M3 — Confirm

Controls, evidence, independence — regulator-defensible by default.

Every control has a named owner, an independent reviewer and an approver. Same-team overlaps are flagged automatically; blocking conflicts stop sign-off.

Controls in flight

163

Ready for evidence

Evidenced

Independence issues

JurisdictionAll UK EU US CA SG HK AU UAE GLOBAL

StatusAll Proposed In design In test Ready Evidenced Approved

Independence issues only

RAG	Control	Owner · Reviewer · Approver	Status	Evidence	Due
On track	CA-OSFI-B10-2026-C-002 OSFI B-10 — control 2 CAOSFI B-10 — Third-Party Arrangements	OwnerYuki Tanaka· Operations ReviewerMarcus Lin· Risk ApproverBen Carter· Regulatory Change	Approved	3	6 Jul 26
On track	EU-MICA-2026-C-009Check MiCA — control 9 EUMiCA — Whitepaper Filing Regime	OwnerAmelia Hart· Retail Banking ReviewerNina Bergqvist· Retail Banking ApproverAlex Novak· Retail Banking	Approved	1	8 Jul 26
On track	PRA-OP-RES-2026-C-007 Operational Resilience — control 7 UKOperational Resilience — Impact Tolerances Refresh	OwnerAmelia Hart· Retail Banking ReviewerArjun Menon· Payments ApproverBen Carter· Regulatory Change	Approved	2	12 Jul 26
Off track	PRA-OP-RES-2026-C-001 Operational Resilience — control 1 UKOperational Resilience — Impact Tolerances Refresh	OwnerYuki Tanaka· Operations ReviewerMarcus Lin· Risk ApproverBen Carter· Regulatory Change	Approved	3	6 Aug 26
At risk	EU-AI-ACT-FIN-2026-C-003 EU AI Act — control 3 EUEU AI Act — Financial Services Guidance	OwnerLena Kowalski· Wealth ReviewerNina Bergqvist· Retail Banking ApproverRohan Patel· Change	Approved	3	6 Aug 26
Not started	CA-OSFI-B10-2026-C-003 OSFI B-10 — control 3 CAOSFI B-10 — Third-Party Arrangements	OwnerAmelia Hart· Retail Banking ReviewerTom Whitfield· Internal Audit ApproverRohan Patel· Change	Approved	—	12 Aug 26
On track	MAS-EDDR-2026-C-001Check MAS Enhanced Due Diligence Rules — control 1 SGMAS Enhanced Due Diligence Rules — VA	OwnerDavid Okafor· Payments ReviewerArjun Menon· Payments ApproverAlex Novak· Retail Banking	Approved	—	14 Aug 26
At risk	UAE-DFSA-CRYPTO-2026-C-005Check DFSA Crypto Token Regime — control 5 UAEDFSA Crypto Token Regime — Phase 2	OwnerDavid Okafor· Payments ReviewerArjun Menon· Payments ApproverChris Adeyemi· Executive	Approved	—	15 Aug 26
At risk	US-OCC-3P-RISK-2026-C-003 OCC Third-Party Risk Management Guidance — control 3 USOCC Third-Party Risk Management Guidance	OwnerPriya Desai· Global Markets ReviewerTom Whitfield· Internal Audit ApproverChris Adeyemi· Executive	Approved	3	4 Sep 26
At risk	EU-T1-SETTLE-2027-C-001Check T+1 Settlement — control 1 EUT+1 Settlement — Final Rule	OwnerAmelia Hart· Retail Banking ReviewerNina Bergqvist· Retail Banking ApproverBen Carter· Regulatory Change	Approved	3	6 Sep 26
On track	CA-OSFI-B10-2026-C-006 OSFI B-10 — control 6 CAOSFI B-10 — Third-Party Arrangements	OwnerYuki Tanaka· Operations ReviewerTom Whitfield· Internal Audit ApproverRohan Patel· Change	Approved	—	22 Sep 26
Not started	EU-DORA-3P-REGISTER-C-018 DORA — control 18 EUDORA — ICT Third-Party Register	OwnerYuki Tanaka· Operations ReviewerMarcus Lin· Risk ApproverChris Adeyemi· Executive	Evidenced	2	4 Jul 26
On track	EU-CSRD-2026-C-001Check CSRD — control 1 EUCSRD — Sustainability Reporting	OwnerDavid Okafor· Payments ReviewerArjun Menon· Payments ApproverAlex Novak· Retail Banking	Evidenced	3	4 Jul 26
On track	EU-CSRD-2026-C-004 CSRD — control 4 EUCSRD — Sustainability Reporting	OwnerLena Kowalski· Wealth ReviewerArjun Menon· Payments ApproverRohan Patel· Change	Evidenced	1	4 Jul 26
Not started	EU-AI-ACT-FIN-2026-C-001 EU AI Act — control 1 EUEU AI Act — Financial Services Guidance	OwnerAmelia Hart· Retail Banking ReviewerMarcus Lin· Risk ApproverRohan Patel· Change	Evidenced	2	11 Jul 26
On track	PRA-OP-RES-2026-C-008 Operational Resilience — control 8 UKOperational Resilience — Impact Tolerances Refresh	OwnerPriya Desai· Global Markets ReviewerInes Silva· Legal ApproverRohan Patel· Change	Evidenced	2	14 Jul 26
Not started	EU-T1-SETTLE-2027-C-005 T+1 Settlement — control 5 EUT+1 Settlement — Final Rule	OwnerPriya Desai· Global Markets ReviewerTom Whitfield· Internal Audit ApproverChris Adeyemi· Executive	Evidenced	3	15 Jul 26
On track	EU-CSRD-2026-C-007 CSRD — control 7 EUCSRD — Sustainability Reporting	OwnerDavid Okafor· Payments ReviewerInes Silva· Legal ApproverBen Carter· Regulatory Change	Evidenced	1	21 Jul 26
On track	MAS-EDDR-2026-C-005 MAS Enhanced Due Diligence Rules — control 5 SGMAS Enhanced Due Diligence Rules — VA	OwnerLena Kowalski· Wealth ReviewerMarcus Lin· Risk ApproverBen Carter· Regulatory Change	Evidenced	—	23 Jul 26
On track	EU-DORA-3P-REGISTER-C-002 DORA — control 2 EUDORA — ICT Third-Party Register	OwnerPriya Desai· Global Markets ReviewerArjun Menon· Payments ApproverBen Carter· Regulatory Change	Evidenced	2	26 Jul 26
On track	MAS-EDDR-2026-C-003 MAS Enhanced Due Diligence Rules — control 3 SGMAS Enhanced Due Diligence Rules — VA	OwnerAmelia Hart· Retail Banking ReviewerInes Silva· Legal ApproverBen Carter· Regulatory Change	Evidenced	—	26 Jul 26
Not started	CA-OSFI-CLIMATE-2026-C-004 OSFI Climate Risk Guideline B-15 — control 4 CAOSFI Climate Risk Guideline B-15	OwnerPriya Desai· Global Markets ReviewerNina Bergqvist· Retail Banking ApproverChris Adeyemi· Executive	Evidenced	—	29 Jul 26
Off track	EU-T1-SETTLE-2027-C-009 T+1 Settlement — control 9 EUT+1 Settlement — Final Rule	OwnerLena Kowalski· Wealth ReviewerInes Silva· Legal ApproverBen Carter· Regulatory Change	Evidenced	3	3 Aug 26
On track	MAS-OR-TRM-2026-C-008 MAS Technology Risk Management Guidelines Update — control 8 SGMAS Technology Risk Management Guidelines Update	OwnerAmelia Hart· Retail Banking ReviewerArjun Menon· Payments ApproverRohan Patel· Change	Evidenced	—	3 Aug 26
On track	PRA-OP-RES-2026-C-003Check Operational Resilience — control 3 UKOperational Resilience — Impact Tolerances Refresh	OwnerDavid Okafor· Payments ReviewerArjun Menon· Payments ApproverRohan Patel· Change	Evidenced	3	4 Aug 26
On track	EU-DORA-3P-REGISTER-C-022 DORA — control 22 EUDORA — ICT Third-Party Register	OwnerLena Kowalski· Wealth ReviewerInes Silva· Legal ApproverBen Carter· Regulatory Change	Evidenced	3	4 Aug 26
At risk	EU-CSRD-2026-C-005 CSRD — control 5 EUCSRD — Sustainability Reporting	OwnerAmelia Hart· Retail Banking ReviewerTom Whitfield· Internal Audit ApproverBen Carter· Regulatory Change	Evidenced	2	6 Aug 26
Off track	EU-DORA-3P-REGISTER-C-015 DORA — control 15 EUDORA — ICT Third-Party Register	OwnerAmelia Hart· Retail Banking ReviewerMarcus Lin· Risk ApproverRohan Patel· Change	Evidenced	2	9 Aug 26
Off track	EU-AI-ACT-FIN-2026-C-005 EU AI Act — control 5 EUEU AI Act — Financial Services Guidance	OwnerDavid Okafor· Payments ReviewerMarcus Lin· Risk ApproverBen Carter· Regulatory Change	Evidenced	1	22 Aug 26
Not started	US-CFPB-1071-2026-C-010 Small Business Data Collection — control 10 USSmall Business Data Collection — Section 1071	OwnerLena Kowalski· Wealth ReviewerMarcus Lin· Risk ApproverChris Adeyemi· Executive	Evidenced	2	25 Aug 26
At risk	CA-OSFI-CLIMATE-2026-C-002 OSFI Climate Risk Guideline B-15 — control 2 CAOSFI Climate Risk Guideline B-15	OwnerYuki Tanaka· Operations ReviewerTom Whitfield· Internal Audit ApproverChris Adeyemi· Executive	Evidenced	—	27 Aug 26
On track	US-OCC-3P-RISK-2026-C-002 OCC Third-Party Risk Management Guidance — control 2 USOCC Third-Party Risk Management Guidance	OwnerYuki Tanaka· Operations ReviewerNina Bergqvist· Retail Banking ApproverChris Adeyemi· Executive	Evidenced	3	3 Sep 26
On track	MAS-OR-TRM-2026-C-006 MAS Technology Risk Management Guidelines Update — control 6 SGMAS Technology Risk Management Guidelines Update	OwnerAmelia Hart· Retail Banking ReviewerInes Silva· Legal ApproverRohan Patel· Change	Evidenced	—	4 Sep 26
At risk	FCA-CONSUMER-DUTY-2026-C-007 Consumer Duty — control 7 UKConsumer Duty — Annual Board Report	OwnerPriya Desai· Global Markets ReviewerMarcus Lin· Risk ApproverBen Carter· Regulatory Change	Evidenced	3	9 Sep 26
Off track	MAS-OR-TRM-2026-C-003Check MAS Technology Risk Management Guidelines Update — control 3 SGMAS Technology Risk Management Guidelines Update	OwnerAmelia Hart· Retail Banking ReviewerNina Bergqvist· Retail Banking ApproverChris Adeyemi· Executive	Evidenced	—	13 Sep 26
Not started	AU-ASIC-DDO-2026-C-003 ASIC DDO — control 3 AUASIC DDO — Target Market Determinations	OwnerPriya Desai· Global Markets ReviewerNina Bergqvist· Retail Banking ApproverBen Carter· Regulatory Change	Evidenced	—	16 Sep 26
Off track	EU-MICA-2026-C-006 MiCA — control 6 EUMiCA — Whitepaper Filing Regime	OwnerDavid Okafor· Payments ReviewerTom Whitfield· Internal Audit ApproverChris Adeyemi· Executive	Evidenced	3	21 Sep 26
At risk	EU-DORA-3P-REGISTER-C-007 DORA — control 7 EUDORA — ICT Third-Party Register	OwnerAmelia Hart· Retail Banking ReviewerInes Silva· Legal ApproverRohan Patel· Change	Evidenced	2	21 Sep 26
On track	GLOBAL-BCBS-CVA-2026-C-006 BCBS CVA Framework — control 6 GLOBALBCBS CVA Framework — Basel Finalisation	OwnerPriya Desai· Global Markets ReviewerNina Bergqvist· Retail Banking ApproverRohan Patel· Change	Evidenced	—	21 Sep 26
At risk	HK-HKMA-TECH-2026-C-002 HKMA Cyber Resilience Assessment Framework — control 2 HKHKMA Cyber Resilience Assessment Framework	OwnerLena Kowalski· Wealth ReviewerInes Silva· Legal ApproverRohan Patel· Change	Evidenced	—	22 Sep 26
On track	US-OCC-3P-RISK-2026-C-005 OCC Third-Party Risk Management Guidance — control 5 USOCC Third-Party Risk Management Guidance	OwnerLena Kowalski· Wealth ReviewerArjun Menon· Payments ApproverRohan Patel· Change	Evidenced	1	29 Sep 26
On track	PRA-OP-RES-2026-C-004 Operational Resilience — control 4 UKOperational Resilience — Impact Tolerances Refresh	OwnerAmelia Hart· Retail Banking ReviewerArjun Menon· Payments ApproverRohan Patel· Change	In design	—	6 Jul 26
At risk	EU-DORA-3P-REGISTER-C-019 DORA — control 19 EUDORA — ICT Third-Party Register	OwnerDavid Okafor· Payments ReviewerMarcus Lin· Risk ApproverAlex Novak· Retail Banking	In design	—	7 Jul 26
At risk	CA-OSFI-B10-2026-C-004 OSFI B-10 — control 4 CAOSFI B-10 — Third-Party Arrangements	OwnerYuki Tanaka· Operations ReviewerTom Whitfield· Internal Audit ApproverRohan Patel· Change	In design	—	7 Jul 26
At risk	FCA-CONSUMER-DUTY-2026-C-011 Consumer Duty — control 11 UKConsumer Duty — Annual Board Report	OwnerYuki Tanaka· Operations ReviewerInes Silva· Legal ApproverChris Adeyemi· Executive	In design	—	9 Jul 26
At risk	EU-T1-SETTLE-2027-C-007 T+1 Settlement — control 7 EUT+1 Settlement — Final Rule	OwnerDavid Okafor· Payments ReviewerTom Whitfield· Internal Audit ApproverBen Carter· Regulatory Change	In design	—	12 Jul 26
At risk	MAS-OR-TRM-2026-C-002 MAS Technology Risk Management Guidelines Update — control 2 SGMAS Technology Risk Management Guidelines Update	OwnerPriya Desai· Global Markets ReviewerTom Whitfield· Internal Audit ApproverChris Adeyemi· Executive	In design	—	13 Jul 26
On track	MAS-EDDR-2026-C-004 MAS Enhanced Due Diligence Rules — control 4 SGMAS Enhanced Due Diligence Rules — VA	OwnerPriya Desai· Global Markets ReviewerTom Whitfield· Internal Audit ApproverAlex Novak· Retail Banking	In design	—	14 Jul 26
Off track	US-SEC-CYBER-2026-C-001 SEC Cyber Incident Disclosure Rule — control 1 USSEC Cyber Incident Disclosure Rule	OwnerPriya Desai· Global Markets ReviewerNina Bergqvist· Retail Banking ApproverBen Carter· Regulatory Change	In design	—	21 Jul 26
At risk	EU-DORA-3P-REGISTER-C-006 DORA — control 6 EUDORA — ICT Third-Party Register	OwnerPriya Desai· Global Markets ReviewerInes Silva· Legal ApproverBen Carter· Regulatory Change	In design	—	24 Jul 26
At risk	MAS-OR-TRM-2026-C-004 MAS Technology Risk Management Guidelines Update — control 4 SGMAS Technology Risk Management Guidelines Update	OwnerPriya Desai· Global Markets ReviewerArjun Menon· Payments ApproverAlex Novak· Retail Banking	In design	—	26 Jul 26
At risk	HK-SFC-VA-2026-C-005 SFC Virtual Asset Licensing Regime — control 5 HKSFC Virtual Asset Licensing Regime	OwnerYuki Tanaka· Operations ReviewerArjun Menon· Payments ApproverRohan Patel· Change	In design	—	26 Jul 26
On track	PRA-OP-RES-2026-C-002 Operational Resilience — control 2 UKOperational Resilience — Impact Tolerances Refresh	OwnerPriya Desai· Global Markets ReviewerInes Silva· Legal ApproverAlex Novak· Retail Banking	In design	—	31 Jul 26
On track	MAS-OR-TRM-2026-C-007 MAS Technology Risk Management Guidelines Update — control 7 SGMAS Technology Risk Management Guidelines Update	OwnerYuki Tanaka· Operations ReviewerInes Silva· Legal ApproverAlex Novak· Retail Banking	In design	—	2 Aug 26
Not started	EU-T1-SETTLE-2027-C-008 T+1 Settlement — control 8 EUT+1 Settlement — Final Rule	OwnerLena Kowalski· Wealth ReviewerMarcus Lin· Risk ApproverAlex Novak· Retail Banking	In design	—	4 Aug 26
Off track	EU-MICA-2026-C-002 MiCA — control 2 EUMiCA — Whitepaper Filing Regime	OwnerAmelia Hart· Retail Banking ReviewerInes Silva· Legal ApproverBen Carter· Regulatory Change	In design	—	6 Aug 26
At risk	EU-DORA-3P-REGISTER-C-017 DORA — control 17 EUDORA — ICT Third-Party Register	OwnerYuki Tanaka· Operations ReviewerNina Bergqvist· Retail Banking ApproverRohan Patel· Change	In design	—	7 Aug 26
At risk	US-SEC-CYBER-2026-C-004Check SEC Cyber Incident Disclosure Rule — control 4 USSEC Cyber Incident Disclosure Rule	OwnerLena Kowalski· Wealth ReviewerNina Bergqvist· Retail Banking ApproverAlex Novak· Retail Banking	In design	—	8 Aug 26
At risk	EU-T1-SETTLE-2027-C-002 T+1 Settlement — control 2 EUT+1 Settlement — Final Rule	OwnerPriya Desai· Global Markets ReviewerMarcus Lin· Risk ApproverAlex Novak· Retail Banking	In design	—	9 Aug 26
Off track	UAE-DFSA-CRYPTO-2026-C-003 DFSA Crypto Token Regime — control 3 UAEDFSA Crypto Token Regime — Phase 2	OwnerAmelia Hart· Retail Banking ReviewerTom Whitfield· Internal Audit ApproverAlex Novak· Retail Banking	In design	—	9 Aug 26
Off track	FCA-CONSUMER-DUTY-2026-C-003 Consumer Duty — control 3 UKConsumer Duty — Annual Board Report	OwnerDavid Okafor· Payments ReviewerMarcus Lin· Risk ApproverChris Adeyemi· Executive	In design	—	10 Aug 26
On track	EU-T1-SETTLE-2027-C-013 T+1 Settlement — control 13 EUT+1 Settlement — Final Rule	OwnerDavid Okafor· Payments ReviewerInes Silva· Legal ApproverChris Adeyemi· Executive	In design	—	10 Aug 26
Off track	EU-DORA-3P-REGISTER-C-011 DORA — control 11 EUDORA — ICT Third-Party Register	OwnerPriya Desai· Global Markets ReviewerMarcus Lin· Risk ApproverAlex Novak· Retail Banking	In design	—	11 Aug 26
At risk	EU-T1-SETTLE-2027-C-004 T+1 Settlement — control 4 EUT+1 Settlement — Final Rule	OwnerYuki Tanaka· Operations ReviewerNina Bergqvist· Retail Banking ApproverRohan Patel· Change	In design	—	11 Aug 26
Off track	US-SEC-CYBER-2026-C-007 SEC Cyber Incident Disclosure Rule — control 7 USSEC Cyber Incident Disclosure Rule	OwnerYuki Tanaka· Operations ReviewerInes Silva· Legal ApproverBen Carter· Regulatory Change	In design	—	13 Aug 26
On track	GLOBAL-BCBS-CVA-2026-C-003 BCBS CVA Framework — control 3 GLOBALBCBS CVA Framework — Basel Finalisation	OwnerYuki Tanaka· Operations ReviewerInes Silva· Legal ApproverRohan Patel· Change	In design	—	13 Aug 26
Off track	FCA-CONSUMER-DUTY-2026-C-001Check Consumer Duty — control 1 UKConsumer Duty — Annual Board Report	OwnerAmelia Hart· Retail Banking ReviewerNina Bergqvist· Retail Banking ApproverAlex Novak· Retail Banking	In design	—	18 Aug 26
Off track	EU-DORA-3P-REGISTER-C-021Check DORA — control 21 EUDORA — ICT Third-Party Register	OwnerAmelia Hart· Retail Banking ReviewerNina Bergqvist· Retail Banking ApproverChris Adeyemi· Executive	In design	—	18 Aug 26
Off track	AU-APRA-CPS-230-2026-C-008 APRA CPS 230 — control 8 AUAPRA CPS 230 — Operational Risk Management	OwnerYuki Tanaka· Operations ReviewerTom Whitfield· Internal Audit ApproverRohan Patel· Change	In design	—	19 Aug 26
At risk	EU-MICA-2026-C-004Check MiCA — control 4 EUMiCA — Whitepaper Filing Regime	OwnerDavid Okafor· Payments ReviewerArjun Menon· Payments ApproverAlex Novak· Retail Banking	In design	—	20 Aug 26
At risk	EU-DORA-3P-REGISTER-C-008Check DORA — control 8 EUDORA — ICT Third-Party Register	OwnerLena Kowalski· Wealth ReviewerNina Bergqvist· Retail Banking ApproverAlex Novak· Retail Banking	In design	—	22 Aug 26
At risk	US-CFPB-1071-2026-C-002 Small Business Data Collection — control 2 USSmall Business Data Collection — Section 1071	OwnerDavid Okafor· Payments ReviewerInes Silva· Legal ApproverAlex Novak· Retail Banking	In design	—	22 Aug 26
At risk	EU-MICA-2026-C-008 MiCA — control 8 EUMiCA — Whitepaper Filing Regime	OwnerPriya Desai· Global Markets ReviewerInes Silva· Legal ApproverAlex Novak· Retail Banking	In design	—	23 Aug 26
At risk	EU-T1-SETTLE-2027-C-011 T+1 Settlement — control 11 EUT+1 Settlement — Final Rule	OwnerAmelia Hart· Retail Banking ReviewerTom Whitfield· Internal Audit ApproverRohan Patel· Change	In design	—	25 Aug 26
Off track	EU-MICA-2026-C-014 MiCA — control 14 EUMiCA — Whitepaper Filing Regime	OwnerDavid Okafor· Payments ReviewerNina Bergqvist· Retail Banking ApproverBen Carter· Regulatory Change	In design	—	27 Aug 26
Off track	MAS-OR-TRM-2026-C-005Check MAS Technology Risk Management Guidelines Update — control 5 SGMAS Technology Risk Management Guidelines Update	OwnerPriya Desai· Global Markets ReviewerNina Bergqvist· Retail Banking ApproverAlex Novak· Retail Banking	In design	—	27 Aug 26
At risk	EU-DORA-3P-REGISTER-C-012 DORA — control 12 EUDORA — ICT Third-Party Register	OwnerYuki Tanaka· Operations ReviewerTom Whitfield· Internal Audit ApproverChris Adeyemi· Executive	In design	—	28 Aug 26
On track	PRA-OP-RES-2026-C-009 Operational Resilience — control 9 UKOperational Resilience — Impact Tolerances Refresh	OwnerLena Kowalski· Wealth ReviewerTom Whitfield· Internal Audit ApproverChris Adeyemi· Executive	In design	—	29 Aug 26
At risk	FCA-CONSUMER-DUTY-2026-C-009 Consumer Duty — control 9 UKConsumer Duty — Annual Board Report	OwnerAmelia Hart· Retail Banking ReviewerTom Whitfield· Internal Audit ApproverRohan Patel· Change	In design	—	30 Aug 26
At risk	EU-DORA-3P-REGISTER-C-020 DORA — control 20 EUDORA — ICT Third-Party Register	OwnerAmelia Hart· Retail Banking ReviewerInes Silva· Legal ApproverRohan Patel· Change	In design	—	30 Aug 26

Showing up to 80 controls. Filter by jurisdiction, status or independence to narrow.