Loading officer dashboard…
Loading officer dashboard…
Loading officer dashboard…
CBK BS-1 · PG/04 · ODPC consent · NDTCP threshold
| Regulator | Obligation | Trigger | Evidence | Owner | Status |
|---|---|---|---|---|---|
Central Bank of Kenya Digital Credit Providers Regulations, 2022 | Digital credit provider licensing, fit-and-proper, policy, and renewal evidence | license renewal, ownership change, or board policy refresh Due: 2026-09-30 · annual | dcp-license-renewal-pack Control: regulatory-horizon-radar | regulatory operations company secretary |
| Pack | Ownership | Obligations | Custody artifacts | Package hash | Status |
|---|---|---|---|---|---|
Central Bank of Kenya Digital credit provider licensing, third-party notices, customer-protection, pricing, and policy evidence Next export: 2026-09-30 | regulatory operations Reviewer: company secretary | cbk-dcp-licensing cbk-dcp-third-party-notice consumer-protection-complaints |
Regulated activity, licensing, registration, authorization, key-person, fit-and-proper, change-control, product launch, country expansion, enterprise mapping, action-pack, and custody evidence.
| Obligation | Regime | Due | Days | Status |
|---|---|---|---|---|
| No live regulatory deadlines are available. | ||||
Central Bank of Kenya Digital Credit Providers Regulations, 2022 | Thirty-day Central Bank notice before third-party financing, investment, or operating arrangements | new lender, bureau, telco, cloud, collections, or capital partner Due: before signature · event-driven | third-party-substitutability-table Control: bcbs-third-party-resilience | vendor risk vendor risk committee | Watch |
Office of the Data Protection Commissioner Data Protection Act, 2019 | Data controller and processor registration, DPO ownership, privacy notice, and data-subject rights handling | registration renewal, new processor, or privacy-notice change Due: 2026-10-31 · annual | consent-ledger-and-dsar-register Control: nist-csf-govern | privacy office data protection officer | Ready |
Office of the Data Protection Commissioner Data Protection Act, 2019 | DPIA and Data Commissioner consultation decision for high-risk processing | new automated decisioning, alternate data, biometric, geolocation, or cross-border processing Due: before launch · event-driven | high-risk-dpia-and-consultation-decision Control: customer-harm-guardrail | privacy engineering privacy risk council | Watch |
Financial Reporting Centre Proceeds of Crime and Anti-Money Laundering Act (POCAMLA) | Suspicious or Unusual Transactions reporting and reviewer evidence | sanctions hit, structuring signal, mule network pattern, fraud ring, or adverse-media alert Due: within 2 days of suspicion · continuous | suspicious-transaction-reporting-queue Control: nist-csf-detect-respond | financial crime money laundering reporting officer | Ready |
Central Bank of Kenya National Payment System Act, 2011 | Payment service provider authorization, settlement, audit, and incident evidence | float anomaly, settlement exception, PSP change, outage, or payment incident Due: monthly operating review · monthly | payment-provider-oversight-pack Control: auditability-chain | payments operations payments risk forum | Ready |
Central Bank of Kenya / Office of the Data Protection Commissioner Digital Credit Providers Regulations, 2022 / Data Protection Act, 2019 | Complaint, correction, deletion, dispute, and customer-harm remediation SLA | complaint, adverse-action challenge, DSAR, consent withdrawal, or disputed repayment allocation Due: daily SLA review · continuous | consumer-protection-sla-register Control: cfpb-specific-reasons | customer operations conduct risk owner | Ready |
Block partner go-live until the notice pack, contract clause map, provider exit path, and board approval are linked.
Require DPIA, purpose map, retention rule, data-minimisation evidence, and consultation decision before production enablement.
| 1adf2dfa8312...d9cea654 |
| Watch Resolve watch obligations before marking the pack regulator-ready. |
Office of the Data Protection Commissioner Controller registration, processor inventory, consent ledger, DSAR, DPIA, and consultation evidence Next export: 2026-10-31 | privacy office Reviewer: data protection officer | odpc-controller-processor-registration odpc-high-risk-dpia consumer-protection-complaints | consent-ledger-and-dsar-register nist-csf-govern / 32d1764a69a2...aaae8e81 high-risk-dpia-and-consultation-decision customer-harm-guardrail / ed0ab7b91b73...f090fc5f consumer-protection-sla-register cfpb-specific-reasons / aa4216b0f7ac...99afc398 | ed57579c7a5c...8c88ec90 | Watch Resolve watch obligations before marking the pack regulator-ready. |
Financial Reporting Centre Suspicious or Unusual Transactions queue, reviewer decisioning, sanctions alerts, and submission receipts Next export: continuous | financial crime Reviewer: money laundering reporting officer | frc-suspicious-transaction-reporting | suspicious-transaction-reporting-queue nist-csf-detect-respond / eb66e1a9835f...aaa695b9 | 21a768116c57...46f86e83 | Ready Ready for regulator export and board evidence-pack review. |
Central Bank of Kenya Payment service provider authorization, settlement controls, float reconciliation, and incident evidence Next export: monthly operating review | payments operations Reviewer: payments risk forum | cbk-national-payment-oversight | payment-provider-oversight-pack auditability-chain / 107d025d42a6...d60ccb09 | 52ee1dc941c9...a448c5b0 | Ready Ready for regulator export and board evidence-pack review. |
| Activity | Authority and service | Approval evidence | Review | Status | Hash |
|---|---|---|---|---|---|
Digital credit origination and servicing Kenya | Central Bank of Kenya Digital credit provider | licence ready / scope ready / product ready / disclosure ready / block ready | 24/90d | within | da5fa5f40c17...c1b136c7 |
Payment collection, wallet, and settlement orchestration Kenya | Central Bank of Kenya Payment service provider / NPS participant oversight | licence ready / scope ready / product ready / disclosure ready / block ready | 18/90d | within | 600a378b7eac...7b680b59 |
Personal data processing for credit, collections, and fraud controls Kenya | Office of the Data Protection Commissioner Data controller and processor registration | licence ready / scope ready / product ready / disclosure ready / block ready | 30/90d | within | 064160b7286b...c5f35953 |
Investor note, participation, and capital markets distribution Kenya | Capital Markets Authority Capital markets approval and intermediary permissions | licence ready / scope ready / product ready / disclosure ready / block ready | 35/90d | within | 9a256cb42e13...e86fb1df |
Credit-linked insurance and protection products Kenya | Insurance Regulatory Authority Insurance intermediary, MGA, or licensed partner gate | licence ready / scope ready / product ready / disclosure ready / block ready | 45/90d | within | 399d3cf5e554...6712e451 |
Regional rollout and partner integration East Africa | Host-country regulators Country-specific licence, registration, and no-objection route | licence ready / scope ready / product ready / disclosure ready / block ready | 40/90d | within | ad5406e52370...fd1a0812 |
| Licence or registration | Owner | Evidence | Status | Hash |
|---|---|---|---|---|
Digital Credit Provider licence Central Bank of Kenya / CBK-DCP-2026-001 | regulatory operations | filing approved / expiry 260/90d / renewal ready / fee ready / policy ready / shareholders ready / ack ready | within | f211cef36293...b014e8fb |
Payment service provider authorisation reliance pack Central Bank of Kenya / CBK-NPS-2026-014 | payments operations | filing approved / expiry 210/90d / renewal ready / fee ready / policy ready / shareholders ready / ack ready | within | 7724b6852837...a72d52ee |
Data controller and processor registration Office of the Data Protection Commissioner / ODPC-REG-2026-084 | privacy office | filing approved / expiry 310/90d / renewal ready / fee ready / policy ready / shareholders ready / ack ready | within | 01dc68a0932b...1baf2013 |
Capital markets product and intermediary approval pack Capital Markets Authority / CMA-APP-2026-027 | capital markets desk | filing approved / expiry 180/90d / renewal ready / fee ready / policy ready / shareholders ready / ack ready | within | 0b2e3417e0a3...f3843a4c |
AML/CFT/CPF reporting-institution and MLRO evidence pack Financial Reporting Centre / FRC-RI-2026-012 | financial crime compliance | filing approved / expiry 365/90d / renewal ready / fee ready / policy ready / shareholders ready / ack ready | within | d411792d94b4...29fbe2c5 |
Insurance intermediary, MGA, and protection-product gate Insurance Regulatory Authority / IRA-GATE-2026-009 | insurance governance | filing approved / expiry 240/90d / renewal ready / fee ready / policy ready / shareholders ready / ack ready | within | e8720c02ebfa...e429503d |
| Key person | Authority | Filing evidence | Status | Hash |
|---|---|---|---|---|
Daniel Mwangi chief executive officer and DCP senior officer | Central Bank of Kenya | fit ready / funds ready / conflict ready / criminal ready / appointment ready / board ready / refresh 25/365d | within | bb1bf2dd2d5b...c9c3d055 |
Grace Wanjiru company secretary and board filing owner | Central Bank of Kenya | fit ready / funds ready / conflict ready / criminal ready / appointment ready / board ready / refresh 32/365d | within | 7c754836eb4f...7c0c7e83 |
Mercy Cherono data protection officer | Office of the Data Protection Commissioner | fit ready / funds ready / conflict ready / criminal ready / appointment ready / board ready / refresh 20/365d | within | e3d3f1e9b1d6...326ff51c |
Hassan Ali money laundering reporting officer | Financial Reporting Centre | fit ready / funds ready / conflict ready / criminal ready / appointment ready / board ready / refresh 18/365d | within | a7746e0ac687...bdab4fb2 |
Peter Njoroge payment service risk accountable officer | Central Bank of Kenya | fit ready / funds ready / conflict ready / criminal ready / appointment ready / board ready / refresh 22/365d | within | bab4b4da4790...5108dc81 |
| Trigger | Authority / owner | Hold evidence | Status | Hash |
|---|---|---|---|---|
| Significant shareholding, controller, or beneficial ownership change | Central Bank of Kenya / company secretary | window 45/30d / board ready / notice ready / no-objection ready / customer ready / hold ready | within | 82cbdba5c318...f942547d |
| Third-party financing, investment, bureau, cloud, or outsourcing arrangement | Central Bank of Kenya / vendor risk and legal control | window 40/30d / board ready / notice ready / no-objection ready / customer ready / hold ready | within | 8ab7c5722850...8091ebff |
| Payment service, e-money, float, settlement, or product-name change | Central Bank of Kenya / payments operations | window 35/30d / board ready / notice ready / no-objection ready / customer ready / hold ready | within | c6c4a1e78ddd...f7fd60b9 |
| High-risk processing, automated decisioning, cross-border transfer, or processor change | Office of the Data Protection Commissioner / privacy office | window 33/30d / board ready / notice ready / no-objection ready / customer ready / hold ready | within | 15079d23f4ff...4d7f4e05 |
| Capital markets offer, bookbuilding, distribution, or investor platform change | Capital Markets Authority / capital markets desk | window 60/45d / board ready / notice ready / no-objection ready / customer ready / hold ready | within | 718254ba913b...6af2d353 |
| Country expansion, partner launch, or host-regulator perimeter shift | host-country regulators / platform expansion | window 75/60d / board ready / notice ready / no-objection ready / customer ready / hold ready | within | 1819db02e31e...9eba4a46 |
| Product | Owner | Gate evidence | Status | Hash |
|---|---|---|---|---|
Logbook loans Kenya | credit product governance | product ready / legal ready / data ready / AML ready / payment ready / CMA ready / insurance ready / price ready / live-read ready | within | 4f1ac36ccc65...52e4d9a1 |
Situ Haraka nano loans Kenya | credit product governance | product ready / legal ready / data ready / AML ready / payment ready / CMA ready / insurance ready / price ready / live-read ready | within | 8780d1d28e30...64f195b4 |
Wallet, collections, and repayment rail orchestration Kenya | payments operations | product ready / legal ready / data ready / AML ready / payment ready / CMA ready / insurance ready / price ready / live-read ready | within | 1f4460c652e8...3a955fa9 |
Investor note and participation products Kenya | capital markets desk | product ready / legal ready / data ready / AML ready / payment ready / CMA ready / insurance ready / price ready / live-read ready | within | a150f5d915bc...bff7e3d7 |
Insurance protection and Cap17 products Kenya | insurance governance | product ready / legal ready / data ready / AML ready / payment ready / CMA ready / insurance ready / price ready / live-read ready | within | 26269f5a2c05...da0a0ed4 |
| Domain | Owner | Mapped controls | Evidence | Status | Hash |
|---|---|---|---|---|---|
CBK DCP, NPS, supervisory, and regulatory return coverage licence | regulatory operations and payments risk | 5/5 mapped / coverage 100.0% | DCP licence, NPS authorisation, return production, supervisory response, and payment settlement controls are mapped. | within | ff8b9294afd7...3042d9ff |
ODPC registration, privacy, AML, records, and customer-harm route activity | privacy office, financial crime, and records manager | 6/6 mapped / coverage 100.0% | Data registration, DPIA, AML/CFT, records, and customer-harm controls are linked. | within | e814f6e612d5...17a97fe8 |
Product, pricing, capital markets, insurance, and fair-value launch coverage launch | product governance, legal control, and capital markets desk | 5/5 mapped / coverage 100.0% | Product approval, pricing, investor, insurance, and responsible-lending gates are mapped. | within | 3abdc7b4a5a1...e63cc73e |
Board, key-person, fit-and-proper, tax, audit, and assurance coverage person | company secretary and compliance assurance | 5/5 mapped / coverage 100.0% | Key-person filings, board approvals, assurance, audit, and statutory obligations are mapped. | within | 53d95d548bbe...f43722e1 |
Risk data, live-read, cyber, identity, third-party, and expansion coverage domain | risk data governance, platform expansion, and security governance | 7/7 mapped / coverage 100.0% | Perimeter evidence maps to data lineage, third-party, cyber, identity, live-read, and custody controls. | within | 4ccbd3d5c028...e4b3fa78 |
| Control | Metric | Value | Management action | Status | Hash |
|---|---|---|---|---|---|
Regulated activity classification and launch blocking Every regulated activity should have identified authority, approved scope, product approval, customer disclosure, and a launch block when unclear. | activities with clear authority, scope, product approval, disclosure, and launch hold | 100.0% / 100.0% | Block product, partner, or country launch until activity scope and authority mapping are approved. | within | c5658dac7785...739516d8 |
Licence, registration, authorization, renewal, and acknowledgement currentness Licences, registrations, no-objections, and regulatory approvals should be current before activity begins or continues. | licence and registration rows approved, acknowledged, paid, policy-backed, and outside renewal warning window | 100.0% / 100.0% | Refresh approval, renewal, fee, policy, shareholder, and acknowledgement evidence. | within | df770a4df34a...39bcc81d |
Expiring licence zero-tolerance posture Renewal windows should be visible early enough to avoid unauthorized regulated activity. | licences inside renewal warning window | 0 / 0 | Open renewal workpaper, fee, policy, and board approval workflow for expiring licences. | within | ad019dd8a3e3...b2f354d8 |
Key-person, fit-and-proper, source-of-funds, and appointment filing Directors, senior officers, MLRO, DPO, payment, and capital markets accountable officers should have current fit-and-proper and appointment evidence. | key persons with fit-and-proper, conflict, source-of-funds, criminal check, appointment notice, and board approval evidence | 100.0% / 100.0% | Refresh key-person filing, board approval, conflict, source-of-funds, and criminal-check evidence. | within | 6a9b4567e1b2...226c4997 |
Regulatory change-control, notice, no-objection, and contract hold Ownership, financing, third-party, product, payment, data, capital-markets, and country changes should be held until notice or approval evidence is complete. | change triggers with notice window, board approval, regulator notice, no-objection, customer notice, and contract hold | 100.0% / 100.0% | Hold change execution until regulator notice, no-objection, customer notice, and board approval evidence are attached. | within | db16f6b6374c...9f30902d |
Product launch licensing, privacy, AML, payment, capital-markets, insurance, and disclosure gates Product launch should prove all applicable regulated-activity gates are complete before activation. | product gates with legal, regulatory, data, AML, payment, capital markets, insurance, pricing, and live-read controls | 100.0% / 100.0% | Block launch until product, legal, privacy, AML, payment, capital markets, insurance, pricing, and live-read gates pass. | within | c55f93e71bee...ded4ab87 |
Payment, data-protection, AML, and live-read coverage Regulatory perimeter evidence should cover payments, personal data, AML/CFT/CPF, and live-read blocking for every product. | product gates with payment, data-protection, AML, and live-read controls | 100.0% / 100.0% | Repair payment, ODPC, AML, and live-read controls before go-live or renewal. | within | 0905af48d52c...71dbfb0e |
Cross-border and host-regulator expansion readiness Regional launches should prove host-country perimeter, licensing, partner, payment, data, and customer disclosure evidence. | activity rows with country-specific approval, no-objection, disclosure, and launch blocking | 100.0% / 100.0% | Hold expansion until host-regulator, partner, payment, data, and disclosure evidence is mapped. | within | b0e1cd6c880d...7793ae0e |
Regulatory perimeter enterprise manifest coverage Perimeter governance should reconcile to regulatory horizon, returns, supervisory response, payment, privacy, AML, products, board, audit, risk data, third-party, cyber, identity, live-read, and custody controls. | domain controls mapped to enterprise evidence with no open findings | 100.0% / 100.0% | Map missing enterprise controls and close perimeter findings before attestation. | within | 5e8a732f9be6...0d830d51 |
Regulatory perimeter evidence custody and package integrity Licensing and perimeter evidence should be reproducible, tamper-evident, retained, and exportable for regulators, board, and auditors. | evidence rows with custody hashes and within status | 100.0% / 100.0% | Regenerate perimeter custody manifests and close incomplete evidence rows before regulator export. | within | febd53d31376...8c16dd5e |
| Trigger | Owner | Action | Deadline | Status | Hash |
|---|---|---|---|---|---|
| No regulatory perimeter licensing action packs are required for the current evidence set. | |||||
| Request | Regulator / owner | Due / SLA | Legal / route | Status | Hash |
|---|---|---|---|---|---|
Digital credit provider license refresh evidence request intake ready / scope ready / owner ready | Central Bank of Kenya regulatory operations | 31d / 15d | legal ready route ready / board ready | within | e47a9a9504c8...19c011c8 |
Credit file sample, affordability, collateral, and provisioning evidence request intake ready / scope ready / owner ready | Central Bank of Kenya credit risk review | 24d / 10d | legal ready route ready / board ready | within | 4dbec28da967...15369cc9 |
AML/CFT monitoring alert, reviewer disposition, and STR receipt evidence request intake ready / scope ready / owner ready | Financial Reporting Centre financial crime compliance | 18d / 7d | legal ready route ready / board ready | within | 2bf2c73322a5...c3fa072d |
DPIA, consultation decision, processor, and DSAR control evidence request intake ready / scope ready / owner ready | Office of the Data Protection Commissioner privacy office | 21d / 10d | legal ready route ready / board ready | within | cb364549dcf7...44bf2338 |
Payment settlement, float reconciliation, and incident response evidence request intake ready / scope ready / owner ready | Central Bank of Kenya payments risk forum | 28d / 10d | legal ready route ready / board ready | within | a8c2b960e8e2...56863289 |
| Response pack | Artifacts | Review | Submission | Status | Hash |
|---|---|---|---|---|---|
DCP licensing policy, ownership, pricing, and customer-protection response pack cbk-dcp-license-refresh-request | 18/18 | QA ready / legal ready redaction ready | submitted yes ack yes / script ready | within | fc56c3e56a62...bc47cc7c |
Credit lifecycle, collateral, impairment, pricing, and conduct file sample pack cbk-credit-risk-file-sample | 24/24 | QA ready / legal ready redaction ready | submitted yes ack yes / script ready | within | 9ad5b26c2201...6522404f |
AML/CFT typology, alert disposition, no-tipping-off, and STR receipt pack frc-aml-cft-surveillance-request | 16/16 | QA ready / legal ready redaction ready | submitted yes ack yes / script ready | within | 47fec279484a...c47fdf81 |
High-risk processing DPIA, consultation, consent, retention, and processor evidence pack odpc-dpia-consultation-request | 20/20 | QA ready / legal ready redaction ready | submitted yes ack yes / script ready | within | 07623cc0eee0...1f840b35 |
Payment authorization, settlement exception, float reconciliation, and incident response pack cbk-payment-settlement-incident-request | 19/19 | QA ready / legal ready redaction ready | submitted yes ack yes / script ready | within | 3ca1fa8591f6...9884339d |
| Finding | Severity | Remediation | Validation | Status | Hash |
|---|---|---|---|---|---|
Third-party notice evidence must be attached before partner signature Central Bank of Kenya / vendor risk | moderate | open 9d / due 16d root cause ready / harm ready | evidence ready independent ready / board ready | within | 014d97cd12cb...bca53264 |
High-risk processing launch gate needs consultation decision evidence Office of the Data Protection Commissioner / privacy engineering | high | open 13d / due 18d root cause ready / harm ready | evidence ready independent ready / board ready | within | d8677f085d83...1ad48a01 |
Complaint redress root-cause evidence must reconcile to conduct outcome reporting Central Bank of Kenya / conduct risk | moderate | open 11d / due 19d root cause ready / harm ready | evidence ready independent ready / board ready | within | 18bd6fba8981...17495cef |
Payment settlement exception evidence needs incident and float reconciliation linkage Central Bank of Kenya / payments operations | moderate | open 8d / due 22d root cause ready / harm ready | evidence ready independent ready / board ready | within | e39035a98aca...e75e019f |
AML alert dispositions require reviewer and filing receipt custody hash Financial Reporting Centre / financial crime compliance | high | open 10d / due 14d root cause ready / harm ready | evidence ready independent ready / board ready | within | f6641e91ae43...8afcce38 |
| Commitment | Milestones | Control evidence | Governance | Status | Hash |
|---|---|---|---|---|---|
Refresh board-approved DCP policy pack and pricing schedule before renewal submission Central Bank of Kenya / company secretary | 5/5 / 29d | 2/2 mapped | board ready / second line ready audit ready / regulator update ready | within | c4cddd9a619a...9397fdb8 |
Evidence thirty-day third-party notice controls for material providers before signature Central Bank of Kenya / vendor risk | 6/6 / 21d | 2/2 mapped | board ready / second line ready audit ready / regulator update ready | within | 6c055cf2de45...319fe230 |
Attach DPIA, consultation decision, retention, processor, and consent evidence to launch gates Office of the Data Protection Commissioner / privacy office | 7/7 / 24d | 2/2 mapped | board ready / second line ready audit ready / regulator update ready | within | 36714cfdefe1...9c7f1d19 |
Join complaint root-cause, redress, pricing, and customer-harm evidence for conduct reporting Central Bank of Kenya / conduct risk | 5/5 / 18d | 2/2 mapped | board ready / second line ready audit ready / regulator update ready | within | 9a2bb685630f...ab2abacb |
Retest regulator-ready export packs with manifest, records, assurance, and board custody hashes Central Bank of Kenya / regulatory operations | 8/8 / 14d | 3/3 mapped | board ready / second line ready audit ready / regulator update ready | within | daee34d41056...e9e6019c |
| Domain control | Stage / owner | Manifest | Evidence | Status | Hash |
|---|---|---|---|---|---|
Supervisory request intake, scope, owner, due-date, legal-hold, and escalation control Keep every supervisory request inside the response SLA with named owners and legal review before evidence collection. | request regulatory operations | 3/3 mapped | Request register with agreed scope, due date, evidence owner, legal hold, confidentiality class, and board escalation route. coverage 100% / findings 0 | within | 1652dc1f2cc6...af7a6e58 |
Evidence response pack completeness, QA, redaction, legal review, approval, submission, and acknowledgement control Block supervisory submissions until required artifacts, redactions, legal review, and approval evidence are complete. | response compliance assurance | 3/3 mapped | Response package inventory with required artifacts, QA review, legal review, redaction, management approval, submission, acknowledgement, and custody hashes. coverage 100% / findings 0 | within | 406606a8efd9...5758e57f |
Supervisory finding root-cause, customer-harm, remediation, independent validation, and closure control Keep all supervisory findings inside due date with validated closure evidence and customer-harm review. | finding enterprise risk | 3/3 mapped | Finding register with severity, root cause, customer-harm assessment, management action, independent validation, closure evidence, and board reporting. coverage 100% / findings 0 | within | e027e8823f5e...03654c8b |
Regulatory commitment milestone, dependency, update, assurance, and delivery control Track every regulatory commitment to milestone completion, dependency clearance, update scripts, and independent review. | commitment regulatory operations | 3/3 mapped | Commitment register with milestones, dependencies, second-line review, audit notice, board approval, regulator update, and evidence-control links. coverage 100% / findings 0 | within | 1fe53014d6fa...5d7c4b8a |
Single-message regulator communication, legal privilege, confidentiality, redaction, and management approval control Maintain a single approved response narrative for each supervisory matter with legal and privacy checks. | response legal control and compliance | 3/3 mapped | Communication log with approved response scripts, privilege review, confidentiality labels, redaction evidence, and regulator acknowledgement. coverage 100% / findings 0 | within | 9730ac12498a...8b0f1d06 |
Supervisory evidence manifest traceability, retention, package hash, and board custody control Regenerate supervisory custody hashes and reconcile manifest mappings before regulator or board submission. | assure records manager and board secretariat | 10/10 mapped | Enterprise manifest mappings, records retention, evidence routes, assurance hashes, board package hashes, and reproducible supervisory export evidence. coverage 100% / findings 0 | within | 7f319451e334...0296819e |
| Supervisory control | Metric | Current | Limit | Status | Evidence |
|---|---|---|---|---|---|
Supervisory request intake and due-date control Overdue or unscoped supervisory requests require risk and compliance committee escalation. | Requests with intake, scope, owner, due date, legal review, evidence route, board route, and fail-closed source controls | 100% | 100% | within | Supervisory requests should be logged, scoped, owner-assigned, legally reviewed, confidentiality classified, evidence-routed, board-escalatable, and answered inside due date. e3938be4acf2...696aef11 |
Supervisory evidence response completeness Incomplete supervisory submissions require compliance assurance escalation before delivery. | Response packs with all artifacts, QA, legal review, redaction, approval, submission, acknowledgement, and evidence links | 100% | 100% | within | Responses to supervisors should be complete, accurate, legally reviewed, redacted, approved, submitted, acknowledged, and reproducible. fdd7dc36a128...a45c6001 |
Supervisory finding remediation and closure High, critical, or overdue findings require board risk committee escalation. | Findings closed with root cause, customer-harm review, remediation evidence, independent validation, and board reporting | 100% | 100% | within | Supervisory findings should have root-cause analysis, customer-harm assessment, management action, validated closure evidence, and board reporting. 46725bea3f2a...cbf9b7e5 |
Regulatory commitment milestone tracking Overdue or unmapped commitments require executive owner and board risk committee escalation. | Commitments delivered with milestones, mapped controls, board approval, second-line review, audit notice, regulator update, and cleared dependencies | 100% | 100% | within | Regulatory commitments should be owned, milestone-tracked, control-mapped, board-approved, independently reviewed, updated to the regulator, and delivered before due date. c553ad62d9a4...92433dec |
Board and senior management supervisory escalation Missing board route blocks supervisory attestation. | Supervisory matters with board route, board reporting, or board-approved commitment evidence | 100% | 100% | within | Material supervisory requests, findings, and commitments should have senior management ownership and board escalation evidence. c708a763c03a...bc6a9dab |
Legal privilege, confidentiality, and redaction control Unreviewed privileged or confidential evidence blocks submission. | Requests and responses with legal privilege review, confidentiality classification, and redaction evidence | 100% | 100% | within | Supervisory evidence should preserve legal privilege, confidentiality, data protection, and appropriate redaction before submission. 3042d38b9743...aeb38f3b |
Regulator communication consistency Conflicting or unapproved regulator messaging requires legal and compliance escalation. | Responses and commitments with single-message scripts, approval, submission or update readiness, and acknowledgement evidence | 100% | 100% | within | Regulator communications should use a controlled narrative, approved facts, update discipline, and acknowledgement evidence. 5ebf935a0489...0c1c5d22 |
Synthetic-data and unavailable-source action blocking Synthetic or unavailable supervisory evidence blocks regulator-ready submission. | Supervisory request, response, finding, and commitment actions blocked unless source evidence is live and linked | 100% | 100% | within | Supervisory submissions and remediation actions should fail closed on synthetic, unavailable, or unlinked source evidence. a7bfc499b0ed...2b673f57 |
Enterprise control manifest traceability Missing manifest traceability blocks supervisory evidence export. | Supervisory domain controls mapped to enterprise manifest rows and evidence routes | 100% | 100% | within | Supervisory requests, findings, and commitments should trace to enterprise controls, source routes, artifacts, retention, export packages, and custody hashes. c5e92f4d34db...a426ad22 |
Supervisory evidence custody Missing custody hashes block board and regulator evidence pack sign-off. | Supervisory evidence rows with reproducible SHA-256 custody hashes | 100% | 100% | within | Supervisory request, response, finding, commitment, domain control, action, and board evidence should be reproducible for audit and supervision. 444b422d0d2b...7742492c |
| Action | Status | Evidence | Owner | Deadline | Hash |
|---|---|---|---|---|---|
| No supervisory exam response or regulatory commitment action packs are required for the current evidence set. | |||||
Amina Oketch capital markets responsible officer | Capital Markets Authority | fit ready / funds ready / conflict ready / criminal ready / appointment ready / board ready / refresh 30/365d | within | ebcd6c6bd00c...3ef00718 |
Tanzania and Uganda pilots East Africa | platform expansion | product ready / legal ready / data ready / AML ready / payment ready / CMA ready / insurance ready / price ready / live-read ready | within | b3af78999b3b...8de38f41 |