AI · REGTECH · KNOWLEDGE GRAPH · BANKING COMPLIANCE

Kavach: AI-Powered Regulatory Change Management Platform for Banking Compliance

An operating system for regulatory change that traces every RBI circular from source text to requirement, control, code change, verification evidence, customer remediation and board reporting, with a named human decision at every gate.

RBICircular Intelligence
GraphRequirement-to-Control
EvidenceLiving Chain of Trust
InspectAnswers with Records

Project at a Glance

Industry
Banking & Financial Services
Engagement
AI + RegTech Platform Development
Platform
Web Application (GRC Operating View) + APIs
AI Technology
AI Reasoning, Knowledge Graph, Workflow Orchestration
Core Use Case
Regulatory Change Management & Inspection Readiness
Users
Compliance, Risk, Engineering, QA, Operations, Board

Challenge and solution

The Business Challenge

Banks receive a steady stream of RBI circulars, and every one must be interpreted, implemented, tested and proven. The link between a regulatory paragraph and the system change that satisfies it usually lives in emails, spreadsheets and tickets.

  • ✕Interpretations of circulars sit in documents and email threads, with no clear owner or approval record.
  • ✕It is hard to see which products, controls, procedures and systems a single rule actually touches.
  • ✕Engineering tickets lose the connection to the source paragraph, so a wrong implementation can ship unnoticed.
  • ✕When an implementation was wrong, past customers may have been affected, and assessing them is slow and manual.
  • ✕Procedure updates and staff acknowledgements are tracked by hand.
  • ✕When an inspector asks why a release was approved, evidence has to be assembled from many systems.

The SoluLab Solution

SoluLab built Kavach, a regulatory change platform that keeps one connected, auditable record from circular to board report.

  • ✓Regulatory Intelligence triages incoming circulars by domain, impact and owner.
  • ✓Circular Workspace anchors each case to the exact source paragraph and the bank records it affects.
  • ✓Reasoning Engine drafts applicability decisions and testable requirements; named reviewers approve each version.
  • ✓Knowledge Graph links requirements to controls, procedures, systems and code.
  • ✓Work Orchestrator turns approved requirements into owned delivery work and procedure updates.
  • ✓Living Chain of Trust ties verification runs, QA decisions and build identity to the requirement they prove.
  • ✓Inspection Mode and Board & Executive views answer "why" with the underlying case records.

Solution Architecture

Every layer of Kavach answers one question an inspector will eventually ask: why was this decision made, and what proves it? The knowledge graph keeps each RBI paragraph linked to its requirement, control, code and evidence. AI drafts interpretations and finds candidate changes so teams move faster, but named people approve every interpretation and release, and the activity log keeps that chain intact.
Taher PittalvalaAI Practice Head, SoluLab

Why AI and a Knowledge Graph: Our Technology Decisions

Regulatory change fails at the joins: between a paragraph and its interpretation, a requirement and its code, a test and the build it proves. Each technology in Kavach was chosen to hold one of those joins together.

Why AI

Reading circulars and mapping them to bank systems takes expert time that does not scale.

Applicability reasoning
Drafts which products and journeys a circular covers, and states the scope boundary explicitly.
Requirement drafting
Turns source text into a testable requirement with acceptance criteria, ready for review.
Impact analysis
Finds candidate code changes and explains why each one is a candidate.
Human approval
AI drafts; named compliance and QA reviewers approve every interpretation and release.

Why a Knowledge Graph

Compliance evidence is only useful if every link in the chain can be followed.

End-to-end traceability
Paragraph, requirement, control, procedure, code, test and approval are all connected records.
Impact you can see
Teams open a requirement and see every owner, system and control it touches.
Versioned evidence
Builds, source snapshots and QA decisions are tied to the requirement version they prove.
Inspection answers
"Why was this approved?" is answered from case records, not reconstructed from email.

Key technology choices

DecisionWhy we chose it
Paragraph-level anchoringEvery case points to the exact clause of the circular, so interpretations can be checked against the source.
Maker-checker approvalsAI output never becomes a requirement or release decision without a named approver.
Build-specific verificationEvidence records which build and source snapshot were tested, so a passing run cannot prove the wrong version.
Independent outcomesRelease approval, deployment, customer remediation and case closure are tracked separately, so one never hides another.
Bank-hosted deploymentRuns in the bank's own environment, keeping regulated data and models under the bank's control.

The result: faster regulatory change, implemented the way the regulation intends, with every decision traceable to its evidence.

Product Experience

Outcomes Demonstrated

₹900Interest discrepancy traced to one wrong start event
1 failBuild A caught before release by the approved checks
8 / 8Scoped checks passed on Build B with QA evidence
24Customer accounts assessed retrospectively; 3 flagged
4Outcomes tracked independently: release, deployment, remediation, case

Technology & Integrations

AI Reasoning (LLMs)Retrieval-Augmented GenerationKnowledge GraphWorkflow OrchestrationReactREST APIsPostgreSQLDockerRole-Based Access & Maker-CheckerImmutable Activity LogGit & CI IntegrationCore Banking & LOS ConnectorsRBI Circular Feeds

Frequently Asked Questions

1. What does Kavach do?

Kavach manages regulatory change end to end. It takes an RBI circular from source text through applicability, requirements, controls, delivery work, verification, customer remediation and board reporting, keeping every step linked and auditable.

2. How does AI help with regulatory interpretation?

The reasoning engine drafts applicability decisions and testable requirements from the circular text, states the scope boundary, and identifies candidate system changes. Each draft is reviewed and approved by a named person.

3. Can AI approve a requirement or a release on its own?

No. AI drafts and recommends. Requirements, applicability decisions, QA evidence and release decisions are approved by named reviewers, and each approval is recorded.

4. What is the Knowledge Graph used for?

It connects each regulatory paragraph to the requirements, controls, procedures, systems and code it affects, so teams can see the full impact of a change and follow any link in the chain.

5. How does Kavach prove a change was implemented correctly?

The Living Chain of Trust runs the approved checks against a specific build and source snapshot. Results, QA decisions and the release gate are tied to the requirement version they prove.

6. What happens if past customers were affected?

Kavach runs a retrospective customer assessment, comparing observed and expected outcomes per account, flagging discrepancies and keeping customer remediation open as its own outcome until it is resolved.

7. How are procedure changes and acknowledgements handled?

Updated procedures are versioned and distributed through the Work Orchestrator, and each recipient's acknowledgement is tracked until the distribution is complete.

8. How does Inspection Mode work?

An inspector or auditor can ask case-specific questions, such as why a release was approved, and get an answer drawn from the case records, with the supporting requirement, run, QA decision and procedure linked.

9. What does the Board & Executive view show?

It shows each case as independent outcomes, such as release approval, deployment, customer remediation and case status, so approval of one part never hides open work elsewhere.

10. Where is Kavach deployed?

It is designed to run in the bank's own cloud or on-premises environment, with role-based access, maker-checker approvals, encryption and a complete activity log.