M3 — Confirm

Controls, evidence, independence — regulator-defensible by default.

Every control has a named owner, an independent reviewer and an approver. Same-team overlaps are flagged automatically; blocking conflicts stop sign-off.

Controls in flight

Ready for evidence

Evidenced

Independence issues

JurisdictionAll UK EU US CA SG HK AU UAE GLOBAL

StatusAll Proposed In design In test Ready Evidenced Approved

Independence issues only

RAG	Control	Owner · Reviewer · Approver	Status	Evidence	Due
At risk	US-CFPB-1071-2026-C-011 Small Business Data Collection — control 11 USSmall Business Data Collection — Section 1071	OwnerAmelia Hart· Retail Banking ReviewerTom Whitfield· Internal Audit ApproverBen Carter· Regulatory Change	Ready	3	6 Jul 26
Off track	AU-APRA-CPS-230-2026-C-002Check APRA CPS 230 — control 2 AUAPRA CPS 230 — Operational Risk Management	OwnerSarah Reynolds· Compliance ReviewerNina Bergqvist· Retail Banking ApproverAlex Novak· Retail Banking	Ready	—	9 Jul 26
Not started	EU-DORA-3P-REGISTER-C-014 DORA — control 14 EUDORA — ICT Third-Party Register	OwnerYuki Tanaka· Operations ReviewerTom Whitfield· Internal Audit ApproverChris Adeyemi· Executive	Ready	2	16 Jul 26
On track	US-OCC-3P-RISK-2026-C-004 OCC Third-Party Risk Management Guidance — control 4 USOCC Third-Party Risk Management Guidance	OwnerDavid Okafor· Payments ReviewerNina Bergqvist· Retail Banking ApproverRohan Patel· Change	Ready	1	19 Jul 26
At risk	EU-T1-SETTLE-2027-C-010 T+1 Settlement — control 10 EUT+1 Settlement — Final Rule	OwnerYuki Tanaka· Operations ReviewerTom Whitfield· Internal Audit ApproverChris Adeyemi· Executive	Ready	2	23 Jul 26
On track	CA-OSFI-B10-2026-C-001 OSFI B-10 — control 1 CAOSFI B-10 — Third-Party Arrangements	OwnerPriya Desai· Global Markets ReviewerMarcus Lin· Risk ApproverBen Carter· Regulatory Change	Ready	1	28 Jul 26
Not started	CA-OSFI-CLIMATE-2026-C-001 OSFI Climate Risk Guideline B-15 — control 1 CAOSFI Climate Risk Guideline B-15	OwnerLena Kowalski· Wealth ReviewerTom Whitfield· Internal Audit ApproverRohan Patel· Change	Ready	—	28 Jul 26
At risk	GLOBAL-BCBS-CVA-2026-C-004 BCBS CVA Framework — control 4 GLOBALBCBS CVA Framework — Basel Finalisation	OwnerYuki Tanaka· Operations ReviewerInes Silva· Legal ApproverRohan Patel· Change	Ready	—	28 Jul 26
At risk	US-CFPB-1071-2026-C-006 Small Business Data Collection — control 6 USSmall Business Data Collection — Section 1071	OwnerPriya Desai· Global Markets ReviewerMarcus Lin· Risk ApproverAlex Novak· Retail Banking	Ready	3	29 Jul 26
Off track	EU-MICA-2026-C-003Check MiCA — control 3 EUMiCA — Whitepaper Filing Regime	OwnerAmelia Hart· Retail Banking ReviewerNina Bergqvist· Retail Banking ApproverBen Carter· Regulatory Change	Ready	3	30 Jul 26
At risk	AU-ASIC-DDO-2026-C-002 ASIC DDO — control 2 AUASIC DDO — Target Market Determinations	OwnerPriya Desai· Global Markets ReviewerMarcus Lin· Risk ApproverChris Adeyemi· Executive	Ready	—	1 Aug 26
On track	HK-SFC-VA-2026-C-003 SFC Virtual Asset Licensing Regime — control 3 HKSFC Virtual Asset Licensing Regime	OwnerPriya Desai· Global Markets ReviewerArjun Menon· Payments ApproverAlex Novak· Retail Banking	Ready	—	10 Aug 26
Off track	AU-APRA-CPS-230-2026-C-003Check APRA CPS 230 — control 3 AUAPRA CPS 230 — Operational Risk Management	OwnerDavid Okafor· Payments ReviewerArjun Menon· Payments ApproverRohan Patel· Change	Ready	—	27 Aug 26
On track	GLOBAL-BCBS-CVA-2026-C-002 BCBS CVA Framework — control 2 GLOBALBCBS CVA Framework — Basel Finalisation	OwnerDavid Okafor· Payments ReviewerMarcus Lin· Risk ApproverRohan Patel· Change	Ready	—	29 Aug 26
On track	HK-SFC-VA-2026-C-002 SFC Virtual Asset Licensing Regime — control 2 HKSFC Virtual Asset Licensing Regime	OwnerYuki Tanaka· Operations ReviewerInes Silva· Legal ApproverChris Adeyemi· Executive	Ready	—	4 Sep 26
Off track	AU-APRA-CPS-230-2026-C-004Blocked APRA CPS 230 — control 4 AUAPRA CPS 230 — Operational Risk Management	OwnerPriya Desai· Global Markets ReviewerPriya Desai· Global Markets ApproverChris Adeyemi· Executive	Ready	—	5 Sep 26
At risk	AU-ASIC-DDO-2026-C-004 ASIC DDO — control 4 AUASIC DDO — Target Market Determinations	OwnerAmelia Hart· Retail Banking ReviewerInes Silva· Legal ApproverBen Carter· Regulatory Change	Ready	—	8 Sep 26
On track	UAE-DFSA-CRYPTO-2026-C-001 DFSA Crypto Token Regime — control 1 UAEDFSA Crypto Token Regime — Phase 2	OwnerLena Kowalski· Wealth ReviewerTom Whitfield· Internal Audit ApproverChris Adeyemi· Executive	Ready	—	9 Sep 26
On track	US-OCC-3P-RISK-2026-C-001Check OCC Third-Party Risk Management Guidance — control 1 USOCC Third-Party Risk Management Guidance	OwnerAmelia Hart· Retail Banking ReviewerNina Bergqvist· Retail Banking ApproverRohan Patel· Change	Ready	2	10 Sep 26
Not started	EU-DORA-3P-REGISTER-C-013 DORA — control 13 EUDORA — ICT Third-Party Register	OwnerDavid Okafor· Payments ReviewerMarcus Lin· Risk ApproverBen Carter· Regulatory Change	Ready	3	11 Sep 26
At risk	EU-CSRD-2026-C-006 CSRD — control 6 EUCSRD — Sustainability Reporting	OwnerLena Kowalski· Wealth ReviewerInes Silva· Legal ApproverChris Adeyemi· Executive	Ready	1	15 Sep 26
On track	US-CFPB-1071-2026-C-001 Small Business Data Collection — control 1 USSmall Business Data Collection — Section 1071	OwnerLena Kowalski· Wealth ReviewerInes Silva· Legal ApproverRohan Patel· Change	Ready	3	15 Sep 26
Not started	EU-MICA-2026-C-012Check MiCA — control 12 EUMiCA — Whitepaper Filing Regime	OwnerLena Kowalski· Wealth ReviewerNina Bergqvist· Retail Banking ApproverAlex Novak· Retail Banking	Ready	3	23 Sep 26
At risk	US-OCC-3P-RISK-2026-C-006 OCC Third-Party Risk Management Guidance — control 6 USOCC Third-Party Risk Management Guidance	OwnerLena Kowalski· Wealth ReviewerTom Whitfield· Internal Audit ApproverRohan Patel· Change	Ready	1	30 Sep 26

Showing up to 80 controls. Filter by jurisdiction, status or independence to narrow.