// USE CASE · LEGAL

Legal AI agents that run on your hardwareand pause before they sign.

Most law firms have banned cloud AI on day one because client documents cannot end up in a third-party model's training pipeline. Melaya runs the legal crew on your own machine. ContractReviewer, AMLSpecialist, and KYCLead can read privileged matters on a local Ollama or LM Studio model so the privileged file never leaves your network. Bring Claude or GPT only where the matter is non-privileged. The lawyer signs. Every read is logged.

01
// What breaks today

Manual workflows cost more than the agent does.

Three pains every sales and BD team hits weekly. Each one is what your reps actually complain about, not what a feature page would call them.

  1. 01

    Screen every wallet and transfer against OFAC, UN, EU, and HMT lists inside a 24-hour list-update window.

  2. 02

    Run enhanced due diligence on a DAO or token foundation regardless of size, with a full UBO chain documented.

  3. 03

    Track MiCA, FCA, MAS, SEC, and CFTC changes 90 days ahead across every jurisdiction you operate in.

02
// Pipelines you can build

Agent workflows: compose, approve, replay.

Every pipeline below is a shape you wire on the canvas using the crew and tools further down. Not a feature we ship for you, a pattern you configure.

P01

Sanctions and AML screening, on-chain and off

AMLSpecialist screens against OFAC, UN, EU, and HMT lists and flags structuring patterns like multiple transfers just under a reporting threshold, or 10+ transactions in 24 hours from one wallet. Melaya Agents runs ofac_screen_crypto_address and ofac_consolidated_screen against the live sanctions lists, then verifies the transaction pattern with eth_txlist and eth_token_transfers.

P02

KYB on DAOs and token foundations

KYCLead applies institutional-grade enhanced due diligence to any DAO or token foundation regardless of size, and documents every entity with a stake above 25% ownership. Melaya Agents backs the review with public filing lookups through edgar_ticker_to_cik and edgar_full_text_search wherever a counterparty is a registered entity.

P03

Regulatory change tracking, 90 days ahead

RegulatoryAffairs tracks MiCA, FCA, MAS, SEC, and CFTC changes and flags anything set to affect operations within 90 days. Melaya Agents pulls primary-source text directly with regs_search_documents and regs_search_dockets for federal rulemaking, plus congress_bill_search and congress_recent_actions for pending US legislation.

P04

Contract redline within 48 hours

ContractReviewer runs every SAFT, TPA, and term sheet through a red-flag and yellow-flag framework (unlimited liability, uncapped indemnification, non-standard MFN clauses) and produces a deal risk score. Melaya Agents reads the draft with word_read, drafts the redline with word_add_paragraphs, and routes deal-blocking issues to ChiefLegalOfficer through pause_for_human before anything returns to the counterparty.

P05

Board legal briefing, synthesized

LegalSynth rolls AML, KYC, regulatory, privacy, and contract findings into one RAG-scored risk landscape for the board, and ComplianceMonitor backs it with the quarterly control-test evidence. Melaya Agents writes the briefing to a shared doc and keeps the control register in a queryable table.

03
// The multi-agent crew

Legal & Compliance crew

Real personas from the legal_compliance crew. Each ships with a tuned system prompt and a default tool allowlist. Swap models per persona on the canvas.

Contract Reviewer

ContractReviewer

Reviews and redlines commercial contracts, SAFTs, TPAs, and term sheets, flagging red and yellow clauses against the firm's pre-approved playbook.

Regulatory Affairs

RegulatoryAffairs

Tracks MiCA, MiFID II, FCA, MAS, SEC, and CFTC changes 90 days ahead and runs licensing applications and renewals across operating jurisdictions.

AML Specialist

AMLSpecialist

Screens on-chain and off-chain transactions against AML typologies, flags structuring and Travel Rule gaps, and drafts SARs with supporting evidence.

KYC Lead

KYCLead

Runs KYC and KYB onboarding across three risk tiers, handles UBO chains, sanctions hits on OFAC, UN, EU, HMT lists, and EDD on PEPs.

Privacy Officer

PrivacyOfficer

Maintains the RoPA, runs DPIAs before high-risk processing, executes DSRs inside GDPR and CCPA deadlines, and owns the 72-hour breach protocol.

Compliance Monitor

ComplianceMonitor

Tests every compliance control on a quarterly cadence, maintains the control register, and assembles audit-ready evidence packs for examinations.

Regulatory Litigator

RegulatoryLitigator

Drafts responses to SEC, CFTC, and FCA inquiries, runs Howey and Reves analyses on token activity, and issues litigation holds when matters open.

Chief Legal Officer

ChiefLegalOfficer

Owns the top-10 legal risk register, briefs the board on enforcement exposure, and balances in-house versus external counsel spend against revenue.

Legal Synth

LegalSynth

Synthesises AML, KYC, regulatory, privacy, and contract signals into a single decision-grade brief for the CEO and board with action owners and deadlines.

04
// Scoped tools

Tool allowlists: only the actions you grant.

Every tool below is a real shared tool from the Melaya bundle. Allowlist per agent; HITL-gate the writes; revoke any of them in one click.

shared/tools/knowledge/

Load contract playbooks, MiCA and FCA rulebooks, prior SARs, DPAs, and regulator correspondence into the per-workflow vector store. Powers rag_retrieve for ContractReviewer, RegulatoryAffairs, and PrivacyOfficer. Writes are scoped to the workflow store, no cross-tenant leak.

build_knowledge_from_textbuild_knowledge_from_filebuild_knowledge
shared/tools/core/

General research, regulator-page fetches, and grep across policy repos. file_write is HITL-gated for any output that lands in your DMS or shared drive.

web_searchweb_fetchhttp_requestfile_readfile_writegrep_searchgit_log
shared/tools/scraping/

Pull EUR-Lex pages, FCA Handbook updates, SEC enforcement dockets, and MAS consultation papers into the regulatory radar. Reads only, no writes.

scrape_pagescrape_structuredscrape_linksscrape_table
shared/tools/email/

Read inbound regulator correspondence and client KYC documents, draft replies, and stage every send. gmail_send is HITL by default for this crew so no regulator email leaves without counsel sign-off.

gmail_readgmail_sendgmail_my_address
shared/tools/tavily_tools/

Search regulatory news, enforcement actions, and case law with citations the agent can ground its analysis in. Read-only, no HITL needed.

tavily_searchtavily_search_newstavily_extract
shared/tools/msoffice/

Read incoming contracts and KYC files in Word, build redline drafts and control registers in Excel. Writes land in a staging folder that requires HITL before promoting to the matter folder.

word_readword_createword_add_paragraphsexcel_read_sheetexcel_write_data
shared/tools/database/

Read the matter, control, and CDD tables for ComplianceMonitor and KYCLead. sql_execute is omitted on purpose, this bundle is read-only so the agent cannot mutate the compliance database.

sql_querysql_schemasql_export_csv
05
// Three knowledge layers

The crew reads what you give it.

Every pipeline ships with three layers of knowledge access. Mix and match per agent on the canvas. No shared vector space with another tenant, no surprise reads, no opaque retrieval.

L1

Static context

includeContext

Per-pipeline documents appended to specific agents' input on every run. The ICP brief, playbook, pricing sheet, or won-deal email corpus. Whatever needs to be there before the agent thinks. You pick which personas get which docs.

L2

RAG retrieval tool

rag_retrieve

A scoped tool granted per-agent. When the agent decides it needs more depth, it queries the workflow's vector store on demand. Same knowledge base as Static context, accessed only when the model asks for it.

L3

Cross-run memory

pipeline_memory

Pipeline-level state that carries from one run to the next. Yesterday's research is in scope for today's follow-up. The crew remembers what it already prospected, what got approved, what was sent. The audit log is the second-order knowledge base.

07
// FAQ

AI agent questions we get every week.

Can an AI agent file a Suspicious Activity Report or respond to a regulator on its own?

No. Every SAR draft and regulatory response pauses for human review; RegulatoryLitigator's own protocol requires senior management sign-off before privilege is touched or a reply goes out.

Does Melaya's legal crew replace outside counsel?

No. ContractReviewer and ChiefLegalOfficer flag deal-blocking risk and draft a position; the crew's own contract-review framework routes anything above the playbook's approved positions to a human before it moves.

Can it screen a wallet address against OFAC before accepting a transfer?

Yes. AMLSpecialist runs ofac_screen_crypto_address and ofac_consolidated_screen against the live SDN and consolidated sanctions lists.

How does the compliance crew track regulatory change across 15+ jurisdictions?

RegulatoryAffairs monitors EUR-Lex, the FCA Handbook, MAS consultation papers, and SEC/CFTC enforcement dockets with a 90-day alert threshold, backed by direct primary-source lookups instead of secondary summaries.

Does the legal crew produce audit-ready documentation for a regulatory exam?

Yes. ComplianceMonitor tests every control at least quarterly using a walkthrough-plus-sample-testing methodology and maintains a control register with status, last-tested date, and effectiveness score.

What jurisdictions does the AML and KYC framework cover?

KYCLead's enhanced due diligence tier explicitly flags Russia, Iran, North Korea, Belarus, Myanmar, Afghanistan, and any FATF grey-listed jurisdiction, screened against OFAC SDN, UN Consolidated, EU Consolidated, and HMT UK lists.

Build legal & compliance teams pipelines on Melaya.

Sandbox tier is free with no card. Join the waitlist and we will email you the moment a slot opens.

← Back to every use case
Join the community
// Cookies
Melaya uses a small set of first-party cookies that are strictly necessary to authenticate you, maintain your session, and protect the platform from abuse. We do not use advertising cookies, cross-site trackers, or third-party analytics by default. The full cookie list is in our Privacy Policy.