COMPLIANCE ARCHITECTURE
IBOR/ABOR Investment Compliance Rule Library
Compliance tested on the wrong book is a blind spot. The pre-trade and settled books of record are not the same dataset, and compliance engines that treat them as one inherit that risk.
Problem statement
Most investment compliance frameworks treat "Fund Accounting" as a single data source feeding every rule — issuer concentration limits, liquidity tests, leverage caps, all pulling from one book. That's a modeling error with real consequences: the book used for pre-trade decisions (the Investment Book of Record, IBOR) and the book used for official NAV publication (the Accounting Book of Record, ABOR) have different completeness profiles, different position lifecycle states, and different governance implications. Collapsing them into one source is a known governance failure pattern — a rule that passes against one book can silently fail against the other.
Beyond that structural issue, compliance rules originate from four very different sources — US and European regulation, prospectus/PPM language, internal policy, and side letters — each with its own data requirements, testability profile, and interpretation burden. Most rule libraries don't distinguish them, which makes it impossible to know which rules can actually be pre-trade blocked versus which ones require a human to notice an event occurred.
Approach
Five steps, applied in sequence — each one deliberately checked back against the big picture before moving to the next, so the detail work never drifts from the actual business problem.
Discover & diagnose
Catalogued every rule source a compliance program actually has to monitor — US regulatory, European regulatory, prospectus/PPM, internal policy, and side letters — and the datasets each one really depends on.
Model the domain
Identified and corrected the core modeling error: replaced a single "Fund Accounting" source with distinct IBOR, ABOR, and a narrowed FA designation — the same discipline FIBO (the EDM Council's Financial Industry Business Ontology) applies industry-wide — reflecting how pre-trade and settled data actually differ in practice. Kept that distinction stable by separating definitions from settings: what a book of record is lives in the model and doesn't change; what tolerance, owner, or booking basis applies to a given fund is configuration, resolved by specificity — an instrument-level override beats a fund-level one, which beats an asset-class default. That's what lets the same rule library serve funds with genuinely different practices without turning into a pile of special cases.
Validate against the big picture
Re-tested the existing rule set against the corrected model, adding a dedicated book-of-record integrity section — rules that check IBOR-to-ABOR consistency itself, not just what each book says individually. The governing principle: two books kept on different clocks will always show some difference, so a raw mismatch isn't yet a finding — each difference has to be explained first, by a named item (a trade not yet settled, a pending corporate action, a cash movement still in flight) that opens in one book and clears in the other. Only what's left over after that accounting is a real break worth escalating. And it's tested in order — quantity first, value second — so a quantity mismatch and the value difference it causes are never raised as two separate findings; only once quantities agree does any remaining value gap get split into price source, FX, and accrued income.
Build
Structured 135+ rules across all four sources with explicit data provider attribution, tiered severity (internal limits designed to trip before regulatory ones do), and a testability classification — pre-trade blockable, post-trade only, liability-side, calendar obligation, or event-triggered.
Govern & sustain
Delivered the library as both a reference document and a structured workbook, with an interpretation log requirement for every rule derived from prose, so the reasoning behind each interpretation stays auditable.
What was built
An investment compliance rule library — 135+ rules across regulatory, prospectus, internal policy, and side-letter sources — built on a corrected book-of-record model that treats IBOR and ABOR as the distinct datasets they actually are, with a dedicated section testing the integrity of that separation itself.
Every rule carries its data provider attribution, its tier (so internal limits are designed to breach before regulatory ones do), and its testability classification, so the difference between "this can be pre-trade blocked" and "this needs a human to notice an event happened" is explicit rather than discovered during an audit. Pre-trade blockable is what most people picture when they hear "compliance system" — but across a real rule library, roughly half the rules fall outside it: post-trade and model-dependent, liability-side (testing the investor register, not the portfolio), a calendar deliverable with a due date, or an event a human has to notice before any clock starts. Treating that half as an afterthought is where frameworks quietly fail.
This is the same instinct behind the broader "governed like a product" argument circulating in the data community right now — that a data asset earns trust through an explicit contract, clear ownership, and observable quality signals, not through tribal knowledge. Modern Data 101's writing on architectural standards for data products makes a parallel case for AI-consumed data; a compliance rule library with attribution, tiering, and an interpretation log is that same discipline applied to investment restrictions instead of a dataset.
Business value
What it delivered
- Closed a governance blind spot that lets a rule pass on one book of record and silently fail on the other.
- 135+ rules structured with clear data provider attribution and tiered severity — internal limits calibrated to trip first, then prospectus terms, then regulatory limits last. If a regulatory limit ever trips before its internal counterpart, that's not just a breach — it's a sign the calibration itself is wrong.
- A testability classification separating true pre-trade controls from calendar and event-triggered obligations most teams miss.
- An auditable interpretation log for every rule derived from prose sources, rather than undocumented tribal knowledge — and a governance layer with real teeth: every finding carries a named owner role, a severity, and a response-time clock, not just "assigned to compliance" with no one accountable for when it gets looked at.