> ## Documentation Index
> Fetch the complete documentation index at: https://docs.frayme.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance

> How Frayme produces the artefacts a regulator will ask for. Always built around the audit-trail export.

Compliance in Frayme is one workflow: **the audit-trail export**. Everything else — decision states, evidence packs, retention windows, regulator submissions — feeds into the same export bundle.

## The audit-trail export

A self-contained, hash-verifiable bundle of everything Frayme observed and did, scoped to whatever the regulator (or internal audit) is asking for.

<Steps>
  <Step title="Scope the query">
    By `decision_id`, by date range, by submission code, by client (`main_account`), by rule. Multi-dimension combinations supported.
  </Step>

  <Step title="Generate the bundle">
    `GET /api/audit/exports?…` produces a ZIP with:

    * `manifest.json` — what's included, what's excluded, why.
    * `decisions/` — one JSON per decision with the full evidence pack.
    * `workflows/` — workflow definitions at the versions that originally executed.
    * `audit_log.ndjson` — chain-hashed entries for the scoped events.
    * `signature.sig` — cryptographic signature over the bundle.
  </Step>

  <Step title="Verify">
    The bundle includes a `verify.sh` script that reads `signature.sig` and re-hashes the chain to confirm no tampering.
  </Step>

  <Step title="Deliver">
    Bundles can be delivered via signed S3 URL, secure email (with passphrase out-of-band), or on a hardware device.
  </Step>
</Steps>

## What's in the bundle for any regulator

The bundle is **regulator-agnostic** by design. The same export shape covers:

* COAF communications under Brazil's Circular BCB 3.978/2020.
* SAR filings under the US Bank Secrecy Act.
* STR filings under FATF Recommendation 20 in any jurisdiction.
* Internal-audit and Subject-Access-Request responses.

Per-jurisdiction nuance lives in the **submission code catalogue** (e.g. COAF codes for Brazil) and the destination endpoint — not in the export format.

## Decision-level PDF

In parallel with the bundle, individual decisions can be exported as standalone hash-stamped PDFs from the [Decision Console](/decisions/console). Useful for one-off regulator interviews, internal review packets, or sharing a specific case with an external counsel without handing over the full bundle.

## Retention guardrails

Frayme applies retention windows automatically per decision class — the longest default is 7 years for regulator-filed decisions, exceeding the typical 5-year regulatory floor by 2 years for buffer. Active-store vs offsite-mirror tiers are transparent to the export — `GET /api/audit/exports` resolves both.