Maintain a defensible control framework aligned to your regulatory obligations.
| Control | Category | Status | Priority | Owner | Last Review | Evidence |
|---|---|---|---|---|---|---|
Customer Identification & Verification (CIP/CDD) Before a customer can use the account, prove they are who they say they are using reliable, independent evidence, not just what they typed into the form. | Customer Due Diligence | Not Started | High | Unassigned | Not set | 6 |
Beneficial Ownership Identification & Verification For any company or trust customer, find out who really owns or controls it (the actual humans), and prove it, before letting them transact. | Customer Due Diligence | Not Started | High | Unassigned | Not set | 7 |
Expected Activity Profiling at Onboarding At sign-up, ask and record what normal looks like for this customer (how much, how often, to where) so monitoring can later spot when they behave nothing like that. | Customer Due Diligence | Not Started | Medium | Unassigned | Not set | 5 |
Customer Risk Assessment & Rating Score each new and existing customer for money-laundering risk from clear factors (who they are, what they do, where they are) so the firm spends most effort on the riskiest ones. | Customer Due Diligence | Not Started | High | Unassigned | Not set | 7 |
Source of Funds Verification For a specific large or unusual deposit, establish and evidence where that exact money came from before it is used. | Customer Due Diligence | Not Started | High | Unassigned | Not set | 6 |
Source of Wealth Corroboration (High Risk / PEP) For high-risk and PEP customers, understand and prove how they built their overall wealth (not just one deposit), and make sure that story is plausible and independently corroborated. | Customer Due Diligence | Not Started | High | Unassigned | Not set | 7 |
Showing 1 to 6 of 6 controls
This tool produces a control specification for design and discussion. It is not legal advice; validate thresholds, ownership and status against your own risk assessment and the cited sources before implementing. Your register is kept in this browser (not on a server); we only store the contact details you provide when you request an export.