How a digital bank turned manual, spreadsheet compliance into a program it can prove.
Sector
Digital Banking
Jurisdiction
Philippines
Frameworks in Scope
BSP MORB Part IX (AML/CFT) and BSP Issuances
Program Scope
Nine Capabilities, Three Workstreams
The team had strong documentation and clear processes, but limited real-time visibility into obligation coverage, into how new BSP issuances affect MORB (AML/CFT) obligations, and into end-to-end remediation status. Work spanned multiple regulators and business units, yet lived largely in spreadsheets and ad hoc trackers.
AML obligations under MORB Part IX were not held in a searchable registry with evidence anchored in board-approved internal policy. BSP circulars were followed manually. Gap findings were not managed in one place from assignment through closure.
The engagement ran on primary sources, including MORB obligations, internal AML policy, BSP issuances and compliance frameworks. Each had clear ownership, executive visibility and measurable outcomes.
Excel-heavy tracking and limited real-time visibility into obligation coverage, regulatory change impact and remediation status.
No structured registry linking BSP MORB (AML/CFT) requirements to board-approved internal policy with evidence-grade citations.
BSP issuances read, interpreted and summarized by hand, without a unified feed, classification or executive briefs.
Policy-to-regulation gap reviews apart from a single remediation workflow, with weak traceability from surfaced gap to verified closure.
Manuals, annexes and testing artifacts kept apart instead of one evidence and audit-readiness view.
The effect of new BSP circulars on MORB obligations assessed by hand, with limited linkage to internal policy updates.
The program connects regulatory source law, internal policy, business-unit accountability and audit-grade evidence at once.
01 · Structured
Discrete obligations are extracted from BSP MORB Part IX, normalized and held in one searchable register, each with metadata for ownership, severity and mapping to policy and controls.
02 · Traceable
Every obligation is tied to verbatim source text and to AML policy language, with inline citations showing where internal standards meet or diverge from the regulator's rules.
03 · Measured
Policy coverage is scored against the obligation set, so leadership sees which requirements are fully evidenced, which are partial and which are open gaps.
04 · Live
New BSP circulars are captured continuously and surfaced in a central dashboard with proactive notifications, one front door for regulatory change.
05 · Triage
Each issuance is triaged for relevance to the bank's license and operating model, tagged by intent and linked to the MORB sections it amends or supersedes.
06 · Executive
Action-required issuances produce one-page summaries for leadership. What changed, who is affected and what must happen next, with clear ownership.
07 · Routed
Gaps become trackable items with human confirmation, assignment to business units, deadlines and status from open through review to completion.
08 · Defensible
Remediation outcomes, evidence and control mappings roll up into a living evidence matrix, with pass, partial and fail states attached to each obligation.
09 · Auditable
Validated remediation propagates into audit-readiness views, a traceable chain from surfaced gap to verified closure, linked back to the register.
The bank is moving from manual spreadsheets and ad hoc tracking to a single enterprise program across the full compliance operating stack. Leadership-grade reporting ties each layer to primary regulatory and policy sources, so complexity becomes visibility, not noise.
