Conduct rules, AML refreshers, and attestations — captured as defensible evidence.
Capture conduct attestations and prove acknowledgment for SMCR/SEAR, MAR, personal-account-dealing, and DORA, ready for FCA/PRA/SEC/FINRA. Reach office, frontline, and contractor staff over email and the recipient portal — SMS, WhatsApp and Enterprise QR campaigns coming soon; remind automatically; and export an audit-ready evidence pack on demand.
Start free — up to 20 employees, no card · Sign in
From SMCR conduct attestations to sanctions and AML updates, ReadSignFlow captures a signed acknowledgment from every regulated person, against the exact policy version — with a tamper-evident trail built to support regulatory and internal-audit review.
The regulator expects evidence, not assurances.
- Personal — accountability under SMCR / SEAR. Senior managers are personally liable — you need defensible proof each individual attested, not a team email.
- Annual — cycles across multiple legal entities. Conduct rules, AML, and policy attestations repeat every year across entities, jurisdictions, and roles.
- Days — to evidence a single attestation cycle. Pulling who-signed-what from email and shared drives is slow and rarely complete when the regulator calls.
Illustrative figures reflecting common industry patterns, not a specific published survey.
Built for the three lines of defense.
Every conduct, financial-crime, and policy workflow your compliance and risk teams run — with evidence built for regulatory review.
- SMCR / SEAR conduct attestations — Annual and ad-hoc conduct rule attestations per certified and senior manager, with role-based targeting and personal sign-off.
- AML & sanctions refreshers — Push KYC, AML, and sanctions-list updates the moment they change, with a tight SLA and escalation for outstanding staff.
- Policy & procedure attestations — Code of conduct, conflicts of interest, gifts & entertainment, market abuse — versioned and re-attested on change.
- Annual compliance cycles — Run each year's attestation cycle across entities and jurisdictions by copying last year's campaign; ReadSignFlow chases and escalates automatically.
- Onboarding & role changes — Joiner/mover/leaver (JML) automation assigns the right regulated-person packets on joiners and role moves, and retires them on leavers.
- Regulator & audit packs — One-click, tamper-evident evidence packs formatted for the FCA, PRA, SEC, and internal audit.
What compliance teams actually send through ReadSignFlow.
The conduct rules, sanctions updates, and supervisory policy changes that need a signed attestation — captured as defensible evidence the first time.
Trading & supervision
- Written Supervisory Procedures (WSP) updates
- Restricted / watch list bulletins
- Insider-trading window & blackout notices
- New product approval memos & desk procedures
- Branch operations updates (cash handling, dual control)
- Updated underwriting & lending guidelines
AML, KYC & sanctions
- OFAC / UK OFSI / EU sanctions list updates
- AML red-flag & suspicious-activity bulletins
- KYC / CDD procedure changes
- Customer-complaint handling SOP updates
- Annual AML & financial-crime training
- Beneficial-owner refresh attestations
Conduct, cyber & attestations
- Code of Ethics & personal account dealing (PAD)
- Gifts & hospitality and outside business activities
- SM&CR / fitness & propriety attestations
- Cybersecurity advisories & phishing alerts
- DORA / NYDFS Part 500 acknowledgments
- Whistleblower / Speak-Up policy reminders
Aligned to financial conduct oversight.
Configurable retention, legal holds, and a one-click evidence pack for the conduct and financial-crime regimes you report into.
Frameworks covered: FCA SMCR, PRA, SEC, FINRA, SEAR (Ireland), MiFID II, AMLD / MLR, OFAC / Sanctions, MAR (Market Abuse), GDPR (EU), SOX, DORA, ISO 27001, Operational Resilience.
Frequently asked questions
Can ReadSignFlow evidence SMCR conduct-rule attestations for each certified person?
Yes. Attestations are captured as personal sign-offs per senior manager and certified person — not a team email — each with signer identity, policy version, and a UTC timestamp. That gives you defensible, individual-level evidence for personal accountability under SMCR or SEAR.
How do we run annual attestation cycles across multiple legal entities?
Run each cycle as a campaign targeted by department, location, and role — set each legal entity up as its own department or location — and start next year's cycle by copying this year's campaign. ReadSignFlow chases automatically with reminders and escalation for anyone outstanding. One workspace runs separate cycles across all your entities without duplicating the policy library.
What can we produce when the FCA or internal audit asks for attestation evidence?
A tamper-evident evidence pack — who attested to which policy version and when, with the full append-only trail behind every signature — exportable the same day. Retention is configurable, so records stay available over the multi-year horizons regulators expect.
Can ReadSignFlow reach staff who don't have a corporate email?
Yes — we send each person a secure magic-link by email — a personal address works, no corporate mailbox needed — so frontline and contractor staff read and sign on their own phone with no app and no login. The recipient portal also runs on a shared tablet, where each worker signs in with the email address on their staff record and a one-time code or their password. SMS, WhatsApp and QR campaigns (Enterprise) are coming soon.
Does it integrate with our HRIS or ATS?
Your HRIS or ATS pushes people and joiner/mover/leaver (JML) events to our REST API — Workday, BambooHR, SuccessFactors and others can all do this, and no native connector is required or provided. Policy assignments then follow staff automatically as they join, move, or leave.
Where is our data hosted, and is it secure?
US-hosted (single region); an EU data region is planned (in progress). Data is encrypted in transit and at rest with AES-256, isolated per tenant in the application layer, and recorded in an append-only, tamper-evident audit log. An independent third-party auditor is assessing our controls as we prepare for SOC 2 Type II and ISO 27001; we do not hold either certification yet.
Is an electronic acknowledgment legally defensible?
Every signature captures signer identity, intent, a UTC timestamp, and a tamper-evident audit trail. ReadSignFlow supports eIDAS (EU/UK) and the US ESIGN Act / UETA, neither of which lets a record be denied legal effect solely because it is electronic; how a record is weighed depends on that evidence and the jurisdiction.
How long does it take to go live?
Self-serve, most teams launch their first campaign in an afternoon: upload a policy, import recipients from a CSV, set a deadline, and send. Wiring your HRIS into the JML API takes days rather than a quarter-long implementation project.
Which languages can recipients sign in?
The recipient experience is available in five languages — English, Spanish, French, German, and Portuguese — so deskless staff can read and acknowledge policies in their own language. Documents themselves are shown in the language you upload them in.
My employer sent me a ReadSignFlow link — what is it?
It's a secure link your organization uses to share a workplace policy or document with you and record that you confirmed reading it and acknowledged it — you read and sign on your phone, with no app and no account password. See readsignflow.com/for-recipients for what we record and what we'll never ask for.
ReadSignFlow · Product · Pricing · Security · Solutions · Resources · Enterprise · vs. e-signature · FAQ · Customers · About · Careers · For recipients · Status · Contact us · Start free · Sign in
Privacy · Terms · DPA · Acceptable use · Recipient terms · Cookies