Spring Labs buys Winnow to map 100,000 attorney-kept requirements onto bank workflows

Sun put the product's job in one sentence. "Every bank compliance program comes down to one question: are we doing what the rules require, and can we prove it?" he said in the release ^[8]. SpringGRC answers it with two layers of data. The first is Winnow's library of more than 100,000 requirements ^[1], kept current by attorneys and other professionals ^[13]. Every customer reads the same records. The second layer belongs to each bank: its policies and procedures, controls, testing and case management, each piece traceable to the law or regulation it addresses ^[5].

Traceable describes the schema. A control that cites the wrong regulation is still, technically, traceable. RuntimeWire, reporting the deal from the October 7 PR Newswire release ^[2], wrote that SpringGRC's promise will be tested by whether those links stay correct as rules and customers' own processes change ^[14].

Winnow already handles the first step of a rule change. Chris Hilliard, its co-founder and president and a certified regulatory compliance manager ^[9], said customers rely on it to track the rules that apply to them and flag changes before they take effect ^[10]. SpringGRC adds a second step. It uses the library to identify workflows that may be affected and helps compliance teams keep them current ^[7]. Both ends of every link can move ^[14]. The library side changes when the law does. The bank side changes when someone rewrites a procedure or retires a control, and a link goes stale when one end moves without the other.

The acquisition is a buy decision on the first layer. RuntimeWire wrote that it lets Spring Labs build on material already organized for the market instead of starting a library from scratch ^[15]. Keeping Orrick on content updates and quality assurance is the right call, in my view ^[11]. The lawyers who interpret a rule stay attached to the record that states it. The release does not say who verifies the second layer, the links into one bank's controls ^[16]. On its wording, the software proposes affected workflows and the bank's compliance team confirms them ^[7].

Owning the content settles the shared layer. One law firm's review covers every customer's copy of a requirement ^[11]. The per-bank links grow with each control set Spring Labs signs up, and that work starts over at every bank.