Internal Control Rules and AML Policies
We write internal control rules for your business, not for an abstract firm. With the required programmes, annexes and an explanation of how to apply them in daily work.
- Duration
- Two to six weeks
- Format
- Remote
- Result
- A full set of rules with annexes
Why a downloaded template fails
The most common question about this service is whether you can take generic rules off the internet and edit them lightly to save money. The honest answer: you can, and it is almost always spotted.
An inspector does not look at whether the document exists, but at whether it matches your business and your risk profile. Downloaded rules describe someone else's products, someone else's customers and someone else's geography. The gap shows on the first pages: the rules contain procedures you physically do not have, and lack procedures for what you do every day.
Downloaded template
- Someone else's products
- Someone else's customers
- Someone else's geography
- Procedures you do not have
Rules written for you
- Your products
- Your customers
- Your geography
- Procedures for the work you actually do
There is a second, practical problem. Rules that are not about you cannot be followed. An analyst opens the document, sees a process that does not match their job, and falls back on common sense. Formally a breach occurs every day, and it surfaces all at once during an inspection.
How the work runs
- AnalysisBusiness model, products, customer base, documents in force, IT systems and risk levels.
- Draft rulesWritten against the AML/CFT law, sector requirements and the risk-based approach.
- ReviewSeveral rounds of comments: you object where the text diverges from real work, we rewrite.
- HandoverFinalising and the full set. Where needed, training the responsible officer and setting up processes.
The analysis at the start is not a formality: what we see there drives the content of every programme. The review stage cannot be skipped either, otherwise you end up with the same foreign document, only more expensive.
What we need from you
- A description of the business model and products.
- Internal documents in force, if any exist.
- Information about the structure, responsible officers, IT systems and customer base, in anonymised form.
- Timely feedback on drafts.
- A single point of contact on your side.
The speed of feedback affects the timeline more than anything else. A document that sits with you for three weeks delays the project by exactly three weeks.
What you get
The full set of rules
Internal control rules with every mandatory programme, covering the organisation of control, risk management, customer identification, monitoring and record keeping.
Annexes and working forms
Questionnaire forms, checklists, registers, risk matrices, report templates and the order appointing the responsible officer.
An explanation of how to implement
A short explanatory note or a deck for management. On request, method guides for the staff.
Templates for updating
On request we hand over the forms you will use to update the rules yourselves when the law or the business changes.
Duration and format
The timeline depends on the complexity and size of the business, on how complete the material you provide is, on the number of products and the geography of operations, on whether extra methodologies and annexes are needed, and on the speed of your feedback.
Frequently asked questions
We already have rules. Do we need new ones or an update?
It depends on how well the current document describes what you do now. If the business model has not changed and the rules were written for it, an update is usually enough. If products, geography or the customer base have changed, an update becomes a rewrite. We will tell you once we have read the document.
Who approves the rules?
Your firm approves them: it is an internal document and the signature is yours. We draft them, explain every decision and answer questions during the review.
Do you help implement them or only write them?
On request we help: training the responsible officer, setting up processes and preparing for an inspection. That is a separate part of the work and its scope is fixed in the contract.
What language will the documents be in?
Russian or English. For Kazakh we work through a professional translator with a mandatory terminology check.
What does it cost?
The fee depends on the size of the business, the number of products and the geography, and on whether extra methodologies and annexes are needed. We name an exact figure after a short conversation and fix the scope in the contract.
Shall we look at your case?
Tell us the task and we will say whether it needs the full piece of work or a narrower one.
Book a consultationNorthhold Advisory is an independent consultancy. We are not affiliated with, and do not represent, the AFM of Kazakhstan, the AIFC (AFSA) or the National Bank of Kazakhstan.