Compliance
Compliance Manual that explains how your controls actually work.
A practical manual for regulated and high-risk businesses (fintech, crypto, cross-border operations):
roles and responsibilities, oversight, reporting, monitoring routines, escalation playbooks, recordkeeping —
aligned with your operating model and counterparties’ expectations.
Banks and regulators rarely reject “policies” — they reject missing governance, unclear responsibilities and weak evidence trails. The manual fixes that.
When you need it
- Licensing / regulatory submissions.
- Bank / PSP onboarding and due diligence.
- Audit preparation and internal controls refresh.
- Outsourcing-heavy tech stacks and cross-border flows.
Often paired with AML / KYC policies.
Deliverables
Compliance Manual — typical modules
We adapt the manual to your business model, products, transaction flows, jurisdictions and team structure.
Below is a standard structure used for fintech, payments and digital asset projects.
Core
Governance & roles
Defines the compliance function and “who does what”.
- Compliance function mandate and scope.
- MLRO/Compliance responsibilities and delegation.
- Independence, conflicts and approvals.
- Committees / board reporting lines.
Fixes the #1 cause of due diligence questions: unclear accountability.
Core
Controls map (by process)
Controls linked to real operational flows.
- Client onboarding and acceptance workflow.
- Transaction flows (fiat rails / crypto transfers).
- Counterparty and vendor control points.
- Evidence, logs and audit trail design.
Shows that documents match operations (not generic text).
Core
Monitoring & escalation playbooks
How issues are detected and handled.
- Monitoring routines and review cadence.
- Escalation chain and decision rights.
- Case management and documentation rules.
- STR/SAR preparation and reporting steps (if applicable).
Designed for execution by a real team.
Add-on
Regulatory reporting & recordkeeping
What you retain, for how long, and how you prove it.
- Record retention schedule (by data type).
- Reporting calendar and internal sign-offs.
- Audit readiness: evidence packs and samples.
- Data access controls and logging.
Critical for audits and partner due diligence.
Add-on
Outsourcing & tech governance
Vendor oversight and technology risks.
- Outsourcing register and vendor due diligence.
- Access management and privileged roles.
- Incident response and escalation.
- Change management and security baseline.
Important for custody/exchange/payment stacks.
Add-on
Training & compliance KPIs
Routine that keeps the system alive.
- Training plan, attestations and onboarding.
- Compliance KPIs and management dashboard.
- Periodic reviews and control testing baseline.
- Remediation tracking and follow-up.
Turns “documents” into an operating system.
Approach
How we draft a manual (so it survives Q&A)
We write manuals from your operating model: products, flows, roles, tech stack and evidence.
This is what banks, auditors and regulators look for.
Inputs we request
- Products/services, target markets and client types.
- Flow of funds/assets and custody touchpoints.
- Counterparties: banks, PSPs, liquidity, custodians.
- Org chart, outsourcing and technology stack overview.
Output: a controls map + manual where each section references real roles, evidence and escalation.
Typical engagement formats
From scratch
Map flows → draft manual → align policies → final evidence pack.
Gap analysis
Review existing docs → identify failures → rewrite only what’s needed.
Licensing support
Manual + narrative alignment → responses to regulator comments.
Banking readiness
Manual + AML/KYC → onboarding SOPs → bank Q&A support.
Related: Crypto licensing and
AML / KYC.
FAQ
Common questions
Short answers. The manual is tailored to your regulator/partner requirements and operating model.
How is a Compliance Manual different from policies?
Policies state “what” you must do. The Compliance Manual explains “how it works” in your business: responsibilities, controls mapping, monitoring routines, escalation, reporting and evidence.
Will this help with bank or PSP onboarding?
Yes. A strong manual reduces follow-up questions because it shows governance, accountability, monitoring and recordkeeping in one place. Banks want clarity on execution, not just policy text.
Can you adapt the manual to a specific regulator rulebook?
Yes. We align terminology, roles, reporting and control expectations to the applicable rulebook and guidance (where relevant), and ensure the manual matches your operating model.
Do you provide support after delivery (Q&A / audits)?
Yes. We can support regulator/bank Q&A, audit preparation, and updates when your products, markets or team structure changes.
Need a manual that explains your controls clearly?
Send a short description of your business model: products, markets, client types, counterparties and tech stack.
We will propose a structured scope and the first deliverables.
If you already have documents, we can run a gap analysis and rebuild only what fails diligence.
Good fit for this service:
- Regulated or licensing-ready fintech/crypto businesses.
- Companies onboarding with banks/PSPs across borders.
- Teams with outsourcing-heavy tech stacks and custody dependencies.
- Projects preparing for audits or institutional partnerships.
We focus on operational clarity: roles, controls, monitoring and evidence trail — that’s what gets approved.