Interactive tool

How much of your AML programme could you evidence tomorrow?

Nineteen questions across seven control dimensions. Each one restates a control objective from the register this product holds itself to, and each answer level is about evidence rather than intent — because the difference between a control that exists and a control you can show an examiner is the whole of this assessment.

Step 3 of 7

0 of 19 questions answered

Transaction intelligence

Whether every transaction carries the evidence a monitoring decision needs, and whether the decision it produced can be reconstructed later.

Capability group: D. Transaction intelligence

The five levels

0 Not in place: — The control does not exist, or nobody could say who performs it.
1 Ad hoc: — It happens in practice, but it is not a defined control: no named owner, no written procedure.
2 Defined: — The objective, the owner and the procedure are documented. Whether it ran last quarter would take some digging to establish.
3 Evidenced: — It runs, and it produces the evidence artefact by itself — a test result, an audit sample, an approval record — without anyone assembling one afterwards.
4 Accepted: — That evidence has been independently reviewed and accepted, and any exception has a named owner, an expiry date and a compensating control.

1. Transaction ingest is idempotent and currency-safe: amounts are integer minor units with an explicit currency, mixed currencies are never silently aggregated, and invalid input is quarantined rather than dropped.

A silently aggregated multi-currency total is a threshold calculation that is wrong in a direction nobody can see. [C-10]

0 — Not in placeThe control does not exist, or nobody could say who performs it.1 — Ad hocIt happens in practice, but it is not a defined control: no named owner, no written procedure.2 — DefinedThe objective, the owner and the procedure are documented. Whether it ran last quarter would take some digging to establish.3 — EvidencedIt runs, and it produces the evidence artefact by itself — a test result, an audit sample, an approval record — without anyone assembling one afterwards.4 — AcceptedThat evidence has been independently reviewed and accepted, and any exception has a named owner, an expiry date and a compensating control.

2. Monitoring decisions are explainable: the rule, its version and the evaluation evidence are retained, and a historical alert can be deterministically replayed.

A rule that has been re-tuned since the alert fired cannot explain that alert, and 'the system flagged it' is not a rationale an examiner accepts. [C-09]

0 — Not in placeThe control does not exist, or nobody could say who performs it.1 — Ad hocIt happens in practice, but it is not a defined control: no named owner, no written procedure.2 — DefinedThe objective, the owner and the procedure are documented. Whether it ran last quarter would take some digging to establish.3 — EvidencedIt runs, and it produces the evidence artefact by itself — a test result, an audit sample, an approval record — without anyone assembling one afterwards.4 — AcceptedThat evidence has been independently reviewed and accepted, and any exception has a named owner, an expiry date and a compensating control.

3. Analyst triage is separated from closure authority, and evidence linked to an alert is bounded and subject-consistent.

An analyst who can both work and close their own queue has no second pair of eyes on the disposition that ends the matter. [C-09, SoD]

0 — Not in placeThe control does not exist, or nobody could say who performs it.1 — Ad hocIt happens in practice, but it is not a defined control: no named owner, no written procedure.2 — DefinedThe objective, the owner and the procedure are documented. Whether it ran last quarter would take some digging to establish.3 — EvidencedIt runs, and it produces the evidence artefact by itself — a test result, an audit sample, an approval record — without anyone assembling one afterwards.4 — AcceptedThat evidence has been independently reviewed and accepted, and any exception has a named owner, an expiry date and a compensating control.

Back

Next: Screening.

How this works

The framework is not ours to inventThe seven dimensions are the enterprise capability map in the product's own design documentation. The questions restate control objectives from its control register, and each shows the control reference it came from.
Every step is a real pageAnswers travel in the address bar and the score is computed on the server. You can bookmark a half-finished assessment, send it to a colleague, or use the Back button without losing it.
Nothing is storedThere is no database behind this. Your answers exist in your own browser's address bar and in the HTML sent back to you, and nowhere else — which is a better posture for a self-assessment than a session on someone else's server.

The levels are deliberately weighted towards evidence. A control that runs but produces nothing an examiner could inspect scores 2, not 4, however well it works — because in a review it is indistinguishable from a control that does not run at all. That is the same standard the register applies to this product’s own controls: a status cannot be changed to accepted until the evidence column holds a test result, an audit sample, a signed pack, a provider contract or an approved policy.

Start the conversation

A gap you can name is a gap you can plan around

If the assessment surfaced something, the useful next step is an hour with a compliance specialist looking at the specific control — not a product demo. Bring the URL of your result and we will start from your answers.

Book a working session See the platform