regulatory-compliance

Structured review of an AML program against FATF / FFIEC expectations — the 5 pillars, common findings, regulatory citations with primary sources. Used by `aml-kyc-analyst` (primary).

Classify a Bermuda (non-insurance) entity into its BMA sector + licence class and resolve its AML/ATF position before any capital/Code/filing advice. Used by `bma-financial-institutions-specialist`. Traverses the BMA decision trees, then the sector files.

Draft or refresh a compliance policy that survives an exam and an annual refresh — scope the regime, keep policy separate from procedure, frame conduct as outcomes, give every layer a cite + named owner + exceptions. Used by policy-and-procedure-writer. Gap analysis against a new regulation stays in regulatory-mapping.

Compliance / second-line control testing rubric — design adequacy + operating effectiveness for compliance controls (KYC quality, monitoring rule tuning, training coverage, regulatory-mapping freshness). Distinct from SOC1/SOC2 financial-control testing — second-line compliance testing has different scoping, sampling, and reporting. Reach for this skill when scoping a periodic compliance-monitoring program, training MI/QC analysts, or responding to an exam request for "evidence your controls work." Used by `risk-and-controls-specialist` (primary) and `aml-kyc-analyst`.

Pre-exam playbook for regulator examinations — PBC tracker, walkthrough rehearsal, mock interviews, exam-week posture, MRA / MRIA / management-letter response patterns. Used by `examination-prep-specialist` (primary).

KYC file + EDD review playbook — risk-rating logic, BOI / UBO verification, source-of-wealth vs source-of-funds, EDD trigger conditions, file completeness checklist, sign-off chain. Reach for this skill when reviewing a single customer file, designing the firm's KYC standard, or training analysts. Used by `aml-kyc-analyst` (primary).

Map internal controls / policies / procedures to specific regulatory citations (regulator + section + paragraph). Gap-analysis output format. Used by `risk-and-controls-specialist` + `policy-and-procedure-writer`.

Build / refresh an enterprise risk register that survives audit committee scrutiny — three lines of defense assignment, inherent + residual rating math, KRI design, risk-appetite mapping, control coverage, and the half-yearly refresh cadence. Reach for this skill when standing up a new ORM/ERM framework, refreshing the register, or remediating an "outdated register" finding. Used by `risk-and-controls-specialist` (primary) and `policy-and-procedure-writer`.

Disposition framework for sanctions screening alerts — true-match vs false-positive triage, secondary-match evidence chain, escalation criteria, documented-rationale template, list-version capture, and the audit-trail requirements that survive examiner review. Reach for this skill when designing the disposition process or training analysts on hit clearance. Used by `aml-kyc-analyst` (primary).

Draft SAR / STR narratives that survive regulator review — typology + the W's + what to omit + reviewer sign-off chain. Used by `aml-kyc-analyst` (primary). Confidentiality class always at least client-confidential; often regulator-only.

Period-end supervisory / regulatory return preparation playbook — data lineage, maker-checker, materiality / threshold definitions, common return families (FATCA, CRS, BMA EBS, Solvency II, supervisory returns, capital adequacy / RBC), late-filing protocols. Reach for this skill 4-6 weeks before a periodic filing or when responding to a regulator data request. Used by `regulatory-reporting-analyst` (primary).