New: the Kontor regulatory map, with UK, EU and US obligations mapped to controls and evidence. Read it

[ Kontor / Trust ]

The regulatory map.

For each obligation a consumer lender carries, this map shows which Kontor control supports it and the evidence the control produces. It's written for compliance teams, internal audit and anyone who needs to explain agent-run servicing to a regulator, in any market.

View demoRead the regulatory map

You, the lender

Own the permissions and the policy

You hold the licences and permissions in each market where you lend, write the credit and conduct policy, set agent autonomy and remain accountable to your regulators. Using Kontor doesn't move regulatory responsibility.

Kontor, the platform

Enforce the policy and produce the evidence

Kontor enforces your policy consistently, records every decision and action, and gives you the controls and evidence below. Our contracts are set up for the outsourcing rules that apply to you, such as UK SYSC 8, the EBA guidelines or US interagency guidance.

[ Jurisdiction packs ]

One platform. A rule pack per market.

Notices, disclosures, allocation orders, hardship flows and timing rules ship as versioned configuration per jurisdiction, maintained by Kontor and approved by you. The packs below are live today; new markets are added as packs, not projects.

[ UK ]

United Kingdom

FCA CONC, Consumer Credit Act, Consumer Duty

[ EU ]

European Union

Consumer Credit Directive (CCD2), GDPR, DORA

[ US ]

United States

TILA / Reg Z, ECOA / Reg B, FCRA

[ Obligation → control → evidence ]

Mapped clause by clause.

Fair treatment & conduct

Fair outcomes

UK Consumer Duty · EU CCD2

Outcome MI by cohort; fair-value inputs from the ledger; complete customer journey logs

EvidenceOutcome dashboards and board-report exports

Explainable decisions

US ECOA / Reg B · EU GDPR Art. 22

Principal reasons stored on every decision; adverse action and decline letters generated; human review on request

EvidencePer-decision reasons, replayable

Vulnerable customers

UK FG21/1 and equivalents

Vulnerability flags from conversations and behaviour; routing to trained staff

EvidenceVulnerability register and handling log

Complaints

UK DISP · US CFPB handling

Complaint detection in every channel; local response clocks; final response tracking

EvidenceComplaint returns data and case files

Lending lifecycle

Creditworthiness & affordability

UK CONC 5.2A · EU CCD2 Art. 18 · US ability-to-pay

Inputs, model version and outcome stored per decision; limit changes under policy

EvidencePer-decision record, replayable

Disclosures & statements

US TILA / Reg Z · UK CCA s.77–78

Statements, periodic disclosures and information requests generated from the ledger, on schedule

EvidenceDelivery log and retained copies

Payment allocation

US Reg Z §1026.53 · UK CCA

Surplus above the minimum goes to the highest-APR balance first; each allocation is a ledger event

EvidenceAllocation events per payment

Early repayment

EU CCD2 Art. 29 · UK ES Regs 2004

Statutory rebate per market; payoff statement within the required window

EvidenceQuote with calculation inputs

Billing disputes & connected lender

US Reg Z §1026.13 · UK CCA s.75

Eligibility checks, evidence packs, deadlines tracked, human decision on rejection

EvidenceClaim file with timeline

Financial difficulty

Hardship & forbearance

UK CONC 7 · EU CCD2 Art. 35

Policy-bound hardship agent; forbearance before escalation; debt advice signposted

EvidenceCase file showing every contact and option offered

Delinquency notices

UK CCA s.86B/86C · US state notices

Required notices generated on trigger, within each market's statutory timing

EvidenceNotice record with trigger event

Default & enforcement

UK CCA s.87–88 and equivalents

Drafted by the agent, approved by a named person, remedy periods enforced

EvidenceApproval record and served notice

Long-term debt

UK CONC 6.7

Live interest-vs-capital tracking with staged interventions; reusable for any minimum-payment regime

EvidenceStatus history per account

Operations & security

Operational resilience

UK SYSC 15A · EU DORA

Important business services mapped; impact tolerances tested; stand-in authorisation

EvidenceScenario test results for your self-assessment

Outsourcing

UK SYSC 8 · EBA guidelines · US interagency

Audit and access rights for you and your regulators; documented exit plan with full data export

EvidenceContract pack and exit runbook

Card data

PCI DSS

PANs tokenised at the edge; card data environment segmented from the core

EvidenceAttestation shared under NDA

Personal data

EU / UK GDPR · US state privacy laws

Regional data residency, retention schedules per record type, subject access export

EvidenceDPA, processing records, access-request export

This map is a summary to help with due diligence. It is not legal advice and does not replace your own compliance assessment. Full control descriptions are available to prospective clients under NDA.

[ Security ]

Built for the bank's security review.

Certification reports, penetration test summaries and our full security questionnaire are shared under NDA during due diligence.

Data

Encrypted, resident, retained by rule

Encrypted in transit and at rest with per-tenant keys. Data is held in the region you choose — UK, EU or US — and retention schedules are enforced by record type.

Access

Least privilege, including for agents

SSO with enforced MFA, role-scoped permissions and just-in-time production access. Agents have scoped credentials and never hold PANs.

Integrity

A ledger that can't be quietly edited

The event log is append-only and hash-chained. Corrections are new events, and any break in the chain raises an alert.

Run your credit book on Kontor.

Bring a product spec or a portfolio extract. We'll show you how the ledger, decisions and agents would run it, and what your regulator would see.

View demoRead the regulatory map