Maintain a defensible control framework aligned to your regulatory obligations.
| Control | Category | Status | Priority | Owner | Last Review | Evidence |
|---|---|---|---|---|---|---|
Customer Identification & Verification (CIP/CDD) Before a customer can use the account, prove they are who they say they are using reliable, independent evidence, not just what they typed into the form. | Customer Due Diligence | Not Started | High | Unassigned | Not set | 6 |
Expected Activity Profiling at Onboarding At sign-up, ask and record what normal looks like for this customer (how much, how often, to where) so monitoring can later spot when they behave nothing like that. | Customer Due Diligence | Not Started | Medium | Unassigned | Not set | 5 |
Activity vs Expected Profile Monitoring Compares what a customer actually does on the account with what they told you they would do at sign-up, and flags when the two no longer match. | Transaction Monitoring | Not Started | High | Unassigned | Not set | 6 |
Rapid Movement / Pass-Through Detection Spots money that arrives and leaves almost immediately, where the account is being used as a channel to move funds on rather than to hold or spend them. | Transaction Monitoring | Not Started | High | Unassigned | Not set | 6 |
Money-Mule & Network Detection Finds accounts being used by other people to receive and pass on dirty or stolen money, and links them together when they are part of the same ring. | Transaction Monitoring | Not Started | High | Unassigned | Not set | 6 |
Crypto Blockchain Analytics Monitoring Uses blockchain analytics to check where crypto sent or received by a customer has been, and flags links to mixers, illicit services or sanctioned addresses. | Transaction Monitoring | Not Started | High | Unassigned | Not set | 5 |
Showing 1 to 6 of 6 controls
This tool produces a control specification for design and discussion. It is not legal advice; validate thresholds, ownership and status against your own risk assessment and the cited sources before implementing. Your register is kept in this browser (not on a server); we only store the contact details you provide when you request an export.