M3 — Confirm

Controls, evidence, independence — regulator-defensible by default.

Every control has a named owner, an independent reviewer and an approver. Same-team overlaps are flagged automatically; blocking conflicts stop sign-off.

Controls in flight

Ready for evidence

Evidenced

Independence issues

JurisdictionAll UK EU US CA SG HK AU UAE GLOBAL

StatusAll Proposed In design In test Ready Evidenced Approved

Independence issues only

RAG	Control	Owner · Reviewer · Approver	Status	Evidence	Due
Not started	EU-DORA-3P-REGISTER-C-018 DORA — control 18 EUDORA — ICT Third-Party Register	OwnerYuki Tanaka· Operations ReviewerMarcus Lin· Risk ApproverChris Adeyemi· Executive	Evidenced	2	4 Jul 26
On track	EU-CSRD-2026-C-001Check CSRD — control 1 EUCSRD — Sustainability Reporting	OwnerDavid Okafor· Payments ReviewerArjun Menon· Payments ApproverAlex Novak· Retail Banking	Evidenced	3	4 Jul 26
On track	EU-CSRD-2026-C-004 CSRD — control 4 EUCSRD — Sustainability Reporting	OwnerLena Kowalski· Wealth ReviewerArjun Menon· Payments ApproverRohan Patel· Change	Evidenced	1	4 Jul 26
Not started	EU-AI-ACT-FIN-2026-C-001 EU AI Act — control 1 EUEU AI Act — Financial Services Guidance	OwnerAmelia Hart· Retail Banking ReviewerMarcus Lin· Risk ApproverRohan Patel· Change	Evidenced	2	11 Jul 26
On track	PRA-OP-RES-2026-C-008 Operational Resilience — control 8 UKOperational Resilience — Impact Tolerances Refresh	OwnerPriya Desai· Global Markets ReviewerInes Silva· Legal ApproverRohan Patel· Change	Evidenced	2	14 Jul 26
Not started	EU-T1-SETTLE-2027-C-005 T+1 Settlement — control 5 EUT+1 Settlement — Final Rule	OwnerPriya Desai· Global Markets ReviewerTom Whitfield· Internal Audit ApproverChris Adeyemi· Executive	Evidenced	3	15 Jul 26
On track	EU-CSRD-2026-C-007 CSRD — control 7 EUCSRD — Sustainability Reporting	OwnerDavid Okafor· Payments ReviewerInes Silva· Legal ApproverBen Carter· Regulatory Change	Evidenced	1	21 Jul 26
On track	MAS-EDDR-2026-C-005 MAS Enhanced Due Diligence Rules — control 5 SGMAS Enhanced Due Diligence Rules — VA	OwnerLena Kowalski· Wealth ReviewerMarcus Lin· Risk ApproverBen Carter· Regulatory Change	Evidenced	—	23 Jul 26
On track	EU-DORA-3P-REGISTER-C-002 DORA — control 2 EUDORA — ICT Third-Party Register	OwnerPriya Desai· Global Markets ReviewerArjun Menon· Payments ApproverBen Carter· Regulatory Change	Evidenced	2	26 Jul 26
On track	MAS-EDDR-2026-C-003 MAS Enhanced Due Diligence Rules — control 3 SGMAS Enhanced Due Diligence Rules — VA	OwnerAmelia Hart· Retail Banking ReviewerInes Silva· Legal ApproverBen Carter· Regulatory Change	Evidenced	—	26 Jul 26
Not started	CA-OSFI-CLIMATE-2026-C-004 OSFI Climate Risk Guideline B-15 — control 4 CAOSFI Climate Risk Guideline B-15	OwnerPriya Desai· Global Markets ReviewerNina Bergqvist· Retail Banking ApproverChris Adeyemi· Executive	Evidenced	—	29 Jul 26
Off track	EU-T1-SETTLE-2027-C-009 T+1 Settlement — control 9 EUT+1 Settlement — Final Rule	OwnerLena Kowalski· Wealth ReviewerInes Silva· Legal ApproverBen Carter· Regulatory Change	Evidenced	3	3 Aug 26
On track	MAS-OR-TRM-2026-C-008 MAS Technology Risk Management Guidelines Update — control 8 SGMAS Technology Risk Management Guidelines Update	OwnerAmelia Hart· Retail Banking ReviewerArjun Menon· Payments ApproverRohan Patel· Change	Evidenced	—	3 Aug 26
On track	PRA-OP-RES-2026-C-003Check Operational Resilience — control 3 UKOperational Resilience — Impact Tolerances Refresh	OwnerDavid Okafor· Payments ReviewerArjun Menon· Payments ApproverRohan Patel· Change	Evidenced	3	4 Aug 26
On track	EU-DORA-3P-REGISTER-C-022 DORA — control 22 EUDORA — ICT Third-Party Register	OwnerLena Kowalski· Wealth ReviewerInes Silva· Legal ApproverBen Carter· Regulatory Change	Evidenced	3	4 Aug 26
At risk	EU-CSRD-2026-C-005 CSRD — control 5 EUCSRD — Sustainability Reporting	OwnerAmelia Hart· Retail Banking ReviewerTom Whitfield· Internal Audit ApproverBen Carter· Regulatory Change	Evidenced	2	6 Aug 26
Off track	EU-DORA-3P-REGISTER-C-015 DORA — control 15 EUDORA — ICT Third-Party Register	OwnerAmelia Hart· Retail Banking ReviewerMarcus Lin· Risk ApproverRohan Patel· Change	Evidenced	2	9 Aug 26
Off track	EU-AI-ACT-FIN-2026-C-005 EU AI Act — control 5 EUEU AI Act — Financial Services Guidance	OwnerDavid Okafor· Payments ReviewerMarcus Lin· Risk ApproverBen Carter· Regulatory Change	Evidenced	1	22 Aug 26
Not started	US-CFPB-1071-2026-C-010 Small Business Data Collection — control 10 USSmall Business Data Collection — Section 1071	OwnerLena Kowalski· Wealth ReviewerMarcus Lin· Risk ApproverChris Adeyemi· Executive	Evidenced	2	25 Aug 26
At risk	CA-OSFI-CLIMATE-2026-C-002 OSFI Climate Risk Guideline B-15 — control 2 CAOSFI Climate Risk Guideline B-15	OwnerYuki Tanaka· Operations ReviewerTom Whitfield· Internal Audit ApproverChris Adeyemi· Executive	Evidenced	—	27 Aug 26
On track	US-OCC-3P-RISK-2026-C-002 OCC Third-Party Risk Management Guidance — control 2 USOCC Third-Party Risk Management Guidance	OwnerYuki Tanaka· Operations ReviewerNina Bergqvist· Retail Banking ApproverChris Adeyemi· Executive	Evidenced	3	3 Sep 26
On track	MAS-OR-TRM-2026-C-006 MAS Technology Risk Management Guidelines Update — control 6 SGMAS Technology Risk Management Guidelines Update	OwnerAmelia Hart· Retail Banking ReviewerInes Silva· Legal ApproverRohan Patel· Change	Evidenced	—	4 Sep 26
At risk	FCA-CONSUMER-DUTY-2026-C-007 Consumer Duty — control 7 UKConsumer Duty — Annual Board Report	OwnerPriya Desai· Global Markets ReviewerMarcus Lin· Risk ApproverBen Carter· Regulatory Change	Evidenced	3	9 Sep 26
Off track	MAS-OR-TRM-2026-C-003Check MAS Technology Risk Management Guidelines Update — control 3 SGMAS Technology Risk Management Guidelines Update	OwnerAmelia Hart· Retail Banking ReviewerNina Bergqvist· Retail Banking ApproverChris Adeyemi· Executive	Evidenced	—	13 Sep 26
Not started	AU-ASIC-DDO-2026-C-003 ASIC DDO — control 3 AUASIC DDO — Target Market Determinations	OwnerPriya Desai· Global Markets ReviewerNina Bergqvist· Retail Banking ApproverBen Carter· Regulatory Change	Evidenced	—	16 Sep 26
Off track	EU-MICA-2026-C-006 MiCA — control 6 EUMiCA — Whitepaper Filing Regime	OwnerDavid Okafor· Payments ReviewerTom Whitfield· Internal Audit ApproverChris Adeyemi· Executive	Evidenced	3	21 Sep 26
At risk	EU-DORA-3P-REGISTER-C-007 DORA — control 7 EUDORA — ICT Third-Party Register	OwnerAmelia Hart· Retail Banking ReviewerInes Silva· Legal ApproverRohan Patel· Change	Evidenced	2	21 Sep 26
On track	GLOBAL-BCBS-CVA-2026-C-006 BCBS CVA Framework — control 6 GLOBALBCBS CVA Framework — Basel Finalisation	OwnerPriya Desai· Global Markets ReviewerNina Bergqvist· Retail Banking ApproverRohan Patel· Change	Evidenced	—	21 Sep 26
At risk	HK-HKMA-TECH-2026-C-002 HKMA Cyber Resilience Assessment Framework — control 2 HKHKMA Cyber Resilience Assessment Framework	OwnerLena Kowalski· Wealth ReviewerInes Silva· Legal ApproverRohan Patel· Change	Evidenced	—	22 Sep 26
On track	US-OCC-3P-RISK-2026-C-005 OCC Third-Party Risk Management Guidance — control 5 USOCC Third-Party Risk Management Guidance	OwnerLena Kowalski· Wealth ReviewerArjun Menon· Payments ApproverRohan Patel· Change	Evidenced	1	29 Sep 26

Showing up to 80 controls. Filter by jurisdiction, status or independence to narrow.