Who can fix compliance problems inside a NZ financial service system
Most compliance failures in financial services are not policy failures. The policy is usually right and the system has quietly drifted away from it, terms changed and the calculation did not, a disclosure requirement was added and one code path missed it, a retention rule was written and nothing enforces it. Auditors find the gap, the fix is engineering, not another document.
The gap between the policy and the system
When your terms changed, did you remember to update your system?
Where the drift shows up
Interest and fee calculations. Disclosure timing. Data retention. Access controls that were correct three restructures ago. manual workarounds that became the process.
Policy drift rarely affects every path at once. A main workflow may use the new calculation or disclosure while an exception path, manual override or batch process continues using the old rule. The system can appear correct until an auditor follows one of those less common routes. The engineering task is to find every implementation of the rule, align it and leave a versioned record of the change.
Why documentation trails matter more than the fix
An auditor asking "show me when this changed and who approved it?" is asking a system question.
Regulation anchor
Requirements under the CCCFA and AML/CFT regime can have direct system consequences: what is calculated, what is disclosed, which checks must complete, what is retained and what evidence can be produced later. Dark Arts does not provide legal or compliance advice. Your advisers define the obligation; we trace it through the software, identify gaps between the approved policy and implemented behaviour, and make the agreed engineering changes.
Frequently Asked Questions
Our auditors flagged gaps in our documentation trail. Is that a systems problem?If your system is fully automated then yes. We build systems that know what documentation is required and when, if the documentation has not been received at a certain step in proceedings, our systems will not move forward. All documents in our systems whether manually uploaded or from and API are flagged in the log with the date and time they are received and how they were sent, email, API, scanned. This way our clients know they have all they need in one place so if the auditor asks to see them, they can find them quickly and easily.
We changed our terms, how do we know the system followed?
A change in terms is a policy change therefore the system will only comply if the matching logic has been changed in the system. At Dark Arts we document all changes to every system and would be able to tell you when the system changes were introduced, so long as we were given direction to make the change.
Do you provide legal and compliance advice?No. We look at your policies and terms and make sure that the system follow these. It is up to your compliance officer to make sure we are aware of any changes or gaps that may require changes to the system.
Can you assess without production access?
Absolutely. Our assessment is read-only. We don't make changes to your production environment or data during the assessment. Any recommendations are discussed with you before any implementation work begins.
How quickly can we know how exposed we are?
That will depend on the size and complexity of your system. A larger platform will take longer to work through. Once we have scoped the system we usually give a turnaround estimate. Spectra assesses a defined set of checks, which is why we know roughly how long an assessment will take.
Related reading: Can you prove the data hasn't been changed?