What regulations apply to us?
Scoped by jurisdiction, industry and activity, across all five layers.
Regulatory library →Regulatory intelligence · North America & EMEA
Every rule.
Every control.
Dialled in.
Compliance doesn't come from one rulebook. Regulation Layer reads all five layers that bind your business — laws, regulations, guidance, supervisory expectations and industry standards — maps each obligation to the controls you actually run, and seals signed, regulator-ready evidence.
Shown: Mintwell, a fictional crypto company with 612 controls and 3,840 obligations. All company records, people and numerical readings are synthetic.
| Sector | Passing | Controls |
|---|---|---|
| Treasury & Stablecoin Reserves | 52 | 64 |
| AML & Sanctions | 88 | 96 |
| Consumer · UDAAP | 51 | 59 |
| Security & Privacy | 70 | 79 |
| SOX & Reporting | 40 | 46 |
| Custody & Segregation | 38 | 41 |
| Product & Eng | 44 | 51 |
| Comms & Marketing | 26 | 29 |
| People & HR | 18 | 18 |
| Tax & 1099-DA | 30 | 34 |
| Facilities & EHS | 91 | 95 |
- Kinds of authority
- 8
- from legislatures to accreditors
- Layers of obligation
- 5
- statute to standard
- Links per obligation
- 10
- jurisdiction to enforcement
- Signed pack
- 1
- on your private chain
Why we're called Regulation Layer
Obligations arrive in five layers. Most tools read one.
A law sets the frame. A regulation fills it in. Guidance says how the regulator reads it, an examiner decides what good looks like, and a standard you signed up to by contract adds its own controls. Miss a layer and you pass the law but fail the exam.
| Layer | United States | Canada | EU & UK | Middle East & Africa |
|---|---|---|---|---|
| 1Statute Passed by a legislature. Sets the frame. | Dodd-Frank, HIPAA, Sherman Act, GENIUS Act | Bank Act, PIPEDA, Competition Act | GDPR, MiCA, DORA, EU AI Act, UK GDPR | Saudi PDPL, South Africa POPIA, royal and ministerial decrees |
| 2Regulation Written by an agency. Binding, specific, testable. | Regulations B, E, P, X, Z · FDA, FAA and FERC rules | FINTRAC AML regulations · provincial securities rules | EBA and ESMA technical standards · FCA Handbook rules | DFSA Rulebook · Central Bank of UAE regulations |
| 3Guidance How the authority expects you to comply. | CFPB interpretive guidance · OCC bulletins | OSFI guidelines · OPC guidance | EDPB guidelines · FCA guidance · Q&As | SAMA circulars · FSCA guidance notes |
| 4Supervisory expectation Exam manuals and reviews. Rarely codified, often decisive. | FFIEC exam manuals · Federal Reserve supervisory letters | OSFI supervisory framework · capital reviews | ECB supervisory expectations · PRA supervisory statements | DFSA risk-based supervision · central bank inspections |
| 5Industry standard Becomes binding through regulation, contract or audit. | NIST CSF, SOC 2, PCI DSS | CSA Group, CIS Controls | ISO 27001, Basel principles | ISO 27001, PCI DSS |
Every obligation carries its source layer, so you can see when a control rests on guidance that could move next quarter.
Who has authority over you
Regulators are one of eight kinds of authority.
An SRO can fine you. A standards body can't, but a regulator can point to it. Regulation Layer records which body can do what, so every obligation carries the power behind it.
● Has this power · ◐ Sometimes, by statute · ○ No
| AUTHORITY | Make law | Write rules | Examine | License | Fine | Revoke or restrict | Set standards | Refer for prosecution |
|---|---|---|---|---|---|---|---|---|
| LegislatureCongress · Parliament of Canada · European Parliament | Has this power | No | No | No | No | No | No | No |
| Regulatory agencySEC · CFPB · OSFI · FCA · ESMA · FDA | No | Has this power | Has this power | Has this power | Has this power | Has this power | Sometimes, by statute | Has this power |
| Supervisory authorityFederal Reserve · ECB · PRA · EBA | No | Sometimes, by statute | Has this power | No | Sometimes, by statute | Sometimes, by statute | Sometimes, by statute | No |
| Enforcement authorityDOJ · OFAC · FinCEN · FTC · CNIL | No | Sometimes, by statute | Sometimes, by statute | No | Has this power | Has this power | No | Has this power |
| Self-regulatory organisationFINRA · CIRO · stock exchanges | No | Has this power | Has this power | Sometimes, by statute | Has this power | Has this power | Sometimes, by statute | Sometimes, by statute |
| Standards bodyNIST · ISO · PCI SSC · Basel Committee · FASB · IASB | No | No | No | No | No | No | Has this power | No |
| Professional licensing bodyState bars · law societies · medical boards · APEGA · CPA bodies | No | Sometimes, by statute | Sometimes, by statute | Has this power | Has this power | Has this power | Has this power | Sometimes, by statute |
| Accreditation bodyUniversity and laboratory accreditors · Joint Commission | No | No | Has this power | Sometimes, by statute | No | Has this power | Has this power | No |
One obligation, end to end
Ten links from where you operate to the proof you ran.
Every obligation sits in one connected record. Pull any link and the rest come with it: change a regulation and the right controls redline; open a pack and trace it back to the law.
01 · Jurisdiction →
United States · New York
Federal and state both apply.
02 · Industry →
Crypto & digital assets
Sub-industry: stablecoin issuance.
03 · Activity →
Redeeming MWUSD for dollars
What Mintwell actually does.
04 · Authority →
OCC · NYDFS
Regulator and state supervisor.
05 · Regulation →
GENIUS Act · illustrative OCC rule
Layers 1 and 2.
06 · Requirement →
Redeem at par, on time
GENIUS.Redemption · synthetic requirement
07 · Guidance →
Redemption timing Q&A
Illustrative layer 3 interpretation.
08 · Control →
C-RED-03 · redeem within two business days
Owner: Treasury · every request.
09 · Evidence →
EV-2026-10-4472 · signed
37 of 4,112 redemptions late · awaiting review.
10 · Enforcement ✓
3 illustrative late-redemption actions
Synthetic examples, not real enforcement records.
Illustrative mapping on synthetic Mintwell data. Example rule references, timing, actions and records are not legal advice or real regulatory publications.
The same graph, open to your agents over API & MCP →Coverage
North America and EMEA, at every level of government.
Federal and state. Federal and provincial. Supranational and member state. Coverage is scoped to the sources that govern you.
Coverage stages shown as in the PDF. Authority lists are illustrative.
Pilot-ready
United States
Federal · state
SEC, CFTC, CFPB, OCC, FDIC, Federal Reserve, FinCEN, OFAC, FTC · NYDFS and state departments
Pilot-ready
European Union
Supranational · member state
ECB, EBA, ESMA, EIOPA, EDPB, AI Office, ACER · BaFin, AMF France, CNIL, Irish DPC
Modelled
United Kingdom
National
FCA, PRA, ICO, CMA, Ofcom, MHRA, HSE
Modelled
Canada
Federal · provincial
OSFI, FCAC, FINTRAC, OPC, Competition Bureau, CER · OSC, AMF Québec, BCSC, ASC, AER, CIRO
On the roadmap
United Arab Emirates
Federal · free zones
Central Bank of UAE, DFSA, FSRA, TDRA
On the roadmap
Saudi Arabia
National
SAMA, Capital Market Authority, SDAIA
On the roadmap
Africa
South Africa · Nigeria · Kenya
FSCA, Prudential Authority, Information Regulator · CBN, SEC Nigeria, CMA Kenya
Industries
Different rulebooks. Same five layers.
We start where the rules move fastest and the proof matters most. Every other supervised industry runs on the same layer.
Lead sector
Banking
Prudential, conduct, AML and fair lending. Fed, OCC, FDIC, CFPB, OSFI, FCAC, PRA, FCA, ECB, EBA.
Lead sector
Fintech & payments
Regulation E, UDAAP, PSD rules, sanctions and the Travel Rule. CFPB, FinCEN, OFAC, FINTRAC, FCA.
Lead sector
Crypto & digital assets
Stablecoin reserves, custody and market conduct. SEC, CFTC, OCC, NYDFS, ESMA, EBA, DFSA, CIRO.
Lead sector
Energy, oil & gas
Permits, pipeline integrity, methane and disclosure. FERC, PHMSA, EPA, CER, AER, ACER.
Same layer
- Healthcare & life sciences
- Privacy & data
- Cybersecurity
- Telecommunications
- Transportation
- Manufacturing
- Environment
Every challenge, one platform
Point tools answer one of these questions. Regulation Layer answers all nine.
Change feeds track rules. GRC suites track controls. Evidence tools collect screenshots. Regulation Layer holds the whole chain, so every answer comes from the same record.
Which authorities can examine, license or fine us?
Your authority map, with the powers each one holds.
Regulatory library →What is changing, and when?
The bezel shows upcoming rules, guidance and deadlines.
Organisation dial →How does new guidance change our obligations?
An impact note redlines every control it touches, ready to approve.
Control detail →Which controls satisfy this requirement?
Requirements connect to controls, owners and run history.
Control detail →Where do our jurisdictions overlap?
One control can carry obligations from several regimes.
Opportunities →What does enforcement tell us to expect?
Public actions linked to the obligations they cite.
Regulatory library →Which standards support our compliance?
Standards crosswalked to the regulations that reference them.
Regulatory library →Can we prove it to an examiner today?
Signed packs, exportable while they are on the call.
Evidence ledger →Read the dial
Six readings, from the bezel in.
Colour only appears where someone needs to act. A dialled-in organisation reads calm.
01 · Bezel
The next 30 days
Today lit. Bars show how much falls due; diamonds mark incoming rules, guidance and comment deadlines.
02 · Sectors
How you cut it
Departments by default. Switch the lens to regulators, jurisdictions, layers or risk tiers.
03 · Health
Controls by state
Failing, needs review, stale and passing, stacked so problems lead each sector.
04 · Coverage
Obligations and gaps
Thousands of obligations as one quiet band. Only unmapped ones are marked.
05 · Opportunities
Work you can remove
One control that satisfies three jurisdictions. Evidence one pack could cover. Tests that could run themselves.
06 · Needle
Your cursor
Turn it to preview a sector, push in to zoom. The centre gives the reading.
How it works
Four steps keep the dial true.
Agents do the reading, the mapping and the assembling. People make the judgment calls and sign their names to them.
01
Track all five layers
Classify laws, regulations, guidance, exam manuals, standards and enforcement: authority, layer, binding status and obligation owner.
02
Map them to controls
Each obligation links to a testable control, an owner, a frequency and a pass condition. One control can carry overlapping jurisdictions.
03
Run the controls
Run against transaction, ledger and on-chain events as they stream in, and on schedule for everything else.
04
Seal the evidence
Seal the source, layer, mapping rationale, data and human decision in a hashed, signed pack.
Evidence
The unit of truth is a signed pack.
A supervisor, an SRO examiner, an auditor, an accreditor and a board committee can all be answered with the same artefact. You decide who sees it, for how long, and every view is recorded.
- Traced to its authority
- Rule, layer, source, version and issuing body.
- On your private chain
- Packs and logs on a chain used by your company alone.
- Signer attested
- Approver, role, notes and human decision.
- Exportable
- JSON for systems. PDF for examiners.
{
"synthetic": true,
"evidence_id": "EV-2026-10-4472",
"tenant": "mintwell-example",
"jurisdiction": [
"US",
"US-NY"
],
"obligation": {
"id": "GENIUS.Redemption",
"layer": "regulation",
"authority": {
"name": "OCC",
"type": "regulator"
},
"version": "illustrative"
},
"guidance": [
"synthetic.redemption-timing"
],
"control": {
"id": "C-RED-03",
"result": "fail",
"late_redemptions": 37,
"checked_redemptions": 4112,
"value_late": "$2.4M",
"longest_delay": "T+3"
},
"reviewer": {
"name": "Dana Whitlock (fictional)",
"role": "Treasurer",
"decision": "awaiting review"
},
"ledger": {
"prev": "0x6e1d…a90b",
"hash": "0x2b77…04fe"
}
}Illustrative JSON, fictional reviewer and abbreviated hashes. Not a valid cryptographic proof.
Our story
The first great dial was made of stone.
Read our story →A ring of standing stones on Salisbury Plain was built in layers, keeps time with the sun, and carries sound inside its circle. Five thousand years on, it is still the best brief we have.
Reference
Speak the same language.
A vendor-neutral glossary of the terms that come up in every regulated industry — searchable, sourced, and cite-ready.
- Obligation
- A specific, citable requirement extracted from a statute, regulation, guidance, supervisory expectation or standard. Full definition →
- Control
- A specific, testable action an organisation performs to meet an obligation, with an owner, a frequency, a test and evidence on every run. Full definition →
- Evidence package
- A signed, hash-chained bundle proving a control ran against an obligation at a point in time. Full definition →
- RegTech
- Regulatory technology: the use of software, data and AI to meet regulatory requirements more efficiently and effectively than manual processes. Full definition →
- Transaction monitoring
- Continuous, rules- and model-based detection of suspicious patterns in transaction flows. Full definition →
- SupTech
- Supervisory technology: the regulator-side counterpart of RegTech, used by supervisors to collect data, monitor firms and analyse risk. Full definition →
A two-week pilot, not a pitch deck.
Tell us where you operate and what you do. We map your authorities, build an obligation library across five layers and seal sample evidence on synthetic data.