Broker-first registry — open a broker to see their agents with split, banking and freeze. Codes are hierarchical (broker = 3 letters, agents {CODE}1, {CODE}2…). Every change is server-authorised and audited; the commission engine and bank file are untouched.

Grant or revoke staff access. The owner account is protected; you cannot change your own roles.

Pick an arrears bucket and draw the non-payment file. Drawing produces the CSV/Excel and records each policy as “drawn & sent”. The system never sends the SMS — you send the file through your own SMS provider.

Every member moved from employer payroll to the Voluntary group, and where each one is in the switch: Awaiting banking → Mandate signed → Debit order active. Tracking only — no grace: each policy's lapse clock runs exactly as for the rest of the book.

Export the whole book of record as a faithful POL360-shape file (one row per life — main member, every dependent/extended life, and the nominated beneficiary). This is the highest-PII export in the system: admin/ops-manager only, every export is a single logged disclosure event, and the file is delivered by a short-lived link to a private store that auto-deletes within 24 hours. Banking is not included.

Pending senior maker-checker change requests for high-risk fields (inception, agent/employer, identity, beneficiary, clawback waiver). You are the second pair of eyes — you cannot approve a request you raised, and the database enforces it. Every decision is recorded in the hash-chained audit log.

Live billing vs payments across all employers — Billed (drawn), Received (matched), Outstanding and Collection %. This view maintains itself from the engines; manual/cash receipts are shown separately. Click an employer to see its non-payers and underpayers.

Only the payment lines that need a person — ambiguous, overpayment, underpayment and unmatched. Everything that auto-matched cleanly is hidden. Assign the correct policy, accept the engine's recommendation, or dismiss the line. Every action is audited; a resolved line drops off the list.

Run the engines: draw billing, import payments, record a manual receipt, and run commission. Every run is authorised on the server and written to the audit log. The engines never move money — they produce, match and record; a human executes payment.

Who each employer's monthly deduction file goes to, and whether it sends by hand (MANUAL) or on a schedule (AUTOMATIC). The same per-employer run day drives the draw, the inception lock and the send — one event. Opt-in: every employer starts MANUAL until switched on. The system never moves money — it emails the deduction request file; the employer deducts.

Who each broker's weekly commission statement goes to, and whether it sends by hand (MANUAL) or on a schedule (AUTOMATIC). Recipients resolve from the broker registry email unless overridden here. The branded statement PDF is attached. Opt-in: every broker starts MANUAL. External recipients are prepared while SES is in sandbox; in-domain recipients send now.

The master roster of every employer. Each Employer Card holds the employer's details, canonical code, payroll format, billing-delivery config, and signed agreement. Edit and onboarding are admin/ops-manager; finance is view-only. Every change is server-authorised and audited. The system never moves money.

Lodge, adjudicate and pay funeral claims. The payee, the waiting-period gate, the external (DHA/ICB/AVS) checks, the death-certificate authenticity engine, the four-eyes payout and the owner escalation are all server-enforced. The engine never auto-pays — the payment file is produced for a human to execute.