FinGuard let the compliance team own the rules marketing writes against
An internal tool built at PingPong to unblock the queue between marketing and compliance. Submit any public-facing asset, pick where it will run, and get a jurisdiction-matched audit that cites the rule and links its source. Compliance and legal maintain the policies themselves.
The internal build ran at PingPong. The demo that opens here is public, and it runs on seed data with static rule text.
Marketing approved it in an hour. Then it sat in compliance for a week.
At PingPong, a B2B cross-border payments platform, every public-facing word goes through internal review. Marketing signs off quickly. Compliance has to sign off too, and that is where the timeline lived, because a marketing asset is rarely the most urgent thing on a compliance team's desk.
Compliance had written marketing guidance, and it varied by region. The team applied it from memory and asked a person when unsure, over email, which is where requests get buried. The publishing calendar bent around a queue nobody owned. Nobody was measured on that queue either, so the hour and the week are what the team recalled.
This is a cross-department problem before it is a technology problem, and it is the kind I find worth solving: a small, specific operational failure that the team put at days every month.
Compliance suites, AI checkers, a raw chatbot
This is a common enough problem that products exist for it. None of them fit a marketing team sitting inside a regulated payments business.
They watch, archive and attest, and they leave the audit trail regulators expect.
They are built and priced for the compliance department, so marketing cannot self-serve. That is the bottleneck.
RejectedAn instant read on any text, with no setup.
They cite nothing, and they know nothing about which jurisdiction the asset is shipping into. A compliance reviewer cannot verify what comes back.
RejectedA good answer on the day you paste it, for the cost of a subscription somebody already has.
The policy goes stale inside the prompt, it logs nothing, and the next person starts from an empty box.
RejectedAll three treat the verdict as the deliverable. Legal wanted the artifact around it: a time-stamped record with the rule and the source attached, which they had been assembling by hand after the fact.
Built so the compliance team could run it without help
I designed it for the reviewer first. If compliance and risk could not maintain the rules themselves, the tool would drift out of date and the team would go back to email within a month.
So compliance and legal own their own records: they upload the approved company policy, the compliance policy, and the regional variations, and edit them in place. Marketing submits an asset and picks where it will run. The tool matches the asset to the rules for that jurisdiction and channel, and anything needing a human decision notifies the right reviewer, and the shared inbox is out of the path.
Everything lands in one record, which I expected to matter as much as the checking: past approved copy became searchable, so the safest phrasing for a claim could be reused.
Compliance writes the rule in the product, marketing gets the verdict in seconds
Submit ad copy, a one-pager or a deck, choose the destination jurisdiction, and get a risk score with the phrases that caused it.
The company's own overlays, each tagged to where it applies: absolute terms, fee disclosure, testimonial wording, capital-at-risk language.
Each jurisdiction carries its rules and their source, from FINRA 2210 and SEC 206(4)-1 to CCPA, NYDFS Part 500 and MiCA. I picked this set for the public demo so the example scope is reproducible. The internal build ran on a payments rulebook.
It keeps every submission with its score, verdict and jurisdiction, so the log is the review history.
Findings cite the rule and link to its source, so a compliance reviewer can check the tool. The verdict is advisory throughout: it tells a human where to look and leaves the decision with them.
A flagged phrase comes back with the rule it breaks and a rewrite the marketer can use
Submit a line like "Guaranteed 15% Returns" and the tool returns three things together: the rule it breaks, FINRA 2210, the reason in a sentence a marketer understands, and a rewrite that keeps the intent. In this case "Historically targeted 15% annual returns", which is the same claim with the promise taken out of it.
The score alongside it runs 0 to 100 on risk, so a piece of copy sorts into pass, needs review or fail without anyone arguing about severity. The bet was that returning the rewrite in the same response would end the round trip: a flag on its own sends the draft back into the queue, while a flag with a compliant alternative ends the round trip there.
The review turned into a decision at the point of submission
I wanted marketing to stop shipping drafts that were going to come back, and compliance to stop being the first reader of obvious problems. In the product, the handoff is a notification with the flagged lines attached.
It is a small tool, and that is the point. I built it for one operational failure between two departments, and for the non-technical team that had to live in it.
The first of these I built, and the one the others grew out of
FinGuard is early work. It was among the first things I web-coded.
The idea it proved, that a rulebook is more useful as structured data than as a document, is the one that carried forward. AdGuard applied it to platform advertising policy, and CreativeOS moved both to where the copy is drafted.
What the public demo does today, and what I am not claiming
The four surfaces are open at a public URL. The change it was built to make is where my evidence stops, so that boundary is named here.
Running
The four surfaces: compliance hub, firm policies, global atlas and audit log. Nine jurisdictions, each carrying its rule text and a link to the source. Batch audit takes PDF, TXT or DOCX, and every check can be exported as a PDF certification. The internal build pulled SEC and FINRA updates on a schedule, and the public demo here ships with static rule text.
Not claimed
I have no post-launch measurement to put against that. The counts in the public demo are seed data, and they say nothing about usage.
Related
Deliberately small, because compliance had to be able to maintain it
There is no vector store and no retrieval layer here on purpose. The rulebook is small, bounded and changes rarely, so matching against records beats embedding them and hoping.
Application
ReactThe four surfaces compliance and marketing both work in.
TypeScriptTypes for the rule records and jurisdiction tags.
ViteBuild tooling.
TailwindThe design layer.
Models
Gemini FlashMatches submitted copy against the rules for the selected jurisdiction and drafts the compliant rewrite.
Knowledge
Jurisdictional catalogFINRA, SEC, CCPA, NYDFS and MiCA entries, each carrying the rule text and a link to the primary source. Firm policy overlaysThe company’s own directives, editable in the product by the people accountable for them.Delivery
VercelHosting and the audit endpoint.
Want this kind of tooling on your team?
FinGuard was built inside PingPong, and the version here is a public demo. The part that travels is letting the compliance team maintain the rulebook itself.