For licensed fintech, digital-asset and payments firms
Get licensed. Stay inspection-ready.
Carina runs your license application from the regulator's checklist to the approval letter. Once you're licensed, it keeps the records an inspector asks for: customer due diligence with identity verification and sanctions screening, incidents and complaints, and board reports, each with its audit trail. Built for small teams without a compliance department.
- Regulator checklists
- E-signed declarations
- Fingerprinted submissions
- Customer due diligence
- ID and sanctions checks
- Inspection exports
Sign up with a code sent to your email. No card needed to start.
Opening first inCayman IslandsThe BahamasBermuda
Every requirement has an owner and a status.
Shared drives and spreadsheets don't hold a license together.
During the application, versions get lost, deadlines live in one person's head, and the answer to the regulator's question is somewhere in an email thread.
After approval it gets harder. Customer files sit in inboxes, a breach deadline is counted on someone's calendar, and an inspection means weeks of pulling records together.
In Carina, every requirement, customer and case has an owner, a deadline and a history, and every change is in an append-only audit log.
From the first checklist to your next inspection.
One workspace for the people doing the work: your team, your directors and your outside advisers, each seeing only what their role allows.
Apply follows an application to the approval letter. Operate keeps the records you need once you're licensed.
01 / 07
Start from the regulator's requirements
Pick a template and the checklist builds itself: every requirement with its reference, guidance and default owner, in the regulator's order. Templates are versioned and cite their sources; your application records the version it started from.
- Firm-level and per-person items
- Activities filter what applies
- Draft templates are clearly marked
What it never does.
People make the decisions. These rules are built into the product and checked by its tests where they can be.
audit log · append-only
- 10:42C. Officeraccepted customer 118 · reasons recorded
- 10:40AI review3 flags on aml-policy.pdf v2
- 10:31J. Riverasigned the Q3 board report · 52d98f…
- 10:12C. Officerbreach 4: regulator notified, on time
Give legal advice
It organizes your work and points out gaps. Interpreting the law stays with you and your counsel.
Close an item for you
AI flags; people close items. Only your firm's own people mark a requirement done or not applicable.
Accept or decline a customer
It proposes a risk rating with its reasons, and identity checks return results for review. Your owner or compliance officer makes the decision and records why.
File or send anything
Submission packs, regulator answers and incident notifications are yours to send. It records that you did.
Change what was signed or submitted
Signed declarations, customer submissions, board reports and frozen submissions carry SHA-256 fingerprints and can't be edited.
Keep ID documents past your policy
You set how long identity documents are kept. When the time is up, they're deleted and the deletion is logged.
Built for the people around a license.
See it step by step in seven use casesFounders and compliance officers
Run the license application with a small team, then keep customer files, cases and board reports in order once you're licensed.
Directors and officers
Finish a fit-and-proper pack from a private link, with no account. Approve board reports with an e-signature, and see nothing else.
Advisers
Outside counsel and consultants see all their clients in one place. They comment, review and draft; the firm closes items and makes decisions.
Three financial hubs first.
Carina opens first in the Cayman Islands, The Bahamas and Bermuda. Each opens to new firms once its regulator's checklist has been prepared and published, so the requirements you work from are that regulator's own. The wider Caribbean follows, one jurisdiction at a time.
- Cayman IslandsOpening first
- The BahamasOpening first
- BermudaOpening first
- The wider CaribbeanNext, one at a time
Two plans: one to get licensed, one to stay compliant.
Prices aren't published yet. Start a workspace and we'll share them with you.
Available now
Apply
For the license application. One fixed price, covering up to 12 months.
- Regulator checklist, owners and deadlines
- Fit-and-proper packs with e-signature
- AI gap review of your policies
- Submission packs with fingerprints
- Regulator question log with cited drafts
- Approval and conditions
Early access
Operate
For staying compliant once you're licensed. Annual, tiered by number of active customers.
- Everything in Apply
- Customer onboarding with signed submissions
- Your own risk model, with enhanced due diligence sign-off
- Identity verification and sanctions screening, charged per check
- Incident, breach and complaint register on your own deadlines
- Quarterly board reports with e-signature approval
- Inspection exports with their audit trails
- Retention policy for identity documents
Available to early-access firms for now. Approved firms on Apply can register interest from their workspace.
Something a compliance officer is happy to show a regulator.
It holds a licensed firm's records, so it's built the way a regulated firm would build it.
Tenant isolation, tested
Every record belongs to one organization, and every request checks membership on the record's own organization. Access across organizations is covered by tests.
Roles, not shared logins
Owners, compliance officers, members, advisers and directors each see and do only what their role allows. Sign-in is by one-time email code; there are no passwords.
An audit trail you can show
An append-only log of every change, plus a log of who downloaded which file. Files are served through single-use links that expire within minutes.
Fingerprints on what matters
Documents, signatures, customer submissions, frozen submissions, approved answers and board reports carry SHA-256 fingerprints of their exact content.
Identity documents don't linger
Your retention policy deletes identity documents, blanks ID numbers and dates of birth, and asks the identity verification provider to delete its copy when the time is up. The owner and compliance officer get notice before anything is deleted.
AI on your terms
AI reviews and drafts use only the documents you choose, treat them as data rather than instructions, and are logged. Your owner can switch AI off for the whole organization.
Questions firms ask first.
Does it tell us what the law requires?
No. Templates set out the regulator's requirements in its order, and stay marked as drafts until a named reviewer verifies them against the sources. Interpreting the law stays with you and your counsel.
Which countries and licenses does it cover?
It opens first in the Cayman Islands, The Bahamas and Bermuda, then the wider Caribbean, one jurisdiction at a time. A jurisdiction becomes available once its regulator's checklist is published, and each checklist names the license it covers. When you start a workspace, you choose from the jurisdictions that are open.
Can our outside advisers work in it?
Yes. Invite them as advisers. They see your application, comment, review and draft answers. Only your own people close items, accept customers or approve answers.
What does the AI see, and can we turn it off?
A review reads only the document uploaded to that item; a draft answer reads only the documents you pick. Every call is logged and capped per organization per day. Flags and drafts never change a status or an answer on their own. Your owner can switch AI off.
Can we screen customers against sanctions lists?
Yes, as an Operate add-on in early access, charged per check. Your owner switches checks on and chooses the lists: sanctions, politically exposed persons, adverse media and more. Customers verify their ID document with a selfie, and business customers their company, on an identity verification provider's pages. Every possible match goes to your owner or compliance officer, who marks it with a note. Results never accept or decline anyone.
Does it send anything to the regulator or our customers?
No. You download submission packs and inspection exports, copy your answers, and send notifications yourself. It records when and how you did. Customers get only the links you send them (to onboard, or to verify their identity) and the code they ask for to sign.
Can we get our records out?
Yes. Submission packs and inspection exports are ZIP files with a manifest and checksums. Signed declarations and approved board reports are PDFs, and every document version can be downloaded.
Do our directors need an account?
Not for fit-and-proper packs: they finish those from a private link and sign with a code sent to their email. To approve a board report, they sign in with their email.
Start with your license application. Keep it all together once you're licensed.
Sign up with a code sent to your email, then start an application from the template. No card needed to start.