◆FinServ Compliance pack

Record a compliance decision as an audit-trail note in the form an examiner relies on — the determination stated plainly up front, the specific facts and documents actually reviewed as its basis, and the exact rule or threshold applied and how the facts met it, dated and attributed to the decision-maker, with no speculation about intent and no hedging prose. Use when a compliance disposition has already been reached (an alert cleared, an exception approved, a transaction declined, a hold released) and it must be written to the file. Do NOT use to make the decision itself, to draft a customer-facing letter, to write a SAR narrative, or to compile a period report.

End-to-end KYC (Know Your Customer) identity verification for onboarding real users. Use when someone needs to perform KYC, onboard users with identity verification, verify a person's identity with ID scan and selfie, run a full KYC flow, create a verification session for a user, set up ID + liveness + face match verification, or implement user onboarding with document and biometric checks. Creates a KYC workflow, generates a verification URL, and retrieves the decision.

Integrate Didit Proof of Address standalone API to verify address documents. Use when the user wants to verify a proof of address, validate utility bills, bank statements, government documents, extract address from documents, verify residential address, implement address verification, or perform PoA checks using Didit. Supports OCR extraction, geocoding, name matching, and multi-page documents.

Integrate Didit AML Screening standalone API to screen individuals or companies against global watchlists. Use when the user wants to perform AML checks, screen against sanctions lists, check PEP status, detect adverse media, implement KYC/AML compliance, screen against OFAC/UN/EU watchlists, calculate risk scores, or perform anti-money laundering screening using Didit. Supports 1300+ databases, fuzzy name matching, configurable scoring weights, and continuous monitoring.

Full Didit identity verification platform management — account creation, API keys, sessions, workflows, questionnaires, users, billing, blocklist, and webhooks. Use when someone needs to create a Didit account, get API keys, set up verification workflows, create or retrieve verification sessions, approve or decline sessions, manage users, check credit balance, top up credits, configure blocklists, configure webhooks programmatically, handle webhook signatures, or perform any platform administrat

Compliance OS — meta-orchestrator that lets compliance teams CONFIGURE which frameworks apply, COMPUTE cross-framework control overlap, SIMULATE internal audits, and CONSOLIDATE evidence across multiple frameworks. Four decisions: (1) Given a company profile, which of the 12 supported frameworks apply (ISO 27001/13485/42001/14971, EU AI Act, MDR 745, GDPR, SOC 2, FDA QSR, NIST CSF 2.0, NIS2, HIPAA)? (2) Across selected frameworks, which controls overlap and how much evidence reuses? (3) For a gi

Verifies identity documents via the Didit standalone API. Use when verifying a passport, ID card, driver's license, or residence permit, performing OCR extraction, MRZ parsing, document authenticity checks, or KYC document validation. Supports 4000+ document types across 220+ countries.

Move cash (JNLC) and securities (JNLS) BETWEEN accounts inside your own Alpaca omnibus via the Broker API — single, batch, and reverse-batch journals, the Idempotency-Key header, journal status lifecycle including corrections, and the firm/sweep-account pattern that powers instant funding and share rewards. Use for internal account-to-account movement in any language. For deposits/withdrawals to EXTERNAL banks, use funding-transfers instead.

Implement PCI DSS compliance requirements for secure handling of payment card data and payment systems. Use when securing payment processing, achieving PCI compliance, or implementing payment card security measures.

Integrate Didit Transaction Monitoring (KYT), crypto wallet screening, and the FATF / EU TFR Travel Rule. Use when the user wants to monitor transactions in real time, score transactions against AML/fraud rules, screen crypto wallets or transaction hashes against blockchain analytics, comply with the crypto Travel Rule (originator/beneficiary exchange with counterparty VASPs), verify self-hosted wallet ownership, mint SDK transaction tokens for client-side submission, or step up risky transactio

Integrate Didit Database Validation API to verify personal data against government databases. Use when the user wants to validate identity against government records, verify national ID numbers, check CPF/CURP/DNI/cedula numbers, perform identity database lookups, validate identity documents against official sources, or implement database verification for Latin American or Spanish identity documents using Didit. Supports 18 countries with 1x1 and 2x2 matching methods.

企业破产预警与破产重整监控 SKILL · 企查查 MCP V2.0 增强版。 对重要客户、债务人、担保方进行破产风险的持续监控工具，同时覆盖"破产预警"（事前识别）与"破产重整预警"（事中跟踪）两种子场景。通过 qcc-history 历史数据 + qcc-executive 核心人员画像 + qcc-risk 当前司法信号三层融合，在破产重整申请提交、清算公告发布等关键节点实时推送预警，帮助债权人在债权申报窗口期内及时采取保全措施。 核心能力： - 破产先行指标识别：法代被执行、股权冻结扩散、终本案件累积、失信连年新增等 7 大先行指标 - 破产重整 / 清算状态跟踪：`get_bankruptcy_reorganization` / `get_liquidation_info` 实时监控正式破产程序 - 核心人员跑路信号：实控人限制出境、法代更替、核心高管离任等 qcc-executive 穿透 - 重整可行性预判：基于财务底盘 × 司法泥潭 × 实控人现状三元组合，区分"值得重整 vs 必然清算" - 债权申报窗口期推算：按破产法规定的 30 / 60 / 90 日窗口，动态计

Open and manage brokerage accounts via the Alpaca Broker API — account creation, KYC/CIP, identity & disclosures, agreements, document upload (incl. W-8BEN), account status lifecycle, and account updates/closure. Use when a developer is building onboarding, KYC, or account-management flows on Alpaca in any language.

问询材料引用助手 - 协助管理问询回复中的材料引用。当用户需要在问询回复中规范引用底稿证据、核查材料或外部资料，确保引用格式统一、来源可追溯时触发此技能。适用于投行、律所、会所等中介机构的问询回复场景。

Automate Identitycheck tasks via Rube MCP (Composio). Always search tools first for current schemas.

APRA CPS 234 expert for Australian prudential information security. Reference-depth framework plugin with scope determination, evidence checklist, and SCF-backed assessment guidance.

Define process performance measures, KPIs, and compliance controls for a validated PNS. Use this skill when the user needs to add measurability and governance to a documented process; when they ask to define KPIs, set performance targets, add compliance controls, or map the process to a control framework. This is a recommended extension skill — use after process-narrative-authoring when governance and measurement rigour is required. Produces a measures register and a controls register.

The single skill for the entire Didit verification platform. Covers account creation, session management, workflow configuration, questionnaires, user management, billing, blocklist, and webhook configuration — 45+ endpoints across 9 categories.

监管问询回复助手（IPO 版）- 协助撰写 IPO 审核问询回复。当用户需要为 IPO 项目准备交易所/证监会问询回复、梳理回复思路、组织回复材料或核查回复内容时触发此技能。适用于投行、律所、会所等中介机构的 IPO 项目场景。

监管问询回复助手（再融资版）- 协助撰写再融资审核问询回复。当用户需要为定增、配股、可转债等再融资项目准备交易所/证监会问询回复、梳理回复思路或组织回复材料时触发此技能。适用于投行、律所、会所等中介机构的再融资项目场景。

/cs:compliance-readiness <program> — Multi-framework compliance officer 6-question forcing interrogation of any compliance program. Use before starting a new framework, planning the annual audit calendar, or preparing for certification stage 1.

监管问询回复助手。专注于协助回复监管问询函，包括问询分析、回复框架、要点梳理、合规审核，帮助上市公司规范回复监管问询。 **触发场景**： - 用户需要回复监管问询函 - 用户说"问询回复"、"监管问询"、"问询函" - 需要问询分析、回复框架 - 需要要点梳理、合规审核 **关键词**："监管问询"、"问询回复"、"问询函"、"交易所"、"证监会"、"回复框架"、"合规审核"

风鸟企业数据查询引擎，用于查询中国企业的结构化工商、关系与风险信息，并在需要时生成报告、摘要等衍生输出。 当用户想查询企业基本信息（如法定代表人、注册号、统一社会信用代码、成立日期、注册地址、经营范围及基础联系方式）、股东结构、主要人员、对外投资、工商变更，或查询被执行人、失信被执行人、限制高消费、经营异常、严重违法、行政处罚等风险信息时使用。 也适用于合作方背景核查、供应商管理、客户风险识别等场景。支持输入企业简称并先做模糊搜索获取企业主体。

Verify whether a PDF document (bank statement, payslip, invoice, tax return, ID, contract) is authentic or has been forged, AI-generated or edited. Use whenever the user asks to "verify", "check", "validate" or "detect fraud in" a PDF, or asks whether a document is real, fake, tampered or trustworthy. Submits the file to the VerifyPDF forensic API and returns a structured trust_score (0-100), a fraud_risk label and a list of fraud warnings.

Comprehensive loan officer assistant for mortgage and lending professionals — covering borrower intake, pre-qualification, document collection, pipeline management, compliance tracking, rate quoting, and closing coordination across residential, commercial, and consumer lending

Automate Fraudlabs Pro tasks via Rube MCP (Composio). Always search tools first for current schemas.

MiCA compliance evidence and stablecoin risk scoring. Use when the user asks about stablecoin compliance, MiCA status, peg stability, or needs verifiable evidence for audit workflows.

Tracks KYC and KYB renewal cycles for counterparties and entities in a Notion register, surfaces upcoming or overdue renewals on a daily digest, and drafts outreach to the counterparty when documentation is requested.

监管问询回复助手（债券版）- 协助撰写债券审核问询回复。当用户需要为公司债、企业债等债券项目准备交易所/交易商协会问询回复、梳理回复思路或组织回复材料时触发此技能。适用于投行、律所、会所等中介机构的债券承销场景。

Automate Enigma tasks via Rube MCP (Composio). Always search tools first for current schemas.

Captures incoming OTC demand and trade-desk inquiries into a Notion pipeline, triages each by size, counterparty, and instrument, and routes the entry to the right desk owner with an SLA timer.

Maps code, architecture, and infrastructure changes to specific control IDs in PCI-DSS v4.0 and MAS TRM (Singapore financial regulator), producing an audit-traceable findings report with per-control remediation.

Facilitate over-the-counter trades between agents using Uniswap as the settlement layer. Use when user wants to trade tokens directly with another agent, settle an agent-to-agent trade through Uniswap, or execute an OTC swap with a specific counterparty agent. Verifies counterparty identity via ERC-8004, negotiates terms, and settles through Uniswap pools.

Review prediction-market, basket, oracle, and trading-agent workflows for compliance, safety, data-quality, privacy, and execution risk. Use before any workflow handles venue auth, user portfolio data, API keys, or trade planning.

Enforces that a person's or entity's presence or absence on a sanctions list is never asserted from memory — every answer must rest on a real-time lookup of the official list, cited with the source and the date checked, and if that lookup cannot be performed the model says so and escalates instead of guessing. Use when someone asks whether a counterparty, customer, vendor, individual, or beneficiary is sanctioned, on the SDN list, on a watchlist, or clear to onboard/pay. Do NOT use for explaining how a sanctions program works in general, drafting a sanctions clause, or export-control classification.

Write the narrative section of a Suspicious Activity Report (SAR) in the form regulators expect — a chronological, third-person account of who did what, when, where, how, and why the activity is being reported, with concrete dollar amounts and dates, stated as facts rather than as a conclusion of guilt, and never suggesting the subject be told. Use when transaction facts need to be turned into a SAR narrative or the narrative rewritten to standard. Do NOT use for deciding whether a SAR should be filed, scoring AML risk, screening sanctions or PEP lists, or drafting customer-facing account communications.

Master PCI DSS (Payment Card Industry Data Security Standard) compliance for secure payment processing and handling of cardholder data.

Enforces mortgage regulatory compliance — TRID, RESPA, TILA, ECOA/Fair Lending, state licensing, required disclosures, and data privacy rules for all borrower interactions.

Analyzes documents and processes against FINRA, SEC, Federal Reserve, and CFPB regulatory frameworks. Identifies compliance gaps, classifies findings by severity, and recommends remediation. Use when performing compliance audits, regulatory reviews, gap analyses, or verifying policy adherence to financial regulations.

Reviews financial documents (prospectuses, ADVs, marketing materials) for FINRA 2210 compliance, required disclosures, and balanced presentation. Use when reviewing financial statements, audit documents, regulatory filings, or when the user mentions compliance checks, financial audits, or document verification.