One of the major challenges for businesses today is to ensure that their processes are regulatory compliant. This implies that business processes must be appropriately constrained for their correct and legal operation. To evaluate such constraints, evidence of the implementation of the business process execution is needed. In a SOA, a business process is commonly realised as an orchestration of services. It is therefore necessary to observe the runtime behaviour of these services. In this paper we propose a common evidence model, which allows constraints to be modelled upon service behaviour and mapped to the available evidence. We propose an architecture to provide the runtime monitoring needed to evaluate the constraints based on this model.