Corlytics: regulatory intelligence, policy workflows and controls

Monitoring collects regulatory notices into a common store and enriches them through classification, summaries and risk analysis. Business units can receive relevant content and carry out impact assessments in one workflow. This provides a route from a regulator’s announcement to an accountable internal review, rather than treating the notification itself as completed implementation.[2]

Policy distribution extends the process to staff. The portal distributes current documents, supports comparison with earlier versions and records attestations. Reports identify employees who have not engaged with assigned content. These records support the firm’s evidence trail; deciding what staff must receive and what an attestation demonstrates remains part of its policy process.[8]

Regulatory Risk Analytics applies a common taxonomy and risk models to curated regulatory information. It can compare jurisdictions, topics and provisions, including enforcement trends and peer benchmarks, to help teams prioritise their work. These are vendor analytical outputs used in compliance planning.[10]

The Taxonomy Manager maps external regulatory content into a firm’s own business lines, products, teams and risk framework. Automated tagging then directs information to the relevant reviewers. Its practical role is to make incoming material understandable within the organisation’s structure, rather than requiring every department to work only with a regulator’s classification.[9]

The regulatory library and monitoring products expose APIs for use with other governance, risk and compliance systems. Clausematch separately publishes a REST API for automating application workflows and sharing data, with endpoint documentation and an API support route. An API interface establishes an integration method; it does not establish a ready-made connector to every named third-party system.[11][4]

Clausematch also documents a Model Context Protocol connection for compatible AI assistants, available in non-production environments when enabled. It can expose authorised documents and permitted document or administrative actions. Access follows the signed-in user, the scopes approved for the connection and existing document and system permissions; connecting an assistant supplies no additional application authority.[13][12]

Corlytics directs prospective customers to a demonstration and commercial discussion. The reviewed sales pages do not publish a standard subscription price, per-user rate, implementation fee or minimum contract term. A written proposal is therefore needed to establish the purchased modules, regulatory coverage, user access, integration work and support entitlement.[18]

For existing Clausematch clients, the documented route for additional products or services is the Customer Success Manager. The public help page does not establish that every add-on is included in the base subscription.[16]

Implementation involves connecting regulatory classifications to the firm’s taxonomy and configuring the reviewers, document permissions and approval stages used by its teams. These choices determine where notices are routed and which people can draft, review, approve or distribute a policy. The public product pages do not prescribe one deployment timetable for all organisations.[9][3]

Corlytics describes cloud delivery for its data, software and document-management services. Its public security page lists geographic hosting and incident response among its control areas, but does not specify a universal hosting country, recovery objective or uptime commitment. Those details need to match the customer’s contracted environment.[17]

The published support routes include the client’s Corlytics team contact and the help centre. Clausematch documentation also identifies a support email for API questions and release-related assistance. The reviewed public pages do not provide standard support hours, incident-response targets or a contractual resolution time.[21][11]

Corlytics describes a combination of AI extraction and mapping with expert validation. Its obligations workflow explicitly includes the customer’s subject-matter review. That review connects suggested obligations and remediation to the firm’s actual activities and jurisdictions; software-generated mappings are inputs to that process.[5]

The supplier reports ISO/IEC 27001 certification and a SOC 2 Type 1 report. Its own description of Type 1 concerns control design at a particular point in time. The public summary is useful for initial due diligence, while the report’s actual scope, date and exceptions require the underlying assurance material.[17]

The legal page identifies Corlytics Limited as an Irish entity and distinguishes website information from professional services or advice. This profile covers regulatory information and workflow software. Company registration and information-security assurance do not establish financial-services permissions or relieve a customer of its own regulatory obligations.[19]

Corlytics’ company history records the acquisitions of ING SparQ, Clausematch and Deloitte RegHub during 2023–2024, followed by a majority investment from Verdane in 2024. The current site names Lisa Miles-Heal as chief executive and John Byrne as founder. Clausematch remains visible in product documentation and API addresses within the wider Corlytics offering.[20]

The website identifies Corlytics Ltd, Irish company number 535110, with a Dublin address. Its public contact page also lists London, Lisbon, New York and a DACH-region contact. A customer’s agreement should identify the entity supplying its particular service.[19][18]

Operator

Corlytics Limited (Corlytics Ltd)

Service scope

Regulatory intelligence, obligation and policy management, controls mapping and compliance workflows.

Customer types

Banks; Investment managers; Hedge funds; Insurers; Payment businesses; Regulators

Delivery

SaaS; API

Pricing publication

Quote only

Headquarters

Dublin, Ireland

Platforms

Regulatory Monitoring; Regulation Library; Obligations Management; Clausematch; Controls Mapping

Integrations

Regulatory content APIs; Clausematch REST API; Clausematch MCP connection — non-production availability

Pricing scope

Commercial discussion required; reviewed public pages do not specify a standard tariff.

Implementation

Cloud services with taxonomy mapping, workflow configuration and API integration; scope depends on the purchased solution.

Support

Client team contact, help centre and product/API support email; contractual hours and targets are not publicly specified.

Permissions and regulatory scope

Regulatory information and workflow technology supporting the customer’s compliance process.

Provider metadata checked 21 Oct 2026Source 12Source 11Source 6Source 20Source 18Source 7Source 19Source 2Source 5Source 1Source 21Source 17

Clausematch’s AI Chat, AI Actions and AI Assistant are disabled by default, controlled separately and require enablement through Customer Success or support. Document permissions remain effective. Built-in AI uses the dedicated hosting environment; external MCP assistants handle content under the customer’s agreement with their provider.[12]

The MCP documentation distinguishes suggested approval prompts from technical enforcement. It describes a code-enforced confirmation step for metadata-field deletion, while other destructive operations do not have an equivalent gate. This matters when choosing write scopes: an assistant’s instruction to seek approval is not the same control as a platform block. Calls are logged with the acting user and outcome.[13]