CASE STUDY · UK FINTECH · 9-MONTH BUILD

Compliance-grade audit logging and a KYC pipeline that survives a regulator visit.

A UK-regulated fintech needed its audit trail and KYC pipeline rewritten from the ground up before its next external audit. Nine months later: zero audit findings, faster onboarding, and a compliance team that finally trusted their own logs.

Industry
UK Fintech / FCA-regulated
Engagement
9 months
Pod
3 senior engineers + compliance lead
Outcome
Zero audit findings

Challenge

The client was a UK fintech with a real customer base, real regulatory exposure, and an audit logging system that had grown organically across four years and three engineering generations. The compliance team distrusted the logs. The CTO knew it. The next external audit was nine months away.

Their pain points were the kind that compound:

  • Audit events were emitted from inconsistent code paths — some logged, some didn't, no schema discipline.
  • KYC verification was a 7-step pipeline with five third-party vendors, error handling implemented as try/catch + Sentry and not much else.
  • Reconstruction of a customer's verification history required pulling from four data sources and a Confluence page.
  • The compliance team spent ~20% of their week on hand-built reports because they couldn't trust the dashboard.

The brief was specific: rebuild the audit log and the KYC pipeline so that the next regulator visit produced a clean letter, and the compliance team stopped double-checking the system manually.

Approach

Phase 1 — Discovery (weeks 1–4)

We didn't write code. We sat with the compliance team for half a day a week, walked through actual cases (including ones that had gone wrong), and built an event catalog: every regulatorily significant action, who emits it, what fields it must carry, what its retention rule is. The catalog was the contract — once signed off, it drove every PR.

Phase 2 — Audit log foundation (weeks 5–14)

We replaced the ad-hoc logging with a typed event spec. Every emit goes through a single library that validates, serializes, signs, and persists to a write-once store with hash-chained tamper evidence. Reads happen through a queryable read model. We did not migrate historical events — we rebuilt the one source of truth going forward and kept the legacy system in cold storage.

Phase 3 — KYC pipeline rewrite (weeks 15–30)

The pipeline was redesigned around explicit state, not implicit flow. Every customer's verification is a state machine with named states, named transitions, persisted timestamps, and a single source of truth for "where is this customer in onboarding." Vendor calls are wrapped in idempotent adapters with retry policy, circuit breakers, and recorded request/response (subject to PII redaction policy) for the audit trail.

Phase 4 — Compliance dashboard + reporting (weeks 31–36)

The compliance team got a dashboard built on the new read model. Reports they used to assemble manually (SAR-relevant queries, periodic reviews, aggregate vendor-failure rates) became one-click exports with traceability back to source events.

"Compliance is a code problem before it's a process problem. If your engineers can't write down every regulatorily significant event in a single typed schema, your compliance team is doing the schema in their heads."

What we built

  • Event catalog — 47 typed compliance event types, contract-tested, version-pinned.
  • Audit log service — single write API, hash-chained store, queryable read model, retention policy by event type.
  • KYC state machine — explicit states, validated transitions, full vendor-call adapter layer with retries and circuit breakers.
  • Vendor adapters — five third-party KYC vendors abstracted behind a common interface; swapping one is a config change, not a refactor.
  • PII redaction policy in code — fields tagged at source, redaction enforced before any export or downstream service call.
  • Compliance dashboard — internal tool with role-based access, query builder for compliance team, audit-grade exports.
  • Runbooks — every failure mode we encountered during the build documented with reproduction steps for the in-house team.

Results

The next external audit produced zero findings against the rebuilt subsystems. KYC time-to-decision dropped because the pipeline now retried sensibly on transient vendor failures instead of dead-lettering them. The compliance team's manual report time fell substantially — they now run their own queries instead of asking engineering for one-off pulls.

Most importantly: the in-house engineering team owns the system. We left a single document with the catalog, the state machine, the runbooks, and a sign-off from the compliance lead. Six months after we stepped off, they shipped a sixth vendor adapter without us.

Stack

LANGUAGETypeScript (Node) + a small Go service for the hash-chain
DATABASEPostgres + append-only audit table
QUEUESQS + dead-letter monitoring
STATE MACHINEXState (typed, persisted)
VENDOR ADAPTERSOnfido, Veriff, Trulioo, Sumsub, ComplyAdvantage
OBSERVABILITYOpenTelemetry + Datadog + structured logs
SECRETSAWS Secrets Manager + KMS-encrypted at rest
TESTINGContract tests for every event type, integration tests against vendor sandboxes

Why we were a fit

We've shipped fintech and AML-adjacent systems before. We treat regulatory work as engineering, not paperwork. And we don't ship "compliance theatre" — work that looks compliant in a slide deck but fails the moment a regulator pulls a sample of 20 cases at random.

◆ START A PROJECT

Want similar results?

Compliance, AML, KYC, audit-grade systems for regulated fintech. NDA standard.