Every lifecycle
Evidence packs: the decision, with the record behind it.
Once a case is approved or rejected, an authorised user can generate its evidence pack: the decision, the sources it rests on, the review and the recorded moves in the case, as a PDF with a manifest. The manifest records the SHA-256 hash of the PDF and of itself, so a recipient can check the files are consistent with the hashes they came with.
- DecisionHuman reviewApproved · checker
- SourcesEvidence inventoryEach with its retrieval time
- IntegrityManifestPDF and manifest hashes
The recipient recomputes both hashes and compares them with the ones supplied.
How it works
Generate the pack. Assemble the record. Hash the files. Check the hashes. Keep every revision.
- 01GenerateCaseKYC-2026-0418DecisionApprovedRequested byMLRO
Once a case is approved or rejected, an authorised user generates its evidence pack.
- 02AssembleIn the packSourcesEach with its timeHitsWith their historyMovesEvery step
The pack assembles the decision, the sources with their retrieval times, the screening hits with their history, and every recorded move in the case.
- 03HashPDFsha256:4be1…a07cManifestsha256:9c0d…e512Chain headsha256:7d2c…19ab
The manifest records the SHA-256 hash of the PDF and of itself, and the head of the audit chain behind the case when the pack was made.
- 04CheckThe recipientMatchDifferHashes match the manifestRecomputed by the recipient
A recipient recomputes the hashes, as the pack's own instructions describe, and compares them.
- 05KeepRevisionsStatusPartial · unsignedRevision2 · earlier keptExport PDF
If a case is corrected and decided again, the new pack supersedes the earlier one, which stays on record. Download requests are logged in the audit ledger.
The product
Why did we approve this customer?
A reviewer in cmpliance follows an approved case back to its source evidence, the human rationale and the recorded actions.
The pack
What should an evidence pack let you answer?
Another officer or an auditor should be able to answer five questions from the pack.
- What was decided, in which role and when.Human reviewQuestion for the readerDone ·DecisionRoleTimein the pack
- Which sources the decision rests on, and when each was retrieved.Evidence inventoryQuestion for the readerDone ·SourceRetrievedeach listed
- Which findings were open, cleared or confirmed, and why.Hit historyQuestion for the readerDone ·OpenClearedReasonper hit
- Whether the files match the hashes they came with.ManifestQuestion for the readerDone ·PDF hashManifest hashrecompute and compare
- Enough to judge whether the decision was reasonable.Your callAuditor
A status and a folder: open questions for the auditor.
cmpliance: answered in the pack, the judgment left to the reader.
The checks
Two checks, and what they do not show
A pack can be checked in two ways, and neither proves everything.
A recipient with the PDF and the manifest can recompute both SHA-256 hashes and compare them with the ones supplied.
An authorised user can verify the audit chain behind the case inside cmpliance, event by event.
The pack is not signed, and its verification status reads partial.
A matching checksum shows the files match the hashes they came with, not who made them, that they are true or that the evidence is complete.
The record
More than a decision memo
A decision memo says what was decided. The pack also shows which sources were used and when, what was open, each recorded move in the case, and a manifest with the hash of the PDF and the head of the audit chain at the time it was made. The record itself stays in cmpliance.
A decision memo says what was decided.
Decision memo- The sourcesEach with its time
- What was openHits and requests
- Each moveWho · role · when
- The hashesPDF · manifest · chain head
- The pack holds the decision, its sources, the review and every recorded move in the case, in a PDF with a manifest.
- A recipient can recompute the SHA-256 hashes of the PDF and the manifest and compare them with the ones supplied.
- The manifest records the head of the hash-chained audit trail behind the case, which an authorised user can verify inside cmpliance.
Insights
Related reading
Audit-ready evidence packs for compliance decisions
An evidence pack should let another officer reconstruct a compliance decision without relying on the original reviewer's memory. Here is what that requires.
Read the article
Why did we approve this customer? Reconstructing the decision
An approved status tells a reviewer what happened. Explaining why requires the source evidence, human rationale and recorded actions that supported the decision. This cmpliance walkthrough follows that reconstruction.
Read the article
Compliance evidence glossary: KYC/AML terms, defined plainly
Plain definitions of the terms used in KYC/AML evidence review, from beneficial ownership and adverse media to maker-checker review, evidence packs and hash-chained audit trails.
Read the article
Common questions
What is in an evidence pack?
The decision, in which role and when it was taken, the sources with their retrieval times, the screening hits with their history, every recorded move in the case, the open findings and the limits of what was checked.
How does a recipient check a pack?
With the PDF and the manifest: recompute the SHA-256 hash of each, as the pack describes, and compare them with the hashes supplied. That shows the files match those hashes, not who made them, that they are true or that the evidence is complete. The manifest comes with the PDF through the API.
Is the pack signed?
No. The manifest is unsigned, and the pack says so: its verification status reads partial.
Can a recipient verify the audit trail from the pack?
Not from the pack alone. The audit chain is verified inside cmpliance by an authorised user, and the pack records the head of the chain when it was made.
When is a pack made?
Once a case is approved or rejected, on request. If the case is later corrected and decided again, the new pack supersedes the earlier one, which stays on record.
Are the source documents inside the pack?
No. The pack lists each source with its retrieval time, and its web address where one was recorded. The documents themselves are not included.
Who can download a pack?
People in your organisation whose role includes evidence access, and API keys with that scope. Download requests are logged in the audit ledger.
Do workflow runs get a pack too?
Yes. A workflow run gets its own pack automatically when it finishes. This page describes the pack for a decided case.