One platform, many parts of your business: account segregation and role-based access control in Verify

If your firm has more than one office, more than one entity, or a compliance team that sits apart from the people bringing in the business, you've probably felt this problem.

Everyone in the account can see everything. Or you've split things into separate accounts, and now nothing talks to anything else.

Neither is a good place to be. Here's what we've built to fix it.

The problem with "everyone sees everything"

For a small, single-office firm, a simple setup works. 

Say you run a group with offices in different countries. Your London team has no business browsing client files held by your Dublin team. Or say you have a business development team bringing in new clients, and a compliance team reviewing them. You need those two functions kept apart, and you need to be able to prove it.

Regulators ask exactly that question. "Who could see this record?" "Who approved this client?" "Was it the same person who submitted it?" If your answer is "well, everyone in the account, but we trust them," that's a hard conversation.

The workaround that doesn't work

The usual fix is to set up a separate account for each office or business unit. It keeps people apart, but it creates new problems:

• Costs climb with every new account
• Admin gets duplicated everywhere
• Branding, templates and settings drift out of sync
• Cross-office work becomes painful, because a client who touches two parts of the group lives in two different places
• Group-level oversight means logging into several accounts and stitching the picture together yourself

It works for about as long as you have two offices. After that, it becomes a job in itself.

What we've built

Account segregation and role-based access control (RBAC) lets one Verify account operate cleanly across multiple parts of your business. It's built on three simple ideas.

Divisions are your top-level boundaries. A Division could be a country, a licensed legal entity, a business line, or whatever split makes sense for you. Each one carries its own configuration: branding, terms and conditions, application types, forms, documents, email templates, screening preferences, and MLRO and DPO details. Your Jersey entity can look and behave like your Jersey entity, and your UK entity like your UK entity.

Teams sit inside Divisions. Think offices, locations or desks. By default, people see the records belonging to their Teams and nothing else.

Roles decide what someone can do. Create, edit, submit, review, approve, reject, reset, assign, export, manage settings. Division and Team membership decide where they can do it. Staff, Manager and Admin come ready to use, and your Roles can be shaped around how your firm actually works.

The details that matter to compliance teams

A few things that tend to matter when the regulator comes calling:

Deliberate visibility. Some people do need a wider view, like a regional supervisor or a group lead. That's handled through specific permissions for division-wide or tenant-wide visibility, so wider access is something you grant on purpose, not something that creeps in.

Sharing cases without losing control. If a client relationship spans two Divisions or Teams, you can share that case with them, as view-only or edit. It's a permissioned action, and it's recorded.

A full audit trail. Case actions, membership changes, Role and permission changes, configuration changes. Each entry records who did it and which Team and Division they were operating in. It can't be edited after the fact.

Control over who changes access. Changing someone's Role, Division or Team is itself a permission, held by Admins by default. So access can't be quietly widened by whoever happens to be in a hurry.

The same model runs across the platform, not just on applications. Profiles, individuals, entities, screening and monitoring records all carry the same Division and Team tagging, so you don't get a tidy front door and a wide-open back room.

Who is this for?

Multi-office and international firms. Law firms, accountancy practices and financial services groups with several offices or entities that need to keep data apart while still operating as one business.

Firms with first-line and second-line separation. If the people originating business and the people reviewing it must be kept distinct, this gives you that, with evidence.

Compliance leads and MLROs. You get the controls and the audit trail you'd want to show a regulator, without relying on policy documents alone.

Group leadership. Oversight across the whole organisation from one place, instead of a stack of separate logins.

Firms planning to grow. If you expect to add offices, entities or teams, you can add a Division instead of adding a whole new account.

What happens if you're already a Verify customer?

Nothing changes unless you want it to.

Every existing customer starts with a single Default Division and Default Team. Your records and users are tagged to those, and everyone keeps the access they have today. When you're ready to split things out, we'll help you set it up. Your existing history stays exactly as it is.

The bottom line

Growing firms shouldn't have to choose between giving everyone access to everything and running a separate account for every office. Verify now gives you a third option: one platform, properly divided, with the controls and evidence regulators expect.

If you'd like to see how it would work for your structure, get in touch with the Verify team.