Warning signs include missing CMB authorization, weak customer verification above the reporting threshold, poor retention of transaction records, no dedicated risk team, and limited monitoring for suspicious trading. Another red flag is inconsistent handling of foreign-user access or custody arrangements. If reporting is ad hoc rather than operationalized, the programme is probably not aligned with the framework’s supervisory expectations.
How to read the warning signs in practice
The strongest signal is not a single failed control, but a pattern: the programme cannot demonstrate that onboarding, verification, monitoring, reporting, and retention are operating as a repeatable compliance process. Where those pieces are handled manually or inconsistently, the issue is usually structural, not just procedural.
That is why weak customer verification, incomplete recordkeeping, and ad hoc reporting often appear together. They usually point to a programme that has not been translated from policy into operating controls, which makes supervisory review, audit evidence, and escalation much harder to defend.
A useful way to test alignment is to ask whether the programme can prove three things consistently: who was allowed in, what activity was monitored, and what was retained for review. If any of those cannot be shown on demand, the compliance posture is likely weaker than the written policy suggests.
For broader control context, the same pattern shows up in ISO/IEC 27001:2022 Information Security Management and ISO/IEC 27002:2022 Information Security Controls, where access control, logging, and governance only matter if they are actually operationalised.
What the common failure patterns usually mean
Missing authorization or weak handling of higher-risk users is usually a governance failure first and a technical failure second. It indicates that the firm may not be able to evidence who approved access, what thresholds triggered enhanced checks, or how exceptions were managed over time.
Poor retention of transaction records is especially important because it breaks the chain between activity, review, and supervisory follow-up. If records are incomplete, inconsistent, or not retrievable, the programme may still appear active while failing the evidential standard expected in an examination.
Limited monitoring for suspicious trading often means the programme has not defined alert logic, ownership, or escalation paths clearly enough to support action. In practice, this can leave unusual activity visible in theory but unreviewed in operation, which is exactly the gap regulators tend to focus on.
Where foreign-user access or custody arrangements are handled inconsistently, the main issue is usually boundary control. That should prompt a check on whether the programme can distinguish domestic from cross-border obligations, third-party roles, and custody responsibilities without relying on informal judgement.
For a control-model view of those weaknesses, FATF Recommendations, AML and KYC framework is the clearest external reference for customer due diligence and suspicious activity expectations, while SOC 2 Trust Services Criteria is useful for thinking about evidence, monitoring, and operational consistency.
What practitioners should verify before trusting the programme
What to verify: Confirm that approval, verification, record retention, monitoring, and exception handling are owned by named functions with clear evidence trails. A programme is materially stronger when it can show the same answer across policy, workflow, and reporting, not just in documentation.
- Can the team produce recent examples of onboarding and enhanced verification decisions?
- Are suspicious activity alerts reviewed on a schedule, with recorded disposition and escalation?
- Do records survive long enough to support both internal audit and supervisory review?
- Are foreign-user access and custody decisions governed by a documented rule set rather than ad hoc handling?
Common mistake: Treating a compliance programme as a reporting exercise instead of an operating control set. If reporting exists but cannot be traced back to real decisions, the programme may look mature while still failing the underlying supervisory expectation.
Practitioner takeaway: The key test is whether the programme can demonstrate repeatable control execution under review pressure, not whether it can describe the right policy language.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, CIS Controls v8 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.OV — Oversight | Ongoing oversight is central to proving the programme is operating as intended. |
| PR.AA — Identity Management, Authentication, and Access Control | Customer verification and access handling are core to the warning signs in the programme. | |
| DE.CM — Continuous Monitoring | Suspicious trading monitoring and record-based detection are material to the issue. | |
| Recommendation — Establish oversight checks that verify compliance controls are actually operating, not just documented. Enforce verified access decisions and review exceptions for higher-risk users and access paths. Implement continuous monitoring that produces reviewable alerts, dispositions, and escalation records. | ||
| CIS Controls v8 | 5 — Account Management | Verification and access governance problems often show up as weak account and access control. |
| 8 — Audit Log Management | Poor record retention and weak monitoring directly implicate audit logging and retention. | |
| 13 — Network Monitoring and Defense | Suspicious activity monitoring needs ongoing detection and triage discipline. | |
| Recommendation — Define and review account access rules so access decisions are traceable and consistently enforced. Retain audit records long enough to support investigation, review, and supervisory examination. Use monitored detection workflows that surface suspicious behaviour for review and escalation. | ||
| NIST SP 800-63 | IAL — Identity Assurance Level | Customer verification quality is tied to assurance in identity proofing and verification. |
| AAL — Authenticator Assurance Level | Access controls matter where stronger assurance is needed for higher-risk functions. | |
| FAL — Federation Assurance Level | Foreign-user access and cross-boundary trust depend on federation assurance and governed trust. | |
| Recommendation — Set identity proofing assurance appropriate to the customer risk tier and verify exceptions. Require stronger authentication for privileged or high-impact operations. Validate federation trust and access conditions before allowing cross-organisation access. | ||
Related resources from NHI Mgmt Group
- What are the signs that a crypto compliance programme is not keeping pace with regulatory change?
- What are the signs that a crypto compliance programme in Argentina is not working?
- Who is accountable for making sure crypto KYC processes satisfy both compliance and fraud prevention requirements?
- Why do fast-changing cross-border compliance requirements create operational risk for fintech and crypto firms?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
