The 10 steps to AML/CTF readiness, and the 5 we can help with

The systems holding client identity and due diligence data are configured to keep people out, and watched for the times someone gets in.

In place looks like: multi-factor authentication on every account, no shared logins, and somebody watching for the alerts around the clock rather than only in office hours.

Information about a suspicious matter is restricted to the people authorised to see it, and the restriction is held by the system.

In place looks like: a defined list of people who can open it, logged access, and nothing sitting in a shared inbox.

Records of verification have to survive seven years and still be findable, readable and unaltered.

In place looks like: one place they live, encrypted, with retention that runs on its own rather than on someone remembering.

If client data is exposed, the assessment and any notification to the OAIC must happen within thirty days. The work is deciding who does what before the day arrives.

In place looks like: a written incident response plan with names in it, and records complete enough to tell you what was actually reached.

The people who handle identity documents know what to do with them, and know that a suspicious matter is never mentioned to the client it concerns.

In place looks like: training on phishing, identity documents, tipping off and breach escalation, with a record of who completed it and when, repeated rather than done once.