Compliance Practice

Commercial project - delivered under NDA, client name withheld.

Credible, and not one word more

The client is an experienced AML specialist in Dubai opening a private advisory practice for regulated non-financial businesses: real estate, precious-metals dealers, corporate service providers, law firms. The licence was still on its way. The competition was the Big 4 and slick aggregators.

That combination rules out most of what a services website normally does. No regulator logos, no "approved by", no guarantees, no "100% compliant", no prices, no testimonials that don't exist yet, no legal entity or address before there is one. In compliance, a website that overstates is not just bad marketing - it's evidence against you.

So the brief was unusual: make the site credible by being exact.

One line carries the whole project:

The frame carries the brand. The voice belongs to the person. Everything that's true today is said in the first person; everything that will only be true after the licence lives where it can be switched on without rewriting a word.

The brief came from questionnaires, the decisions from a council

The brief was gathered through two long structured questionnaires - business and brand, then product, operations and security - generated as forms so the client could answer in their own time. Then, before a line of code, five specialist roles each argued the site from their side: conversion, SEO, brand and UX, technical architecture, and UAE regulatory compliance. Three rounds: independent positions, an agreed core plus a list of disputes, and a final round where each dispute was decided and the reason written down.

Some of those decisions are the most useful part of the project:

• The hook that judged someone else's document. Marketing wanted to tell visitors their AML manual was out of date. Compliance objected: that's a verdict on a document we haven't read. It became a question with a checkable fact - which law replaced which, and on what date - sitting as a sourced, dated line above the services rather than a headline.
• One trigger, one page. "The bank is asking for your AML framework" is the most common reason people call. SEO wanted it to land on one service, marketing and compliance on another. The rule that won: one trigger leads to one page, so attribution stays clean.
• Anti-spam without a captcha on day one. The architect wanted a challenge from the start; design and marketing wanted none. Launch is a honeypot, a minimum fill time and rate limiting, with the challenge already wired behind a CMS switch for the day spam shows up.
• A mobile call-to-action that doesn't cover the content. A sticky bar only on service and industry pages, hidden when the form is on screen, with its space reserved so the layout never jumps.

The voice rule

Unanimous across the council: the practice's name appears in the frame - header, footer, titles, service headings, disclaimers, structured data. Inside the frame, the voice is "I": the hero, the about page, the process, the service texts, the form. One line connects them. "We", "our team" and "our clients" are not used at all before the licence.

It reads as a personal practice rather than a firm pretending to be bigger, which is exactly the difference from the Big 4. And on the day the licence arrives, nothing has to be rewritten.

A CMS the client runs alone, built to grow into a portal

Everything is editable by the client: pages assembled from blocks, nine services, four industries, insights, media, header and footer, site settings, and every legal text - disclaimers, "not legal advice", a "What I don't do" section, the list of data processors.

Regulatory facts never float free. Every "what changed" entry on a service and every regulatory snapshot on an industry carries the fact, its source, a link and a date, plus who it applies to and when it was last reviewed. Fines and legal provisions appear only in those dated, sourced blocks - never in a headline.

Consent text is versioned; every lead stores the version it agreed to and when.
The audit log is append-only - create, update and delete are denied through the API,
hooks write which fields changed and who changed them. A slug change creates a 301
automatically. User roles already include the future client roles of the portal,
so the portal will share one admin and one login rather than bolt a second one on.
The schema changes only through committed migrations, run before every build.

A form that asks for almost nothing

Name, phone, and how you'd like to be contacted - call, WhatsApp or Telegram. No email field, no direct WhatsApp link. Optional "what prompted this?" chips, pre-filled when the visitor arrives from one of the trigger cards. A required consent under the UAE data protection law.

Notifications go to the client's workflow tool through a signed webhook, and they deliberately leave the phone number out: it's visible only inside the admin, behind a login. Visitor IPs are stored only as salted hashes. Spam gets a convincing success message and nothing is saved.

Results

• Positioning, content model and site decided by a five-role council, every contested call written down with its reason
• A voice rule that keeps the practice credible and legally safe before the licence, with nothing to rewrite after it
• 9 service pages and 4 industry pages built for search, each with dated, sourced regulatory facts
• A CMS the client runs alone - including every legal text - designed as the base of a future client portal
• A three-field lead form with versioned consent, signed notifications and no phone numbers in transit
• Stage 1 built in a single day against a three-week plan; launch waits on the licence, not on the site

Next.js 16 (App Router) + Payload CMS 3 on Postgres · pages statically generated and
revalidated by tag on every CMS change · self-hosted fonts · cookieless analytics with a
five-step form funnel · zod and libphonenumber validation · HMAC-signed webhook ·
EU hosting region.