M3 — Confirm

Controls, evidence, independence — regulator-defensible by default.

Every control has a named owner, an independent reviewer and an approver. Same-team overlaps are flagged automatically; blocking conflicts stop sign-off.

Controls in flight

Ready for evidence

Evidenced

Independence issues

JurisdictionAll UK EU US CA SG HK AU UAE GLOBAL

StatusAll Proposed In design In test Ready Evidenced Approved

Independence issues only

RAG	Control	Owner · Reviewer · Approver	Status	Evidence	Due
At risk	US-OCC-3P-RISK-2026-C-003 OCC Third-Party Risk Management Guidance — control 3 USOCC Third-Party Risk Management Guidance	OwnerPriya Desai· Global Markets ReviewerTom Whitfield· Internal Audit ApproverChris Adeyemi· Executive	Approved	3	4 Sep 26
Not started	US-CFPB-1071-2026-C-010 Small Business Data Collection — control 10 USSmall Business Data Collection — Section 1071	OwnerLena Kowalski· Wealth ReviewerMarcus Lin· Risk ApproverChris Adeyemi· Executive	Evidenced	2	25 Aug 26
On track	US-OCC-3P-RISK-2026-C-002 OCC Third-Party Risk Management Guidance — control 2 USOCC Third-Party Risk Management Guidance	OwnerYuki Tanaka· Operations ReviewerNina Bergqvist· Retail Banking ApproverChris Adeyemi· Executive	Evidenced	3	3 Sep 26
On track	US-OCC-3P-RISK-2026-C-005 OCC Third-Party Risk Management Guidance — control 5 USOCC Third-Party Risk Management Guidance	OwnerLena Kowalski· Wealth ReviewerArjun Menon· Payments ApproverRohan Patel· Change	Evidenced	1	29 Sep 26
Off track	US-SEC-CYBER-2026-C-001 SEC Cyber Incident Disclosure Rule — control 1 USSEC Cyber Incident Disclosure Rule	OwnerPriya Desai· Global Markets ReviewerNina Bergqvist· Retail Banking ApproverBen Carter· Regulatory Change	In design	—	21 Jul 26
At risk	US-SEC-CYBER-2026-C-004Check SEC Cyber Incident Disclosure Rule — control 4 USSEC Cyber Incident Disclosure Rule	OwnerLena Kowalski· Wealth ReviewerNina Bergqvist· Retail Banking ApproverAlex Novak· Retail Banking	In design	—	8 Aug 26
Off track	US-SEC-CYBER-2026-C-007 SEC Cyber Incident Disclosure Rule — control 7 USSEC Cyber Incident Disclosure Rule	OwnerYuki Tanaka· Operations ReviewerInes Silva· Legal ApproverBen Carter· Regulatory Change	In design	—	13 Aug 26
At risk	US-CFPB-1071-2026-C-002 Small Business Data Collection — control 2 USSmall Business Data Collection — Section 1071	OwnerDavid Okafor· Payments ReviewerInes Silva· Legal ApproverAlex Novak· Retail Banking	In design	—	22 Aug 26
On track	US-CFPB-1071-2026-C-008 Small Business Data Collection — control 8 USSmall Business Data Collection — Section 1071	OwnerAmelia Hart· Retail Banking ReviewerInes Silva· Legal ApproverBen Carter· Regulatory Change	In design	—	3 Sep 26
At risk	US-CFPB-1071-2026-C-009 Small Business Data Collection — control 9 USSmall Business Data Collection — Section 1071	OwnerYuki Tanaka· Operations ReviewerArjun Menon· Payments ApproverChris Adeyemi· Executive	In design	—	5 Sep 26
At risk	US-CFPB-1071-2026-C-003 Small Business Data Collection — control 3 USSmall Business Data Collection — Section 1071	OwnerLena Kowalski· Wealth ReviewerArjun Menon· Payments ApproverRohan Patel· Change	In design	—	16 Sep 26
Not started	US-CFPB-1071-2026-C-007 Small Business Data Collection — control 7 USSmall Business Data Collection — Section 1071	OwnerPriya Desai· Global Markets ReviewerInes Silva· Legal ApproverRohan Patel· Change	In design	—	1 Oct 26
At risk	US-SEC-CYBER-2026-C-006 SEC Cyber Incident Disclosure Rule — control 6 USSEC Cyber Incident Disclosure Rule	OwnerAmelia Hart· Retail Banking ReviewerInes Silva· Legal ApproverAlex Novak· Retail Banking	In test	—	15 Jul 26
At risk	US-SEC-CYBER-2026-C-003 SEC Cyber Incident Disclosure Rule — control 3 USSEC Cyber Incident Disclosure Rule	OwnerPriya Desai· Global Markets ReviewerArjun Menon· Payments ApproverChris Adeyemi· Executive	In test	—	11 Aug 26
On track	US-CFPB-1071-2026-C-005 Small Business Data Collection — control 5 USSmall Business Data Collection — Section 1071	OwnerPriya Desai· Global Markets ReviewerNina Bergqvist· Retail Banking ApproverRohan Patel· Change	In test	—	12 Aug 26
At risk	US-SEC-CYBER-2026-C-005 SEC Cyber Incident Disclosure Rule — control 5 USSEC Cyber Incident Disclosure Rule	OwnerAmelia Hart· Retail Banking ReviewerInes Silva· Legal ApproverBen Carter· Regulatory Change	In test	—	13 Aug 26
On track	US-CFPB-1071-2026-C-004 Small Business Data Collection — control 4 USSmall Business Data Collection — Section 1071	OwnerDavid Okafor· Payments ReviewerInes Silva· Legal ApproverAlex Novak· Retail Banking	In test	—	18 Sep 26
At risk	US-SEC-CYBER-2026-C-002 SEC Cyber Incident Disclosure Rule — control 2 USSEC Cyber Incident Disclosure Rule	OwnerLena Kowalski· Wealth ReviewerArjun Menon· Payments ApproverBen Carter· Regulatory Change	Proposed	—	6 Jul 26
At risk	US-CFPB-1071-2026-C-011 Small Business Data Collection — control 11 USSmall Business Data Collection — Section 1071	OwnerAmelia Hart· Retail Banking ReviewerTom Whitfield· Internal Audit ApproverBen Carter· Regulatory Change	Ready	3	6 Jul 26
On track	US-OCC-3P-RISK-2026-C-004 OCC Third-Party Risk Management Guidance — control 4 USOCC Third-Party Risk Management Guidance	OwnerDavid Okafor· Payments ReviewerNina Bergqvist· Retail Banking ApproverRohan Patel· Change	Ready	1	19 Jul 26
At risk	US-CFPB-1071-2026-C-006 Small Business Data Collection — control 6 USSmall Business Data Collection — Section 1071	OwnerPriya Desai· Global Markets ReviewerMarcus Lin· Risk ApproverAlex Novak· Retail Banking	Ready	3	29 Jul 26
On track	US-OCC-3P-RISK-2026-C-001Check OCC Third-Party Risk Management Guidance — control 1 USOCC Third-Party Risk Management Guidance	OwnerAmelia Hart· Retail Banking ReviewerNina Bergqvist· Retail Banking ApproverRohan Patel· Change	Ready	2	10 Sep 26
On track	US-CFPB-1071-2026-C-001 Small Business Data Collection — control 1 USSmall Business Data Collection — Section 1071	OwnerLena Kowalski· Wealth ReviewerInes Silva· Legal ApproverRohan Patel· Change	Ready	3	15 Sep 26
At risk	US-OCC-3P-RISK-2026-C-006 OCC Third-Party Risk Management Guidance — control 6 USOCC Third-Party Risk Management Guidance	OwnerLena Kowalski· Wealth ReviewerTom Whitfield· Internal Audit ApproverRohan Patel· Change	Ready	1	30 Sep 26

Showing up to 80 controls. Filter by jurisdiction, status or independence to narrow.