Skip to main content

Compliance Gap (Feb 2026)

Drop Compliance Gap Analysis — Overnight Sprint

2026-02-16

TL;DR

Readiness: 8/100 (per gap-analysis-v2.md, 2026-02-12)

We have more than we think:

The gap is NOT documentation — it's code infrastructure for compliance. The legal docs exist but the app has zero compliance plumbing.

GAP MATRIX: IMAMO vs TREBA

BACKEND

# Component IMAMO TREBA Gap AI Tonight?
B1 Audit logging Nothing Immutable audit_log table + middleware on all sensitive ops FULL YES
B2 DB schema: compliance columns users.kyc_status only users.dob, national_id_hash, risk_level, pep_status, sanctions_cleared, kyc_method, kyc_verified_at FULL YES
B3 DB schema: compliance tables None audit_log, aml_alerts, str_reports, screening_results, consents, data_access_requests FULL YES
B4 Transaction monitoring Nothing Rule engine: structuring, velocity, corridor risk, volume spike, PEP FULL YES
B5 GDPR: Data export (DSAR) Nothing GET /api/user/data-export — full user data JSON FULL YES
B6 GDPR: Account deletion Nothing DELETE /api/user/account — soft-delete with AML retention FULL YES
B7 Consent management API Nothing POST /api/consents, GET /api/consents — track GDPR consents FULL YES
B8 Pre-auth disclosure Fee shown AFTER submission GET /api/transactions/disclosure — fees, rate, ETA BEFORE auth FULL YES
B9 Transaction receipt API returns tx data GET /api/transactions/[id]/receipt — PSD2 formatted receipt FULL YES
B10 Purpose codes No field transactions.purpose_code column + API support FULL YES
B11 QR KYC gate Missing (QA H-11) KYC check in QR payment route FULL YES
B12 Password complexity Length-only (>=8) Uppercase + lowercase + digit + min 8 PARTIAL YES
B13 Cookie consent API Nothing POST /api/consents/cookies — track cookie preferences FULL YES
B14 Complaint handling API Nothing POST /api/complaints, GET /api/complaints — track complaints FULL YES

FRONTEND

# Component IMAMO TREBA Gap AI Tonight?
F1 Cookie consent banner Nothing GDPR cookie consent with preferences (necessary/analytics/marketing) FULL YES
F2 Pre-payment disclosure Goes straight to submit Screen showing: amount, fees, exchange rate, ETA, total BEFORE confirm FULL YES
F3 Transaction receipt view Basic tx detail PSD2-compliant receipt: amount, fees, rate, ref, date, payee FULL YES
F4 Data export request Nothing Settings → "Download my data" button → triggers DSAR FULL YES
F5 Account deletion Nothing Settings → "Delete account" with confirmation, AML warning FULL YES
F6 Complaint form Nothing Help → "File complaint" form (Finansavtaleloven §3-53) FULL YES
F7 Fee schedule page Nothing Public page: all fees, rates, corridors (Betalingstjenesteloven §3-23) FULL YES
F8 Consent in registration No consent checkbox Checkbox: "I accept terms" + "I accept privacy policy" with links FULL YES
F9 Privacy policy page Only landing vilkar.html In-app /privacy page with full personvernerklaering content FULL YES
F10 Terms page Only landing vilkar.html In-app /terms page with full brukervilkar content FULL YES
F11 Withdrawal form Nothing In-app /withdrawal page (Angrerettloven §11) FULL YES

MOBILE / PWA

Same as frontend — Drop is a PWA, no native app yet.

CANNOT DO TONIGHT (Requires External)

# Component Why Not
X1 BankID integration Needs test agreement + banking partner
X2 Real KYC (Sumsub) Needs Sumsub production contract
X3 Open Banking AISP/PISP Needs banking partner (SpareBank1/Swan)
X4 PostgreSQL migration Infrastructure decision needed
X5 Penetration test External firm required
X6 Finansklagenemnda membership Registration process
X7 SSB/Valutaregister registration Government registration
X8 License application Needs legal advisor + Alem
X9 Compliance officer appointment Human decision
X10 PEP/Sanctions screening Needs provider (ComplyAdvantage/Refinitiv)

OVERNIGHT SPRINT PLAN

Phase A — Database Schema (foundation, do first)

Files: src/lib/db.ts Tasks: B2, B3, B10

Add to users table:

  • risk_level TEXT DEFAULT 'low' (low/medium/high)
  • pep_status TEXT DEFAULT 'not_checked'
  • sanctions_cleared INTEGER DEFAULT 0
  • kyc_method TEXT (bankid/document/simplified)
  • kyc_verified_at TEXT
  • national_id_hash TEXT
  • deleted_at TEXT (soft delete for GDPR)

Add to transactions table:

  • purpose_code TEXT (ISO 20022 purpose codes)

New tables:

  • audit_log (id, timestamp, user_id, action, resource_type, resource_id, details, ip_address, user_agent)
  • aml_alerts (id, user_id, alert_type, severity, transaction_id, details, status, reviewed_by, reviewed_at, created_at)
  • str_reports (id, user_id, alert_id, report_type, status, filed_at, reference_number, details)
  • screening_results (id, user_id, screening_type, provider, result, match_details, screened_at)
  • consents (id, user_id, consent_type, granted, granted_at, withdrawn_at, ip_address)
  • data_access_requests (id, user_id, request_type, status, requested_at, completed_at, download_url)

Phase B — Backend APIs (compliance endpoints)

Tasks: B1, B4, B5, B6, B7, B8, B9, B11, B12, B13, B14

  1. Audit logging middleware — wraps all API routes, logs to audit_log table
  2. Transaction monitoring — post-transaction hook: checks rules, creates aml_alerts
  3. GDPR endpoints — /api/user/data-export, /api/user/account (DELETE)
  4. Consent API — /api/consents (GET, POST)
  5. Pre-auth disclosure — /api/transactions/disclosure (GET)
  6. Receipt endpoint — /api/transactions/[id]/receipt (GET)
  7. Complaint API — /api/complaints (GET, POST)
  8. QR KYC gate — add kyc_status check to qr-payment route
  9. Password complexity — upgrade validation in register route

Phase C — Frontend UI (compliance screens)

Tasks: F1-F11

TASK SPLIT FOR AGENTS

Task Scope Agent Type Est. Files
T1: Schema upgrade Phase A (all DB changes) Builder 1 (db.ts)
T2: Audit logging B1 (middleware + table) Builder 2-3
T3: Transaction monitoring B4 (rule engine) Builder 2-3
T4: GDPR endpoints B5, B6, B7, B13 Builder 4-5
T5: Payment compliance APIs B8, B9, B11, B14 Builder 4-5
T6: Auth hardening B12 (password rules) Builder 1-2
T7: Frontend legal pages F7, F9, F10, F11 Builder 4-5
T8: Frontend compliance UI F1, F2, F3, F4, F5, F6, F8 Builder 6-8

Dependency: T1 must complete first (schema), then T2-T8 can run in parallel.

AFTER TONIGHT

With these tasks done, compliance readiness jumps from 8/100 to ~35-40/100.

Remaining blockers (external):

  • BankID + SCA (CRITICAL — needs banking partner)
  • Real KYC (CRITICAL — needs Sumsub)
  • Open Banking (CRITICAL — needs partner)
  • License application (CRITICAL — needs legal advisor)

But we'll have the infrastructure ready — when the partner comes, we plug in real providers and the compliance plumbing is already there.

No comments to display

Back to top