Scored. Tracked. Alerted. Every month.

It has. The four modules — SARS, website scans, B-BBEE and FSCA — are live, and the pilot is open: sign up with your work email at getkomply.co.za/sign-in. Komply is free for everyone during the pilot. Standard pricing applies after the pilot; the first 25 companies to sign up keep the R5,000 setup fee waived and get their first month free on a monthly plan.

Whether your privacy policy is present and reachable, whether a cookie-consent banner exists and what loads on a site without one, the data-subject rights notice, Information Officer disclosure, direct-marketing opt-in (section 69), breach-notification readiness (section 22), a published PAIA manual, cross-border transfer disclosure, and the third-party processors it detects. It flags a privacy policy written for another country's law, and notes when the site serves European or UK visitors. Findings link to the section of the Act they engage, or to the Information Regulator's guidance or PAIA manual template. Every scan also checks TLS and security headers, and the domain's email security (SPF, DKIM, DMARC, the mail transport policy and DNSSEC). It also reads what your site says about itself: certificates linked from your main pages (ISO, B-BBEE, CIDB, tax compliance) that have expired or expire within 60 days, quoting the line that gives the date; phone numbers, email addresses, registration numbers and company names that differ between pages; blog posts whose address, title and heading disagree, that name no author or that cite no outside source; test and campaign pages left live; and a linked PAIA manual that still gives the Information Regulator's old details, names no Information Officer or doesn't show the registration number.

SEO (meta tags, structured data, sitemap), GEO (Generative Engine Optimisation — JSON-LD and AI-agent crawlability), Performance (response time, render-blocking scripts) and Accessibility & UX (WCAG checks such as colour contrast, form labels, landmarks, and link and button names). Pro and Enterprise scans include them, scheduled and on demand. Security (headers, exposed files, server hygiene, outdated JavaScript libraries with known vulnerabilities, and secrets left in page code), email security and website claims run on every scan, Starter included.

Pro and Enterprise tenants can generate a ready-to-paste remediation artefact from four findings when they fail or warn: privacy-policy section text, cookie-consent banner code, a data-subject-rights notice, and an Information Officer designation block. Each artefact is a deterministic template citing the POPIA sections it answers; review with your legal advisor before publishing. Enterprise also offers CA(SA) remediation sessions for hands-on review, run under a separate engagement letter.

Continuous Professional Development (BN 194 of 2017, sections 31 to 34), complaints management under the General Code of Conduct (Komply's SLA targets: 5 working days to acknowledge, 20 to resolve, each step dated on the day it happened, today by default), conflicts of interest (GCC § 3A), fit-and-proper dates on each person's file, editable as checks are renewed, material-change letters to the FSCA (changes to your licence information are reported within 15 days under FSCA FAIS Notice 29 of 2023; a new key individual may need FSCA approval before acting), and a debarment-check record at every hire linked to the FSCA debarred-persons register. Pro adds the COI Management Policy generator, a cyber-incident log (Joint Standard 2 of 2024 applies to discretionary, administrative and fund-administration FSPs, not to an ordinary Category I advice FSP), the annual ICMP report narrative and the FAIS Ombud response package. Not covered yet: suitability assessment record-keeping (GCC § 8), a Representative Register XML helper, and a timer for the cyber-incident notification window (the notification Determination took effect on 1 September 2026; Komply logs incidents but does not yet time that window).

Pro tenants get a Komply-drafted Internal Compliance Monitoring Programme report covering your reporting period (12 months, or 6 for a Category II, IIA or III FSP) across CPD, complaints, COI, fit-and-proper, and cyber. Each section is composed from the live register data in fixed wording; no AI writes it. You edit every section before sign-off, and the FSP principal signs it off. Sign-off locks the report: Komply stores the signed copy, narrative and tables, and every later download is that copy, with its SHA-256 fingerprint on the sign-off page.

Yes — Pro tenants get a one-click "Generate Ombud response" inline on any escalated complaint. Komply composes a package: a chronology from the existing register, a draft narrative that restates the register and leaves the FSP's account, position and any remediation for you to write, an evidence list drawn from the FSP's roster, recent complaints and COI disclosures for you to prune, and a Komply audit-trail note. The response page counts six weeks from the complaint's receipt as a working marker; the FAIS Ombud's letter sets the date your reply is due. You review, edit, and submit to the FAIS Ombud — Komply doesn't auto-submit.

Not automatically yet. When you add a Key Individual or Representative, Komply records the debarment check as not yet verified and links you to the FSCA's debarred-persons register so you can check the name yourself. Automated matching against a mirrored copy of the register is being built. Until it ships, Komply will never show a hire as cleared.

No. You file through the FSCA's own portals, with your FSP's credentials. Komply holds your CPD ledger, complaints register, COI register and fit-and-proper records and surfaces deadlines; on Pro it also generates the audit-ready PDF.

Moonstone is consulting + training + tooling bundled. Komply is the tool — a readiness dashboard you keep current between Moonstone's audits or your in-house Compliance Officer's reviews. On Pro, Komply scores your readiness against published obligations; it doesn't replace the Compliance Officer's professional judgment.

Built for SA businesses from ~R10M revenue: Starter suits sub-R20M, Pro and Enterprise scale with you. The fit is strongest where there's government procurement exposure, regulated-industry status (financial services, health, telecoms, education), or significant personally-identifiable customer data. Decision-makers are CFOs, COOs, Compliance Officers, or owner-operators.

One dashboard, one subscription, one login. Each regulator keeps its own dossier, scored from its own records. The file summary and the monthly digest read across all four, and the tender-readiness page puts your proofs of good standing side by side and runs a clock on each one that expires: the SARS Tax Compliance Status, a B-BBEE certificate or sworn affidavit and the COIDA Letter of Good Standing, plus an Employment Equity certificate and your CSD registration if you bid for government work, and your CIDB grading for public-sector construction. Komply does not link a finding in one regulator to another; that judgment stays yours.

Komply replaces fragmented per-regulator tooling with one platform. Enterprise onboarding includes an audit of your existing compliance stack to identify consolidation opportunities. We don't ask you to throw away what works — we ask you to stop maintaining five separate tools and twenty separate logins.

Yes. Per-tenant Row-Level Security on every table. Encryption at rest and in transit. A POPIA-compliant Data Processing Agreement, accepted at onboarding as part of the Terms. Uploaded files (B-BBEE certificates and affidavits, and the receipts you attach to employer records) sit in private storage buckets, each workspace in its own folder under a path policy.

Consultants are excellent for one-off audits, regulatory opinions, and complex remediation. Komply is built for the other 50 weeks of the year: a monthly scan and digest, and scores that update as your records change, at a price and frequency human consultants cannot match. The two work together: Komply for the record-keeping and monitoring, a consultant for the heavy lifts.