Project CentWin — Internal Brief

01 Company Overview

CompanyProject CentWin — crypto / digital assets compliance firm

LocationGibraltar (GFSC regulated) · incorporated in Portugal

Company size❓ TBD — larger than 7 (verify directly)

Team affected7 people (6 active daily) — compliance/ops only

Entry pathReferral — Nicola Morfini

Key contactsMariana Costa (ops lead) · Charalampos Lazoglou · Veronika Gmiterko · Nicola Morfini

Decision processLegal officer + directors — board approval required

RegulatoryGibraltar Financial Services Commission (GFSC) · GDPR + Gibraltar DPA 2004

Temperature🟡 Warm — real pain, process buyer, no budget signal yet

ICP fitNot ICP — financial services hard fail. Custom build engagement.

02 Project Scope Updated Jun 9

What we are building: Two things. First, a background automation layer connecting 6 tools — Sumsub, Google Sheets, Elliptic, Asana, Fireblocks, Google Drive. When something changes in one system, the others update automatically. The team stays in the same tools they use today. Second, a unified read-only dashboard where any compliance team member can search for a counterparty and see their full picture across all systems in one place — either as current status per system (Option A: cards) or full chronological history (Option B: timeline). Dashboard format is pending Mariana's answer to Q1.

Architecture constraint — stateless mandatory: GDPR data minimization + explicit client requirement. Our system reads and routes but never persists client data outside the existing 6 systems. 5-year audit log retention applies to any logs our system generates. GDPR Art. 28 DPA required before build starts.

⚠️ "80-90% of onboarding time" was disputed by the client. Use "5+ hours/day" only in all external materials.

Tool stack — API status (all confirmed Jun 9)

Tool	Role	API Status
Sumsub	Client data + KYC repository	✅ Confirmed — plan tier includes API at no extra charge. Web SDK, Mobile SDK, API all available.
Asana	Task tracking	✅ Confirmed
Google Sheets	Risk assessment (stays in Sheets — stateless)	✅ Confirmed — Sheets API v4, service account supported
Elliptic	Transaction monitoring alerts	🟡 Public API confirmed — whitelist endpoint coverage under their enterprise contract TBC
Fireblocks	Trade / transaction registration	✅ Confirmed
Google Drive	Document storage + client folders	✅ Confirmed — Drive API v3, service account supported
Slack	Internal team discussions + comms	🟡 Confirmed in use — API access assumed yes, pending verification. Scope pending Q2.

Automation workflows (1–6)

① Client onboarding data flow (Sumsub → Sheets → Elliptic → Drive)

Questionnaire responses auto-populate Sheets risk model. Wallet addresses auto-register in Elliptic. Documents auto-filed to correct Drive folder. Eliminates manual copy-paste across 4 systems.

High potential

② Asana task state management

Sumsub status changes auto-advance Asana tasks and assignments. Weekly status posts auto-generated across all ~40 projects.

High potential

③ Client follow-up reminders

Daily job checks all active cases. Automated email when documents are pending. Eliminates daily manual monitoring per client.

High potential

④ Elliptic smart filter / alert deduplication

Middleware between Fireblocks and Elliptic. Whitelist key = (client_id, wallet_address) tuple — compliance team only. Each wallet reviewed independently. Suppresses duplicate alerts for already-cleared exposures.

High potential

⑤ Periodic client review auto-creation

Risk rating + date in Sheets triggers automatic Asana project creation at scheduled review date (1–3 year cycle).

Medium potential

⑥ Google Drive auto-filing

Reports and documents automatically filed to the correct client folder in Drive when workflow milestones are reached.

Medium potential

Unified view + Slack (7–8) — format pending Mariana answers

⑦ Counterparty knowledge trail (unified read-only dashboard)

Web dashboard: search a counterparty, see all data across Sumsub + Sheets + Elliptic + Asana + Drive + Slack in one view. Stateless — reads live, never stores client data. Two format options pending Q1: Option A (cards — current status per system) or Option B (timeline — full chronological history). Option B matches Mariana's description exactly but is a larger build.

High potential · Most complex piece ⏳ Format pending Q1

⑧ Slack integration

Internal team discussion data surfaced in the counterparty dashboard. Scope pending Q2: outbound notifications only (system pushes alerts to Slack) or interactive (team approves or actions directly from Slack). Channel structure also pending.

Medium potential ⏳ Scope pending Q2

Out of scope — v1

Write access / case manager

No write actions in v1 — creating Asana tasks, adding notes, triggering Sumsub requests. Dashboard is read-only. Natural Phase 2 conversation after delivery.

Out of scope v1

Changes to Elliptic or Sumsub configuration

We integrate via their APIs — we do not modify how they use those tools directly.

Out of scope v1

03 Confirmed Pains

Only what was explicitly said on the call. Nothing inferred.

Same client data entered manually into 4–5 systems after every Sumsub questionnaire submission"A nossa ideia era que a partir do momento em que essa informação existe num sistema, pudesse ser atualizada noutros" — Ops Lead
No central view of onboarding status — team opens 4–5 tools to check one client"Idealmente algo acima de todos estes sistemas que fosse case manager" — Ops Lead
Duplicate Elliptic alerts for exposures already reviewed and cleared (e.g. Russia)"Nós não conseguimos fazer o whitelist dessa exposição que já identificamos" — Ops Lead
Weekly status reports across ~40 Asana projects written manually, one by one"Temos que vir aqui e fazer os posts dos estados — demora-nos muito tempo" — Ops Lead
Periodic client review dates set in Sheets but Asana projects created by hand, months later"Temos que manualmente verificar e criar projeto no Asana para revermos o cliente" — Ops Lead
5+ hours/day manual labor across the 7-person team (⚠️ "80-90% of onboarding time" disputed — use hours only)"Em todas as tarefas manuais no geral, sim nós passamos se calhar cinco horas por dia" — Ops Lead
No internal dev capacity — explicitly stated as a hard requirement for any solution"Não tínhamos essa capacidade de ter alguém que pudesse fazer essa continuidade" — Ops Lead

04 Build Cost Updated Jun 9

Three scenarios — which one we quote depends on Mariana's answers to Q0, Q1, Q2. COGS and price shown side by side for all three.

Pricing assumptions

Dev rate€50/hr · AI-assisted (Claude Code + Codex)

Dev modelNot full-time — 20–30 hrs/week over 10–16 weeks depending on scenario

Tooling~€400/mo (Claude Code Max + API overflow + infra)

Partner timeIn margin — not in COGS. Giuseppe + Raffaello: architecture, client calls, reviews.

Target gross margin40% · Formula: Price = COGS ÷ 0.60

Three scenarios

	Scenario A Automation only	Scenario B Cards dashboard	Scenario C Timeline + Slack
What's included	Workflows 1–6 only. No dashboard.	Workflows 1–6 + cards view (Option A dashboard). Slack excluded.	Workflows 1–8. Timeline view (Option B). Slack integrated.
Depends on	Client declines dashboard	Q1 = Option A (cards)	Q1 = Option B (timeline) + Q2 = Slack included
Dev hours	200 hrs	300 hrs	400 hrs
Pace / calendar	20 hrs/wk · ~10 wks	20–25 hrs/wk · ~12–14 wks	25–30 hrs/wk · ~14–16 wks
Dev cost	€10,000	€15,000	€20,000
Tooling	€800	€1,200	€1,600
COGS	€10,800	€16,200	€21,600
Price (40% margin)	€18,000	€27,000	€36,000
Gross margin €	€7,200	€10,800	€14,400

Partner time (Giuseppe + Raffaello) is absorbed into the 40% margin — not in COGS. This is the consulting premium on top of pure dev cost. Scenario B is the recommended default — delivers the unified view they described, at a digestible price, without overbuilding for a first engagement.

Unknown that could move hours

Elliptic whitelist endpoint: Public API confirmed but whitelist suppression endpoint coverage under their enterprise contract needs verification. If unavailable, the smart filter (Workflow 4) requires a workaround — adds ~10–15h. Low probability but flag before M1 kickoff.

05 Pricing Updated Jun 9

Implementation fee — 4 equal milestones

Equal 25% tranches tied to delivery triggers. Monthly subscription starts 30 days after M4 go-live sign-off.

Milestone	Trigger	A (€18K)	B (€27K)	C (€36K)
M1	Contract signed + GDPR Art. 28 DPA executed	€4,500	€6,750	€9,000
M2	Month 1 review — first workflows in staging	€4,500	€6,750	€9,000
M3	Month 2 review — core automation complete	€4,500	€6,750	€9,000
M4	Go-live sign-off — full system in production	€4,500	€6,750	€9,000
Total implementation fee		€18,000	€27,000	€36,000

Monthly subscription (from M4 + 30 days)

Dev support (~8 hrs/mo)€400/mo

Tooling (Claude API + infra + Slack API)€300/mo

COGS€700/mo

Price (42% margin)€1,200/mo

Y1 economics — Scenario B (recommended)

Implementation fee (4 milestones)	€27,000
Monthly subscription · est. 6 months from M4 (conservative)	€7,200
Y1 total revenue	€34,200
Y1 COGS (build €16,200 + 6mo support €4,200)	€20,400
Y1 gross profit	€13,800 (40%)

Client hidden cost: ~€40K/yr (5+ hrs/day manual work across 7-person team). At €1,200/mo subscription = €14,400/yr, client ROI is roughly 2.8x. Monthly fee only starts when the system is live — they see direct value before paying recurring.

06 Replicability

Module registry matchNone — custom build, outside all current modules

Pipeline demand0 clients — financial services not in ICP

Architectural reusePartial — stateless aggregation patterns reusable in future builds

VerdictZero replicability. Price to full recovery.

Note for Raffaello: Outside ICP. Taking it because (1) the pain is real and well-scoped, (2) Nicola referral opens a warm channel into crypto compliance, (3) build cost is low with AI-assisted dev and 40% margin is achievable. Not a strategic pivot — a one-off. If a second compliance client appears, revisit building a module.

07 Deal Dynamics

Risks

Board approval process — 2–3 week delay between proposal and sign. Once Mariana answers Q0–Q2, proposal should go out within 48h.

No budget signal — they have approved this type of spend before but we have no anchor. Proposal is the first data point for the board.

Slack data compliance (Q5) — if Mariana's legal team rules Slack messages cannot be surfaced in the dashboard, Slack integration scope shrinks to outbound-only. Reduces Scenario C to effectively a Scenario B+ at a lower price.

Zero replicability — if build runs long, margin compresses. Scope must stay tight in v1. No feature creep. Phase 2 conversation handles case manager and write access.

Strong referral from Nicola — warm entry, trust already established. Not a cold outreach close.

They have bought software this way before — board process is known to them. No education required on how to run the approval.

Data compliance reviewed. AML policy + GDPR privacy policy both read (Jun 2026). GDPR Art. 28 DPA required in contract before work starts — note this at M1 trigger. Stateless architecture confirmed correct by their own privacy policy.

Why now

Team grew from 2 to 7 recently. Processes were never scaled. Only now that the ops team is large enough do they have the bandwidth to fix what they have been tolerating. Classic "now we have people to define processes" trigger.

08 Questions Sent to Mariana Sent Jun 9

7 questions sent Jun 9. Answers pending. Q0, Q1, Q2 are pricing-critical — they determine which scenario to quote. Q3–Q6 affect scope complexity but not the base price.

#	Question (sent to Mariana)	Pricing / scope impact	Blocking?
Q0	Workflow design — do you want us to design the logic (triggers, decision rules, information flow), or do you have them defined and need implementation only?	Design phase adds €3–5K and 2–4 weeks to any scenario	Yes — price
Q1	Dashboard type — Option A (cards: current status per system) or Option B (timeline: full chronological history)? ASCII wireframes of both included in message.	Option A = Scenario B (€27K). Option B = Scenario C (€36K). €9K delta.	Yes — price
Q2	Slack — (a) one dedicated channel per counterparty or keyword search across shared channels? (b) outbound notifications only, or does the team need to approve/action from Slack?	Outbound only = included in Scenario C as-is. Interactive (two-way) = +€5–8K on top of Scenario C.	Yes — price
Q3	Auth — do you use Google Workspace? If yes, Google SSO replaces building a login system entirely.	Google SSO saves ~1 week dev if yes	No — scope only
Q4	Audit log — 5-year retention: exportable from our system on demand (CSV/JSON), or sufficient to log to your own infrastructure?	Export capability adds ~1 week backend work	No — scope only
Q5	Slack data in dashboard — your privacy policy lists Slack as a personal data channel. Does your compliance team have sign-off to surface Slack messages in the dashboard under data minimisation obligations?	No sign-off = Slack excluded from the dashboard view. Reduces Scenario C scope.	Yes — scope
Q6	Access roles — how many distinct tiers? (e.g. compliance team sees everything including Elliptic whitelist, ops sees onboarding only, management sees read-only summaries)	Each additional role tier adds RBAC scope to the build	No — scope only

09 Decisions Needed from Raffaello Updated Jun 9

Once Mariana answers Q0–Q2, these are the decisions needed before the proposal goes out. Please reply with yes/no or your pick on each.

Which scenario do we lead with?

Recommendation: Scenario B (cards dashboard, €27K impl + €1,200/mo). Delivers the unified view they described, digestible price, fastest to close. Scenario C (timeline + Slack, €36K) matches Mariana's description exactly but is a bigger first ask — suggest positioning it as the upgrade option in the same proposal. Scenario A (€18K, no dashboard) is a fallback only if they resist the dashboard scope.

Pricing OK? (4 equal milestones + €1,200/mo from go-live + 30 days)

Scenario A: 4 × €4,500 = €18K impl. Scenario B: 4 × €6,750 = €27K impl. Scenario C: 4 × €9,000 = €36K impl. All at 40% gross margin. COGS visible in Section 4. Monthly €1,200/mo applies to all scenarios. Y1 gross profit on Scenario B: €13,800.

Are you on delivery or do I source the dev?

Scoped at 200–400 hours depending on scenario, at 20–30 hrs/week over 10–16 weeks. Not full-time. AI-assisted dev (Claude Code + Codex) reduces calendar time by roughly 40% vs traditional. Dev rate locked at €50/hr in the model above.

Any concern on taking a non-ICP client?

Financial services is a hard ICP fail. Proceeding because: (1) Nicola referral, (2) clear and well-documented pain, (3) scoped + priced correctly with 40% margin, (4) AI-assisted build keeps our risk low. One-off engagement — not a vertical pivot. Flag if you see a risk I am missing.