The provision while the question is still in the room — not afterwards.
Thalassa Compliance shows which supervisory obligation applies and what it says, word for word, with act, article, paragraph and the date the version took effect. It does not assess your individual case, does not state whether your firm meets a requirement, and gives no investment advice.
Two rulebooks at once. One head.
Until July 2027 the old anti-money-laundering directive applies while the new regulation is being prepared. PSD2 applies; PSD3 is agreed and not yet published. DORA is here and its technical standards keep arriving. A person cannot hold two states of the law in parallel — a tool that keeps them apart can.
| Area | applies today | applies soon | the gap |
|---|---|---|---|
| Anti-money laundering | Directive (EU) 2015/849 | Regulation (EU) 2024/1624 and Directive (EU) 2024/1640, from 10 July 2027 | two rulebooks side by side, for two years |
| Payment services | PSD2, Directive (EU) 2015/2366 | PSD3 and PSR — politically agreed, not yet in the Official Journal | firms plan against a text that does not yet apply |
| Digital resilience | DORA, Regulation (EU) 2022/2554 | the technical standards keep arriving | the first examination cycles are running |
| Crypto-assets | MiCA, Regulation (EU) 2023/1114 | interpretation keeps emerging through ESMA and EBA | the Q&A matters more than the statute |
What is searched — and what explicitly is not.
The corpus is narrow and named. It is not a collection of "all EU rules", and that is deliberate: a coverage promise that ages every week would not be defensible in front of a compliance officer. Everything below was retrieved and checked on 5 September 2026.
| Jurisdiction | Corpus | Level | Version |
|---|---|---|---|
| European Union | DORA, MiCA, MiFID II, MiFIR, PSD2, AMLD4/5, AMLR, AMLD6, AMLA, Transfer of Funds Regulation — down to article and paragraph | Level 1 | the consolidated version where one exists — otherwise the original, each labelled as such |
| European Union | Delegated Regulation (EU) 2024/1774 on ICT risk management | Level 2 | consolidated version of 25 June 2024 |
| United States, federal | 31 CFR 1010 (BSA, FinCEN), 17 CFR 275 (SEC, Investment Advisers), 16 CFR 314 (FTC Safeguards Rule), 12 CFR 30 (safety and soundness standards) | implementing regulation | version date taken from the publisher's own interface |
| United States, New York | 23 NYCRR 500 (cybersecurity in financial services) | implementing regulation | the Department's reading copy, which states that it is not an official version |
| Canada | the money laundering act (PCMLTFA) and its five regulations, section by section — in English and French | level 1 and level 2 | the Department of Justice consolidation, expressly not an official version |
| European Union | final Q&As of the European Banking Authority — one at a time by public ID, not searchable | level 3 | interpretation, not directly binding — and every citation says so |
Not searched: the rest of Union law, Court of Justice case law, national transposition, the rest of the Code of Federal Regulations, the US Code, the law of other states, and the rest of Canadian federal law. Of the interpretation layer only a slice is connected — guidelines and the interpretation of the other two authorities are missing. Every citation carries its level and whether it applies today, applies from a stated date, or is still a proposal.
In the examination, not in the follow-up.
The ICT risk management question arrives in minute three. In a window only you see, Article 6 DORA appears word for word, next to Delegated Regulation 2024/1774 — with a note that one is Level 1 and the other Level 2, and with the version date of both. After the call a list of the provisions named, with links: the thing an examiner asks for.
What happens when nothing sourced is available for a question?
Then there is no answer. Without primary text word for word the module stays silent instead of filling a gap with something plausible. A wrong article in front of an examiner is worse than no article.
How do I know whether a provision already applies?
Every citation carries its time status: applies today, applies from a stated date, or is a proposal not yet published. A proposal is never presented as law in force.
What about our own policies and contracts?
Your own knowledge base holds up to 3,000 pages — internal policies, contracts, the outsourcing register. It is processed through the same EU-isolated path as the legal module.
What the module explicitly does not do.
This list belongs on the page, not in the small print.
- No recommendation on a financial instrument — no investment advice within the meaning of Article 4(1)(4) of Directive 2014/65/EU.
- No assessment of an individual case and no legal service within the meaning of § 2 of the German Legal Services Act.
- No deadline calculation for a specific set of facts.
- No statement on whether a firm meets a requirement. Compliance is a state of the firm, not a feature of a tool.
- No substitute for an examiner, a lawyer or a supervisory dialogue.
- No filings with authorities, no generated forms.
Where the texts come from, and what may be charged for them.
- European Union. The acts come from EUR-Lex, Publications Office of the European Union. Re-use including commercial use is permitted under Decision 2011/833/EU. Only publication in the Official Journal is binding; EUR-Lex is not the Official Journal.
- United States. Federal law is in the public domain. The eCFR is an editorial compilation; the Federal Register and the annual CFR edition are the official ones. For New York, the reading copy of the Department of Financial Services applies, which states that it is not an official version.
- Interpretation by the European supervisory authorities. Wherever material from EBA, ESMA or EIOPA is used, the notice each authority requires is carried automatically. That material is available free of charge on those authorities' websites. You pay for bringing it together, for the labelling, and for having it in the room during the call — not for the text.
- No authority has reviewed this product. Neither BaFin nor any European supervisory authority has examined, approved or endorsed it.
Not on sale yet — and this page says why.
Checkout stays closed until source assurance is in place: until every jurisdiction has a verified source, the corpus monitor is running, and a person has held a real examination conversation with it. A module that answers before that would be the largest risk in this project. The tariff is described, the price is on the pricing page, the buy button is missing on purpose.