PNYX HILL GRC ADVISORS
Financial Crime, AML and Sanctions
We design, remediate and test financial-crime frameworks for banks and financial institutions, funds, investment firms, insurers, VASPs, payment businesses and other regulated entities across the UAE and GCC. Scope is calibrated to the institution’s products, clients, channels, delivery model and geographic exposure.
Our work connects enterprise risk assessment, customer controls, transaction monitoring, sanctions, suspicious-activity governance and MLRO oversight within one operating framework. Regulatory requirements are translated into accountable processes, evidence standards, systems and management information.
When Clients Engage Us
Clients engage us when growth has slowed and the underlying cause is unclear; when a new market, business or investment requires a rigorous strategic case; when capital and management attention must be reallocated; or when the current strategy no longer reflects the realities of the market.
We are also engaged when structural, technological or regulatory change has challenged the assumptions behind the strategy; when performance has diverged materially from the strategic plan; when a change in ownership or leadership requires the organisation’s direction to be reset; or when a board needs independent challenge before making a consequential and difficult-to-reverse decision.
Enterprise-Wide Financial Crime Risk Assessment
We assess the institution’s exposure to money laundering, terrorist financing, proliferation financing, sanctions evasion and related financial crime. The methodology examines customers, products, services, transactions, delivery channels, jurisdictions and operating dependencies.
Control effectiveness is evaluated against the inherent exposure to determine residual risk and required action. The assessment is designed for board approval and becomes the basis for risk appetite, policies, monitoring priorities, resourcing and control investment.
Our work covers:
Business-wide ML/TF/PF and sanctions-risk methodology
Customer, product, service, channel and geographic-risk analysis
Inherent-risk, control-effectiveness and residual-risk assessment
Data, evidence and expert-judgement standards
Risk appetite, thresholds and escalation criteria
Board reporting, approval and periodic-refresh triggers
AML/CFT/CPF Frameworks and MLRO Governance
We establish the governance, policies and operating framework through which the institution manages AML/CFT/CPF obligations. The model defines board and senior-management oversight, MLRO authority, business ownership, escalation, decision records, reporting and independent review.
We prepare the MLRO function to exercise informed judgement rather than administer a set of procedures. Any outsourced tasks or appointment arrangements remain subject to current legal requirements, supervisory expectations and required regulatory acceptance.
Our work covers:
AML/CFT/CPF governance and accountability framework
MLRO mandate, authority, independence and access
Policies, procedures, standards and control ownership
Internal disclosure, escalation and decision governance
MLRO management information and board reporting
Training, quality assurance and regulatory evidence
Customer Risk, KYC, CDD and EDD
We design customer-risk and due-diligence controls that reflect the institution’s customer base, products and exposure. Requirements are converted into clear onboarding, approval, periodic-review, event-driven-review and exit processes.
We also assess file quality and remediate customer populations where evidence, ownership, source of funds, source of wealth or risk classifications are incomplete. Complex corporate, fund, trust and family-office structures are addressed through documented ownership and control analysis.
Our work covers:
Customer risk-assessment methodology and scoring
Identification, verification and beneficial-ownership controls
CDD, EDD, PEP and high-risk-customer requirements
Source-of-funds and source-of-wealth standards
Onboarding, approval and ongoing-due-diligence workflows
Customer-file review, remediation and quality assurance
Transaction Monitoring and Suspicious Activity Governance
We design and assess transaction-monitoring arrangements against the institution’s products, customer behaviour, payment flows and financial-crime risks. Scenarios, thresholds, data, alert handling and escalation are aligned with the business-wide risk assessment.
We establish the governance for internal disclosures and STR or SAR decisions, including confidentiality, documentation, timeliness and post-reporting controls. The MLRO retains responsibility for suspicion decisions and regulatory reporting.
Our work covers:
Transaction-monitoring risk and coverage assessment
Scenario, rule, threshold and segmentation design
Data lineage, completeness and control requirements
Alert investigation, escalation and case-management processes
Internal disclosures, STR/SAR decisions and goAML governance
Quality assurance, tuning, backlogs and management information
Sanctions, TFS and Screening
We establish sanctions and TFS controls across customers, beneficial owners, counterparties, transactions and relevant assets. The framework addresses list management, ownership and control, alert disposition, escalation, freezing and reporting obligations.
Screening is assessed as an end-to-end control rather than a technology output. We examine data quality, system configuration, matching logic, operational decisions, governance and the institution’s exposure to evasion techniques.
Our work covers:
Sanctions and TFS risk assessment
Customer, counterparty, payment and asset screening
List governance and ownership-and-control analysis
Alert investigation and false-positive management
Freeze, reject, escalation and reporting procedures
Screening-system calibration, testing and remediation
Digital-Asset, Payments and Cross-Border Financial Crime
We design financial-crime controls for business models involving virtual assets, tokenisation, wallets, custody, payments, remittance or cross-border financial flows. The work addresses risks created by speed, pseudonymity, complex transaction chains, intermediaries and multi-jurisdictional delivery.
Controls are aligned with the applicable FSRA, DFSA, VARA, CMA and CBUAE perimeter and the institution’s own exposure. Technology outputs are integrated with customer context, investigation standards and accountable human decisions.
Our work covers:
VASP, wallet, custody and token financial-crime risk
Blockchain analytics and wallet-risk governance
Travel Rule and originator-beneficiary information controls
Payment-corridor, remittance and correspondent-risk assessment
Source-of-funds, source-of-wealth and transaction-chain analysis
Cross-border escalation, reliance and information-sharing controls
Regulatory Remediation, Lookbacks and Control Optimisation
We lead structured remediation where financial-crime controls have failed, supervisory findings have been issued or management requires evidence that weaknesses have been addressed. Root causes are distinguished from individual exceptions so that remediation corrects the operating system, not only the immediate finding.
Where historical populations or transactions require review, we define scope, methodology, governance, resourcing, quality assurance and reporting. Closure evidence is prepared for management, the board and, where applicable, independent or regulatory review.
Our work covers:
Regulatory-finding and gap-remediation programmes
Root-cause analysis and target-control design
Customer-file and transaction lookbacks
Alert, screening and periodic-review backlog remediation
Remediation governance, quality assurance and reporting
Closure testing, evidence packs and sustainability assessment
