The Islamic Open Finance™ ecosystem.

Every surface, package, service, worker, and regulatory regime that makes up IOF + Open Banking Protocol — colour-coded by layer so you can navigate from foundation to presentation in one page. Cards link to live URLs where they exist.
86
Total entities
27
Frontend apps
10
Backend + edge
17
Domain engines
13
Regulatory regimes

Layer legend

L0
Foundation
Schemas, taxonomy, audit, and shared types — the bedrock every other layer compiles against.
L1
Domain Engines
Ten purpose-built engines that implement the core Shariah-native primitives — contracts, ledger, payments, evidence.
L2
Infrastructure
Cross-cutting platform services — auth, observability, secrets, search, structured logging.
L3
Integration
Tenancy, billing, webhooks, OBP connectors — the tissue that binds engines to applications.
L4
Application
The deployed services and edge workers — rail-api, ledger-service, analytics-api, OBP gateway.
L5
Presentation
User-facing apps — landing, portals, demos, docs, developer surface, ecosystem map.
L0

Foundation

Schemas, taxonomy, audit, and shared types — the bedrock every other layer compiles against.

19 entities
L0Shariah
@iof/contracts-core
Foundation package

Typed contract primitives — every Islamic-finance contract.

AAOIFI
L0
@iof/taxonomy-core
Foundation package

89 rails, 19 categories, MCC mapping, regime taxonomy.

L0
@iof/iso20022-core
Foundation package

ISO 20022 schemas — pain.001, pacs.008, pacs.002, camt.054.

ISO 20022
L0
@iof/audit-core
Foundation package

Append-only audit log — SHA-256 chained, regulator-ready.

SOC2
L0
@iof/db-core
Foundation package

Typed Prisma SSOT — every domain table, migrated forward-only.

L0
@iof/rules-engine-core
Foundation package

Versioned rule evaluation primitives.

L0Shariah
AAOIFI
Regulatory regime

66 Shariah Standards — every Islamic-finance contract type.

L0Shariah
IFSB
Regulatory regime

Prudential standards for Islamic financial services.

L0
SOC 2 Type II
Regulatory regime

Security, availability, processing integrity, privacy.

L0
GDPR
Regulatory regime

EU data protection — minimisation, consent, erasure, portability.

L0
PSD2
Regulatory regime

SCA, secure communication, third-party access.

L0
PSD3 / PSR
Regulatory regime

Open Finance access, enhanced SCA, IBAN-name match, instant-payment fraud framework.

L0
ISO 27001
Regulatory regime

Information security management system.

L0
ISO 20022
Regulatory regime

Financial messaging — XML and JSON.

L0
Basel III
Regulatory regime

Capital adequacy, liquidity, leverage.

L0
EU AI Act
Regulatory regime

Risk-classified AI system governance.

L0
FATF
Regulatory regime

AML / CFT recommendations.

L0
MiCA
Regulatory regime

EU markets in crypto-assets framework.

L0
DORA
Regulatory regime

Digital operational resilience for financial entities.

L1

Domain Engines

Ten purpose-built engines that implement the core Shariah-native primitives — contracts, ledger, payments, evidence.

17 entities
L1Shariah
Contract Engine
Domain engine

AAOIFI-native contract lifecycle — 66 typed schemas with SS-8 to SS-39 enforcement.

AAOIFI
L1Shariah
Ledger Engine
Domain engine

Real-time double-entry — atomic multi-account transfers, immutable history.

L1
Payments Engine
Domain engine

SEPA Instant + SWIFT + RTGS routing with ISO 20022 native messages.

ISO 20022PSD2PSD3
L1
Messaging Engine
Domain engine

Format-agnostic — ISO 20022 XML/JSON, SWIFT MT, proprietary, all SHA-256 anchored.

ISO 20022SWIFT
L1Shariah
Compliance Engine
Domain engine

ABAC + evidence pipeline — 258 policies across 13 regulatory regimes.

AAOIFIIFSBSOC2GDPRPSD2ISO 27001Basel IIIEU AI ActFATFMiCADORA
L1Shariah
Evidence Engine
Domain engine

Tamper-evident audit packs per transaction — Merkle anchored, 7-year retention.

L1
Onboarding Engine
Domain engine

KYC / KYB / AML / sanctions screening — FATCA, CRS, UBO.

FATF
L1Shariah
Treasury Engine
Domain engine

Liquidity, FX, investing, profit-distribution rails.

L1
Rules Engine
Domain engine

Deterministic evaluator — versioned policies, structured outputs.

L1Shariah
Settlement Engine
Domain engine

Multi-asset DvP/PvP with finality semantics and atomic settlement.

L1Shariah
Resilience, Recovery & Exception Engine
Domain engine

Banking-grade operational resilience — split-leg failure, partial settlement, timeout, suspense holdings, compensation, record hierarchy, dispute evidence, supervisory exports. IOF + OBF dual-overlay (Shariah-attested neutrality + conventional reversal).

AAOIFIIFSBDORABCBS
L1
Risk Engine
Domain engine

VaR + scenario analysis + stress testing + per-counterparty + per-product limits. Bound to Basel III + IFSB-15.

Basel IIIIFSB-15
L1
Party Master Engine
Domain engine

Single canonical view of every party: legal entities, beneficial owners, related parties, mandates, LEI/IDs/KYC, role-in-product/role-in-case.

FATFGDPR
L1
Mandates & Authority Engine
Domain engine

Open-finance consents, signatory schemes (single/joint/N-eyes), maker-checker, board / Shariah-board approvals, RM-assisted actions, custodian instructions.

PSD2PSD3
L1
FinCrime Screening Engine
Domain engine

Workflow surface for sanctions / PEP / adverse-media alert lifecycle, decision trail, evidence export, override approvals, false-positive resolution.

FATF
L1
Certification & Conformance Engine
Domain engine

Connector certification, participant conformance, sandbox-test grading, scheme-version compatibility, expiry/renewal/suspension lifecycle.

L1
Market Data Engine
Domain engine

Controlled feed of rates, FX prices, benchmarks, calendars, holidays, instrument reference, valuation inputs, market conventions. Distinct from internal taxonomy.

ISO 20022
L2

Infrastructure

Cross-cutting platform services — auth, observability, secrets, search, structured logging.

6 entities
L2
@iof/auth-core
Infrastructure package

Clerk + JWT + tenant resolution + Cerbos client.

L2Shariah
@iof/ledger-core
Infrastructure package

Double-entry primitives — strict invariants, deterministic transfers.

L2
@iof/event-envelope
Infrastructure package

Typed event bus — webhook delivery, dead-letter, replay.

L2
@iof/search-core
Infrastructure package

Full-text + semantic search abstraction.

L2
@iof/secrets-core
Infrastructure package

Vault-agnostic secret access — AWS SSM + Cloudflare Workers KV.

L2
@iof/observability-core
Infrastructure package

Structured logger, OpenTelemetry traces, Sentry/Axiom export.

L3

Integration

Tenancy, billing, webhooks, OBP connectors — the tissue that binds engines to applications.

7 entities
L3
@iof/service-core
Integration package

Hono middleware — rate-limit, auth, logging, tracing.

L3
@iof/billing-core
Integration package

Stripe metering, subscriptions, invoicing.

PCI DSS
L3
@iof/webhook-core
Integration package

Inbound + outbound webhook signing, replay, idempotency.

L3
@iof/tenant-core
Integration package

Tenant scoping, isolation, BYOC bootstrap.

L3
@iof/workspace-core
Integration package

Multi-workspace inside a tenant — role + member management.

L3
@iof/obp-client
Integration package

Phase-1 sandbox & Phase-2 production OBP connector (PSD2 + Berlin Group).

PSD2PSD3
L3
@iof/compliance-monitor
Integration package

Continuous compliance posture monitoring with alert pipeline.

SOC2ISO 27001
L4

Application

The deployed services and edge workers — rail-api, ledger-service, analytics-api, OBP gateway.

10 entities
L4Shariah
rail-api
Backend service · Data plane

The 109-rail Shariah-native API — 150 routes, OpenAPI 3.1, MCP-exposed.

AAOIFIIFSBISO 20022
L4Shariah
ledger-service
Backend service · Data plane

Real-time double-entry ledger — atomic N-leg transfers, evidence-pack export.

L4
analytics-api
Backend service · Data plane

Analytical OLAP surface — 19 categories, per-rail metrics.

L4Shariah
finops-api
Backend service · Data plane

Treasury, FX, liquidity, profit distribution, RTGS bridge.

L4
obp-gateway
Backend service · Connector

Open Banking Protocol bridge — phased path to Tier-1 core integration.

PSD2PSD3
L4Shariah
document-renderer
Backend service · Data plane

Contract templates, regulator-shaped reports, evidence-pack PDFs.

L4
messaging-service
Backend service · Connector

ISO 20022 XML/JSON, SWIFT MT, queue and HTTP delivery adapters.

ISO 20022
L4
edge-router
Edge worker · Edge

Tenant resolution, auth pre-check, rate-limit, geo-routing.

L4Shariah
mcp-gateway
Edge worker · Edge

Model Context Protocol surface — 89 rails as typed MCP tools.

L4
edge-auth
Edge worker · Edge

Embedded Cerbos PDP — sub-millisecond ABAC at the edge.

CerbosABAC
L5

Presentation

User-facing apps — landing, portals, demos, docs, developer surface, ecosystem map.

27 entities
L5
Landing
Frontend app · Customer-facing

Public marketing site — product, solutions, pricing, FAQ.

L5Shariah
Admin Portal
Frontend app · Operator

Operator console — supervision, conformance, incidents, tenants.

SOC2ISO 27001
L5Shariah
Customer Dashboard
Frontend app · Customer

Tenant self-service — contracts, ledger, treasury, compliance.

GDPRPSD2PSD3
L5
Billing Dashboard
Frontend app · Customer

Plan, usage metering, invoices, and payment methods (Stripe-backed).

PCI DSS
L5Shariah
Compliance Explorer
Frontend app · Compliance

Browse 13 regulatory regimes, 258 ABAC policies, and evidence packs.

AAOIFIIFSBSOC2GDPRPSD2PSD3ISO 27001
L5
API Explorer
Frontend app · Developer

Try every one of the 150 endpoints with live, signed requests.

L5
Developer Portal
Frontend app · Developer

API keys, SDKs, code examples, MCP server, OpenAPI specs.

L5
Sandbox
Frontend app · Developer

Provisioning UI for isolated test tenants with synthetic data.

L5
Webhook Explorer
Frontend app · Developer

Inspect, replay, and validate event-envelope webhook deliveries.

L5
Code Engine
Frontend app · Developer

Code-generation surface for SDK + widget scaffolding.

L5
Docs
Frontend app · Docs

Astro Starlight docs — guides, references, cookbooks.

L5
Wiki
Frontend app · Docs

Long-form architecture and concept reference.

L5Shariah
Glossary
Frontend app · Docs

Islamic-finance and platform terminology — AAOIFI-aligned.

AAOIFI
L5
Why IOF
Frontend app · Marketing

Comparison vs. legacy core-banking and conventional Islamic stacks.

L5
Pitch Deck
Frontend app · Marketing

Investor and partnership pitch surface.

L5
Partnership
Frontend app · Marketing

Channel, integrator, and design-partner programmes.

L5Shariah
Trust
Frontend app · Compliance

Compliance attestations, certifications, and security posture.

SOC2ISO 27001GDPRPSD2AAOIFIIFSBBasel IIIEU AI ActFATFMiCADORAISO 20022
L5
Join
Frontend app · Marketing

Careers and design-partner application surface.

L5Shariah
Agents Catalog
Frontend app · Specialty

Catalog of compliant copilots — Asset Integrity, Sukuk Lifecycle, Takaful.

EU AI Act
L5
EU AI Act Suite
Frontend app · Compliance

Article 49 registry, FRIA/DPIA, oversight logs, conformity packs.

EU AI ActGDPR
L5
Status Page
Frontend app · Operator

Real-time service health, uptime, and incident timeline.

L5
Widgets
Frontend app · Developer

Embeddable widgets for third-party platforms.

L5Shariah
Demo · Bank
Demo surface · Demo

Al-Amanah Islamic Bank — Murabaha, Ijarah, Sukuk, corporate banking.

L5Shariah
Demo · Fintech
Demo surface · Demo

HalalPay — wallet, halal BNPL, embedded payments.

L5Shariah
Demo · Microfinance
Demo surface · Demo

Mizan Microfinance — Qard Hasan, group lending, Waqf, Zakat.

L5Shariah
Demo · Takaful
Demo surface · Demo

Salaam Takaful — family, general, claims, surplus.

L5Shariah
Demo · Embedded
Demo surface · Demo

Aman Embedded Finance — white-label accounts, cards, lending.

© 2026 Islamic Open Finance™ · single-page ecosystem map · auto-generated from apps/landing/lib/ecosystem-data.ts