Interactive tool

How much of your AML programme could you evidence tomorrow?

Nineteen questions across seven control dimensions. Each one restates a control objective from the register this product holds itself to, and each answer level is about evidence rather than intent — because the difference between a control that exists and a control you can show an examiner is the whole of this assessment.

Step 1 of 7

0 of 19 questions answered

Customer and CDD

Whether the institution can identify, classify, risk-rate and periodically review a customer — and whether the person who captured the data is prevented from being the person who approved it.

Capability group: B. Customer and CDD

The five levels

0 Not in place: — The control does not exist, or nobody could say who performs it.
1 Ad hoc: — It happens in practice, but it is not a defined control: no named owner, no written procedure.
2 Defined: — The objective, the owner and the procedure are documented. Whether it ran last quarter would take some digging to establish.
3 Evidenced: — It runs, and it produces the evidence artefact by itself — a test result, an audit sample, an approval record — without anyone assembling one afterwards.
4 Accepted: — That evidence has been independently reviewed and accepted, and any exception has a named owner, an expiry date and a compensating control.

1. The person who captures onboarding data cannot decide that same application. Customer lifecycle and EDD decisions are separated from data capture.

Self-approved onboarding is the single most common finding in a CDD file review, because it leaves no independent judgement anywhere in the record. [C-07]

0 — Not in placeThe control does not exist, or nobody could say who performs it.1 — Ad hocIt happens in practice, but it is not a defined control: no named owner, no written procedure.2 — DefinedThe objective, the owner and the procedure are documented. Whether it ran last quarter would take some digging to establish.3 — EvidencedIt runs, and it produces the evidence artefact by itself — a test result, an audit sample, an approval record — without anyone assembling one afterwards.4 — AcceptedThat evidence has been independently reviewed and accepted, and any exception has a named owner, an expiry date and a compensating control.

2. Beneficial ownership is recorded as a structured, historical graph and verified independently of the declaration. Superseded edges are closed rather than deleted.

Recording the immediate corporate parent instead of the natural person who ultimately controls the customer is the gap an examiner finds most often — and a deleted edge means last year's decision can no longer be reconstructed. [C-08]

0 — Not in placeThe control does not exist, or nobody could say who performs it.1 — Ad hocIt happens in practice, but it is not a defined control: no named owner, no written procedure.2 — DefinedThe objective, the owner and the procedure are documented. Whether it ran last quarter would take some digging to establish.3 — EvidencedIt runs, and it produces the evidence artefact by itself — a test result, an audit sample, an approval record — without anyone assembling one afterwards.4 — AcceptedThat evidence has been independently reviewed and accepted, and any exception has a named owner, an expiry date and a compensating control.

3. CDD forms and their storage bindings are schema-validated and versioned, identifiers are encrypted or blind-indexed, and reading a sensitive profile writes a PII-access audit record.

A form that changed without a version is a form nobody can prove the content of on the day a decision was taken. [C-05, C-06]

0 — Not in placeThe control does not exist, or nobody could say who performs it.1 — Ad hocIt happens in practice, but it is not a defined control: no named owner, no written procedure.2 — DefinedThe objective, the owner and the procedure are documented. Whether it ran last quarter would take some digging to establish.3 — EvidencedIt runs, and it produces the evidence artefact by itself — a test result, an audit sample, an approval record — without anyone assembling one afterwards.4 — AcceptedThat evidence has been independently reviewed and accepted, and any exception has a named owner, an expiry date and a compensating control.

Next: Risk and controls.

How this works

The framework is not ours to inventThe seven dimensions are the enterprise capability map in the product's own design documentation. The questions restate control objectives from its control register, and each shows the control reference it came from.
Every step is a real pageAnswers travel in the address bar and the score is computed on the server. You can bookmark a half-finished assessment, send it to a colleague, or use the Back button without losing it.
Nothing is storedThere is no database behind this. Your answers exist in your own browser's address bar and in the HTML sent back to you, and nowhere else — which is a better posture for a self-assessment than a session on someone else's server.

The levels are deliberately weighted towards evidence. A control that runs but produces nothing an examiner could inspect scores 2, not 4, however well it works — because in a review it is indistinguishable from a control that does not run at all. That is the same standard the register applies to this product’s own controls: a status cannot be changed to accepted until the evidence column holds a test result, an audit sample, a signed pack, a provider contract or an approved policy.

Start the conversation

A gap you can name is a gap you can plan around

If the assessment surfaced something, the useful next step is an hour with a compliance specialist looking at the specific control — not a product demo. Bring the URL of your result and we will start from your answers.

Book a working session See the platform