METHODOLOGY

How DAC maps regulatory logic.

Every finding traced to its source. Every source weighted by its legal authority. No interpretive shortcuts.

The Hierarchy of Authority

DAC applies a four-tier hierarchy to every regulatory requirement we map. This hierarchy determines the weight and urgency of each finding in your Readiness Snapshot and Platform analysis. A Tier 1 finding (binding statute) is treated with greater severity than a Tier 4 finding (emerging proposal) — because an examiner will do the same.

TIER 1 — HIGHEST WEIGHT
Binding Requirements
Federal statutes, federal regulations codified in the Code of Federal Regulations (CFR), state regulations codified in the New York Codes, Rules and Regulations (NYCRR), and other formally adopted rules. Violations at this tier are enforcement events — not judgment calls.
Examples: 31 CFR 1022.210 (BSA/AML Program) · 23 NYCRR 200.15 (BitLicense Custody) · Securities Act §5 (Registration)
TIER 2
Supervisory & Interpretive Guidance
Industry letters, advisories, no-action letters, interpretive statements, and staff guidance. Not law in the strict sense, but examiners treat them as expected practice. Failure to align with Tier 2 guidance frequently appears in examination findings.
Examples: NYDFS Industry Letters · SEC Staff Statements · OCC Bulletins · FinCEN Advisories
TIER 3
Enforcement-Informed Risk Considerations
Documented patterns from consent orders, settlement agreements, and examination findings. These are not requirements per se — but they reveal where agencies are focusing and what they consider deficient. DAC tracks enforcement patterns to identify where your compliance program may face heightened scrutiny.
Examples: OFAC wallet screening (Tornado Cash, BitGo) · NYDFS Part 500 MFA enforcement · FinCEN SAR filing adequacy
TIER 4 — LOWEST WEIGHT
Emerging & Proposed Frameworks
Notices of Proposed Rulemaking (NPRMs), interagency memoranda of understanding, legislative proposals, and strategic watch items. Not yet binding, but shaping the regulatory landscape. DAC tracks these to help you prepare for what's coming — not to claim they're current requirements.
Examples: CLARITY Act (pending Senate action) · SEC Innovation Exemption (forthcoming rulemaking) · Nasdaq Tokenized Stock Rule (SEC review) · SMART Act (SEC-CFTC coordination framework)

Why this matters: When you receive a Readiness Snapshot, every finding is tagged with its tier. A finding based on a binding CFR provision carries different weight than one based on enforcement patterns. This distinction is critical for prioritizing remediation — and for defending your compliance program during an examination.

Requirement Classification

Within each tier, DAC classifies requirements by their source type. This classification appears in your workpapers and portal, allowing you to filter and prioritize your regulatory map.

Statutory
Codified in federal or state law. Highest enforceability.
Regulatory
Adopted by agency rulemaking. Has the force of law.
Exam Expectation
Expected practice during supervisory examinations.
Enforcement-Based
Derived from enforcement actions and settlement patterns.
Agency Guidance
Staff statements, FAQs, and interpretive materials.

What DAC Does — and Does Not — Provide

DAC is a regulatory logic mapping platform. We map which requirements likely apply to your business based on your entity type, licenses, jurisdictions, and activities. We trace every finding to its source regulation, weight it by the Hierarchy of Authority, and deliver it in audit-ready format.

DAC does not provide legal advice, render legal opinions, or guarantee compliance. We are not a law firm. We do not act as outside counsel. Our analysis is a decision-support tool that gives your compliance team and legal counsel a defensible, source-cited baseline to work from — not a substitute for either.

Coverage

199
Requirements Mapped
13
Regulatory Anchors
100%
Source-Cited

Our database spans federal, state, and international regulatory frameworks. Each anchor is classified by its current operational status:

ANCHOR SCOPE REQS STATUS
FinCENBSA/AML — Registration, SAR/CTR, Travel Rule21LIVE
OFACSanctions — SDN screening, wallet blocking, Tornado Cash16LIVE
NYDFSBitLicense (Part 200) + Cybersecurity (Part 500)24LIVE
SECSecurities registration, broker-dealer, custody, tokenization20LIVE
CFTCDerivatives, commodity trading, FCM requirements18LIVE
OCCNational bank custody, trust charter, IL 118318LIVE
CFPBRegulation E — fiat electronic fund transfers, error resolution, disclosures6LIVE
State MTLMulti-state money transmitter licensing and AML18LIVE
CA DFALCalifornia Digital Financial Assets Law (DFPI)15PREVIEW
EU MiCAMarkets in Crypto-Assets — EU-wide framework18PREVIEW
Token TaxonomySEC/CFTC Joint Interpretation — digital asset classification (March 2026)11LIVE
GENIUS ActPayment stablecoin — reserves, redemption, certification (signed law, effective ~Jan 2027)9SIGNED LAW
SMART ActSEC-CFTC coordination — inter-agency data sharing5STRATEGIC WATCH

Status definitions: LIVE = fully mapped, source-cited, included in Snapshot analysis. PREVIEW = requirements mapped but framework is newly enacted or not yet fully enforced; findings are flagged as preview in reports. STRATEGIC WATCH = proposed or pending legislation tracked for planning purposes only; not represented as current obligations.

How a Readiness Snapshot Is Produced

When you engage DAC for a Readiness Snapshot, the process follows a structured methodology:

1. Intake: You complete the regulatory exposure questionnaire — entity information, licensing status, business activities, and targeted compliance questions for each applicable regulator.

2. Mapping: Your responses are mapped against our 199-requirement database across 13 regulatory anchors. Only the requirements applicable to your entity type, licenses, jurisdictions, and activities are included in your analysis. Each applicable requirement is classified by tier, type, and risk area. Requirements from Preview and Strategic Watch anchors are clearly flagged as such.

3. Gap Analysis: We compare your stated compliance posture against the mapped requirements to identify gaps — areas where your current program does not satisfy the applicable obligation.

4. Deliverable: You receive a board-ready report (.docx) with an executive summary, prioritized findings with risk ratings and source citations, a remediation priority matrix, and a cited requirement map. Every finding is traceable to the specific regulation, guidance, or enforcement pattern that supports it.

5. Credit: 100% of your Snapshot fee is credited toward your first annual DAC Platform subscription if signed within 30 days of report delivery.

Who Builds DAC

Practitioner-Built Compliance Infrastructure

DAC is built and operated by compliance practitioners — not consultants, not legal theorists, not software developers who read about compliance. The team behind DAC brings Certified Crypto Auditor credentials and over a decade of hands-on experience across federally regulated financial institutions, clearinghouses, and mortgage lending environments.

That operational background is why DAC's methodology reflects how examiners actually conduct reviews — not how compliance is taught in textbooks. The Hierarchy of Authority, the severity classifications, the MRA/MRIA-format gap analysis — these come from years of sitting across the table from examiners and knowing what they look for, how they document findings, and what a defensible response looks like.

DAC is not a law firm. We don't provide legal advice. What we provide is a system-driven regulatory map that gives compliance officers a defensible, source-cited view of where their program stands — so they can make informed decisions with their legal counsel, not in the dark.

System Integrity

Every requirement in our database has been individually validated against its primary source — the actual CFR provision, NYCRR section, or agency guidance document. We do not rely on secondary summaries, third-party compilations, or general knowledge. If we cite 31 CFR 1022.210, we've read 31 CFR 1022.210. No sensitive policy documents are stored on our servers. Analysis is performed via deterministic intake and real-time mapping against our audited database.

See your regulatory exposure.

12 questions. 199 deterministic requirements. No signup required.

Start Your Free Exposure Preview → Book a Snapshot Call