidity as a share of average daily volume; turnover per period; fat-finger (limit price too far from the last price, or notional too large); duplicate orders; short-sale ban.
Lists and windows: restricted list (block), exclusion lists such as ESG or sanctions (block), watch list (warning only), wash sales within 30 days across accounts of the same owner group, blackout windows by security or issuer.
User-defined fields: block or warn when a security's user-defined field is (or is not) one of some values, optionally only for accounts whose own field matches, e.g. "accounts with Mandate code IG-ONLY may not buy anything with an Internal rating of CCC or D" (see User-defined fields).

Exposure limits accept exceptions such as "except ETFs" or "except US Treasuries".

Scope, packages and exceptions

A rule applies to the firm, to account groups, to packages or to named accounts. A package (for example *Growth mandate*, *Conservative*, *ESG*) holds rules and the mandate text, and is assigned to groups or accounts. Compliance can excuse one account from one rule with a written reason.

Severity and when rules run

Hard block: the order cannot proceed.
Soft warning: the order waits on *Compliance hold* until someone writes an override reason; above the firm's threshold a second person in Compliance approves the override.
Information: logged only.

Rules run pre-trade (entry, amendment, allocation), in-trade (every simulated slice) and post-trade (the end-of-day batch, or on demand). A post-trade breach is active when a trade caused it and passive when the market moved; a sale that reduces a passive breach is allowed.

Writing a rule in plain English

Compliance › Write a rule is the main way to create or change a rule.

Write one rule or several, as you would say them: *"No more than 5% of any Growth account in a single issuer, except ETFs - warn, don't block."*
Clarify: when something material is ambiguous (market value or cost? which accounts? block or warn?), the AI asks instead of guessing. Your answers are kept with the rule's history.
Unsupported requests are said plainly. You can take the closest supported rule (marked as not enforcing everything you asked) or record *needs a new rule type* for the Vestoris team. Nothing is approximated silently.
Validate: the AI's structured answer is checked by code against the schema; anything invalid is rejected with the reasons and nothing is saved.
Restatement: the rule page shows your wording beside a restatement generated by code from the structured rule - what the engine will actually enforce - with anything the AI flagged highlighted.
Test bench: required before sign-off. It runs the draft through the same engine as live checks, against every account now and the orders of the last days: what it would block, warn on or log, and which accounts are in breach today.
Sign-off: someone with *approve compliance rules* who is not the author approves with a reason, confirming with their password (or a fresh Google sign-in). The approval records who, when, why, the exact version (a hash of the structured rule), the original wording, the restatement and the test-bench result, and goes into the hash-chained event log. The rule takes effect now or at a scheduled date.
Send back: an approver can return a draft to its author with comments.

Change this rule works the same way and creates a new version, shown as a diff of the structured rule and of the restatements; the old version stays in force until the new one takes over. Retiring a rule needs a sign-off too.

Rules from a mandate

Compliance › Write a rule › Extract rules from a mandate: paste an IMA, mandate or prospectus section. The AI proposes candidate rules, each quoting its exact source sentence (checked by code). Candidates are drafts and go through the test bench and sign-off like any other rule. On Packages and lists, *Coverage review* compares a package's mandate text with the rules assigned to it and lists possible gaps.

Violations

Every violation has an owner, a due date and a history: open → acknowledged → resolved, waived (with a reason) or escalated. The compliance dashboard shows counts by rule, account and severity and how long they have been open; *Triage violations* asks the AI to suggest an order to work them in, and the daily compliance brief summarises the day.

The rule register

Compliance › Rule register lists every rule with its wording, restatement, versions, sign-offs, test-bench snapshot at approval and violations, and exports as a PDF.

When a check fails

The order is rejected with the reason (the measured value and the limit). The explanation may come from the AI, and a passing alternative, such as a smaller quantity, is shown only after the engine re-checks it.

Try it in the demo All articles