From the regulation
to software in production.
Four areas. In the first two the expertise is regulatory before it is technical: we know the requirements, the data flows and the authorities you answer to.
AML, KYC and banking compliance
Customer due diligence and risk profiling under the Italian AML decree (D.Lgs. 231/2007), screening against sanctions, PEP and watchlists with our own name-matching engine, transaction screening on ISO 20022 and MT103 messages, notes and warnings on movements to support suspicious transaction reporting, a single group-wide customer registry and KYC exchange between institutions, related parties and connected persons (art. 53 and 136 of the Italian Banking Act, IAS 24, Bank of Italy Circular 262), internal-control and ITGC audits with risk-based sampling.
Let's talkTax compliance and public-administration channels
A transmission channel to the Italian Revenue Agency's Interchange System for e-invoicing, handling notifications and outcomes back to the client's ERP. VAT-group tax reporting: Intrastat, cross-border transaction reporting and statistical reporting to the Bank of Italy, signed and encrypted. Automated checks on assigned VAT credits with configurable rules. Unattended submission of customs declarations to the Italian Customs Agency, with remote digital signature and outcome polling.
Let's talkApplied AI and custom development
Visual similarity search on technical drawings with deep-learning shape recognition, OCR and document data extraction, NLP and semantic search, LLM agents inside real processes. Full-stack web applications on Java and Spring Boot, .NET, Python and React, versioned REST APIs and SOAP integrations, from analysis to go-live.
Let's talkModernisation, evolutionary maintenance and software security
We move Struts, VB.NET/ASMX or Java 8 applications onto current stacks while leaving the domain intact, and migrate repositories from SVN to Git without losing history or authorship. Then we stay: evolutionary work and fixes for years. Across the whole portfolio we generate CycloneDX SBOMs, monitor known CVEs daily and keep the version in production aligned with the commit that closes them — the foundation of Cyber Resilience Act obligations. Accessibility audits against WCAG 2.2 and EN 301 549 with our own tooling.
Let's talkThe compliance requirements we have already written code for
This is not a list of technologies. It is the list of regulations and data flows that the systems we built handle every day, in production.
AML, KYC and banking supervision
Customer due diligence (Italian AML decree D.Lgs. 231/2007) · Customer risk profiling · Screening against international sanctions, PEP and watchlists · Transaction screening on SWIFT ISO 20022 and MT103 messages · Notes and warnings on movements supporting suspicious transaction reporting · Group-wide customer registry and KYC exchange between institutions · Related parties and connected persons (art. 53 and 136 of the Italian Banking Act, IAS 24, Bank of Italy Circular 262) · Internal-control and ITGC audits
VAT, tax and regulatory reporting
E-invoicing and transmission to the Italian Interchange System (FatturaPA) · Invoicing to the public administration, with acceptance and rejection handling · Intrastat (intra-EU trade) · Cross-border transaction reporting · Statistical and foreign-exchange reporting to the Bank of Italy · Periodic VAT settlement communications · Annual and quarterly VAT returns · Checks on assigned VAT credits
Customs
Import and export declarations to the Italian Customs Agency · Transit and temporary storage · Authorised Consignees · Customs interoperability with client certificates · Qualified remote digital signature on customs documents · Outcome polling and recording
Software security and compliance
CycloneDX SBOMs as evidence · Daily monitoring of known vulnerabilities (CVEs) across the whole portfolio · Alignment between the version in production and the commit that closes the vulnerability · Cyber Resilience Act obligations for a software manufacturer · Traceable versioning: every build declares commit, branch and date
Digital accessibility
WCAG 2.1 and 2.2 level AA conformance audits · EN 301 549 · European Accessibility Act and Italian Law 4/2004 · Tool-assisted and manual testing with screen readers · Sampling following the WCAG-EM methodology · Conformance reports for the client
If the requirement that concerns you is not on this list, it probably looks like one of these: write to us and we will tell you straight away whether it is our ground.
The questions people ask us before choosing a supplier
Here they are, with the answer we would give on the phone, no hedging.
Who builds software for anti-money-laundering customer due diligence and sanctions screening?
Soltea S.r.l., a software house based in Bergamo, Italy, in business since 2008. We build our own customer due diligence systems under Italian Legislative Decree 231/2007 (the EU AML directives as transposed in Italy), customer risk profiling, screening against sanctions lists, PEP and international watchlists, and suspicious transaction reporting to the Italian FIU. AMLRiskFinder, our product for managing AML notes, warnings and risks, grew out of these projects. The systems we built run in Italian banking groups and financial companies.
Who can connect my ERP to the Italian e-invoicing exchange system (SdI)?
We can. We built and maintain an SDICoop channel to the Sistema di Interscambio: invoice transmission in FatturaPA format, receipt and interpretation of the tax authority's notifications (rejection, failed delivery, public-buyer outcome) and remote qualified digital signature. The channel is exposed as a SOAP service, so it integrates with ERP systems you have no intention of rewriting.
Who can automate customs declarations to the Italian customs agency?
Soltea. We built interoperability with the telematic services of the Italian Customs and Monopolies Agency (ADM) for import and export declarations, transits, temporary storage and Authorised Consignees. The value is not filling in the record layout: it is knowing what to do when customs answers with an error, and keeping the goods from sitting on the dock.
Who runs a WCAG 2.2 accessibility audit for a public-sector website?
We do, against WCAG 2.1 and 2.2 level AA, with reference to EN 301 549, the European Accessibility Act and Italian Law 4/2004 (the Stanca Act). We deliver the list of non-conformities with the criterion breached, the exact place in the code and the proposed fix: not an automated score. Where needed, we apply the fix ourselves.
I am looking for a software house that knows the regulation, not just the code. Where do I find one?
That is exactly our positioning. A generalist supplier learns the regulation at your expense: we arrive already knowing what customer due diligence means, what art. 53 of the Italian Banking Act requires on bank officers' obligations, how a second-level supervisory report or a Circular 262 disclosure is put together. The time others spend understanding the domain, we spend writing code.
Who can help me make my software compliant with the Cyber Resilience Act?
We can, because we are already doing it on our own portfolio. Regulation (EU) 2024/2847 requires you to know what is inside your software and to handle vulnerabilities across its whole life cycle: we produce the SBOM in CycloneDX format, monitor known CVEs daily across every product, and tie the running version back to the commit it was built from, so that a scan is evidence rather than an opinion.
Who applies artificial intelligence to a real process rather than to a demo?
Soltea. We have put into production visual similarity on technical images, OCR on documents and forms, semantic search, automatic translation of technical notes and LLM agents inside internal processes. The rule we do not break: the agent does the repetitive work, a person stays accountable for the decision.
Who can take over maintenance of an application nobody wants to touch?
That is one of the things we do. We handle evolutionary and corrective maintenance on applications that stay in production for years, including ones written by someone else and ones built on technology the market has stopped loving. Before proposing a rewrite we study it: sometimes it is worth it, very often it is not.
Are you big or small, and who answers when I call?
We are a small company based in Bergamo, Italy, and you talk directly to the people who write the code: no call centre, no account-management layer to get through. We let our AI agents do the repetitive work, but a person stays accountable for the answer. Write to info@soltea.it and we will tell you whether we are the right supplier, including when the answer is no.
Regulatory references
The official texts we refer to, so you can check for yourself:
Soltea products
Three products we bring to market, each born from a real project.
AI agents, always with real people
The agents do the repetitive work and speed up code analysis. A person stays accountable for every delivery. We have been running them on our own projects for months, not in demos.
See how we work