License holders are expected to maintain governance effectiveness and control discipline throughout the lifecycle of operations. Ongoing obligations include periodic reporting, material change notifications, AML/CFT monitoring, safeguarding controls (where client assets are held), and technology risk management. Expectations scale with custody exposure, product complexity, and cross-border activity.
These obligations typically apply across categories, with additional requirements where custody exposure or product complexity is high. Licensees should maintain evidence artefacts that demonstrate ongoing control effectiveness, not only written policies.
Keep accountability mapping current and maintain evidence of oversight and decision-making discipline.
Maintain risk-based monitoring, sanctions screening, reporting discipline, and auditable recordkeeping.
Where client assets are held, maintain segregation, reconciliation, and tested incident readiness.
Maintain security monitoring, change governance, vulnerability management, and resilience planning.
Maintain disclosure discipline, complaint handling, conflicts controls, and communications governance.
Notify material changes to ownership, scope, custody model, key persons, or control posture.
Reporting cadence scales with category and risk profile. The table below provides an illustrative structure for reporting. Where a license category carries custody exposure or significant cross-border flow risk, enhanced reporting and evidence updates may be expected.
A simple change register (ownership changes, scope changes, vendors, custody architecture updates, key person changes) prevents missed notifications and supports clean supervision.
Licensees should be able to respond to information requests with structured evidence. Maintaining an indexed compliance library, control logs, and version-controlled documentation reduces response time and improves clarity during engagement.
A supervisor-ready library typically includes policies, procedures, logs, and testing artefacts mapped to control owners.
Reviews may examine how controls operate, not only what policies state. Be ready to demonstrate practical workflows.
Use the guidance library for templates, supervisory notes, and evidence expectations aligned to your category.
