Tiered compliant AI system for regulated financial institutions

Agnostic Regulatory Intent and Exposure Matrix

European financial regulation is dense and layered across prudential, conduct, market integrity, data protection and ICT risk instruments. Designing an enterprise system by listing acts and articles provides little direct operational guidance. To address this, we introduce a regulation-agnostic taxonomy that functions as a design primitive. Its purpose is to translate legal text into machine-enforceable control functions that govern orchestration and execution while remaining portable across DACH and the wider EU. We adopt a functional reduction of legal provisions to their operational effect on system behaviour: either a rule forbids an outcome or it demands an outcome with evidence. Compliance therefore reduces to abstention from a prohibited act or to the performance of a positive act that leaves a verifiable trace. This yields a law- and regulation-agnostic orientation in which agents need only decide whether to avoid or to act with evidence, while the specific statutory text is compiled at a later stage into guard families and evidence templates, with exposure handled separately for internal versus external outputs. Practically, this agnostic treatment simplifies handling heterogeneous regulations because the agent can synthesise, per task and context, a checklist of prohibitions and obligations that orchestration executes and tracks, with each item either preventing externalisation or requiring a verifiable artefact with provenance, deterministic timestamping and DAG inclusion proof; alternatively a dedicated compliance agent can apply the same checklist as a pre-output gate, sign the evidence pack, and authorise or withhold release.¹ The taxonomy is formalised as a two-dimensional schema, the Regulatory Intent and Exposure Matrix. Each legal provision receives two labels rule type, capturing intent as either Prohibition or Obligation, and exposure, capturing context as Internal or External.

This binary mapping is used for orientation in reasoning and as a compact handle for later compilation, as shown in Figure 1.

Figure 1 frames two reasoning stances rather than execution rules. A Prohibition prompts scrutiny of potentially disallowed behaviour and a hold on externalisation until resolved. An Obligation prompts identification of duties and anticipation of evidence likely required if the task proceeds. Clauses are stored as atomic statements with mapping and citation to ensure fast reading and consistent interpretation. Concrete gates and logging are derived later once reasoning has reached sufficient confidence.

The second axis classifies exposure. Internal exposure refers to outputs confined to the institution, while external exposure refers to outputs delivered to clients, counterparties, authorities or markets. The distinction is contextual and combines with intent in Figure 2.

This classification orients reasoning by establishing the destination of outputs. Once combined with intent, it guides which questions and candidate actions are relevant. Figure 3 presents the joint view.

At run time an agent performs a lightweight context check against the proposed matrix. If no mapped provision appears to apply, the agent continues under general IT controls and ordinary policy. If the check suggests applicability, the agent classifies the context using the matrix labels and treats that label as an orientation handle for reasoning rather than as an enforcement command, subject to revision as scope and evidence evolve. The context check can be formalised as a binary predicate that determines whether a task falls under a mapped legal provision:

Once classified, the agent frames the task as a constrained optimisation problem of the form

Minting the classification, checklist and gating decisions to the DAG enables ex post assurance and explicit failure analysis: an auditor can reconstruct the task state $\phi(\tau)$ (see Eq. 5), recompute $\chi(\tau)$ (see Eq. 2) and the label $v=(t,e)$ (see Eq. 1) to test whether the agent misunderstood the context, verify that each selected guard $C(\pi,\tau,v)$ in the optimisation constraint (see Eq. 3) was satisfied at the moment of externalisation, and match every obligation item to a concrete artefact with provenance, deterministic timestamping and inclusion proof; this makes distinct failure modes observable, including (i) misclassification of intent or exposure, (ii) correct classification and checklist generation but incomplete execution, (iii) execution with insufficient evidence quality or missing signatures, and (iv) sequencing or gating errors that allowed externalisation without preconditions, as well as budget breaches for risk, latency or ESG. The proposal turns compliance from after-the-fact attestation into assurance-by-construction, where reasoning, decisions and evidence are bound cryptographically so reviewers can check not only outcomes but also whether the agent’s understanding and follow-through were correct.

We propose a short, curated aid for cases where the context check indicates applicability. A quick reference vector is a concise entry prepared by a qualified oversight committee; it orients reasoning without prescribing execution. Each entry names the action archetype, states the typical matrix label, notes salient triggers and the initial evidence posture, and gives an escalation contact. Entries are versioned and signed so that provenance remains clear; they can be revised as scope or information changes. When a task matches such an entry, the agent adopts the entry as orientation and continues analysing the task toward the decision objective; if no entry fits, the agent proceeds under baseline controls and may flag the gap for later inclusion. The intent is speed and consistency in judgement, not hard rules.

Prohibitions as feasibility and obligations as task extension

The matrix provides orientation only; concrete enforcement is selected later by policy compilation and may be revised by human oversight. Given the label $v=(t,e)$ from Eq. 1 and the context determined by the predicate $\chi(\tau)$ in Eq. 2, the rule engine surfaces candidate prohibitions $P$ and obligations $O$, then selects active subsets $P^{\star}\subseteq P$ and $O^{\star}\subseteq O$ together with a strict partial order $\prec$ over $P^{\star}\cup O^{\star}$. The order $\prec$ permits short-circuit evaluation where appropriate and defines a narrow top tier $P^{\perp}\subseteq P^{\star}$ of dominant disqualifiers. Obligations map to mandatory sub-actions and a verifiable evidence artefact; let $E(\cdot)$ denote the admissibility predicate capturing provenance, signatures, deterministic timestamping and DAG inclusion proof. None of these selections is implied by the matrix itself; the matrix narrows the search space, the policy store determines activation.

Prohibitions are encoded as feasibility constraints that prevent disallowed outcomes, while obligations extend the task with preconditions that must hold before optimisation under Eq. 3 is meaningful. The feasible policy set for task $\tau$ is

with optional secondary terms in $U$ for obligation quality such as latency, cost or completeness. This construction preserves the law- and regulation-agnostic stance: prohibitions shape the admissible set, obligations extend the task graph and demand admissible artefacts, and any burden from satisfying obligations may then be traded within the objective once feasibility is secured.

Externalisation refers to any output that leaves the institutional boundary, including recommendations, orders, client-facing summaries, supervisory reports and API calls, whereas internal artefacts, logs and operator messages remain non-external unless later reused. The gate outcome formalises block versus release for a proposed output $y(\pi,\tau)$, $$\begin{equation} \mathrm{Externalise}(\pi,\tau)= \begin{cases} \textsc{deny}(c) & \text{if }\exists p\in P^{\star}\text{ with }p(\pi,\tau)=1\ \ \text{or}\ \ \exists o\in O^{\star}\text{ with }E(\mathrm{artefact}_o(\tau))=\text{false},\\[4pt] \textsc{allow}(y) & \text{otherwise,} \end{cases} \label{eq:externalise} \end{equation}$$ where $c$ is a machine- and human-readable reason code minted to the DAG with a hold or release attestation. Blocking does not suppress internal reasoning; the system returns an explicit explanation to operators and records the decision and grounds for audit.

Short-circuit evaluation reduces latency and user friction without sacrificing assurance. If there exists a dominant disqualifier $p\in P^{\perp}$ with $p(\pi,\tau)=1$, then $\mathrm{Externalise}(\pi,\tau)=\textsc{deny}(c)$ by Eq. 8 and the remaining lower-tier checks in $P^{\star}\cup O^{\star}$ are marked skipped by policy. The audit pack minted to the DAG includes the orientation set, the selected $P^{\star},O^{\star}$, the order $\prec$, the firing guard in $P^{\perp}$, the skipped set with its policy basis, all artefact hashes and admissibility outcomes $E(\cdot)$, and the reason code $c$. This enables an auditor to reconstruct the state $\phi(\tau)$ used in the quick-reference matching Eq. 5, to verify that the selected guards $C(\pi,\tau,v)$ in the optimisation constraint Eq. 3 were satisfied at the moment of externalisation, and to distinguish failure modes such as misclassification, incomplete execution of obligations, insufficient evidence quality, or sequencing errors that allowed externalisation without preconditions.

A composite example illustrates the semantics. Consider a cross-border retail transaction where the amount exceeds the threshold for retail investors and the client is under age. Orientation via $v$ surfaces multiple candidates; policy selects $P^{\star}$ that includes an under-age prohibition and places it in $P^{\perp}$ under $\prec$. The under-age guard fires, so $\mathrm{Externalise}(\pi,\tau)=\textsc{deny}(c)$ by Eq. 8; cross-border and amount checks are skipped by policy with the dominance certificate recorded in the audit pack. If, in a different context, no dominant disqualifier fires, obligations such as identification and know-your-customer documentation become active preconditions, and externalisation is permitted only once admissibility $E(\cdot)$ holds, after which utility is optimised over $\Pi_{\mathrm{feas}}(\tau)$ according to Eq. 7. In both cases the matrix remains an orientation device; selection and activation are determined by compiled policy and oversight, and the full reasoning trail is minted to the DAG for ex post assurance.

We assume only mild regularity, namely that dominant disqualifiers in $P^{\perp}$ remain policy invariant for a given task state, so that $p(\pi,\tau)=p(\pi',\tau)$ holds for all $\pi,\pi'\in\Pi$; in practice these include conditions such as age thresholds, sanctions hits, or bans tied to specific product tiers. The admissibility predicate $E(\cdot)$ is used to capture evidence quality requirements, including provenance, signatures, deterministic timestamping, and DAG inclusion, and is evaluated directly on the artefacts compiled for $\tau$.

Under these assumptions the feasible set is monotone: if the selected sets expand such that $P^{\star}_1\subseteq P^{\star}_2$ and $O^{\star}_1\subseteq O^{\star}_2$, then it follows that $\Pi_{\mathrm{feas}}^{(2)}(\tau)\subseteq \Pi_{\mathrm{feas}}^{(1)}(\tau)$, where $\Pi_{\mathrm{feas}}^{(k)}$ is defined by Eq. 6 under the selection $P^{\star}_k,O^{\star}_k$. The result follows immediately from Eq. 6, since adding further prohibitions or obligations introduces additional conjuncts that can only reduce the satisfying set.

Short-circuit evaluation is sound whenever dominant checks are policy invariant: if a single $p\in P^{\perp}$ evaluates to one for some $\pi$, then it evaluates to one for all $\pi'$, which implies $\Pi_{\mathrm{feas}}(\tau)=\varnothing$ by Eq. 6 and forces $\mathrm{Externalise}(\pi,\tau)=\textsc{deny}(c)$ by Eq. 8. Conversely, if no element of $P^{\perp}$ fires and all selected obligations satisfy admissibility so that $E(\cdot)=\text{true}$, then $\Pi_{\mathrm{feas}}(\tau)$ remains nonempty and the optimisation problem in Eq. 7 is well defined. Evaluation both terminates and remains auditable. Since the sets $P^{\star}\cup O^{\star}$ are finite and $\prec$ is a strict partial order, a topological evaluation sequence necessarily exists, with short-circuiting at $P^{\perp}$ further bounding runtime. The DAG record contains the orientation set, the selected $P^{\star},O^{\star}$, the order $\prec$, any firing element of $P^{\perp}$, the admissibility outcomes $E(\cdot)$, and the resulting gate decision Eq. 8, which together enable replay and independent re-evaluation using Eq. 2, Eq. 1, Eq. 6 and Eq. 3.

If obligation quality is intended to influence the objective once feasibility has been established, the framework admits a straightforward refinement in which $U(\pi,\tau)=U_0(\pi,\tau)-\lambda^\top q(\tau)$, with $q(\tau)$ aggregating latency, cost, and completeness across satisfied obligations and $\lambda\ge 0$ denoting policy weights. The lexicographic regime in Eq. 7 guarantees that such trade-offs are only evaluated within the feasible set $\Pi_{\mathrm{feas}}(\tau)$.

Agent activation by intent and exposure

The orientation matrix provides the initial signal, but the selection and activation of executors is determined by compiled policy and remains subject to oversight revision. Institutions may maintain standing rosters of domain-specific agents and persistent committees for recurring functions, while reserving the possibility of ad hoc committees when context requires. In a banking environment, a payments roster typically spans functions such as wiring funds between accounts, executing foreign-exchange conversions, and arranging treasury transfers. For an investment firm under MiFID II, routine activities encompass the reception and transmission of client orders, order execution on behalf of clients, the provision of investment advice with suitability and appropriateness checks, portfolio management, and post-trade reporting. These rosters remain dormant until activated by the orientation label $v=(t,e)$ from Eq. 1 in combination with the context check $\chi(\tau)$ defined in Eq. 2. Committee formation follows a policy-driven logic. Where $\chi(\tau)=0$ or the task is assessed as internal and low risk, such as drafting an internal email or scheduling a meeting, a single role-scoped agent executes under baseline IT controls. When $\chi(\tau)=1$, activation depends on the exposure level $e$, the number and dominance of active checks, and the availability of runtime budgets. This is formalised as

Execution proceeds through a structured handshake. The orchestration agent forwards the task $\tau$ together with the orientation $v$ to the designated agent set or committee, which undertakes its domain-specific responsibilities and returns artefacts, rationales, and provisional outcomes. A dedicated compliance agent then applies the pre-output gate defined in Eq. 8; if admissibility is confirmed for all selected obligations and no prohibition fires, the output is released, whereas any failure results in blocked externalisation accompanied by a reason code. Each stage mints a committee token to the DAG ledger, recording membership, role scopes, selected checks, reason codes, and inclusion proofs, which collectively support later reconstruction and independent re-evaluation under Eq. 3.

Examples illustrate proportionality and dominance. A domestic, low-value internal transfer with $\chi(\tau)=0$ is executed by a single payments agent without committee escalation, reflecting the proportionality condition that internal exposure with few selected checks below the policy threshold $k$ activates only the primary role. A cross-border retail securities order with $\chi(\tau)=1$ and $e=\text{External}$ activates the standing “securities orders” set comprising client categorisation and suitability, order execution, best-execution monitoring, and transaction reporting; if a dominant disqualifier in $P^{\perp}$, such as an under-age client, fires, the committee collapses to the compliance gate and the externalisation returns $\textsc{deny}(c)$ under Eq. 8, with all skipped checks logged as skipped by policy. Formally,

Legal corpus indexing and agent routing

The legal corpus is treated as a structured, versioned asset rather than a flat vector space. Each instrument is normalised, segmented, and cited at clause level, with every chunk $l$ carrying canonical metadata $\mathrm{cite}(l)=\langle\text{jurisdiction},\text{instrument\_id},\text{article},\text{paragraph},\nu\rangle$, where $\nu$ encodes version and effective interval, supplemented by tags for instrument class (prudential, conduct, data protection, ICT), intent and exposure labels, and explicit cross-references. Ingestion preserves both the original language and a controlled translation, while recording equivalence mappings between recitals, articles, RTS/ITS, and supervisory Q&A, so that downstream retrieval can resolve different references to a single, time-scoped citation.

Indexing is hybrid in order to preserve meaning as well as citations. Three coordinated views are maintained for the same chunks: a dense semantic index for embeddings $\phi(l)$, a sparse citation and keyword index for exact retrieval, and a citation graph $G$ linking instruments through “refers to,” “implements,” and “interprets” edges. Queries are constructed from task features $\psi(\tau)$, the orientation $v=(t,e)$ from Eq. 1, triggers $\kappa$ from the quick-reference vector Eq. 4, and the exposure $e$. Retrieval proceeds in two stages: a semantic pre-filter selects top-$k$ candidates $\tilde L(\tau)$ by similarity $\mathrm{sim}(\psi(\tau),\phi(l))$ under jurisdiction and effective-date filters, and a reranker then fuses sparse scores with graph proximity to produce the final set $L(\tau)$. Every returned item includes $\mathrm{cite}(l)$ together with its text span, ensuring human-readable grounding.

Clustering is dual to reflect legal reading practice. We compute instrument-anchored clusters $C_{\text{inst}}$ for each statute or linked set of acts, and aspect clusters $C_{\text{asp}}$ derived from the citation graph and tag distributions, covering recurring themes such as suitability, client categorisation, personal recommendations, onboarding, and record-keeping. Chunks may appear in both views. Aspect clusters allow rapid coverage across instruments, while instrument clusters ensure that the exact article and paragraph remain available for citation and audit. The design avoids reliance on a single global cluster.

Routing is performed by capability rather than by statute. Institutions register domain agents with declared capabilities and evidence schemas, covering for example payments, FX, treasury, onboarding, suitability and appropriateness, personal recommendations, order execution, reporting, data protection, and ICT controls. Orientation $v$, exposure $e$, and the retrieved set $L(\tau)$ jointly determine which capability bundles are relevant. The router applies the same selection logic as Eq. 9 to activate either a single role or a minimal committee. A dedicated citation clerk agent attaches $\mathrm{cite}(\cdot)$ and extracts the governing spans, while a compliance agent executes the pre-output gate Eq. 8. This design keeps knowledge current and avoids brittle “one agent per law” silos.

Correlation between chunks and their governing law is guaranteed through metadata rather than embeddings. Each chunk carries its canonical citation, effective dates, and instrument identifiers (e.g. CELEX for EU acts, BaFin circular IDs, FINMA RS numbers). When retrieval proposes candidates, a citation-consistency check eliminates items whose $\mathrm{cite}(\cdot)$ lies outside the jurisdiction or effective interval of the task, and a majority-vote over top-$n$ candidates stabilises the legal basis. The resulting citation pack $\{\mathrm{cite}(l),\text{span}(l)\}_{l\in L(\tau)}$ is signed by the citation clerk and minted to the DAG.

Mapping legal text to matrix intent and exposure constitutes orientation rather than determination. A curator-assisted classifier proposes $m(l)\in\{\text{Prohibition},\text{Obligation}\}\times\{\text{Internal},\text{External}\}$ for each chunk, with all proposals reviewed and versioned. At run time the router applies $m(l)$ together with context to select $P^{\star},O^{\star}$ and the order $\prec$ (cf. Eq. 6, Eq. 7), while concrete guard templates and artefact schemas are compiled from the policy store. The complete retrieval and routing trace $\langle v,e,\psi(\tau),L(\tau),\mathrm{cite}(\cdot)\rangle$ is minted to the DAG alongside the gate result, enabling replay and auditor verification.

This design addresses practical concerns. Legal aspects are not collapsed into a single global cluster but organised into multiple coordinated views. Agents are not tied one-to-one with statutes but are registered by capability and routed according to orientation and retrieved evidence. Correlation between chunks and laws is secured by canonical citations and effective dates rather than embedding heuristics. The outcome is portable across jurisdictions, resilient to textual drift, and ready for supervisory scrutiny.

Evidence admissibility model

Admissibility must be explicit to ensure that obligation checks in Eq. 6–Eq. 7 are verifiable at run time and reproducible on audit. Each obligation $o\in O^{\star}$ is modelled as producing an artefact bundle

The admissibility predicate is defined as the conjunction of policy-specified quality dimensions,

Let $\mathrm{Hash}(\cdot)$ denote a collision-resistant digest and $\mathrm{TS}(\cdot)$ a trusted timestamp. A minimal admissible bundle must then satisfy

Policy compilation and governance

The orientation matrix provides the initial signal, while policy compilation determines the active checks. Given the label $v=(t,e)$ from Eq. 1 and the task context $\chi(\tau)$ from Eq. 2, a compiler maps orientation and context into selected guards and their evaluation order, subject to human oversight and revision. The policy store is a versioned, time-scoped rule base with effective intervals, reviewer sign-off, and rollback support.

Compilation is modelled as a deterministic function of the effective policy version $\nu$ at decision time $t$:

Budgets operate both at compile time and at run time. A budget-breach predicate informs committee activation in Eq. 9 and the externalisation gate in Eq. 8:

Obligation templates are bound to admissibility during compilation. For each $o\in O^{\star}$, the compiler selects an evidence schema and admissibility test $E(\cdot)$ from Eq. 13, producing a concrete template for $\mathrm{artefact}_o(\tau)$ with required provenance, signatures, trusted time, and DAG inclusion. The feasible set Eq. 6 and optimisation Eq. 7 then operate over these compiled guards rather than the full candidate space.

Governance ensures reproducibility and institutional control. Each compilation yields a certificate

Overrides are permitted under controlled conditions. An authorised reviewer may issue $\mathrm{Override}(\mathrm{Cert}_{\mathrm{comp}},\Delta)$ that modifies $(P^{\star},O^{\star},\prec)$ with reason code and dual control. Safety monotonicity applies to dominant prohibitions: if $p\in P^{\perp}$ and $p(\pi,\tau)=1$, the override cannot deactivate $p$ when exposure is external $(e=\text{External})$; any attempted weakening is logged and forces $\textsc{deny}(c)$ under Eq. 8. Strengthening is always admissible, while removal of non-dominant checks requires reviewer signatures and the issuance of a new certificate version $\nu'$.

Determinism and time anchoring close the loop. The compiler is deterministic given $(v,\text{context},\nu,t)$, and any change in output is attributable to context updates, policy version changes, or time-scoped rule amendments. Trusted time binds both $\nu$ and $\mathrm{Cert}_{\mathrm{comp}}$ to replayable evidence via Eq. 14. The result is a governance process that integrates admissibility, feasibility, committee formation, and externalisation, while keeping the orientation matrix as a guidance device rather than a source of hard-coded execution rules.

Stylised simulation pseudocode

The following pseudocode illustrates a pass through context detection, policy compilation, dominant disqualifier short-circuiting, admissibility checks, and the externalisation gate defined in Equation Eq. 8.

This pseudocode shows how the system detects applicability, assigns the orientation label, compiles policy deterministically, short-circuits on dominant disqualifiers, evaluates admissibility for obligation artefacts, optimises over the feasible set defined by Eq. 6–Eq. 7, executes the externalisation gate Eq. 8, and records every decision path by minting a replayable, time-bound audit pack.