The rule library
Every rule we check, published in full.
131 rules, each with the provision behind it, the trigger that fires it, what evidence satisfies it, and how to close it. Free to read, no account, before you decide whether to trust the platform that runs them.
Most compliance tools keep their rule set private. We think a rule you cannot check is not evidence of anything.
One
Conduct — 99 rules across 8 categories
How you are licensed, how you advise, how you onboard, how you handle personal information, how you deal with complaints, and how your board oversees it. Each rule is priority-weighted and carries its own citation.
FAIS readiness
Licensing, competence, supervision and ongoing conduct obligations. 12 rules
Treating customers fairly
Product governance, disclosure, needs analysis and post-sale outcomes. 12 rules
Privacy governance
Information officer duties, lawful basis, data subject rights and breach handling. 14 rules
Client onboarding
Risk management programme, identification, verification, screening and reporting. 15 rules
Complaints handling
Policy, register, timelines, Ombud referral and root cause analysis. 10 rules
Digital channels
Consent design, electronic contracting, disclosure online and channel security. 12 rules
Executive governance
Board mandate, independence, risk register, regulatory change and outsourcing. 14 rules
Binder & outsourcing
Insurance Broker: Binder duties apply where the broker is a binder holder and performs functions under a binder agreement. Uma Binder Holder: A UMA that is a binder holder must operate within its written binder agreement and the applicable statutory and regulatory framework. Insurer: An insurer using a binder arrangement remains responsible for establishing and overseeing a compliant written arrangement. 10 rules
All 99, with the priority matrix
Counts by category and board priority, and every rule in one place.
Two
Cyber — 32 rules across 7 sub-domains
Governance, digital estate, identity and access, resilience, third parties, people, and the South African operating context. Aligned to FSCA and Prudential Authority Joint Standard 2 of 2024 (in effect since 1 June 2025 for defined financial institutions). Most independent non-life Category I brokers are not directly in scope in that capacity; a broker or UMA may instead face requirements through a particular insurer contract or oversight process. 8 of the checks run automatically against your domain.
Three
The regulators behind the citations
The mandates, governing legislation, obligations and enforcement powers of the Financial Sector Conduct Authority, the Financial Intelligence Centre and the Information Regulator — so you can see not just which provision a finding rests on, but who enforces it.
How to read a rule
Every entry gives you five things: what the rule requires, what triggers a finding, the provision it rests on, the evidence that satisfies it, and the remediation that closes it. The provision is the part that matters. Look it up. If you think we have it wrong, tell us — a rule library nobody challenges is a rule library nobody checked.
The library carries a version stamp, and every report records the version it was assessed against.
Read the rules, then run them
The library is free. The assessment against your own practice takes about a minute to start.
Check my practice ↗