M3 — Confirm

Controls, evidence, independence — regulator-defensible by default.

Every control has a named owner, an independent reviewer and an approver. Same-team overlaps are flagged automatically; blocking conflicts stop sign-off.

Controls in flight

Ready for evidence

Evidenced

Independence issues

JurisdictionAll UK EU US CA SG HK AU UAE GLOBAL

StatusAll Proposed In design In test Ready Evidenced Approved

Independence issues only

RAG	Control	Owner · Reviewer · Approver	Status	Evidence	Due
Off track	AU-APRA-CPS-230-2026-C-005 APRA CPS 230 — control 5 AUAPRA CPS 230 — Operational Risk Management	OwnerYuki Tanaka· Operations ReviewerInes Silva· Legal ApproverRohan Patel· Change	In test	—	4 Jul 26
Off track	AU-APRA-CPS-230-2026-C-007 APRA CPS 230 — control 7 AUAPRA CPS 230 — Operational Risk Management	OwnerAmelia Hart· Retail Banking ReviewerArjun Menon· Payments ApproverBen Carter· Regulatory Change	In test	—	11 Jul 26
At risk	EU-DORA-3P-REGISTER-C-003 DORA — control 3 EUDORA — ICT Third-Party Register	OwnerPriya Desai· Global Markets ReviewerNina Bergqvist· Retail Banking ApproverRohan Patel· Change	In test	—	12 Jul 26
At risk	US-SEC-CYBER-2026-C-006 SEC Cyber Incident Disclosure Rule — control 6 USSEC Cyber Incident Disclosure Rule	OwnerAmelia Hart· Retail Banking ReviewerInes Silva· Legal ApproverAlex Novak· Retail Banking	In test	—	15 Jul 26
At risk	HK-HKMA-TECH-2026-C-003 HKMA Cyber Resilience Assessment Framework — control 3 HKHKMA Cyber Resilience Assessment Framework	OwnerLena Kowalski· Wealth ReviewerMarcus Lin· Risk ApproverBen Carter· Regulatory Change	In test	—	16 Jul 26
Not started	HMT-CRYPTO-2026-C-002Check HMT Cryptoasset Regime — control 2 UKHMT Cryptoasset Regime — Perimeter	OwnerDavid Okafor· Payments ReviewerNina Bergqvist· Retail Banking ApproverAlex Novak· Retail Banking	In test	—	18 Jul 26
Not started	CA-OSFI-CLIMATE-2026-C-003 OSFI Climate Risk Guideline B-15 — control 3 CAOSFI Climate Risk Guideline B-15	OwnerYuki Tanaka· Operations ReviewerArjun Menon· Payments ApproverAlex Novak· Retail Banking	In test	—	21 Jul 26
Off track	AU-APRA-CPS-230-2026-C-009 APRA CPS 230 — control 9 AUAPRA CPS 230 — Operational Risk Management	OwnerLena Kowalski· Wealth ReviewerArjun Menon· Payments ApproverAlex Novak· Retail Banking	In test	—	22 Jul 26
On track	CA-OSFI-B10-2026-C-005 OSFI B-10 — control 5 CAOSFI B-10 — Third-Party Arrangements	OwnerLena Kowalski· Wealth ReviewerMarcus Lin· Risk ApproverAlex Novak· Retail Banking	In test	—	23 Jul 26
At risk	UAE-DFSA-CRYPTO-2026-C-004 DFSA Crypto Token Regime — control 4 UAEDFSA Crypto Token Regime — Phase 2	OwnerDavid Okafor· Payments ReviewerMarcus Lin· Risk ApproverRohan Patel· Change	In test	—	25 Jul 26
On track	PRA-OP-RES-2026-C-006Check Operational Resilience — control 6 UKOperational Resilience — Impact Tolerances Refresh	OwnerDavid Okafor· Payments ReviewerNina Bergqvist· Retail Banking ApproverAlex Novak· Retail Banking	In test	—	26 Jul 26
At risk	FCA-CONSUMER-DUTY-2026-C-006 Consumer Duty — control 6 UKConsumer Duty — Annual Board Report	OwnerPriya Desai· Global Markets ReviewerNina Bergqvist· Retail Banking ApproverRohan Patel· Change	In test	—	28 Jul 26
Off track	EU-DORA-3P-REGISTER-C-009 DORA — control 9 EUDORA — ICT Third-Party Register	OwnerAmelia Hart· Retail Banking ReviewerMarcus Lin· Risk ApproverChris Adeyemi· Executive	In test	—	28 Jul 26
Not started	FCA-CONSUMER-DUTY-2026-C-008 Consumer Duty — control 8 UKConsumer Duty — Annual Board Report	OwnerLena Kowalski· Wealth ReviewerTom Whitfield· Internal Audit ApproverBen Carter· Regulatory Change	In test	—	3 Aug 26
At risk	EU-DORA-3P-REGISTER-C-001 DORA — control 1 EUDORA — ICT Third-Party Register	OwnerLena Kowalski· Wealth ReviewerMarcus Lin· Risk ApproverAlex Novak· Retail Banking	In test	—	8 Aug 26
On track	HMT-CRYPTO-2026-C-001Check HMT Cryptoasset Regime — control 1 UKHMT Cryptoasset Regime — Perimeter	OwnerDavid Okafor· Payments ReviewerArjun Menon· Payments ApproverRohan Patel· Change	In test	—	10 Aug 26
At risk	EU-AI-ACT-FIN-2026-C-004 EU AI Act — control 4 EUEU AI Act — Financial Services Guidance	OwnerDavid Okafor· Payments ReviewerInes Silva· Legal ApproverChris Adeyemi· Executive	In test	—	11 Aug 26
At risk	US-SEC-CYBER-2026-C-003 SEC Cyber Incident Disclosure Rule — control 3 USSEC Cyber Incident Disclosure Rule	OwnerPriya Desai· Global Markets ReviewerArjun Menon· Payments ApproverChris Adeyemi· Executive	In test	—	11 Aug 26
On track	US-CFPB-1071-2026-C-005 Small Business Data Collection — control 5 USSmall Business Data Collection — Section 1071	OwnerPriya Desai· Global Markets ReviewerNina Bergqvist· Retail Banking ApproverRohan Patel· Change	In test	—	12 Aug 26
At risk	US-SEC-CYBER-2026-C-005 SEC Cyber Incident Disclosure Rule — control 5 USSEC Cyber Incident Disclosure Rule	OwnerAmelia Hart· Retail Banking ReviewerInes Silva· Legal ApproverBen Carter· Regulatory Change	In test	—	13 Aug 26
Off track	EU-T1-SETTLE-2027-C-006 T+1 Settlement — control 6 EUT+1 Settlement — Final Rule	OwnerYuki Tanaka· Operations ReviewerTom Whitfield· Internal Audit ApproverChris Adeyemi· Executive	In test	—	14 Aug 26
At risk	AU-ASIC-DDO-2026-C-001 ASIC DDO — control 1 AUASIC DDO — Target Market Determinations	OwnerYuki Tanaka· Operations ReviewerInes Silva· Legal ApproverChris Adeyemi· Executive	In test	—	14 Aug 26
Not started	EU-DORA-3P-REGISTER-C-005 DORA — control 5 EUDORA — ICT Third-Party Register	OwnerYuki Tanaka· Operations ReviewerNina Bergqvist· Retail Banking ApproverBen Carter· Regulatory Change	In test	—	18 Aug 26
At risk	HMT-CRYPTO-2026-C-006 HMT Cryptoasset Regime — control 6 UKHMT Cryptoasset Regime — Perimeter	OwnerAmelia Hart· Retail Banking ReviewerMarcus Lin· Risk ApproverChris Adeyemi· Executive	In test	—	19 Aug 26
On track	GLOBAL-BCBS-CVA-2026-C-001 BCBS CVA Framework — control 1 GLOBALBCBS CVA Framework — Basel Finalisation	OwnerPriya Desai· Global Markets ReviewerMarcus Lin· Risk ApproverChris Adeyemi· Executive	In test	—	21 Aug 26
Off track	HMT-CRYPTO-2026-C-005 HMT Cryptoasset Regime — control 5 UKHMT Cryptoasset Regime — Perimeter	OwnerYuki Tanaka· Operations ReviewerArjun Menon· Payments ApproverBen Carter· Regulatory Change	In test	—	25 Aug 26
On track	EU-CSRD-2026-C-003 CSRD — control 3 EUCSRD — Sustainability Reporting	OwnerPriya Desai· Global Markets ReviewerArjun Menon· Payments ApproverRohan Patel· Change	In test	—	25 Aug 26
On track	EU-CSRD-2026-C-008 CSRD — control 8 EUCSRD — Sustainability Reporting	OwnerDavid Okafor· Payments ReviewerTom Whitfield· Internal Audit ApproverChris Adeyemi· Executive	In test	—	25 Aug 26
On track	HK-HKMA-TECH-2026-C-005 HKMA Cyber Resilience Assessment Framework — control 5 HKHKMA Cyber Resilience Assessment Framework	OwnerLena Kowalski· Wealth ReviewerTom Whitfield· Internal Audit ApproverAlex Novak· Retail Banking	In test	—	30 Aug 26
Not started	EU-DORA-3P-REGISTER-C-016 DORA — control 16 EUDORA — ICT Third-Party Register	OwnerDavid Okafor· Payments ReviewerTom Whitfield· Internal Audit ApproverBen Carter· Regulatory Change	In test	—	31 Aug 26
On track	EU-DORA-3P-REGISTER-C-010 DORA — control 10 EUDORA — ICT Third-Party Register	OwnerDavid Okafor· Payments ReviewerMarcus Lin· Risk ApproverChris Adeyemi· Executive	In test	—	3 Sep 26
At risk	HK-HKMA-TECH-2026-C-001 HKMA Cyber Resilience Assessment Framework — control 1 HKHKMA Cyber Resilience Assessment Framework	OwnerPriya Desai· Global Markets ReviewerMarcus Lin· Risk ApproverRohan Patel· Change	In test	—	3 Sep 26
On track	HK-SFC-VA-2026-C-001Check SFC Virtual Asset Licensing Regime — control 1 HKSFC Virtual Asset Licensing Regime	OwnerDavid Okafor· Payments ReviewerArjun Menon· Payments ApproverAlex Novak· Retail Banking	In test	—	4 Sep 26
At risk	EU-DORA-3P-REGISTER-C-004 DORA — control 4 EUDORA — ICT Third-Party Register	OwnerYuki Tanaka· Operations ReviewerTom Whitfield· Internal Audit ApproverRohan Patel· Change	In test	—	7 Sep 26
Off track	FCA-CONSUMER-DUTY-2026-C-012 Consumer Duty — control 12 UKConsumer Duty — Annual Board Report	OwnerYuki Tanaka· Operations ReviewerTom Whitfield· Internal Audit ApproverAlex Novak· Retail Banking	In test	—	12 Sep 26
On track	US-CFPB-1071-2026-C-004 Small Business Data Collection — control 4 USSmall Business Data Collection — Section 1071	OwnerDavid Okafor· Payments ReviewerInes Silva· Legal ApproverAlex Novak· Retail Banking	In test	—	18 Sep 26
On track	EU-CSRD-2026-C-002 CSRD — control 2 EUCSRD — Sustainability Reporting	OwnerYuki Tanaka· Operations ReviewerTom Whitfield· Internal Audit ApproverRohan Patel· Change	In test	—	22 Sep 26
Not started	UAE-DFSA-CRYPTO-2026-C-002 DFSA Crypto Token Regime — control 2 UAEDFSA Crypto Token Regime — Phase 2	OwnerAmelia Hart· Retail Banking ReviewerArjun Menon· Payments ApproverChris Adeyemi· Executive	In test	—	25 Sep 26
At risk	FCA-CONSUMER-DUTY-2026-C-010 Consumer Duty — control 10 UKConsumer Duty — Annual Board Report	OwnerPriya Desai· Global Markets ReviewerMarcus Lin· Risk ApproverRohan Patel· Change	In test	—	28 Sep 26
On track	PRA-OP-RES-2026-C-005 Operational Resilience — control 5 UKOperational Resilience — Impact Tolerances Refresh	OwnerLena Kowalski· Wealth ReviewerArjun Menon· Payments ApproverChris Adeyemi· Executive	In test	—	29 Sep 26
On track	EU-T1-SETTLE-2027-C-014 T+1 Settlement — control 14 EUT+1 Settlement — Final Rule	OwnerLena Kowalski· Wealth ReviewerMarcus Lin· Risk ApproverChris Adeyemi· Executive	In test	—	29 Sep 26

Showing up to 80 controls. Filter by jurisdiction, status or independence to narrow.