A generic compliance checklist can be dangerous because obligations attach to facts: where an entity is formed, what it sells, whose money it handles, and where customers or counterparties are located.
Inventory facts by jurisdiction
Record incorporation, tax residence, licenses, beneficial owners, bank locations, customer residence, payment flows, custody, lending, investment advice, virtual assets, and cross-border transfers. Product labels do not determine regulatory status; actual activity does.
Date every fact and preserve contracts, diagrams, and product screenshots as evidence. A market entered through remote sales may still create consumer, sanctions, tax, payments, or reporting duties.
Convert rules into an obligation register
For each candidate rule, capture the issuing authority, exact scope, triggering fact, effective date, filing or control, frequency, owner, evidence, exception process, and counsel conclusion. Link to official text rather than a vendor summary.
Separate universal risk controls from jurisdiction-specific duties. FATF recommendations inform risk-based AML design, while domestic law determines whether the company is regulated, what checks are mandatory, and which authority receives reports.
Work a dated triage
Illustrative case as of 15 August 2026: two entities sell into three markets. Twelve material facts produce seven candidate triggers; qualified local review confirms four obligations and three controls are due. These counts organize work and are not legal conclusions for another company.
Assumptions: no client funds are held, no credit is extended, all beneficial owners are disclosed, transaction currency is retained, and USD translations use the dated treasury rate. Change any assumption and re-run licensing, sanctions, AML, tax, privacy, and reporting analysis.
- Facts collected12 count
- Triggers logged7 count
- Obligations confirmed4 count
- Controls due3 count
FATF Recommendations (2026-08-15). Illustrative register workflow; counts are not prevalence or legal advice.
Operate, test, and escalate
Screen counterparties at onboarding and when relevant lists or ownership change; preserve query inputs, list version, timestamp, result, reviewer, and disposition. OFAC and other sanctions regimes differ, so one-country screening logic cannot be assumed globally sufficient.
Sensitivity: adding custody or money transmission can turn a low-touch software flow into a licensable activity; entering another state or country can multiply registrations. Require compliance approval before product or market changes, with local counsel where the interpretation is material.
Frequently asked questions
Is this register legal advice?
No. It structures facts and evidence; qualified counsel must resolve material jurisdiction-specific questions.
Does using a payment processor remove obligations?
No. It may allocate duties contractually, but product, merchant, tax, sanctions, and reporting obligations can remain.
How often should the register be reviewed?
At a fixed cadence and before changes to products, flows, entities, owners, or markets.
Can one global policy cover every country?
It can set a baseline, but local addenda and controls are needed where laws differ.
Answers to the questions this topic usually leaves hanging.
How we sourced this
Every statistic in Map Regulatory Triggers Before Mapping Controls is attributed. Where a number is an estimate rather than a census, the note says so.
- FATF RecommendationsInternational risk-based AML and counter-financing framework.
- FinCEN beneficial ownership informationOfficial U.S. filing status and guidance.
- OFAC sanctions programsOfficial sanctions programs and country information.
- FCA HandbookOfficial UK financial-services rules and guidance.
Primary sources used for this edition.
The bottom line
Map one money flow and record every jurisdiction, party, asset, and handoff.
If you want the adjacent decisions after Map Regulatory Triggers Before Mapping Controls, start with Financial controls, Compliance auditing, Financial Documentation and Record Keeping, IT Project Failure Statistics.
