A program written once and filed in a drawer is not a program. It is a document. ComplyIQ is where your AML/CTF program, risk assessments, board approvals and independent review records live, stay current, and stay connected to the controls actually running on the floor. When the reviewer or AUSTRAC asks “show me”, it is one click, not a scramble.
An AML/CTF program is a living obligation, not a one-off deliverable. But most venues treat it as a document, written once, often by a consultant, filed, and never touched again. The independent review finds the same gaps every time because the program and the day-to-day operation have drifted apart.
The program is a static document, written once and never updated as the venue, risks or rules change.
Risk assessments sit separately from the controls meant to address them, with no demonstrable control-to-risk alignment.
There is no version control. Nobody can prove which version of the program was in force on a given date.
Board approvals and meeting minutes are not stored with the program, so governance and oversight cannot be evidenced.
Six capabilities that keep the program, the risk assessments and the governance evidence connected to the controls running every day.
Your AML/CTF program lives in one place, with a single authoritative current version. Group-level programs cascade to each venue, with venue-specific variations captured against the group baseline.
Single source of truth for the current program
Group-to-venue inheritance with local variation
Money-laundering and terrorism-financing risk assessments are documented, dated and retained, covering customer, product, channel and jurisdiction risk, and linked to the program they support.
ML/TF risk assessment captured and version-dated
Customer, product, channel and jurisdiction factors
Linked to the program and the controls
Retained for the seven-year AUSTRAC period
Each control in the program is mapped to the risk it addresses, so you can show a reviewer exactly how an identified risk is mitigated, and spot a risk with no control behind it before they do.
Controls mapped to identified risks
Gaps surfaced where a risk has no control
Demonstrable mitigation for every assessed risk
Live link to the controls running in ComplyIQ
Every change to the program is versioned and dated, with a full history. You can show exactly which program was in force on any date, the question reviewers and regulators always ask.
Full version history with dates and authors
Point-in-time view of the program on any date
Change log for every revision
Review reminders before a version goes stale
Board and senior-management approvals, meeting minutes and oversight decisions are stored with the program version they relate to, so governance is not just claimed, it is evidenced.
Board and senior-management approvals recorded against versions
Meeting minutes and oversight decisions retained
Governance visibility for the compliance officer
Approval trail ready for independent review
Independent review reports and findings are stored against the program, and remediation actions are tracked through to closure, so the next review starts from what the last one found, not from scratch.
Review reports stored with the program
Findings tracked to remediation and closure
Evidence the program improves review on review
Ready for the next independent reviewer
The program isn’t a document you revisit once a year. In ComplyIQ it stays connected to the controls running every day and to the findings that come back from review.
The group program cascades to each venue, with local variations captured.
Rolling totals and pattern windows recalculate for the patron across the group.
Board approval and minutes are recorded against the program version in force.
Controls run live in ComplyIQ, including payouts, monitoring and CDD, against the documented risks.
Independent review findings are logged and tracked to closure, feeding the next version.
The hardest part of an independent review or an AUSTRAC enquiry is not having done the work. It is proving it, quickly, in one place. ComplyIQ keeps the evidence assembled as you go, not reconstructed under pressure.
Review reminders and version control mean the program in the system is the program in force, never a stale copy nobody trusts.
Program, risk assessments, approvals, minutes and review findings sit together, not scattered across email, drives and binders.
Set the program once at group level and cascade it, so every venue runs from the same baseline with its variations documented.
Show exactly which program, which risk assessment and which approvals were in force on any given date, the question that ends most reviews.
Risk Assessments and Program is the governance layer of the platform. The risks you document here define the controls that run in payouts, monitoring and CDD, and the evidence those modules generate flows back here for review.
The payout controls you operate are defined and governed in the program.
Monitoring rules map back to the risks documented here.
Customer risk assessment methodology lives in the program.
Every program change and approval is written to the audit trail.
No. ComplyIQ is where your AML/CTF program lives once it is built: kept current, version-controlled, linked to the controls running in your venue and ready to produce when a reviewer asks.
Yes. Full version history with dates means you can produce a point-in-time view of the program, risk assessment and approvals for any date, exactly what reviewers and AUSTRAC ask for.
Set the program at group level and cascade it to every venue, with venue-specific variations captured against the group baseline. One program, consistently applied, with local context preserved.
They are stored against the program and tracked to closure as remediation actions, so the next review starts from what the last one found, and you can show the program improving over time.
Every control is mapped to the risk it addresses, and the controls running in ComplyIQ, including payouts, monitoring and CDD, link back to that mapping, so a risk without a control is visible immediately.
They are recorded against the program version they relate to, so governance and senior-management oversight are evidenced, not just asserted, when a reviewer asks.
Book a demo to see centralised program storage, control-to-risk alignment, version history, governance evidence and independent review tracking working together, so the next “show me” is one click.
