FinQub
Audit trail & compliance evidence

Examiner-safe vendor orchestration. One export, every decision.

Every vendor call, document, screening result, and human decision logged in order to a hash-chained audit trail — tagged by regulatory framework, queryable by tenant and date range, exportable for an examiner in minutes.

See how it works ↓

Built for sponsor banks, BSA officers, CCOs, and fintech compliance teams

What is a tamper-evident audit trail?

An immutable, hash-chained log of every event in a regulated workflow — every vendor call, every document upload, every screening result, every human decision and its rationale — written in order, signed for integrity, queryable by tenant, framework, and time range. When an examiner asks for the complete file for a specific entity at a specific date, the answer is one export, not a six-week scavenger hunt.

Most fintech compliance teams reconstruct audit evidence after the fact — pulling vendor dashboard exports, ShareFile attachments, email threads, Slack screenshots, and case-management notes into one PDF. The reconstruction is slow, expensive, and brittle. An examiner cross-checking timestamps across five sources will surface gaps that don't actually exist in the workflow but exist in the evidence assembly.

FinQub treats the audit trail as a primitive of the orchestration engine, not a reporting layer bolted on top. Every workflow step writes a structured event the moment it executes. Events are hash-chained so a tampered or missing record breaks the chain visibly. Events are tagged at write time by regulatory framework — BSA, AMLD6, FinCEN CDD, OCC bulletin 2013-29, FFIEC IT examination — so retrieval is a query, not a manual classification project.

Audit trail as a primitive. Six properties that make it useful.

Built into the orchestration engine, not bolted on as a reporting layer.

Hash-chained immutability

Every event includes a cryptographic hash of the prior event. A tampered or missing record breaks the chain on the next verification — no silent edits, no retroactive rewrites. Anchor periodically to an external timestamping service for third-party-verifiable integrity.

Framework-tagged at write time

Events are labeled with the applicable regulatory framework as they execute — BSA, AMLD6, FinCEN CDD, OCC bulletin 2013-29, FFIEC IT examination, PCI DSS. Retrieving evidence for a specific exam becomes a query, not a manual reclassification of unstructured logs.

Per-tenant isolation

Multi-tenant by design. Each tenant's events, decisions, and policies are isolated; a sponsor bank reviewing one fintech partner sees that partner's file only. Per-tenant policies (different jurisdictions, different risk thresholds) execute against the same engine without cross-contamination.

Decision rationale preserved

When a workflow step is human-reviewed, FinQub captures the reviewer, the inputs they saw, the rationale they gave, and the policy version applied. When a step is auto-decided, the policy ID, signal values, and threshold logic are preserved. Examiners get the why, not just the what.

Queryable by tenant, framework, time, entity

Filter by tenant, partner, regulatory framework, decision type, time range, vendor, or workflow ID. The same query language drives ad-hoc internal review, scheduled compliance reports, and regulatory exam responses. No separate reporting database to keep in sync.

Examiner-ready export in minutes

Produce the complete audit file for a partner as of a specific date — every registry lookup, every document, every UBO verification, every screening result, every decision and its rationale — as a chronologically ordered, hash-verifiable bundle. What used to take six weeks of manual assembly is a query and an export.

For BSA officers, CCOs & sponsor-bank compliance teams

The exam is on a Tuesday. The evidence assembly should be on Monday.

Since 2023, the OCC, FDIC, and Federal Reserve have issued seven-plus enforcement actions against sponsor banks for inadequate fintech partner oversight — Blue Ridge, Cross River, Lineage, Choice, Sutton, Evolve, and others. The specific failure pattern repeats: the bank cannot produce a coherent audit trail of its KYB and ongoing-monitoring decisions fast enough to satisfy the examiner.

The root cause is structural. When KYB lives in ShareFile, screening lives in a vendor dashboard, EDD lives in email threads, and re-verification lives in a spreadsheet — assembling the "complete file for partner X as of date Y" is an archaeological project. By the time the file is assembled, the examiner has already noted the delay.

FinQub reduces that to a single export. Every registry lookup, every document upload, every UBO verification, every screening result, every decision and its rationale — logged in chronological order, hash-chained for integrity, tagged by BSA / FinCEN CDD / OCC bulletin / FFIEC framework, queryable by partner, by date range, by decision type. What used to take six weeks is a query and a download.

This works the same way for the inverse direction: when your fintech partner asks for evidence that your sponsor-bank approval was current as of a specific date, you produce it in the same one-export motion. Bidirectional accountability without a bidirectional spreadsheet.

FinQub provides evidence infrastructure. Compliance determination, examiner narrative, and risk acceptance remain your responsibility, informed by your auditors and regulators.

Keep reading

Frequently asked questions

Stop building your orchestration layer. Start running on it.

Let's talk about what FinQub looks like for your stack — which tools you're running, where the pain is, and how quickly you can eliminate it.

Not ready to book a call? Apply for the Partner Program →