The First Compliance Linter for Community Banks

Who This Is For

A $500M community bank has the same BSA/AML obligations as JPMorgan. Same examiners, same consent orders, same potential for enforcement action. But JPMorgan has a compliance department of 30,000 people. The community bank has three. Those three people maintain SAR narratives, CIP procedures, GLBA privacy notices, PCI-DSS policies, and SOX controls. They review them annually, usually by reading the document and checking it against their memory of the regulation. Sometimes the regulation changed. Sometimes their memory didn't. Comply is a linter. Run it against your compliance documentation and it tells you what's missing, what's imprecise, and what cites the wrong source. No AI, no cloud, no subscription. vale --config=.vale.ini your-policy.md.

What It Catches

The SAR narrative rule alone has 21 tokens that catch vague language examiners flag: "various transactions," "large amount," "suspicious activity was noted." FinCEN examiners want specifics: who, what, when, where, why. If your SAR says "the customer conducted various transactions" instead of naming the transactions, amounts, and dates, this catches it. The PCI prohibited storage rule checks for references to storing CVV, track data, or full magnetic stripe data in documentation that should explicitly prohibit it. If your data retention policy says "card data is stored securely" without specifying what's retained and what's destroyed, it flags the gap. The UDAAP buried disclosures rule looks for patterns where material terms appear deep in documents rather than prominently. Cited against CFPB v. TransUnion (2017) and Supervisory Highlights Issue 28, not vague "CFPB policy."

The Audit Problem

We spot-checked 10 of 49 rules. Found zero fabricated rules (Vale's concrete pattern matching limits this), but three with issues: one rule had severity too high (flagging legally required language as errors), one had inverted logic (flagging procedure boilerplate instead of weak narratives), one had a vague citation. All three fixed. 39 rules still need the same audit. The tool is honest about this: the README says exactly which rules are verified and which aren't.

Regulations Covered

Area	Rules	What They Check
BSA/AML	7	CIP language, SAR narratives, CDD procedures, CTR documentation
SOX	5	Section 302/404 controls, material weakness indicators
PCI-DSS	7	Prohibited data storage, encryption requirements, access controls
GLBA	3	Privacy notices, opt-out rights, safeguards
UDAAP	3	Deceptive language, buried disclosures, unfairness indicators
Reg E/CC/DD	6	Electronic funds, check clearing, deposit disclosures
NCUA	1	Credit union specific requirements
Cross-regulation	17	Common compliance patterns across all areas

Stack: Vale, Python, YAML. Open source, Apache 2.0.