Suitability
The rules are part of the flow, so advice is checked as it is built. You decide which controls a flow uses and the platform enforces them at submit: risk bounds on a custom portfolio, against the maximum equity share and volatility for the client's risk score; financial capacity, stopping deposits above what the client can afford or a liquidity buffer below your minimum; knowledge and experience, so a portfolio cannot hold a product type the client has not passed the assessment for; sustainability preferences; and MiFID II client classification. Where your policy allows a deviation, it takes a written justification, recorded on the flow and printable in the suitability report — documented where the client and your compliance function will see it. 

KYC and AML
Screening is part of the flow, not a separate errand. Put the PEP and sanctions lookup in a flow and the flow cannot be submitted until it has run. For a company, the beneficial owners and the representative are taken from the company register and screened too.

A compliance area of its own
People with the Compliance role can open any client's advice read-only, and have five tools: clients review, for every client's PEP and sanctions standing; batch lookup, screening every client in a view in one run; flow approvals; flows review; and identity changes. 

Approvals as a gate inside the process
Per flow, choose which submissions a compliance user must approve before they continue — none, all, or only those with PEP or sanction hits. Submitted advice is locked for editing. Compliance approves it, or rejects it with a reason the advisor sees on the flow. Webhooks fire when an approval is requested, given, refused or withdrawn, and a flow can wait on another system's decision through the API. 

Review after the fact
Completed advice with the facts that matter side by side: filter by period, advisor, flow, risk deviation, custom portfolio, sustainability, amount and review status, or let the platform pick flows at random so the sample is not hand-picked. Flag, remark or approve — every action needs a note, because a verdict without a reason is not evidence — and the history stays on the flow. 

What is recorded
Each step of a flow's process, from submitted and sent to compliance through approved, signed and completed, with who did it and when. Every compliance decision with its reason. Every screening lookup and every decision on a match. And at submit, the client's preferences and the generated portfolio are stored with the flow, so a later change does not rewrite what was advised. 

The same foundation applies whether you advise under MiFID II, sell insurance-based investments under IDD, or offer investment mandates.