Maintain a defensible control framework aligned to your regulatory obligations.
| Control | Category | Status | Priority | Owner | Last Review | Evidence |
|---|---|---|---|---|---|---|
Customer Identification & Verification (CIP/CDD) Before a customer can use the account, prove they are who they say they are using reliable, independent evidence, not just what they typed into the form. | Customer Due Diligence | Not Started | High | Unassigned | Not set | 6 |
Beneficial Ownership Identification & Verification For any company or trust customer, find out who really owns or controls it (the actual humans), and prove it, before letting them transact. | Customer Due Diligence | Not Started | High | Unassigned | Not set | 7 |
Expected Activity Profiling at Onboarding At sign-up, ask and record what normal looks like for this customer (how much, how often, to where) so monitoring can later spot when they behave nothing like that. | Customer Due Diligence | Not Started | Medium | Unassigned | Not set | 5 |
Customer Risk Assessment & Rating Score each new and existing customer for money-laundering risk from clear factors (who they are, what they do, where they are) so the firm spends most effort on the riskiest ones. | Customer Due Diligence | Not Started | High | Unassigned | Not set | 7 |
Enhanced Due Diligence Programme For the highest-risk customers, run a deeper, joined-up due diligence package (extra evidence, senior sign-off, closer monitoring) and make sure it actually happens before and during the relationship. | Customer Due Diligence | Not Started | High | Unassigned | Not set | 7 |
Cash Deposit Anomaly Monitoring Flags when a customer pays in cash that does not fit their declared business or income, so unexplained cash can be reviewed before it disappears into the system. | Transaction Monitoring | Not Started | High | Unassigned | Not set | 6 |
Activity vs Expected Profile Monitoring Compares what a customer actually does on the account with what they told you they would do at sign-up, and flags when the two no longer match. | Transaction Monitoring | Not Started | High | Unassigned | Not set | 6 |
Structuring & Smurfing Detection Catches people breaking one big payment into lots of smaller ones to stay under reporting or alerting limits, including when several accounts act together. | Transaction Monitoring | Not Started | High | Unassigned | Not set | 6 |
Rapid Movement / Pass-Through Detection Spots money that arrives and leaves almost immediately, where the account is being used as a channel to move funds on rather than to hold or spend them. | Transaction Monitoring | Not Started | High | Unassigned | Not set | 6 |
Money-Mule & Network Detection Finds accounts being used by other people to receive and pass on dirty or stolen money, and links them together when they are part of the same ring. | Transaction Monitoring | Not Started | High | Unassigned | Not set | 6 |
Crypto Blockchain Analytics Monitoring Uses blockchain analytics to check where crypto sent or received by a customer has been, and flags links to mixers, illicit services or sanctioned addresses. | Transaction Monitoring | Not Started | High | Unassigned | Not set | 5 |
Transaction-Monitoring Scenario Coverage Assurance Checks that the firm's monitoring rules actually cover the risks the firm faces, so no major money-laundering pattern is left with no rule watching for it. | Transaction Monitoring | Not Started | High | Unassigned | Not set | 7 |
Transaction-Monitoring Threshold Tuning Regularly tests and adjusts monitoring rule settings so the firm catches real risk without drowning analysts in pointless alerts, with evidence for every change. | Transaction Monitoring | Not Started | High | Unassigned | Not set | 7 |
Sanctions List Screening (Customer & Transaction) Checks every customer and payment against official sanctions lists before money moves, so the firm does not deal with a sanctioned person or entity. | Screening | Not Started | High | Unassigned | Not set | 6 |
Sanctions Screening Coverage & Calibration Testing Regularly tests the sanctions screening engine with known good and bad names to prove it actually catches what it should and is not silently letting hits through. | Screening | Not Started | Medium | Unassigned | Not set | 5 |
PEP Screening Flags customers who are senior public officials or their close associates so the firm applies extra checks before and during the relationship. | Screening | Not Started | Medium | Unassigned | Not set | 5 |
Adverse Media Screening Searches news and public sources for negative stories about a customer (fraud, corruption, crime) so the firm spots risk that lists alone miss. | Screening | Not Started | High | Unassigned | Not set | 5 |
Real-Time Payment Screening Checks the names, banks and countries on each payment message against sanctions lists in real time and holds anything that hits before the money leaves. | Screening | Not Started | High | Unassigned | Not set | 5 |
Name-Screening Fuzzy-Match Tuning Adjusts how loosely or tightly the screening engine matches names so it keeps catching real hits while cutting the flood of false alarms. | Screening | Not Started | Medium | Unassigned | Not set | 5 |
Ongoing CDD & Periodic Review Every customer's identity and risk information is refreshed on a fixed schedule so the firm never relies on stale onboarding data. | Ongoing Monitoring | Not Started | Medium | Unassigned | Not set | 5 |
Trigger-Based (Event-Driven) Review When something material changes about a customer, the firm reviews them straight away instead of waiting for the next scheduled review. | Ongoing Monitoring | Not Started | Medium | Unassigned | Not set | 5 |
Dynamic Customer Re-Rating The customer's risk score is recalculated automatically from their real behaviour, so a customer who starts acting riskier is re-rated without waiting for a manual review. | Ongoing Monitoring | Not Started | High | Unassigned | Not set | 5 |
Onboarding Fraud & Identity Controls At sign-up the firm checks the applicant is a real, unique person using their genuine identity and device, blocking fake, stolen and bulk-created accounts before they open. | Customer Due Diligence | Not Started | High | Unassigned | Not set | 5 |
Account Takeover Detection The firm spots when someone other than the real customer has gained control of an account, by watching for sudden changes in device, login and payment behaviour. | Transaction Monitoring | Not Started | High | Unassigned | Not set | 5 |
Monitoring Coverage Reconciliation The firm regularly proves that every account and every payment is actually being watched by its monitoring system, so nothing slips through an un-monitored gap. | Ongoing Monitoring | Not Started | Medium | Unassigned | Not set | 5 |
Showing 1 to 25 of 33 controls
This tool produces a control specification for design and discussion. It is not legal advice; validate thresholds, ownership and status against your own risk assessment and the cited sources before implementing. Your register is kept in this browser (not on a server); we only store the contact details you provide when you request an export.