AML / KYC for UAE fintechs
ComplyGCC — AML and KYC compliance software for UAE fintechs
A rule engine you can read, and a model that never sees a name.
What it is
Screening, case management and SAR drafting with roles that are actually enforced — an auditor cannot write, and that is checked in every server action. All PII is stripped before anything reaches a model, and SAR drafts use local placeholder tokens that are substituted on your machine.
The numbers
- Roles enforced server-side
- Admin · Officer · Auditor
- Threshold rule
- AED 55,000
- Structuring window
- 3 × 72h
- PII reaching the model
- Zero
What is inside
- Configurable rules — threshold, structuring, high-risk jurisdiction
- Single data layer = a one-line data-residency switch
- SAR drafts with {{TOKEN}} placeholders substituted locally
- Honest about what is simulated: watchlist, FATF snapshot, filing
In more detail
Which transactions the rule engine flags
Three rule families do the flagging. A threshold rule catches a single transaction above the configured amount. A structuring rule catches a set of smaller ones — 3 inside one 72-hour window on this build — that add up to the same amount. A jurisdiction rule flags counterparties in high-risk countries. All three are configuration, not numbers compiled into the code.
What the model is allowed to see
Nothing that identifies a person. Names, account numbers and identifiers are stripped on the server before any request leaves it, so the count of personal fields reaching the model is zero by construction rather than by policy. A drafted report comes back with placeholder tokens in the gaps, and your own machine substitutes the real values when you open it.
Why an auditor cannot write to a case
Because the check sits in the server action, not in the button. Admin, officer and auditor are separated at the point where the write happens, so a read-only auditor stays read-only even if the interface is bypassed. Hiding a control in the browser is not access control, it is a suggestion. This is the difference between a role that holds and one that only looks like it does.
What is real in the demo and what is simulated
The rule engine, the role enforcement and the report drafting are real code you can run. The watchlist, the FATF snapshot and the filing step are simulated, and the page says so rather than letting a demo imply an integration that is not there. ComplyGCC is an MVP built for a UAE fintech, not a system in production. What that leaves is a shape you can adapt: because everything reaches the database through one layer, moving that database to hosting inside the UAE is a one-line change rather than a rewrite.
Built with
It boots in your browser and runs the real logic — no form, no sales call.
Common questions
Is ComplyGCC something we can deploy today?
Not as it stands — it is a working demo, an MVP built for a UAE fintech. The rule engine, the roles and the report drafting run for real; the watchlist, the FATF lists and the filing step are simulated. Fitting it to your own thresholds, providers and data is the build.
Does customer data get sent to an AI model?
No personal data reaches the model. Identifiers are stripped on the server before the request goes out, and drafted reports come back with placeholder tokens that your own machine fills in locally. The model sees the shape of a case, never a customer.
Are the flagging thresholds fixed?
No — they are configuration rather than logic. The amount that trips the threshold rule, the count and the window that trip the structuring rule, and the list of high-risk jurisdictions are all values held outside the code. That is the point of a rule engine you can read: the person who owns the policy can see exactly what it does, instead of taking a black box on trust.
What does a system like this cost to build?
Scope decides the figure, and it is quoted per project in writing after a call. What moves it here is how many rule families you need, whether a real watchlist provider is integrated, and where the data has to live. There is no list price on this site.
Related reading
More of the work
- JD PROP AIReal-estate command centre
- JD Property OSManage and maintain, one account
- Atlas ERPAI-native ERP for GCC contractors
- StockBookBuilt around one man’s spreadsheet
- MRP Businessman ServicesPublish what the industry hides
- Estate VaultFor land deals that arrive on WhatsApp
- CourseDeskTutor-side automation
- RippleWhat should we develop next?
- ScanversePhone to photoreal 3D
- Alaska MachineryInjection moulding · Sharjah
- Aluminium & Glass demoNothing typed in from a catalogue
- Tyre & Oil demoPrices benchmarked to the real market
- Cafe demoThe licence says cold and hot
- Barbershop demoBarbering, booked properly
- Excel PlasticsEvery bottle solved, not modelled
JD Software Solutions — a four-person software studio in the United Arab Emirates. We build the system, hand over the code, and stay on to run it.