We assess the institution’s exposure to money laundering, terrorist financing, proliferation financing, sanctions evasion and related financial crime. The methodology examines customers, products, services, transactions, delivery channels, jurisdictions and operating dependencies.

Control effectiveness is evaluated against the inherent exposure to determine residual risk and required action. The assessment is designed for board approval and becomes the basis for risk appetite, policies, monitoring priorities, resourcing and control investment.

Our work covers:

• Business-wide ML/TF/PF and sanctions-risk methodology

• Customer, product, service, channel and geographic-risk analysis

• Inherent-risk, control-effectiveness and residual-risk assessment

• Data, evidence and expert-judgement standards

• Risk appetite, thresholds and escalation criteria

• Board reporting, approval and periodic-refresh triggers

We establish the governance, policies and operating framework through which the institution manages AML/CFT/CPF obligations. The model defines board and senior-management oversight, MLRO authority, business ownership, escalation, decision records, reporting and independent review.

We prepare the MLRO function to exercise informed judgement rather than administer a set of procedures. Any outsourced tasks or appointment arrangements remain subject to current legal requirements, supervisory expectations and required regulatory acceptance.

Our work covers:

• AML/CFT/CPF governance and accountability framework

• MLRO mandate, authority, independence and access

• Policies, procedures, standards and control ownership

• Internal disclosure, escalation and decision governance

• MLRO management information and board reporting

• Training, quality assurance and regulatory evidence

We design customer-risk and due-diligence controls that reflect the institution’s customer base, products and exposure. Requirements are converted into clear onboarding, approval, periodic-review, event-driven-review and exit processes.

We also assess file quality and remediate customer populations where evidence, ownership, source of funds, source of wealth or risk classifications are incomplete. Complex corporate, fund, trust and family-office structures are addressed through documented ownership and control analysis.

Our work covers:

Customer risk-assessment methodology and scoring

Identification, verification and beneficial-ownership controls

CDD, EDD, PEP and high-risk-customer requirements

Source-of-funds and source-of-wealth standards

Onboarding, approval and ongoing-due-diligence workflows

Customer-file review, remediation and quality assurance

We design and assess transaction-monitoring arrangements against the institution’s products, customer behaviour, payment flows and financial-crime risks. Scenarios, thresholds, data, alert handling and escalation are aligned with the business-wide risk assessment.

We establish the governance for internal disclosures and STR or SAR decisions, including confidentiality, documentation, timeliness and post-reporting controls. The MLRO retains responsibility for suspicion decisions and regulatory reporting.

Our work covers:

• Transaction-monitoring risk and coverage assessment

• Scenario, rule, threshold and segmentation design

• Data lineage, completeness and control requirements

• Alert investigation, escalation and case-management processes

• Internal disclosures, STR/SAR decisions and goAML governance

• Quality assurance, tuning, backlogs and management information

We establish sanctions and TFS controls across customers, beneficial owners, counterparties, transactions and relevant assets. The framework addresses list management, ownership and control, alert disposition, escalation, freezing and reporting obligations.

Screening is assessed as an end-to-end control rather than a technology output. We examine data quality, system configuration, matching logic, operational decisions, governance and the institution’s exposure to evasion techniques.

Our work covers:

• Sanctions and TFS risk assessment

• Customer, counterparty, payment and asset screening

• List governance and ownership-and-control analysis

• Alert investigation and false-positive management

• Freeze, reject, escalation and reporting procedures

• Screening-system calibration, testing and remediation

We design financial-crime controls for business models involving virtual assets, tokenisation, wallets, custody, payments, remittance or cross-border financial flows. The work addresses risks created by speed, pseudonymity, complex transaction chains, intermediaries and multi-jurisdictional delivery.

Controls are aligned with the applicable FSRA, DFSA, VARA, CMA and CBUAE perimeter and the institution’s own exposure. Technology outputs are integrated with customer context, investigation standards and accountable human decisions.

Our work covers:

• VASP, wallet, custody and token financial-crime risk

• Blockchain analytics and wallet-risk governance

• Travel Rule and originator-beneficiary information controls

• Payment-corridor, remittance and correspondent-risk assessment

• Source-of-funds, source-of-wealth and transaction-chain analysis

• Cross-border escalation, reliance and information-sharing controls

We lead structured remediation where financial-crime controls have failed, supervisory findings have been issued or management requires evidence that weaknesses have been addressed. Root causes are distinguished from individual exceptions so that remediation corrects the operating system, not only the immediate finding.

Where historical populations or transactions require review, we define scope, methodology, governance, resourcing, quality assurance and reporting. Closure evidence is prepared for management, the board and, where applicable, independent or regulatory review.

Our work covers:

• Regulatory-finding and gap-remediation programmes

• Root-cause analysis and target-control design

• Customer-file and transaction lookbacks

• Alert, screening and periodic-review backlog remediation

• Remediation governance, quality assurance and reporting

• Closure testing, evidence packs and sustainability assessment