1.Brief of the Application

ForexComply is a cloud-based application built for Chartered Accountant firms that perform concurrent audits of Full-Fledged Money Changers (FFMCs) licensed by the Reserve Bank of India under FEMA 1999. The platform manages the entire concurrent audit lifecycle within a single system — from engagement creation and document collection to automated transaction validation, dynamic checklist execution, structured observation management, and final report generation.

FFMCs are authorised dealers permitted to buy and sell foreign currency notes, coins, and travellers' cheques with members of the public. The RBI mandates that FFMCs above a specified annual turnover threshold undergo monthly concurrent audits, and smaller FFMCs undergo quarterly concurrent audits. These audits require 100% transaction verification — not sampling — against a complex framework of FEMA provisions, LRS limits, AML/CFT norms, TCS thresholds, KYC requirements, and purpose code rules.

The platform is built on Django 5.2 + Django REST Framework (backend), React 18 + TypeScript + Ant Design 5 (frontend), PostgreSQL (database), and Celery + Redis for asynchronous task processing. It supports six distinct user roles across two stakeholder types — CA firm personnel and FFMC client users — each with separate, role-controlled workspaces within the same application.

2.Problem Being Solved

Before ForexComply, CA firms conducting FFMC concurrent audits relied on:

1. Excel workbooks for transaction-level verification, built and maintained manually per audit
2. Printed or Word-based checklists that do not link to actual transaction data
3. Email and WhatsApp for document collection from FFMC clients — no version control
4. Manual lookup of RBI circulars, LRS limits, TCS thresholds, and BTQ limits before each audit
5. Manually typed observation reports referencing separate validation notes
6. Word templates for audit reports that required copying all transaction data by hand
7. No structured client response workflow — queries and replies managed over email
8. No automated monitoring of RBI circular publications or client licence expiry dates

These approaches are error-prone, time-intensive, and create compliance gaps — particularly given the RBI mandate for 100% transaction coverage and the volume of transactions in an active FFMC branch.

3.Key Features

3.1User and Role Management

Five role levels with distinct access controls:

1. Super Admin: Manages all users, clients, and system configuration
2. Audit Manager: Creates and oversees audit engagements; approves plans and reports
3. Auditor: Executes checklist items, records observations, uploads documents
4. Client Admin: FFMC-side user who uploads documents and manages client users
5. Client Reviewer: FFMC-side read-only access to audit status, observations, and reports

3.2FFMC Client Master

1. RBI authorisation — licence number, licence type, validity dates, renewal date
2. FIU-IND registration number
3. Paid-up capital, Net Owned Funds, annual turnover
4. Audit frequency assignment — monthly (turnover > USD 100,000) or quarterly
5. AML risk rating — Low / Medium / High
6. Branch master with branch-level flags: VTM (Video Teller Machine), TC (Travellers' Cheques), MTSS
7. Permanent master document repository (FEMA registration, internal AML policy, rate approvals)

3.3Eleven-Stage Audit Lifecycle

Each audit engagement moves through the following tracked stages:

1. Created: Audit period, team, and engagement letter reference recorded
2. Documents Requested: Required document categories listed; client portal request activated
3. Documents Uploaded: FLM and supporting documents received; automatic processing begins
4. Extraction Complete: Transaction data extracted from FLM Excel and structured
5. Validation Run: Automated validation engine executed against all configurable rules
6. Plan Generated: Audit plan auto-drafted with scope, period, team, and methodology
7. Plan Approved: Manager reviews and approves the plan before fieldwork proceeds
8. Fieldwork: Auditor executes checklist items, records observations
9. Draft Report: Platform assembles draft report from audit database
10. Client Review: Client views draft via portal and submits responses to observations
11. Final / Locked: Report finalised; locked to prevent further edits; distributed

3.4Automated Document Processing Pipeline

On FLM document upload, a Celery asynchronous task chain executes these steps in sequence:

1. Excel extraction — FLM rows parsed into structured transaction records
2. Transaction promotion — each row written to the Transaction table with customer, amount, currency, purpose code, and risk metadata
3. Audit plan auto-draft — plan document created (never overwrites an already-approved plan)
4. Checklist auto-initialisation — full checklist built from master items, document items, and one item per transaction
5. AES-256-GCM encryption — source file encrypted in place on disk

3.5Validation Engine

Configurable validation rules are executed automatically on each uploaded document. Rules are organised in eight categories:

1. Document Completeness: Verifies all mandatory FLM register categories are present for the audit period
2. Balance Continuity: Opening balance + net transactions = closing balance per currency per branch
3. Cross Reconciliation: FLM totals reconciled against subsidiary ledger and stock statements
4. KYC / AML Compliance: Customer KYC currency verified; high-risk customer status checked
5. Threshold Breach: LRS annual cap (USD 2,50,000), TCS threshold (₹7 lakh), BTQ notes limit (USD 3,000), PAN requirement (above INR 50000 ), cash receipt limit (₹2 lakh per Section 269ST)
6. Duplicate Detection: Same transaction referenced across multiple uploads or branches
7. Negative Balance Checks: No negative stock balances or negative customer forex outstanding
8. Split Transaction: Same customer, same month, multiple transactions structured to stay below reporting thresholds

Each failed rule produces a validation result record with the specific affected transaction or document reference. Failed validations can auto-create observation drafts pre-populated with the affected record details.

3.6Dynamic Audit Checklist

The checklist is not a static template — it is generated fresh for each audit from the actual data of that engagement. Items come from four sources:

1. Master checklist items configured by the firm (firm-level standing items with RBI/FEMA section references)
2. Document verification items — one item per uploaded document category
3. Transaction verification items — one item per transaction; risk-flagged transactions (high-value, LRS breach, PAN absent, split suspected) placed in a separate highlighted section
4. Validation failure items — one item per failed validation rule, pre-linked to the affected record

Each item tracks: auditor compliance status (Pending / Complied / Partially Complied / Not Complied / N/A), reviewer approval, remarks, and attached evidence documents.

3.7Observation and Finding Management

Structured audit findings with full lifecycle tracking:

1. Severity — Critical, High, Medium, Low
2. Area — FLM Registers, KYC/AML, Sales, Purchase, Stock, Reporting, Display, Documentation, Controls, Previous Audit Points
3. Nature — Compliance, Control Weakness, Operational, AML/CFT
4. Client response workflow — Open → Under Review → Client Responded → Auditor Reply → Closed or Carried Forward
5. Evidence documents attached per observation
6. Repeat observation flag linking finding to prior-period counterpart
7. Auto-generation from failed validation results

3.8Secure Client Portal

FFMC client users access a separate, role-controlled workspace within the same platform. Available actions for client users:

1. Upload documents for an ongoing audit directly into the platform
2. View the current audit stage and timeline
3. Read observation details and submit formal written responses with supporting evidence
4. Acknowledge receipt of the final audit report
5. Access RBI circulars marked as client-visible by the firm
6. Use the AI Compliance Assistant for regulatory queries
7. Manage their own firm's user accounts (Client Admin role only)

3.9Automated RBI Circular Monitoring

A scheduled Celery Beat task runs daily at 09:00 IST and:

1. Scrapes the RBI website (rbi.org.in) for new circulars, notifications, and master direction amendments
2. Filters for FFMC/Forex/FEMA/AML relevance using keyword matching
3. Downloads circular PDFs using realistic HTTP headers and configurable delays
4. Stores title, publication date, category, document type, and source URL
5. Queues automatic re-embedding into the RAG knowledge base
6. Sends a weekly email digest of the past 7 days' circulars to all firm users

3.10 AI Compliance Assistant (RAG)

A Retrieval-Augmented Generation (RAG) AI assistant is built into the platform for both auditors and FFMC client users.The assistant answers compliance questions in plain English, grounded in the platform's own knowledge base.

Knowledge base contents:

1. RBI circulars and master directions (from the Circulars module)
2. Forex Limits master — all configured RBI-mandated limits with effective dates
3. Validation Rules — all active rules with RBI and FEMA references
4. RBI Purpose Codes — all active LRS remittance purpose codes with sub-limits

How it works:

1. User question is embedded using the all-MiniLM-L6-v2 sentence-transformer model (384 dimensions)
2. Top-5 most relevant knowledge chunks retrieved via cosine similarity search (pgvector on PostgreSQL)
3. Answer generated by Groq API (Llama-3.1-70B) with automatic fallback to OpenRouter
4. Every answer displays the source citations with source type, title/code, date, and similarity score
5. Client users are filtered to see only circulars, forex limits, and purpose codes — not internal validation rule details
6. When super admin saves or updates any circular, limit, or rule, a Celery task automatically re-embeds it
7. Multi-turn conversation history maintained per user session

3.11 Automated Report Generation

The platform assembles a structured concurrent audit report from the audit database. The following sections are auto-populated and locked (cannot be edited):

1. Executive Summary — audit period, firm, FFMC client, team members, engagement reference
2. Transaction Summary — total count and amounts (INR and foreign currency) by transaction type
3. Validation Results — all rules executed with pass/fail counts and affected record references
4. FLM Compliance — status of each document category
5. Customer KYC Statistics — KYC-current versus overdue customer counts
6. Observations Summary — count by severity and area

Editable sections (Scope and Methodology, Management Comments, Conclusion, Additional Remarks) accept partner-level narrative input.Report is versioned, exportable as PDF or DOCX, and can be locked to prevent further edits once finalised.

3.12 Document Security (ISO 27001 Aligned)

1. AES-256-GCM authenticated encryption applied to every uploaded document immediately after extraction; 96-bit random nonce prepended to ciphertext; 16-byte GCM authentication tag appended
2. SHA-256 file integrity hash recorded on upload
3. Every file download logged: user, timestamp, first 16 characters of SHA-256 hash, file size, IP address
4. Secure deletion on document delete: file overwritten before removal
5. Content-Security-Policy, Permissions-Policy, and Referrer-Policy HTTP response headers
6. Full entity-level audit trail: every create/update/delete logged with user, timestamp, and changed values
7. JWT access tokens with 60-minute lifetime; refresh token rotation
8. Failed login tracking with account lockout and IP logging
9. Two-factor authentication support

3.13 Scheduled Alerts and Monitoring

The following scheduled tasks run automatically via Celery Beat:

1. 08:00 IST daily — scans all client RBI licence dates; generates alerts for licences expiring within 90 days
2. 08:15 IST daily — scans customer KYC refresh dates; flags overdue KYC records
3. 09:00 IST daily — scrapes rbi.org.in for new FFMC-relevant circulars
4. 09:00 IST daily — scans audit deadlines; notifies audit manager for overdue audits
5. 18:30 IST daily — fetches current RBI exchange rates from data.gov.in
6. 02:00 IST nightly — rebuilds analytics dashboards for all active audits
7. Weekly — email digest of circulars published in the last 7 days sent to all firm users

3.14 Master Data and Regulatory Limit Configuration

Platform administrators configure regulatory limits without code changes. The Forex Limits master holds named limit records with value, currency, effective date, and RBI circular reference. All validation rules reference these limits dynamically. Limits currently configured include:

1. LRS_CAP_USD — Annual LRS remittance cap per individual (USD 2,50,000 per RBI Master Direction)
2. BTQ_NOTES_USD — BTQ travel quota limit in notes/coins (USD 3,000)
3. TCS_THRESHOLD_INR — Income Tax Act Section 206C TCS trigger (₹7 lakh)
4. CASH_RECEIPT_INR — Section 269ST cash receipt prohibition (₹2 lakh)
5. CTR_THRESHOLD_INR — Cash Transaction Report filing threshold
6. Purpose-code-level sub-limits for education, medical, and MTSS remittances

4.How the Platform Benefits a Chartered Accountant

The following table describes, for each stage of an FFMC concurrent audit, what a CA previously had to do manually and what ForexComply now provides:

5.What is Automated — Complete List

Every item below was previously a manual step performed by the auditor, firm staff, or client. ForexComply automates it by the mechanism described.

6.Regulatory Compliance Coverage

The following specific regulatory obligations are directly addressed by features in the platform:

7.Technology Stack

1. Backend: Django 5.2 + Django REST Framework — REST API, ORM, Celery integration
2. Frontend: React 18 + TypeScript + Ant Design 5 with custom teal/gold theme
3. Database: PostgreSQL with pgvector extension for vector similarity search (numpy cosine fallback for development)
4. Async: Celery + Redis — all document processing, RBI scraping, and alert tasks run asynchronously
5. AI / LLM: sentence-transformers all-MiniLM-L6-v2 for local 384-dim embeddings; Groq API (Llama-3.1-70B) primary LLM; OpenRouter automatic fallback
6. Encryption: Python cryptography library — AES-256-GCM authenticated encryption for documents at rest
7. Auth: JWT (djangorestframework-simplejwt) — 60-minute access tokens; refresh token rotation
8. Security: CSP / Permissions-Policy / Referrer-Policy middleware; ISO 27001 aligned audit trail
9. Deployment: Linux with Gunicorn WSGI server; Nginx reverse proxy; Celery worker and beat via systemd