Solutions
Compliance, resolved in three movements.
Understand the exposure. Build the programme. Operate it with intelligence. ZLORYX is designed to work across the whole compliance lifecycle — advisory, operations and technology. The service areas below describe that scope; each engagement is defined and confirmed with you before any work starts.
How the work is organised
How the work is organised
Three movements, one system.
The service areas are organised in three movements. They can be approached one at a time or as one programme; each starts from what the business is regulated for.
Understand
Know the risk
Where the business meets risk, which obligations attach to it, and how far the current programme is from what the regulator will expect to see.
-
Business and customer risk assessment
An assessment of the money-laundering, terrorist-financing and proliferation-financing risk across the business — customers, products, channels, geographies — and a customer-level rating method with a visible rationale.
Typical outputs
- Business risk assessment
- Customer risk rating method
- Risk register and rationale
-
AML readiness review
A structured read of where the programme stands before a supervisor, auditor or counterparty asks — what exists, what is evidenced, what is missing.
Typical outputs
- Readiness report
- Prioritised findings
- Evidence inventory
-
Gap analysis
Obligations mapped against controls, one by one, so the distance between the two is explicit and ordered by consequence.
Typical outputs
- Obligation-to-control map
- Gap list ordered by consequence
- Remediation plan
Build
Control the process
Policies, procedures, controls, people and technology brought into one structure that a supervisor can read and a team can run.
-
AML / CFT / CPF programme design
The programme the business is required to run — governance, ownership, the compliance function and the documentation that holds it together — designed to fit the business rather than a template.
Typical outputs
- Programme structure and governance
- Roles and responsibilities
- Compliance-function design
-
Policies, procedures and controls
Written so that they are followed: policies that state the rule, procedures that state the steps, controls that leave evidence.
Typical outputs
- Policy set
- Procedures and workflows
- Control descriptions and evidence points
-
KYC / KYB and due diligence frameworks
Identification, verification, beneficial ownership and enhanced due diligence — designed around how the business actually onboards people and entities.
Typical outputs
- Onboarding framework
- Beneficial-ownership method
- Enhanced due diligence triggers and steps
Operate
Move forward
The area where a programme has to stay current as regulation moves: screening, monitoring, reporting, review and training.
-
Screening operations and monitoring design
Sanctions screening against the UN Consolidated List, the UAE Local Terrorist List, the OFAC SDN and non-SDN lists and the UK Sanctions List, run in the ZLORYX Platform with every decision recorded — and the design of the transaction and activity monitoring rules you run in your own systems, proportionate to the risk.
Typical outputs
- Screening procedure and monitoring-rule design
- Alert-handling procedure
- Decision records
-
Reporting and MLRO support
Help for the compliance officer in preparing suspicious-activity reports and regulatory returns, which the business itself submits through goAML, so that obligations can be met on time and evidenced.
Typical outputs
- Reporting procedures
- Regulatory-return calendar
- Compliance-officer support
-
Independent review and assurance
Testing and review of the programme against its own rules and the regulator’s expectations, with findings the business can act on.
Typical outputs
- Independent review report
- Control testing results
- Findings and actions
-
Training and awareness
Practical training for front-line teams, management and boards, built around the business’s own obligations and cases.
Typical outputs
- Role-based training
- Board and management briefings
- Attendance and assessment records
The service areas above describe the scope ZLORYX is designed to cover; the final catalogue is confirmed by ZLORYX, and any engagement is scoped to the obligations you actually carry. Nothing on this page is a promise of scope, price or outcome.
How an engagement runs
Detect. Gather. Resolve.
The same working rhythm the platform is built on, as ZLORYX intends to apply it to an engagement.
-
A first conversation
You tell us what the business is regulated for and what you are trying to resolve. No scope is proposed before the obligations are understood.
-
The obligations, read
We read the framework that applies to your licence and activities and map it to what exists today.
-
A scoped proposal
One document: what will be done, what you will receive, who does what, and the timeline.
-
The work, evidenced
Delivered in movements, with every output kept where an examiner can find it.
-
Kept current
Where the engagement continues, regulatory change is read for you and mapped to the controls it touches.
Relationship to the platform
The same rhythm, built into software.
The ZLORYX client Platform is built around the same movements — a Customer / Entity 360 record with sanctions screening, alerts, evidence, reports and an audit trail around it. KYC / KYB, risk, monitoring, cases and reviews are not available to clients.
It is operating today; advisory and operational work still do not depend on it, and neither depends on the other.
Live Live — clients sign in at app.zloryx.ae.
The modules
Start with what you are regulated for.
Tell us the licence, the activities and the state of the programme. The conversation starts with questions; any scope is defined and confirmed with you before work begins.