Controls Policy
Board-approved acquiring policies often list MCC restrictions, beneficial-ownership thresholds, and enhanced due diligence triggers with precision. Workflow engines and ticketing queues evolve weekly. The gap between the two is where residual risk accumulates.
A policy-alignment audit starts with a reconciliation matrix: each policy clause mapped to a system gate, a desk procedure, or an explicit “not automated” label. Anything unlabeled is either a control gap or an undocumented manual control.
Hong Kong platforms serving regional merchants should also confirm which local screening lists and company-search sources are wired into intake. A gate that exists in a runbook but not in the intake form is not a gate.