Building the risk and compliance function of a new entity
A new regulated entity must have, from day one, a complete, proportionate and demonstrable risk and compliance framework. It is a condition of the licence, an expectation of the group and the first thing the supervisor looks at.
I build this framework end to end, from the risk assessment to ongoing controls, with your teams. You start with a function that holds, documents ready for the licence application or the first inspection, and evidence and an audit trail from day one.
Is this your situation?
• You are preparing a licence application (payment institution, e-money institution or credit institution) and need to present a credible risk and compliance organisation.
• Your group is setting up a new subsidiary and expects a framework aligned with its standards, operational from opening day.
• You are launching a new regulated activity and the compliance function has yet to be designed.
• Your entity has grown fast and its foundations were never laid (risk assessment, policies, governance, controls).
• You are adopting new technologies, such as AI or automation, and want compliance built in by design.
This service is designed for payment and e-money institutions, banks and credit institutions, subsidiaries of financial groups and insurers.
What I build with you
• The risk assessment, covering operational risks and compliance risks, linked to the controls that cover them.
• Governance, with the role of senior management, committees, delegations and reporting.
• The policy framework, meaning policies, procedures and operating guides consistent with actual practice.
• The AML/CFT and sanctions framework, from customer due diligence to screening, transaction monitoring and reporting.
• Outsourcing, with oversight of critical service providers and operational resilience requirements (DORA).
• Ongoing controls at first and second level, with a control plan and indicators.
• Compliance by design for products and customer journeys.
• Training for teams and senior management, and risk culture.
How the engagement works
1. Scoping. A first conversation to understand your project, your activities and your timeline (licence, launch, group deadlines), followed by a tailored proposal.
2. Foundations. Risk assessment, governance and allocation of roles, approved with senior management.
3. Build. Policies, procedures, tools, decision circuits and control plan, put in place with your teams.
4. Go-live and handover. First controls, first committees, training, evidence file and audit trail, then handover to your officer or your team. If needed, I can hold the function while you recruit.
What drives the scope
Every project is different. The engagement depends on several factors.
• The nature of the entity and its activities.
• The timeline (licence, opening, group expectations).
• Group standards, if any.
• Available internal resources.
• The level of tooling you are aiming for.
This is why each engagement is based on a proposal built after a first conversation, tailored to your context. You receive it within 48 hours of our conversation.
Why Studio Compliance
• 25 years of experience in compliance and financial crime, across traditional banking and fintech.
• Recent experience of building a complete risk and compliance framework for a new subsidiary of a major banking group.
• Hands-on practice of outsourcing and operational resilience in a licensing context.
• CAMS certified (Certified Anti-Money Laundering Specialist) and board member of ACAMS France.
• A pragmatic approach, with a proportionate, workable and documented framework.
• Strict confidentiality, with a non-disclosure agreement (NDA) available from the first detailed conversation.
Frequently asked questions
When should the compliance function be built?
As early as possible. For a licence, the framework must be described and credible before the application is filed. For a subsidiary or a new activity, it must be operational from opening day.
How is this different from an outsourced AML/CFT officer?
Here, I build the function and its foundations. The outsourced officer runs a function that already exists. The two can follow one another if you have not recruited yet.
Will the framework be proportionate to our size?
Yes. A framework suited to your activities and actual risks is stronger and easier to defend than an oversized model.
Can you work with our group's teams?
Yes. I align the framework with group standards and work with its risk, compliance and control functions.
Will our project remain confidential?
Yes. Confidentiality is a basic condition of every engagement, and a non-disclosure agreement (NDA) can be signed before the first detailed conversation.
A licence, a subsidiary, a launch?
A first conversation is a chance to review your project and define the next steps. Write to contact@studio-compliance.com or use the contact form.