GRC core
MeshComply
Regulatory obligations mapped to policies, controls and evidence, with an owner and a deadline for each.
- MeshComply
- Obligations
| Obligation | Status |
|---|---|
| Annual internal audit report to the board | On track |
| Internal controls report update | In review |
| Record of personal data processing operations | Attention |
| Revised anti-money laundering policy | Pending |
If your regulatory compliance still works like this
- A new rule discovered too late?The change is published in the official gazette, and the area only notices when the deadline is near.
- Obligations without an owner?Everyone assumes it belongs to another area, and the evidence doesn't exist when the regulator asks.
- Compliance evidence scattered around?Each deliverable is in a different folder, and putting together the response to the regulator takes weeks.
- More than one regulator asking for similar things?The same control gets documented twice, in different ways.
What MeshComply does
Obligations inventory
Obligations by regulator and rule, with source article, owner, frequency and expected evidence.
Mapping to policies and controls
Each obligation points to the policy that addresses it and the controls that fulfill it.
Regulatory calendar
Recurring deliverables with deadline, owner and reminders, in a single view.
Compliance evidence
Evidence comes in linked to the obligation and the period, ready for the response to the regulator.
Multiple regulators
When more than one regulator applies, the platform combines their requirements, and one control can serve several obligations.
Compliance by rule
A dashboard of what is met, pending or missing evidence, by regulator and by area.
From the rule to the evidence, on one path.
Open an obligation and see the article that created it, the policy that addresses it, the controls that fulfill it and the latest evidence. A change in the rule shows everything that needs review.
- MeshComply
- OBR-077
- Source
- BACEN · Circular 3.978/2020
- Policy
- POL-012 Anti-money launderingIn review
- Controls
- CTR-061 Monitoring of unusual transactionsCTR-062 Customer registration and due diligence
- Latest evidence
- Committee minutes, 12/2026Approved
Every deliverable of the year in one list.
Recurring and one-off deliverables appear by month, with owner and status. Whatever is late or missing evidence rises to the top.
- MeshComply
- Regulatory calendar
- Annual internal audit reportOn trackBACEN · Audit
- Financial statements for ANSPendingANS · Accounting
- Internal controls reportIn reviewANS · Internal controls
- Annual business continuity plan testAttentionInternal · IT
Illustrative screens with fictitious data.
Starting with the regulators you answer to
Profiles with BACEN and ANS requirements, plus LGPD. New profiles go through regulatory review before they are published.
The AI suggests, compliance decides
Mesh Intelligence reads new rules and suggests which obligations change and who is affected. An obligation only enters the inventory after approval.
Fits with
- MeshPolicyDrafting, approval, publication, acknowledgement and periodic review of policies.
- MeshControlDesign, testing and effectiveness of internal controls, linked to the risks they mitigate.
- MeshESGESG indicators with traceable evidence behind every reported number.
Questions from those who answer to regulators
Do obligations come pre-loaded?
Regulator profiles bring an initial base of obligations. You confirm what applies to your organization and add your internal obligations.
Can one control serve more than one obligation?
Yes. The control is registered once and linked to every obligation it fulfills, from one or more regulators.
How is LGPD handled?
LGPD obligations come as a profile of their own, with the record of processing activities and data subject rights linked to privacy controls.
See MeshComply with a case from your industry
The demo is led by the founder, who has seven years of internal and external audit experience.
Modules are licensed separately. The platform comes with all of them.