Sumsub — Conformance (regulation ↔ deployed config)

Traces every requirement of a regulation through the live config graph and answers, per requirement: collected? → scored? → enforced? The headline finding it surfaces — that nothing else does — is COLLECTED-BUT-NOT-ENFORCED: the config gathers and scores the data a regulation needs, then doesn't act on it (e.g. an appropriateness questionnaire that's scored but never routed).

This is an advisory gap assistant, not a compliance guarantee. It verifies the config-representable parts deterministically and honestly delimits the rest (semantic intent = judgment; SDK/platform outcomes = out of scope). Get a human to sign off.

When to use

• Existing client: "here's our regulation, here's our tenant — what's actually enforced?"
• New client who configured Sumsub with the create-* skills: close the generate → verify loop — did the assembled config end up enforcing the regulation it was built from?

Endpoints (read-only)