Business Policies
The policy set a payments business is held to — written to match how the business actually operates, and to the standard a regulator expects to review.
What you hold at the end
- AML/CFT policy
- Information security policy
- Outsourcing policy
- Complaints and conduct policy
How the engagement runs
Each phase ends with something you can review before the next one starts.
Phase 1: Gap review
Existing policies read against regulatory requirements and the current operating model.
You leave with
A gap list, prioritised by regulatory exposure.
Phase 2: Drafting
Policies written or rewritten with the owners who will be accountable for them.
You leave with
A complete draft policy set.
Phase 3: Approval
Review cycles with management and the board, and preparation for regulator submission.
You leave with
An approved, versioned policy set.
Phase 4: Maintenance
A review calendar and change process so policies stay current as the business changes.
You leave with
A policy governance process in place.
What you hold at the end
- AML/CFT policy
Customer due diligence, monitoring and reporting obligations
- Information security policy
How information and systems are protected
- Outsourcing policy
How third parties are selected, contracted and overseen
- Complaints and conduct policy
How customers are treated and disputes resolved
Questions buyers ask
It depends on scope and starting point. The first phase produces a plan you can hold us to.
Tell us what you’re trying to build
Whether you’re modernizing a banking platform, launching a payment product, or securing existing infrastructure, we’ll help define the right path forward.