Complex Business Rule? – custom validation

I’ve gotten a request to prove out the integration of the BizTalk’s Business Rule Composer for end users mated with a WCF web service that performs a validation. 

Now I’m pretty sure I can serve up an orchestration as a WCF web service, and I’m pretty sure I can get the orchestratoin to consume a policy with the rule in place.  However, I’m not sure how to create the rule I need in the BRC.

This isn’t a simple “If PO amount > 5000 then discount = 10%” type of rule, it’s a validation of a checksum digit.  It’s not something I think I can use a RegEx for either. 

Example:  Business rule is that the check sum digit of a CUSIP number must be valid.  

(Granted that pure validation would probably need to occur in the orchestratoin itself but this is only to prove out that we can push business rules through a service.) 

How do I encapsulate the function in a way that’s meaningful for the end user.  I.E. the proof in the pudding is showing that business users can update the rules of a policy without having to code. 

Would I need to create a .net assembly class that performs the validation?   Does doing that invalidate the proof in the sense that the “real” validation occurs in the .net assembly and not the business rule itself.

Am I over thinking this?  Should I just tell them that the application should use WF or utilize just the BRE itself, etc.

Thanks for any guidance you can provide. 

Neil