Astra Strategies - Compliance Consistency App

AI-native compliance for small Canadian investment firms: cited, red-teamed, and signed by a human.

Comment

Inspiration

I'm a CPA, CFA and former Chief Compliance Officer of a Canadian portfolio manager. Every registered investment firm in Canada has to keep three documents agreeing with each other and with National Instrument 31-103: its conflicts-of-interest register, its client-facing Relationship Disclosure Information, and its policies-and-procedures manual. In practice they drift apart, and that drift is what a regulator finds in an exam. Large firms catch this more easily because they have a larger compliance department. The boutique portfolio managers, exempt market dealers and fund managers don't, and they carry exactly the same obligations. I personally found this as a pain point at these firms that I could solve through technology.

Astra started as the tool I wanted as a CCO and became the operating system for a one-person compliance practice that serves those firms at a price they can justify paying for.

What it does

Document consistency review. Before anything reaches a model, a PII pre-flight scan flags identifiers and a local Redaction tool replaces them with restorable placeholders. Astra then cross-checks the register, RDI and manual against each other and against NI 31-103, cites the provision on every finding, and a second, independent model red-teams each finding (supported / overstated / unsupported) before I see it.

Conflicts-of-interest workbench. Each conflict is assessed the way a CCO would: not a yes/no on disclosure, but a six-way determination (disclosed, or one of five distinct reasons it isn't required). It reads the firm's actual manual and disclosure through targeted passage retrieval and answers "where is this disclosed?" with a citation or "Not in RDI — gap." Eleven output guards constrain every response; the client's own conflict titles can never be overwritten, and a conflict the firm has already disclosed can't be silently un-disclosed by the model.

A real approval control. Final approval is refused while any conflict is parked for follow-up; retiring a conflict demands a written rationale; every decision carries the reviewer's name and role; the approval memo exports to Word or PDF for board sign-off; the register exports as a tracked-changes workbook with the regulatory reason for every change.

The manual keeps working. From the same P&P, Astra generates the firm's compliance calendar (every recurring obligation with its source section, risk, owner and a workflow status) and a scheduled morning briefing reports what is due and what slipped.

AML Compliance review. The same architecture runs a design assessment of a firm's anti-money-laundering program against a versioned library of cited obligations, filtered by registration category, with the red-team disagreements shown to the reviewer and an override that requires a written note.

The business runs on AI too. An Operator layer reads the whole practice and produces deterministic "needs attention" cards with approve-to-act, proposals are AI-drafted against a service catalog, engagement letters render from a version-stamped template with an AI-use policy attached, invoices flow through Wave Accounting, and every AI call's cost is logged per client.

How I built it

React + Vite on Firebase (Auth, Firestore, Cloud Storage, Cloud Functions, Hosting) in Google's Montreal region, with Gemini on Vertex AI as the default model and a role-based model registry that lets me assign other models per task (Claude runs the adversarial red-team). Structured output is schema-enforced on every path. Prompts are fingerprinted for drift, the guard layer has its own 70+-assertion test suite, and a failed evaluation run exits non-zero. Reuse disclosure: the COI field schema, portions of the COI prompts and the approval-workflow design were adapted from a pre-competition prototype I built; all client-specific content was stripped in the port.

Challenges we ran into

Keeping within scope (so many possibilities!) and ensuring the model was acting correctly to understand and interpret the regulations.

Accomplishments that we're proud of

I have no prior background in software development and coding. I taught myself how to use AI tools through tinkering around with Loveable, Open Claw, Claude Co-Work, and AntiGravity. I'm excited to share with others of what is possible for someone with no programming skills!

What I learned

That the hard part isn't getting a model to answer, it's getting it to answer the way a regulator would expect to read it. The model wanted to grade a missing disclosure "minor," to excuse an operating conflict as "merely foreseeable," and to call gifts immaterial because the dollar limits were small. Every one of those became a deterministic guard, because a rule the model may ignore is not a control. The other lesson: the software should hold me to the same standard. The refusals are the feature.

What's next for Astra Strategies - Compliance Consistency App

Continue to build my own consulting practice and potentially resell the app through other compliance consultants, extend the obligation libraries (the AML fieldwork test library and document-request list are already seeded), and keep the eval harness ahead of the prompts.

Built With

  • anthropic-api
  • claude
  • cloud-firestore
  • cloud-functions
  • cloud-storage
  • fintrac
  • firebase
  • firebase-auth
  • firebase-hosting
  • gemini
  • gmail-api
  • google-meet-api
  • jszip
  • ni-31-103
  • node.js
  • pdf.js
  • react
  • sonner
  • tailwindcss
  • tsx
  • typescript
  • vertex-ai
  • vite
  • wave-api
Share this project:

Updates

Submission history