NuArca Labs

Strip the models and what remains is a machine ingested pile of regulatory text with no interface and no buyer. Every function customers pay for is model dependent: answering a question against the corpus, drafting a policy aligned to an institution's profile, reviewing consumer marketing, running a compliance analysis on a proposed new product. The distinction from a regulatory content library matters and this vendor sits on the right side of it.

The repository is described as automated daily ingestion transformed into a form designed for a model to read, which is a substrate built for the product rather than a product sold to humans. Contrast a peer screened in this same competitor set and rejected on this floor, which sells a human curated legislative library with summaries layered on and positions that curation as its differentiator. The discriminator in this category is whether models carry the throughput, not whether people are involved somewhere.

Better than most vendors of this shape and stated rather than implied. The company publishes an explicit position that its system is not a decision maker but an assistant, and argues in its own material that technology in a regulated environment must support institutional accountability rather than displace it.

Two mechanisms back the position instead of merely asserting it: every answer is annotated with direct links to the governing regulation, which is what makes a human check possible at all, and the marketing review workflow names where the human sits, with the compliance officer performing a final pass over annotated output.

Held at B because no threshold, escalation rule, confidence measure or audit sampling is published, and the drafting and what if functions, which produce policies and strategic assessments, have no described gate at all. The reference point for an A names what is automated, what constrains it and how automated decisions are sampled.

No accuracy figure, benchmark, validation method or error rate was located. One design choice genuinely helps and is recorded rather than credited with a higher grade: every answer carries direct links to the governing regulation, so any single output can be checked against its source. That is traceability, and it is the same architecture that earned a B elsewhere in this index only when paired with a published confidence measure alongside the source.

Citation without calibration makes an answer checkable and says nothing about how often the system is right across a corpus. The failure mode it cannot address is the one that matters most in compliance and that has now appeared three times in this competitor set: the obligation the system never surfaced leaves no citation to inspect, because there is no output to check.

No named customer, no customer count, no case study and no independent evaluation were located. The strongest available signals describe the company rather than the product: founders with real regulatory technology provenance, including an executive chairman who previously led the finance, risk and compliance solutions group at a major information services incumbent and co founded a fair lending compliance business, plus inclusion in the American Bankers Association partner directory and a co presented session with the association.

A trade body listing is a distribution and credibility channel, not a measurement. The one quantified claim located, a reduction of review times by more than half, carries no institution's name and no method. Graded on the standard set for Norm Ai, where blue chip institutional backing and a large stated client asset base still produced a C, because the calibre of the company is not evidence about the performance of the product.

No boundary statement was located on whether one institution's uploaded policies, controls or queries inform models, retrieval indexes or outputs served to another. The exposure has a specific and unusually sharp form here because of one named function.

The what if capability runs compliance analysis on a proposed new product, a new market or a new partnership before the institution has entered any of them, which means the system holds a bank's unannounced strategy, not merely its current posture.

That is the most commercially sensitive category of material a compliance platform could hold, competing banks are the intended customer base, and nothing published describes separation between tenants or between a customer's questions and the shared corpus.

The company makes one scope statement that deserves credit and does not, on its own, carry a grade: it positions compliance as the entry point for artificial intelligence in a bank precisely because the workload does not involve customer data, so consumer records never enter the system. That is the right claim to make and it materially narrows the exposure. What is missing is any commitment covering what does enter.

An institution uploads its own policies, procedures, risk controls, loan documents and unreleased consumer marketing, which is confidential material even though it is not customer data, and no privacy statement, retention rule, deletion right or handling commitment for it was located. A scope claim in marketing copy is not a published data handling term, and the gap is what a bank's own vendor assessment will ask about first.

No information security certification, audit report, penetration testing statement or trust centre was located in this pass. The product is repeatedly described as secure, which is an adjective a buyer cannot verify, and the distinction between asserting security and enumerating an attestation is the same one recorded against other vendors here. Listing on a cloud provider's commercial marketplace involves a publisher review process and is not a security attestation.

Recorded as an absence found rather than a proven absence and worth rechecking, since product and use case pages sometimes carry compliance claims a security page never repeats. The commercial cost is direct: the buyer is a bank compliance function, and the vendor questionnaire it must complete opens with exactly this question.

The posture is the correct one for a technology supplier and it is stated with specificity rather than as a generic compliance claim. Published material maps the product to the named prudential and market supervisors whose expectations a bank must satisfy, including the deposit insurer, the comptroller, the securities regulator and the central bank, tracks their guidance and enforcement actions as monitored content rather than as background, and configures the platform to the charter and the regulator a given institution actually answers to.

The company also engages publicly with the European artificial intelligence regulation as it applies to systems of this kind. Graded at B on the standing bar because no formal admission process was located: an industry association partner directory is a trade body endorsement, not a supervisory programme, and no regulator has examined the product itself.

No governance framework, fairness position, testing programme or independent assessment was located. Discussion of artificial intelligence regulation in published commentary is engagement with the topic rather than disclosure about this system. The product specific exposure is pointed enough to be worth stating plainly.

The platform drafts policies and reviews consumer facing marketing for institutions operating under fair lending and community reinvestment obligations, and the company's own leadership provenance is in exactly that field, having built a fair lending and Community Reinvestment Act compliance business. The expertise is demonstrably present and the disclosure is absent, which is a more conspicuous combination than ordinary silence. A second exposure is coverage depth, which will be uneven across fifty states and thinnest where a smaller institution is least equipped to notice an obligation that never surfaced.

No accuracy warranty, service commitment or remedy was located. The consequence structure is heavier than for a monitoring tool because the outputs are adopted rather than merely read. A drafted policy or procedure becomes the institution's own rulebook and is relied on by staff who never see the source. An approved marketing piece goes to consumers, so an error there is a consumer protection matter and there is a party downstream who never chose the system.

A what if analysis informs whether a bank enters a market at all. The published position that the system is not a decision maker is a sensible design stance and it also allocates responsibility to the user, without appearing anywhere as a stated term alongside a remedy if the system is wrong.

No provider, base model, fine tuning approach or hosting arrangement was located for the assistant, and the product is described by the general technology category rather than by what is actually running. Distribution through a cloud provider's marketplace narrows the likely answer without publishing it.

The omission is more consequential for this vendor than for most, because supervisory model risk expectations, which the company invokes in its own published commentary about aligning to prudential guidance, ask an institution to know what model it depends on and to document it. A bank buying an assistant to help it meet those expectations cannot from public material tell its own examiner whose model produced the interpretation it relied on.

The inbound side is genuinely automated, with daily ingestion pulled directly from federal, state and Canadian regulatory sources, and the product is distributed through a major cloud provider's commercial marketplace, which makes procurement and deployment simpler than a bespoke install. Neither of those is integration with the customer's own systems, which is what this axis measures.

No named connection to a governance risk and compliance platform, a policy management system, a core banking platform or a loan origination system was located, and no application programming interface documentation or connector catalogue was found. Document upload appears to be the main route by which an institution's own material reaches the platform, which leaves the mapping from a regulatory obligation to the control that satisfies it to be carried across by hand.

Delivered as cloud software and listed on a major cloud provider's commercial marketplace, which implies where it runs without stating it. No hosting region, tenancy model, residency option or subprocessor list was located, and no on premise or private deployment path was described.

The gap has a concrete edge here rather than a theoretical one, because the product covers Canadian federal and provincial regulation and is therefore sold to Canadian institutions, several of whose supervisors and provincial privacy regimes make the location of processing a live procurement question. A vendor that has done the work to cover a jurisdiction's rules has an obvious reason to answer where that jurisdiction's data sits, and this one does not.

No rate card, tier ladder or billing basis was located and the route to a number is a contact or demo request. Presence on a cloud provider's commercial marketplace is the one channel where a transactable price sometimes appears for products of this shape, and none was found.

The claims that stand in for pricing are savings claims, reduced reliance on outside counsel and lower review cost, which tell a buyer the direction of the argument without its magnitude, and which are harder to evaluate than usual here because the alternative being priced against is legal fees rather than another platform. Consistent with every regulatory compliance vendor screened in this sweep, all of which sit at C on this axis regardless of size or maturity.

Jurisdictional coverage is the real strength and it is unusually granular for a company this size: United States federal regulation, state level regulation with the ability to compare requirements across states, and Canadian federal and provincial regulation, with the platform configured to an institution's charter, its specific regulators, its business lines and its jurisdictions. That is genuine breadth within the region and it is the kind of coverage a multi state bank actually needs.

Held at B rather than A on two limits. The footprint is North America only, with no European or Asia Pacific coverage described, and the buyer is a single function, the compliance office of a bank, with no segmentation by institution size, no customer count and no named institution of any tier to anchor the claim.