Compliance as code
Also called policy as code, codified compliance
Compliance as code is the practice of writing regulatory requirements and internal controls as machine-readable rules that software checks automatically. Instead of a manual review, each transaction, system change or configuration is tested against coded logic. The result is logged as evidence that the control ran, which gives auditors and supervisors a record they can test.
How it works
A firm starts with its obligations register. Compliance and legal staff break each obligation into precise conditions, and engineers translate those conditions into code, tests or configuration policies. The checks run inside trading systems, onboarding flows or cloud deployment pipelines. A failed check blocks the action or raises an alert, and every result is stored with a timestamp and the version of the rule that produced it.
The approach matters because regulated firms face a growing volume of rules across many jurisdictions. Coded rules apply the same interpretation every time and run at machine speed. They also leave an audit trail. The risk sits in translation: if the coded logic misreads the legal text, the error repeats at scale. Firms therefore keep legal sign off on each rule and retest the code whenever the underlying regulation changes.
The rules
Machine-readable XML, JSON and YAML formats for control catalogues, system security plans and assessment results.
Organisations documenting and assessing security controlsThe control catalogue most often published in OSCAL format so controls can be checked by software.
US federal systems; widely used by financial firmsCommon questions
Is compliance as code required by regulators?
No regulator requires it as such. Supervisors expect firms to show that controls work and leave evidence. Compliance as code is one way to produce that evidence automatically and consistently across high volumes of activity.
How is it different from machine-readable regulation?
Machine-readable regulation is published by the rule maker in a structured format. Compliance as code is the firm's own translation of rules and controls into logic that its systems run. The first can feed the second.
Who owns the coded rules?
Ownership usually sits with compliance, which approves the interpretation, while technology teams maintain the code. Many firms record a named owner, a legal reference and a version number for every coded rule.
Where is it used most?
Common uses include pre trade checks on orders, cloud security configuration, access controls and onboarding rules. These areas involve high volumes of repeatable decisions that suit automated testing.
Our coverage
News and analysis on regulatory change from RegTech Post.
Read the coverage →RegTech PostHow Droit Built a Platform Processing Millions of Rule Checks Each DayRead the article →RegTech PostNorm AI Bets on a Future Where Compliance Is AutonomousRead the article →
