Regulatory compliance
BlueUP designs its platforms with regulatory compliance as a foundational requirement. The tables describe what the platform contributes to each requirement: compliance remains the entity's responsibility, and what is not operational yet is marked as in design or roadmap.
What it contributes to each regulation
DORA: Regulation (EU) 2022/2554
Digital Operational Resilience Act for the EU financial sector. Mandatory since January 2025.
| DORA Requirement | What BlueUP contributes |
|---|---|
| ICT incident management (Art. 17) | Automatic classification (Minor/Significant/Major) per DR (EU) 2024/1772 Art. 8 |
| Supervisor notification | Deadline calculation per DR (EU) 2025/301 (initial ≤4h, intermediate ≤72h, final ≤1 month) and a draft initial report with the ITS (EU) 2025/302 template, in PDF and XML; submission to the supervisor is roadmap |
| Operational resilience | Local spooling during network outages with autonomous reconnection and backpressure, and a circuit breaker with controlled degradation (CLOSED → OPEN → HALF_OPEN) |
| Resilience testing | Digital operational resilience testing, TLPT included, is the entity's responsibility; the platform does not run it |
| ICT risk management | Two-level alerts: WARNING (5 min) and CRITICAL (2h) with CSIRT escalation |
SEPBLAC: Law 10/2010
Prevention of Money Laundering and Terrorist Financing. Supervised by Spain's Executive Service (SEPBLAC (Servicio Ejecutivo de la Comisión de Prevención del Blanqueo de Capitales e Infracciones Monetarias) is Spain's Financial Intelligence Unit and its supervisor for the prevention of money laundering and terrorist financing. Obliged entities file suspicious transaction reports with it (Law 10/2010).Read more → SEPBLAC).
| SEPBLAC Requirement | What BlueUP contributes |
|---|---|
| Special Examination (Art. 17) | 10-state workflow with immutable cryptographic audit trail |
| SEPBLAC Communication | F19 download as PDF from the case file; generating the DMO file and submitting it to the Executive Service are roadmap |
| Due diligence | 360° KYC profiles with 8-factor risk analysis |
| Sanctions screening | Verification against EU, OFAC and UN lists with fuzzy matching (Dice coefficient) |
| Segregation of duties | Four-Eyes principle — high-risk approvals require two distinct persons |
GDPR: Regulation (EU) 2016/679
| GDPR Requirement | What BlueUP contributes |
|---|---|
| Data minimization | Minimizing the client identifier in AI triage is in design: today that identifier reaches the external model provider |
| Privacy by design (Art. 25) | mTLS encryption on the OpenZiti overlay and WireGuard between cluster nodes |
| Data residency | Google Cloud Europe infrastructure; AI triage sends the alert context to an external model provider |
| Right of access | Audit record of every case-file transition; handling access requests is the entity's task |
AI Act: Regulation (EU) 2024/1689
| AI Act Requirement | What BlueUP contributes |
|---|---|
| Transparency | Auditable LLM reasoning logs (in design, not deployed today) |
| Human oversight | A person sets the triage priority; the AI proposal is stored separately, with its model and its justification |
| Data governance | AI triage uses an external model provider; processing with a local or regional provider (vLLM / Ollama) is in design |
Standards we follow
The table lists standards BlueUP applies in the product and on the portal. They are not certifications issued by a third party.
| Standard | Use at BlueUP |
|---|---|
| FINOS CDM | Standardized banking data model |
| EIAC V06 | Insurance data model (TIREA standard) |
| WCAG 2.1 AA | Conformance target for the public portal, verified with axe-core on every deployment. No formal accessibility statement and no external audit |
| OAuth2 + OIDC | Standard authentication with Keycloak |
Resources and application by industry
- DORA 2026 guide — Technical guide to Regulation (EU) 2022/2554.
- DORA Calculator — 18-question self-assessment with downloadable report.
- DORA 2026: practical guide — Deadlines, perimeter and obligations by entity type.
Operational application by regulated industry:
Need a compliance assessment?
We analyze your current situation and show you what BlueUPALM can contribute to your regulatory obligations.
Self-assess your DORA/SEPBLAC maturity
Answer 18 questions and get your per-pillar score with recommendations, in 2 minutes.