Documentation

ComplianceOS connects to your Revolut Business account via the Revolut Business API. This provides read-only access to accounts and transactions for automatic reconciliation.

How it works

1. Navigate to Banking and click Connect Revolut Business.
2. You'll be redirected to Revolut to authorize read-only access.
3. After consent, ComplianceOS stores an encrypted access token and syncs your accounts.
4. Transactions are imported with idempotent deduplication (no double-imports).

Sandbox vs production

By default, ComplianceOS connects to the Revolut sandbox for testing. Production mode requires approved API credentials from Revolut and REVOLUT_SANDBOX=false.

Disconnect & re-sync

You can disconnect at any time from Banking → connection card → Disconnect button. Previously imported transaction data is preserved. Reconnecting starts a fresh sync.

Webhooks

ComplianceOS receives Revolut webhooks to trigger automatic syncs when new transactions appear. Webhook signatures are verified before processing.

ComplianceOS can search and import company data from CRO Open Data (when configured) or uses a local mock dataset for development.

Data sources

• Mock (default): Built-in sample companies for development/demo.
• CRO Open Data: Real company records from the CRO public CKAN dataset when CRO_USE_MOCK=0 and CRO_OPENDATA_RESOURCE_ID are configured.

Name screening

Name screening checks your proposed company name against known registered companies. It is indicative only and does not represent official CRO approval. A formal application via CORE is always required.

ComplianceOS implements the Revenue PAYE Modernisation REST API patterns for RPN lookup, PSR submission, and employer registration.

Integration modes

• Mock: Deterministic synthetic responses for dev/testing. No Revenue traffic.
• Live ready: Configuration present (OAuth, token URL) but not all prerequisites met.
• Live configured: Full credentials, certificate, and OAuth in place — live Revenue communication active.
• Fallback mock: If a live call fails, the system returns mock data with a clear advisory warning (configurable via ROS_FALLBACK_MOCK).

Going live

Live Revenue integration requires: (1) developer registration with Revenue, (2) a P12 certificate for mTLS/signing, (3) OAuth client credentials, and (4) setting ROS_MOCK_MODE=false. All submissions create immutable snapshots with payload hashes for audit.

Every significant action in ComplianceOS is recorded in the audit log: bank connections, disconnections, imports, sync operations, filing submissions, and approval/rejection decisions. Audit entries include the user, timestamp, and before/after state.

Filing submissions generate immutable snapshots — a frozen copy of the payload at the moment of submission, with a SHA-256 content hash. These cannot be modified after creation.