Purpose
Maintain the AML/CTF/CPF manual, proportionality rationale and related documentation so the framework stays current and scalable.
Scope
This procedure applies to annual policy review, regulator feedback, control gaps, manual updates, proportionality decisions and material business or risk changes.
Steps
| # | Action | Details | Evidence |
|---|---|---|---|
| 1 | Review policies annually | Review core AML policies, the EWRA/SARA and related procedures and SOPs at least annually | Manual review record |
| 2 | Initiate trigger-based review | Initiate prompt review after legal/regulatory change, material business-model/product/service/client/jurisdiction/technology change, regulator or FIU feedback, audit finding, incident, policy gap or control weakness | Manual review record |
| 3 | Assess regulatory alignment | Assess alignment with applicable Curaçao law, CBCS guidance, FATF standards, sanctions obligations, Bitkaya operations and current risk appetite. Use Global Digital Finance principles as a non-binding benchmark where relevant | Source comparison record |
| 4 | Update subordinate documents | Where required, update affected subordinate manuals, procedures, controls, training, system configurations and BCMS relationships in parallel to maintain consistency across the compliance framework | Change log |
| 5 | Review proportionality | Review proportionality across governance, staffing, role consolidation, CDD/EDD, technology, outsourcing, alert cadence, training and independent review. Proportionality allows Bitkaya to maintain an effective, risk-based AML/CFT framework aligned with CBCS expectations while ensuring efficiency, accountability, and scalability | Proportionality rationale |
| 6 | Confirm risk-based proportionality | Confirm proportionality is based on risk rather than size alone and does not reduce mandatory identification, beneficial-ownership, sanctions, reporting, recordkeeping or Board-accountability obligations | Proportionality rationale |
| 7 | Apply guiding principles | Apply the five proportionality guiding principles: (1) Risk-Based Application — controls applied based on ML/TF risk level, not org size alone; higher-risk services receive enhanced monitoring/EDD. (2) Scalability and Efficiency — processes, documentation and control structures designed to scale; core tools (KYC, KYT, sanctions) centralized and automated. (3) Practical Governance — governance roles may be consolidated (e.g. Compliance Officer also serves as MLRO) provided checks/balances and escalation mechanisms are maintained. (4) Resource Optimization — use of external providers for independent audit, transaction monitoring and sanctions screening to meet CBCS standards without internal duplication. (5) Continuous Alignment — reviewed annually or upon material business change, regulatory update, or audit finding | Proportionality rationale |
| 8 | Review proportionality application | Review proportionality application across AML/CFT domains: EWRA (simplified quantitative scoring, data-driven tools, annual updates unless significant change); CDD/EDD (SDD only for documented low-risk, EDD only where objective indicators warrant, digital onboarding with automated ID and sanctions verification); Transaction Monitoring (outsourced blockchain analytics and rule-based KYT, risk-based alert review: daily for high-risk, weekly for low/medium, UTR centralized under MLRO); Training (all employees receive onboarding and annual refresher, specialized training only for direct AML/CFT impact roles, external e-learning and CBCS guidance materials); Independent Review (annually by independent consultant or internal auditor, scope and depth scaled to volume and complexity) | Proportionality rationale |
| 9 | Document compensating controls | Where roles are combined, document and obtain Board approval for compensating controls such as independent assurance, segregation of approval, CEO oversight or enhanced reporting | Compensating-control assessment |
| 10 | Reassess resource capacity | Reassess resource capacity, client and transaction volumes, product scope and jurisdictional exposure annually. Scale staffing, systems, testing and three-lines-of-defence arrangements as Bitkaya grows. Proportionality transitions into a fully structured three-lines-of-defense model with expanding dedicated compliance and audit staffing | Resource-capacity assessment |
| 11 | Confirm accountability | Confirm Compliance remains accountable for the AML framework, reports directly to the CEO under the approved model, and remains operationally separate from independent audit or testing. Board retains full accountability for the AML/CFT framework | Approval record |
| 12 | Draft and review updates | Draft updates, circulate to Legal, Risk, Operations and other relevant functions for internal review, obtain MLRO sign-off to ensure regulatory alignment and consistency, and obtain Board or committee approval for high-level policies | Approval record |
| 13 | Communicate changes | Communicate approved changes to affected staff and arrange targeted training where required. Updated policies shared with impacted staff | Communication evidence |
| 14 | Version and archive | Version and archive approved and superseded documents in an access-controlled, backed-up master compliance library. MLRO is responsible for maintaining the master compliance policy library. Outdated/superseded versions retained to support audits and regulatory requests | Archived version |
| 15 | Retain review evidence | Retain the review record, source comparison, change log, proportionality rationale, approvals, communication and version-control evidence | Manual review record |
| 16 | Benchmark and integrate lessons | Policies informed by findings from internal audits and independent reviews, regulatory inspections and CBCS guidance updates, and lessons learned from STRs, alerts, or incident investigations. Continuously benchmark against FATF standards, CBCS Provisions, and Global Digital Finance principles. Evaluate proportionality adequacy through annual review of risk exposure and resource capacity, feedback from internal audits, regulatory inspections, FIU interactions, and integration of lessons learned | Effectiveness review and improvement record |
Evidence
- manual review record
- change log
- approval record
- proportionality rationale
- communication evidence
- archived version
- source and subordinate-document consistency review
- compensating-control and resource-capacity assessment
Relationships
- Policy: POL-AML-001 AML CTF CPF Compliance Manual
- Process: PRC-FCI-001 Financial Crime and Integrity
- Controls: CTRL-AML-010 Ensure AML Policy Review and Proportionality Are Maintained
- Manual coverage: sections 1.4, 2.1-2.3, 11.1-11.7 and 14.1-14.5.
Assurance
Runtime effectiveness results are maintained in Odoo and assessed through the Hermes workflow tracked in ISS-HERMES-001. This note defines design, ownership, evidence expectations and testing method; it does not contain a manually maintained operation, evidence or overall effectiveness rating.
- Design status: implemented from approved AML/CTF/CPF Compliance Manual version 2.2
History
- 2026-07-26: Added review frequencies, parallel subordinate updates, governance workflow, compensating controls and scalability assessment after a full manual rescreen.
- 2026-07-26: Created from the approved AML/CTF/CPF Compliance Manual version 2.2.