Choose the route
Select Singapore, UAE mainland/VARA or DIFC/DFSA, or Australia. ADGM/FSRA remains a separate route.
PUBLIC CONTROL SIGNAL LABS · 10 MINUTES
Assess regulatory control evidence
across the globe.
Choose a country or jurisdiction, trace each control to its public source, record the evidence you can show, and receive a gate-based decision signal with lane-level coverage and next actions. Singapore, UAE and Australia are available now; more country routes can be added to the same workflow.
Select an option to open its control-evidence lab below.
Use this safely
Do not enter customer names, account numbers, transaction details, personal data or confidential documents. This is an independent browser-based review aid. It is not produced, approved, endorsed, authorised or certified by MAS, VARA, DFSA, CBUAE, AUSTRAC, APRA, ASIC or any government authority.
HOW IT WORKS
A result you can use in the next meeting.
Each answer updates a traceable control row. The primary result is a decision gate; lane coverage is shown only as supporting context.
Record the evidence
For each control test, select Meets, Partial, Does not meet, Not assessed or Not applicable. Record only non-sensitive references.
Assess the signal
Press Assess this matrix after completing every applicable status. The control result, risk gate and action then appear together.
Take the actions
Use the gaps, lane signals and official source links in your internal review. Results remain in this browser unless you export them.
PLAIN-LANGUAGE GUIDE
The key terms, in one minute.
These short definitions help first-time users read the source matrix. They are orientation only; the linked primary sources remain the authority for scope and interpretation.
TBML
Trade-based money laundering
Moving or disguising value through trade by manipulating price, quantity, description, documents or counterparties.
PF
Proliferation financing
Funding the development, acquisition or transfer of weapons of mass destruction or related delivery systems.
CDD
Customer due diligence
Identifying and verifying the customer and beneficial owner, understanding the relationship and applying ongoing review where required.
FEAT
Responsible-AI principles
Fairness, Ethics, Accountability and Transparency—the four principles used in the MAS responsible-AI reference path.
COSMIC
Financial-crime information sharing
Singapore’s secure financial-crime information-sharing platform and related public reference materials; this tool is not a replacement for it.
Scope note: This page uses regulator and law names only to identify public source paths. It is not produced, approved, endorsed, authorised or certified by any named authority.
SIGNAL DECISION LOGIC
Critical controls override the aggregate indicator.
The coverage indicator is secondary. The primary result is a source-derived control gate, with a separate lane view so a strong area cannot hide a material gap elsewhere.
SIGNAL LABS
Open a jurisdiction-specific signal.
These calculations are an independent review method derived from the source-to-control matrix below. They are not percentages prescribed by a regulator.
1 Select route→2 Record evidence→3 Assess→4 Export or remediate
SINGAPORE · INDEPENDENT REVIEW AID RNX-SIG-SG-01
Singapore control evidence lab
Trace AI governance, AML/CFT, beneficial ownership, trade-risk escalation and controlled information-sharing evidence to their public source paths.
8 SOURCE ROWS · 8 TESTS
SOURCE TRACE MATRIX
What the signal is actually testing
Source rows identify the public reference; control tests state the question; evidence tests state what can be shown; result and risk are outputs.
MAS FEAT / AI governance referenceResponsible-AI reference · independent evidence path
AI use-case owner and human reviewDefine the decision, owner, affected people, materiality and override path.
EvidenceUse-case inventory, owner, risk classification, human-review and override records.
ResultAwaiting assessment
RiskNot rated
MAS Technology Risk GuidelinesGuideline · technology and third-party risk
Technology, model and vendor accountabilityKeep cloud, vendor, incident and model-change responsibility visible.
EvidenceVendor register, responsibility map, change control, incident process and review date.
ResultAwaiting assessment
RiskNot rated
MAS Notice 626Notice · AML/CFT risk assessment and mitigation
ML/TF risk assessment and mitigationIdentify, assess and mitigate customer, product, delivery and geographic risk.
EvidenceApproved risk assessment, mitigation plan, review trigger and accountable owner.
ResultAwaiting assessment
RiskNot rated
MAS Notice 626 + GuidelinesNotice/guidance · customer due diligence
Beneficial ownership and legal personsIdentify and verify ownership/control, then manage opaque or layered structures.
EvidenceOwnership map, verification source, refresh trigger and escalation trail.
ResultAwaiting assessment
RiskNot rated
MAS Notice 626 + financial-crime guidanceNotice/guidance · transaction and trade risk
TBML, PF and suspicious-activity escalationDetect multiple red flags and escalate with rationale, ownership and records.
EvidenceTrade-document review, red-flag library, threshold, rationale and decision owner.
ResultAwaiting assessment
RiskNot rated
MAS Notice 656Notice · single counterparty group exposures
Large-exposure concentration controlsTest whether exposure measurement, aggregation, limits and escalation for a single counterparty group are governed and evidenced.
EvidenceExposure aggregation methodology, limit monitoring, exception/escalation records and management review.
ResultAwaiting assessment
RiskNot rated
MAS Notice 637Notice · risk-based capital adequacy
Capital adequacy and risk-weighted exposure governanceTest whether capital-ratio calculation, risk-weighted exposures, leverage and ICAAP-related governance are supported by traceable controls and evidence.
EvidenceCapital calculations, reconciliation/validation records, ICAAP documentation, approvals and regulatory disclosures.
ResultAwaiting assessment
RiskNot rated
MAS FSM-N02 / COSMIC materialsInformation-sharing · internal governance
Confidential information-sharing governanceControl access, referral rationale, confidentiality, retention and auditability.
EvidenceApproval procedure, safeguards, records, access review and audit trail.
ResultAwaiting assessment
RiskNot rated
Signal rule: each row is scored independently. A critical Does not meet or Not assessed row is Critical; a critical Partial row is High. “Meets” records reported evidence; it does not verify the evidence or establish compliance.
OFFICIAL SOURCE PATHS
Verify the current source before relying on a signal.Each source row below maps to one or more of these public references. Links open the regulator’s publication page; no paragraph-level legal conclusion is implied.PRUDENTIAL LEARNING REFERENCES
Large exposures and capital adequacyFor learning and control-review purposes, keep the historical 2018 Large Exposures consultation distinct from current requirements. MAS currently lists Notice 656 for exposures to single counterparty groups and Notice 637 for risk-based capital adequacy.REVIEW METADATA
Keep the assessment accountableRecord references, ownership and limitations only. Do not upload customer data or confidential evidence.SYNTHETIC SAMPLE CASE
Singapore bank using AI for AML monitoringIllustrative only: ownership refresh is incomplete, while AI governance and information-sharing evidence are available. No customer data is used.
01
AI use-case owner and human review
Evidence to look for: inventory, owner, decision purpose, affected people, risk classification and override path.
02
AI quality, explainability and oversight
Evidence to look for: data-quality checks, fairness review, explainability, override/escalation path and post-change monitoring.
03
Technology and third-party accountability
Evidence to look for: vendor register, cloud responsibilities, change control, incident process, service-level expectations and review dates.
04
Risk assessment and beneficial ownership
Evidence to look for: approved risk assessment, ownership/control map, verification source, refresh trigger and escalation for opaque structures.
05
TBML, PF and suspicious-activity escalation
Evidence to look for: trade-document review, red-flag library, escalation threshold, case rationale and human decision owner.
06
Confidential information-sharing governance
Evidence to look for: confidentiality rules, access approval, referral rationale, safeguards, retention and audit trail.
Complete all control statuses, then press Assess this matrix.
ASSESSMENT RESULT
Assessment complete.
Control-level results are shown in the matrix above.
0%weighted evidence coverage
0Meets
0Partial
0Open
0Critical gaps
Priority gaps
- Assessment result will appear here.
Next actions
- Assessment result will appear here.
Download / email this resultEmail routing: Sender: your signed-in email account · To: enter manually. Generated in your browser. Opening an email draft shares its draft text with your email provider. For non-English entries, use the print dialog to save PDF. Email opens a draft without an attachment; attach the saved PDF before sending.
Indicative review support only. This is not a compliance rating, filing decision or regulatory conclusion. CSV, PDF, print and email actions appear only after a completed assessment; data stays in your browser.
DUBAI / UAE · INDEPENDENT REVIEW AID RNX-SIG-UAE-01
UAE route and virtual-asset signal lab
Start by selecting the correct route. CBUAE/onshore, Dubai/VARA and DIFC/DFSA are not interchangeable; ADGM/FSRA is in Abu Dhabi and remains separate.
6 SOURCE ROWS · 6 TESTS
SOURCE TRACE MATRIX
What the signal is actually testing
Source rows identify the public reference; control tests state the question; evidence tests state what can be shown; the route gate is assessed separately.
UAE Federal AML LawFederal Decree-Law No. 20 of 2018, as amended
Entity and regulator perimeterIdentify the entity, activity, location and applicable regulatory perimeter.
EvidenceLicence, activity, location and selected CBUAE/VARA/DFSA path.
ResultAwaiting assessment
RiskNot rated
CBUAE AML/CFT RulebookCDD, beneficial-owner and risk-based measures
AML/CFT and customer riskIdentify and verify customers, beneficial owners and risk factors.
EvidenceCDD, BO, PEP/sanctions, source of funds and escalation records.
ResultAwaiting assessment
RiskNot rated
VARA AML/CFT risk-assessment rulesVirtual-asset risk and Travel Rule path
Virtual-asset risk and analyticsAssess VA, technology, product, client and counterparty risk, with blockchain-evidence capability.
EvidenceVA risk assessment, Travel Rule data, VASP due diligence, analytics tool review and triggers.
ResultAwaiting assessment
RiskNot rated
CBUAE AML/CFT RulebookRisk-based supervision and transaction review
Trade finance and TBMLReview trade documents, value, goods, counterparties and unusual routes.
EvidenceTrade-document review, valuation checks and escalation trail.
ResultAwaiting assessment
RiskNot rated
DFSA Crypto Token regimeDIFC-specific token suitability and conduct reference
Token suitability and ongoing monitoringDocument token purpose, governance, technology, compliance impact and ongoing review.
EvidenceToken assessment, approval rationale, monitoring record, custody controls and change review.
ResultAwaiting assessment
RiskNot rated
CBUAE STR guidance / VARA RulebookSuspicious transaction/activity escalation
Reporting and escalationAssign escalation, reporting responsibility, rationale and retention.
EvidenceInternal escalation, decision record, filing owner and recordkeeping.
ResultAwaiting assessment
RiskNot rated
Signal rule: a critical control that is Does not meet or Not assessed is shown as Critical; a critical Partial control is shown as High. The tool never decides which UAE regulator legally applies.
Route before you scoreChoose the entity’s location, licence and activity first. This page provides reference paths; it does not decide which regulator legally applies.
OFFICIAL SOURCE PATHS
Verify the selected route’s source before relying on a signal.CBUAE, VARA and DFSA routes are deliberately separated. The links are source paths, not a legal determination of regulator coverage.REVIEW METADATA
Keep the assessment accountableRecord references, ownership and limitations only. Do not upload customer data or confidential evidence.SYNTHETIC SAMPLE CASE
Dubai virtual-asset perimeter reviewIllustrative only: the perimeter and AML controls are partly evidenced, but trade-document review is missing. No wallet or customer data is used.
01
Entity, licence and route
Evidence to look for: location, licence, regulated activity, delivery channel and the selected CBUAE/VARA or DFSA path.
02
AML/CFT and customer risk
Evidence to look for: customer-risk method, beneficial ownership, PEP/sanctions screening, source of funds and escalation records.
03
Virtual-asset risk and analytics
Evidence to look for: VA risk assessment, wallet/counterparty review, Travel Rule data, VASP due diligence and analytics testing.
04
Trade finance and TBML
Evidence to look for: trade documents, goods/value consistency, counterparties, free-zone exposure and escalation for unusual routes.
05
Token suitability and service controls
Evidence to look for: token assessment, approval rationale, custody/platform controls, vendor register, incidents and exit considerations.
06
Suspicious-activity escalation
Evidence to look for: internal escalation, decision rationale, reporting responsibility, review quality and record retention.
Complete all control statuses, then press Assess this matrix.
ASSESSMENT RESULT
Assessment complete.
Control-level results are shown in the matrix above.
0%weighted evidence coverage
0Meets
0Partial
0Open
0Critical gaps
Priority gaps
- Assessment result will appear here.
Next actions
- Assessment result will appear here.
Download / email this resultEmail routing: Sender: your signed-in email account · To: enter manually. Generated in your browser. Opening an email draft shares its draft text with your email provider. For non-English entries, use the print dialog to save PDF. Email opens a draft without an attachment; attach the saved PDF before sending.
Indicative review support only. This is not a compliance rating, filing decision or regulatory conclusion. CSV, PDF, print and email actions appear only after a completed assessment; data stays in your browser.
AUSTRALIA · INDEPENDENT REVIEW AID RNX-SIG-AU-01
Australia AML/CTF and resilience signal lab
Keep the AML/CTF transition lane separate from the operational-resilience lane so one result cannot hide a material gap in the other.
6 SOURCE ROWS · 6 TESTS
SOURCE TRACE MATRIX
What the signal is actually testing
Source rows identify the public reference; control tests state the question; evidence tests state what can be shown; AUSTRAC and APRA remain separate lanes.
AUSTRAC AML/CTF obligationsAct/rules/guidance · entity and designated service
Entity and designated service scopeIdentify whether the entity and service fall within the applicable AML/CTF perimeter.
EvidenceEntity classification, designated service, registration and transition stage.
ResultAwaiting assessment
RiskNot rated
AUSTRAC CDD and transition rulesInitial and ongoing customer due diligence
AML/CTF program, CDD and transition controlIdentify, assess, manage and mitigate ML/TF risk while controlling any transition overlap.
EvidenceRisk assessment, program, initial CDD, ongoing CDD, transition class and change record.
ResultAwaiting assessment
RiskNot rated
AUSTRAC SMR / TTR guidanceReporting and recordkeeping
Reporting and recordkeepingDetect reportable matters, assign filing responsibility and retain records.
EvidenceSMR/TTR workflow, deadline checks, Travel Rule applicability and records.
ResultAwaiting assessment
RiskNot rated
AUSTRAC program assuranceTraining, testing and independent evaluation
Training, testing and assuranceTest whether the AML/CTF program operates, is reviewed and is remediated.
EvidenceTraining, independent evaluation, scenario testing and issue log.
ResultAwaiting assessment
RiskNot rated
APRA CPS 230Prudential Standard · operational risk
Critical operations and toleranceMaintain critical operations within tolerance through severe disruption.
EvidenceCritical operations, maximum tolerable disruption, data-loss limits, scenarios and recovery.
ResultAwaiting assessment
RiskNot rated
APRA CPS 230 / CPG 230Material service provider management
Material service providersManage provider, fourth-party, contract, incident and exit dependencies.
EvidenceProvider register, contracts, fourth-party risk, incidents and exit plan.
ResultAwaiting assessment
RiskNot rated
Signal rule: a critical control that is Does not meet or Not assessed is shown as Critical; a critical Partial control is shown as High. AUSTRAC reporting and APRA resilience outputs are not merged into one legal conclusion.
OFFICIAL SOURCE PATHS
Keep AML/CTF and resilience source paths separate.AUSTRAC transition material and APRA CPS 230 answer different control questions; verify the current source and applicable transition stage.REVIEW METADATA
Keep the assessment accountableRecord references, ownership and limitations only. Do not upload customer data or confidential evidence.SYNTHETIC SAMPLE CASE
Australian fintech AML and resilience reviewIllustrative only: the AML/CTF program is partial, reporting evidence is missing and CPS 230 provider-exit evidence is still open. No institutional data is used.
01
Entity, service and transition scope
Evidence to look for: entity classification, designated service, registration, accountable owner and transition stage.
02
AML/CTF program, CDD and transition
Evidence to look for: risk assessment, program, initial CDD, ongoing CDD, enhanced measures, transition class and review cadence.
03
Reporting and recordkeeping
Evidence to look for: SMR/TTR workflow, Travel Rule applicability, filing deadline control, quality review and retention.
04
Training, testing and assurance
Evidence to look for: independent evaluation, training completion, scenario testing, issue log and remediation owner.
05
Critical operations and tolerance
Evidence to look for: critical operations, disruption and data-loss tolerances, scenario tests, recovery evidence and reporting.
06
Material service providers
Evidence to look for: provider register, contract controls, fourth-party dependency, incident history, concentration and exit strategy.
Complete all control statuses, then press Assess this matrix.
ASSESSMENT RESULT
Assessment complete.
Control-level results are shown in the matrix above.
0%weighted evidence coverage
0Meets
0Partial
0Open
0Critical gaps
Priority gaps
- Assessment result will appear here.
Next actions
- Assessment result will appear here.
Download / email this resultEmail routing: Sender: your signed-in email account · To: enter manually. Generated in your browser. Opening an email draft shares its draft text with your email provider. For non-English entries, use the print dialog to save PDF. Email opens a draft without an attachment; attach the saved PDF before sending.
Indicative review support only. This is not a compliance rating, filing decision or regulatory conclusion. CSV, PDF, print and email actions appear only after a completed assessment; data stays in your browser.
PUBLIC / INTERNAL BOUNDARY
Useful in public. Governed in private.
This page is for early-stage review, training, workshop preparation and evidence-gap discussion. A bank or regulated institution would need its own approved methodology, current source validation, authorised access, secure evidence handling, audit trail and qualified human review before relying on an output.
REFERENCE PATHS
Check the current source before relying on a result.
These links are starting points for source verification. Regulatory content, effective dates and scope can change.
Singapore · MAS Notice 626AML/CFT requirements for banks↗Singapore · MAS COSMICFinancial-crime information-sharing reference↗UAE · Federal AML LawFederal Decree-Law No. 20 of 2018 reference↗UAE · CBUAE RulebookCDD, beneficial ownership and STR reference↗Dubai · VARA Travel RuleVirtual-asset transfer information reference↗DIFC · DFSA cryptoDIFC-specific conduct and custody reference↗Australia · AUSTRAC obligationsAML/CTF program and CDD reference↗Australia · APRA CPS 230Operational-risk and resilience reference↗
Last reviewed: 27 September 2026 · Independent review-support tool · Not official regulatory instruction.