Service catalogue

A measured comparison of your current programme against what your regulator expects, with a prioritised, costed plan to close the difference.

Role-differentiated training content with assessment, built so you can evidence competence to an examiner rather than just attendance.

A board-ready anti-money-laundering, counter-terrorist-financing and counter-proliferation-financing manual written against the regulations that apply to your licence.

A briefing that tells your board what it is personally accountable for, in language that does not require them to be compliance specialists.

Travel Rule compliance design for virtual asset service providers: originator and beneficiary data, counterparty due diligence and unhosted wallet handling.

A documented assessment of your inherent money-laundering, terrorist-financing and proliferation-financing risk, the controls against it, and the residual risk your board must accept.

Know-your-business procedures and a workable method for identifying ultimate beneficial owners through layered corporate structures.

Customer due diligence procedures and a documented, defensible risk-rating model that your systems can actually implement.

Screening programme design covering list coverage, matching thresholds, alert handling and the governance around tuning decisions.

A working procedure for identifying, escalating and filing suspicious transaction reports, including practical goAML submission guidance.

Independent validation of your monitoring system, including above-the-line and below-the-line testing to establish whether thresholds are set where they should be.

Scenario design and threshold calibration for your monitoring system, with the statistical basis for every threshold documented.

A completed Correspondent Banking Due Diligence Questionnaire with the supporting evidence pack correspondent banks actually ask for.

Clearance of an alert backlog or a historic transaction look-back, usually following an examination finding.

The periodic independent test of your AML/CFT programme that regulation requires, conducted by a team with no involvement in building what is being tested.

MLRO, Data Protection Officer and virtual CISO delivered as one function, with a single point of accountability.

A named, qualified MLRO carrying out the role for your firm, including regulator-facing responsibility and board reporting.

Facilitation of the application for a Dedicated Electronic Money Issuer licence with the Bank of Ghana.

Facilitation of the application for a Payment Service Provider licence at the Enhanced tier with the Bank of Ghana.

Authorisation management with the Central Bank of Egypt or the Financial Regulatory Authority, depending on activity.

Facilitation of the application for a Digital Credit Provider licence, including pricing model and debt collection conduct evidence.

Facilitation of the application for a Money Remittance Provider licence with the Central Bank of Kenya.

Facilitation of the application for a Payment Service Provider licence with the Central Bank of Kenya.

Facilitation of the application for an International Money Transfer Operator licence, including corridor structure and correspondent arrangements.

Facilitation of the application for a Mobile Money Operator licence, including e-money issuance structure and trust account arrangements.

Facilitation of the application for a Payment Service Bank licence, the most capital-intensive and most scrutinised of the CBN payment categories.

Facilitation of the licence application with the regulator — preparation, evidence and process management. The regulator alone decides the outcome.

Facilitation of the application for a Payment Terminal Service Provider licence, including terminal deployment and support capability evidence.

Facilitation of the application for a Super-Agent licence, covering agent network structure, agent due diligence and monitoring capability.

Facilitation of the application for a Switching and Processing licence, including scheme and interoperability readiness.

Regulatory approval for a change in control or significant shareholding transfer — the filing most often forgotten after a funding round.

Facilitation of the application for a microfinance banking licence operating a digital model, including prudential and capital planning.

Registration management for digital lending operations with the Federal Competition and Consumer Protection Commission.

Facilitation of the application for a Finance Company licence covering lending, leasing and related activities.

A complete fit-and-proper submission for one director or key officer, assembled and checked before it reaches the regulator.

Facilitation of the application for a Crypto Asset Service Provider licence with the FSCA.

Facilitation of the application for an FSP licence with the Financial Sector Conduct Authority, across categories I to IV.

Annual management of your licence conditions and regulatory returns calendar, so nothing is missed and nothing is filed late.

A simulated regulatory examination run the way the regulator runs it, so the first time you experience one is not the real one.

A comparative study of three markets covering licensing routes, capital requirements, tax, foreign exchange and profit repatriation.

Facilitation of the application for an insurance, insurtech or broking licence with the National Insurance Commission.

Registration management for a credit provider with the National Credit Regulator.

Management of a remediation programme to close examination findings, through to regulator acceptance.

Preparation and management of a regulatory sandbox application in any of the five markets, including test design and exit planning.

Facilitation of the application for a crowdfunding portal licence, including issuer onboarding and investor limit controls.

Registration management for a virtual asset service provider under the SEC Nigeria digital asset rules.

Your full obligations calendar, maintained and filed against, so nothing is missed.

Monitoring of regulatory developments in one market, with an assessment of what each change means for your specific licence.

Continuity and recovery planning built from a business impact analysis, with recovery objectives that reflect what your infrastructure can actually deliver.

An assessment against the CBN Risk-Based Cybersecurity Framework, producing the evidence base for your annual return.

An incident response plan with scenario playbooks, written so an on-call engineer at 3am can follow it.

A complete information security policy set, sized to your organisation rather than copied from a multinational.

The internal audit an ISO 27001 management system requires before certification or surveillance, conducted against the standard rather than a checklist.

The full documented information set an ISO/IEC 27001:2022 information security management system requires, including all Annex A controls in scope.

Cardholder data environment scoping and a gap assessment against PCI DSS v4.0.1, including the requirements that became mandatory in 2025.

A secure development lifecycle your engineering team will actually follow, with the gates placed where they catch problems rather than where they slow releases.

A readiness assessment mapped to the Trust Services Criteria, telling you exactly what will fail before the auditor tells you at a higher price.

An independent security assessment of one of your suppliers, producing a decision you can put in front of a risk committee.

Schema-driven testing of an API including an authorisation matrix across every role and endpoint — the class of flaw automated scanners consistently miss.

A configuration review of an AWS, Azure or GCP account against CIS benchmarks, covering identity, network, storage exposure and logging.

Software composition analysis and container image scanning, with exploitability triage rather than a raw CVE dump.

Testing of your internet-facing perimeter: exposed services, patch currency, TLS posture and default credentials.

Assumed-breach testing from inside your network: lateral movement, privilege escalation and directory service configuration.

Static and dynamic testing of a mobile application against OWASP MASVS, covering local storage, certificate pinning and the backend it talks to.

Quarterly external vulnerability scanning of your cardholder data environment, delivered through an Approved Scanning Vendor.

A controlled phishing campaign measuring click, credential submission and reporting rates, with follow-up training for those who engage.

A hardening review of a single platform — Active Directory, a database, a Kubernetes cluster or a firewall estate — against CIS benchmarks.

A retest of previously reported findings, producing a validation letter stating what was fixed, what remains and what is new.

Static analysis with manual review of security-critical paths: authentication, authorisation, cryptography and payment handling.

Authenticated and unauthenticated testing of a web application against OWASP ASVS, combining an automated toolchain with manual validation of every critical and high finding by a named consultant.

Assessment of wireless networks at a site: authentication strength, segmentation from corporate systems and rogue access point detection.

Support through Visa, Mastercard, Verve, NIBSS and EMV Level 2 and 3 certification.

End-to-end ISO/IEC 27001:2022 implementation: risk assessment, controls, documentation, internal audit and support through the certification audit.

A managed route to a PCI DSS Report on Compliance: scoping, remediation and evidence assembly, with the assessment performed by a Qualified Security Assessor.

An objective-based adversary simulation testing detection and response, not just whether vulnerabilities exist.

A point-in-time SOC 2 Type I report, usually the fastest route to satisfying an enterprise procurement requirement.

A managed route to a SOC 2 Type II report, covering readiness, the observation period and the audit itself.

Ongoing discovery and monitoring of your internet-facing estate, with alerting on new exposure.

A four-hour response commitment with a pre-agreed team, contract and access model, so the paperwork is done before the incident.

A named senior security leader accountable for your security programme, governance and regulator-facing security obligations.

A managed vulnerability management programme: scanning, triage, tracking and verification of remediation.

A playbook that gets you to a defensible regulator notification inside the statutory window, written before you need it.

An assessment of your international data transfers and the mechanism each one relies on, including cloud processing outside the country.

A documented impact assessment for a high-risk processing activity, with mitigations and a residual risk conclusion your DPO can sign.

A process for handling data subject access requests within the statutory period, including identity verification and redaction.

Readiness assessment against the Kenya Data Protection Act with the controller or processor registration pack for the ODPC.

An assessment of your processing against the Nigeria Data Protection Act 2023, with the specific actions needed before your annual audit return.

A readiness assessment against South Africa's Protection of Personal Information Act, including Information Officer obligations.

Privacy notices and a consent framework that meet the transparency standard without being unreadable.

A record of processing activities built from how your systems actually work, with a retention schedule you can defend and operate.

The annual data protection compliance audit and the filing of your Compliance Audit Return with the NDPC.

A named Data Protection Officer discharging the statutory role, including regulator contact and data subject escalation.

A review of your regulatory capital position and prudential ratios against the requirements attached to your licence.

Expected credit loss model documentation and independent validation, at the standard your auditor will require.

A risk-based audit universe and annual plan that your audit committee can approve and your team can deliver.

A compliance due diligence pack for a funding round or acquisition — either preparing your side or assessing a target.

An independent review of how you hold and reconcile customer funds — the single control most likely to end a payment licence if it fails.

A review of your tax position across companies income tax, VAT, withholding tax and payroll obligations.

Transfer pricing documentation for intra-group transactions, meeting local file requirements.

A forensic investigation into suspected fraud or misappropriation, conducted to a standard that survives challenge.

IFRS 17 implementation for insurance contracts, delivered with actuarial partners.

A full outsourced internal audit function delivering an annual programme approved by your audit committee.

A managed statutory audit of your financial statements, delivered through a registered audit firm.

Independent validation of a machine learning model in production: performance, stability, explainability and the governance around it.

An anti-bribery programme aligned to ISO 37001, covering gifts, facilitation payments, third-party intermediaries and whistleblowing.

A complaints and fair-treatment framework meeting the CBN Consumer Protection Framework, with the reporting your regulator expects.

Board and committee charters, delegation of authority and a governance framework compliant with the codes that apply to your entity.

Validation of a credit scoring model including fairness testing across protected characteristics.

An assessment against the digital lending rules in your market, covering pricing disclosure, data use and debt collection conduct.

An enterprise risk management framework with a populated risk register and key risk indicators that produce a usable board report.

Readiness for sustainability disclosure under IFRS S1 and S2, including climate-related risk identification.

A review of your marketing and in-product messaging against financial promotions rules, before a regulator does it for you.

A fraud risk framework covering first-party, third-party and internal fraud, with chargeback and dispute handling.

An internal control framework built on COSO, with controls documented at a level that supports testing rather than assertion.

Identification of your important business services, the resources they depend on, and the maximum disruption each can tolerate.

A framework for managing outsourced and third-party relationships, including the material-outsourcing notifications your regulator requires.

A briefing session for your board on a specific regulatory topic and the personal accountability attached to it.

Structured preparation for CAMS, CISA, CISM or ICA certification.

A single seat on a scheduled open-enrolment course.

A named compliance officer covering conduct, consumer protection and licence conditions outside the AML perimeter.

Access to the maintained policy library with an annual refresh reflecting regulatory change.

A private course delivered for your team, tailored to your products and risks.

An annual training programme across AML, privacy and security, with completion tracking you can show an examiner.