Test whether the documented framework works before the regulator, bank, auditor or incident exposes a gap.
Sample customer files, sanctions decisions, KYT alerts, unusual-activity escalations, access records, reconciliations, management reports and change controls. Findings should be tracked to evidence-based closure.
Service overview
Testing should reveal whether controls operate as designed and whether staff can explain and evidence their responsibilities under realistic scenarios.
- Assurance and sampling plan
- Mock interviews and system walk-through
- Findings and remediation register
- Closure-evidence review
Test whether the framework works under pressure
Training attendance alone does not show competence, and a policy review alone does not test execution. Sampling should follow real customers, alerts, overrides and management decisions.
The assurance output
Prioritised findings, accountable remediation and evidence that lessons reach both staff and system configuration.
Test execution, not attendance
Sampling follows real customers, alerts, decisions, access, reconciliation and change events. Findings identify root cause, accountable remediation, due date, retest and closure evidence.
Coordinate the mandatory assurance cycle
The operating framework now includes annual penetration testing of critical and connected systems, risk-based testing of other systems at least every three years, twice-yearly vulnerability scanning and qualified independent assurance. A newly registered VASP must obtain the risk framework and current independent audit opinion within 12 months after registration.
A common failure
Training slides and policy acknowledgements are treated as proof of competence even though staff cannot handle a realistic case or system failure.
What you can expect from us
We begin with the live model and current evidence, agree the decisions and dependencies, then issue a written scope. You may engage us for advice and review only, for a defined implementation module, or for the complete build and regulatory coordination. The quotation caps our professional fee for the agreed assumptions and separates the GEL 5,000 official registration fee, translations, personnel, office, software, assurance and other third-party costs.
Founder decision
Agree the product perimeter, markets, counterparties and risk appetite before costly build work.
Operating evidence
Connect each claim to an accountable person, configured control, record and test result.
Launch consequence
Carry approved assumptions into filing, banking, provider onboarding and supervised operations.
Questions we address in this workstream
Not by itself. Training should match each role, product and system, include new risks and regulatory changes, and test whether people can handle realistic customers, sanctions results, alerts, incidents and escalation decisions.
It should test people, records and the functioning system together: customer acceptance, transactions, alerts, reporting, provider oversight, access, reconciliation, incidents, change approvals and management information. The exercise should measure retrieval time and decision quality.
Administrators and the owners of compliance, operations, finance, technology, security and customer processes should explain the controls for which they are accountable. Responses should be in their own words and agree with the filed operating model.
Each finding needs a clear risk, root cause, accountable owner, due date and corrective action. Closure should require evidence and independent retesting where appropriate, with overdue or repeatedly failed items escalated to management.
Assurance should identify weaknesses, test competence and improve the evidence available to management. Its practical value lies in timely detection, candid reporting, corrective action, retesting and demonstrable governance.
