eMail
support@celestiaig.com
Internal Audit On Regulatory Findings
Driving Effective Risk Control Self Assessment on Regulatory Findings
Disruptive Internal Audit For Regulatory Confidence
In rapidly evolving digital finance markets, regulatory compliance is no longer just a regulatory checkbox, it’s a strategic competitive necessity. We deliver disruptive regulatory compliance and regulatory audit advisory services that align with Bank Negara Malaysia (BNM) and Monetary Authority of Singapore (MAS) expectations, reduce supervisory and operational risk, plug internal control gaps, and embed repeatable compliance into product development and operations.
We ensure stringent policy, draft, and guideline alignments with BNM’s Risk Management in Technology (RMiT) and AML/CFT policy documents and MAS’s Technology Risk Management (TRM) Guidelines, outsourcing and AML/CFT notices all of which drive board-level expectations for governance, risk oversight, resilience and AML controls in both jurisdictions.
Who We Serve
* Fintechs (payments, wallets, digital lending, token platforms)
* Digital banks and challenger banks
* Crypto & digital token service providers (where regulated)
* Money Services Businesses (MSB) & remittance operators
* Payment Service Providers & acquiring processors
* Traditional FI’s launching digital channels in Malaysia & Singapore
We ensure stringent policy, draft, and guideline alignments with BNM’s Risk Management in Technology (RMiT) and AML/CFT policy documents and MAS’s Technology Risk Management (TRM) Guidelines, outsourcing and AML/CFT notices all of which drive board-level expectations for governance, risk oversight, resilience and AML controls in both jurisdictions.
Who We Serve
* Fintechs (payments, wallets, digital lending, token platforms)
* Digital banks and challenger banks
* Crypto & digital token service providers (where regulated)
* Money Services Businesses (MSB) & remittance operators
* Payment Service Providers & acquiring processors
* Traditional FI’s launching digital channels in Malaysia & Singapore
Our Core Advisory Outcomes
● Board-grade compliance assurance mapped to BNM & MAS expectations.
● Measurable reduction in regulatory, operational and reputational risk.
● Remediated internal process gaps, contemporary policy framework, and role-based staff competency.
● Faster product time-to-market with embedded “compliance by design” controls.
● Demonstrable supervisory evidence to satisfy on-site/desk reviews.
● Measurable reduction in regulatory, operational and reputational risk.
● Remediated internal process gaps, contemporary policy framework, and role-based staff competency.
● Faster product time-to-market with embedded “compliance by design” controls.
● Demonstrable supervisory evidence to satisfy on-site/desk reviews.
Regulatory Gap & Readiness Assessment
● Rapid regulatory mapping (AMLA, Payment Services Act / MAS Notices, RMiT/TRM, Outsourcing).
● Identify where policies, processes, systems and evidence deviate from regulator expectations.
● Prioritised remediation roadmap (risk-weighted, quick wins vs. strategic fixes).
● Regulatory gap heatmap, remediation plan with owners & timelines, executive summary for Board.
● Identify where policies, processes, systems and evidence deviate from regulator expectations.
● Prioritised remediation roadmap (risk-weighted, quick wins vs. strategic fixes).
● Regulatory gap heatmap, remediation plan with owners & timelines, executive summary for Board.
AML/CFT Program Design & Testing
● Full AML program design: risk assessment, CDD/KYC, transaction monitoring thresholds, SAR/STR processes, sanctions screening and TFS (targeted financial sanctions) implementation.
● Tune and validate transaction monitoring rules, false-positive reduction and model governance.
● Independent AML control testing and STR quality reviews.
● AML program playbook, tuned rulebook, STR templates, independent test report.
● Tune and validate transaction monitoring rules, false-positive reduction and model governance.
● Independent AML control testing and STR quality reviews.
● AML program playbook, tuned rulebook, STR templates, independent test report.
Technology Risk & Cloud Compliance
● End-to-end TRM/RMiT compliance: IT governance, resiliency, change control, secure SDLC, third-party/cloud arrangements, data localization and encryption standards.
● Review architecture for single points of failure, disaster recovery (RTO/RPO) and business continuity.
● TRM/RMiT gap report, cloud security blueprint, board-level risk appetite for technology.
● Review architecture for single points of failure, disaster recovery (RTO/RPO) and business continuity.
● TRM/RMiT gap report, cloud security blueprint, board-level risk appetite for technology.
Third-Party & Outsourcing Risk Management
● Vendor due diligence, TPRM scorecards, contract SLAs and exit planning. Ensure outsourcing arrangements meet MAS outsourcing guidance and BNM expectations.
● Vendor risk catalog, contractual clause library, ongoing vendor monitoring plan.
● Vendor risk catalog, contractual clause library, ongoing vendor monitoring plan.
Independent Regulatory Audit & Board Assurance
● Independent deep-dive audits mapped to supervisory expectations with pragmatic remediation tracking.
● Prepare Board and senior management packs that satisfy examiners and support regulatory dialogue.
● Audit reports, remediation tracking dashboard, Board briefing slides
● Prepare Board and senior management packs that satisfy examiners and support regulatory dialogue.
● Audit reports, remediation tracking dashboard, Board briefing slides
People And Culture Training & Certification
● Role-based training (front-line, investigators, compliance analysts, senior management) with scenario simulations and red-team exercises for AML/technology incidents.
● Embedding a “know-your-risk” culture via ongoing microlearning, competency matrices and evaluation.
● Customised learning paths, monthly training calendar, assessment reports.
● Embedding a “know-your-risk” culture via ongoing microlearning, competency matrices and evaluation.
● Customised learning paths, monthly training calendar, assessment reports.
Risk Control Assurance Programs on Regulatory Audit Findings
● To stabilise high-risk operations with temporary dual control and evidence capture.
● Redesign processes, implement maker-checker in core systems, roll out training.
● Automate monitoring, embed KPIs in governance, and institutionalise continuous improvement.
● Ensure reduced control failures and regulatory repeat findings.
● Establish shorter remediation times and demonstrable evidence of operating effectiveness.
● Establish processes and procedures to reduce operational loss and reputational risk whilst maintaining clear audit trails to improve on regulator confidence.
● Redesign processes, implement maker-checker in core systems, roll out training.
● Automate monitoring, embed KPIs in governance, and institutionalise continuous improvement.
● Ensure reduced control failures and regulatory repeat findings.
● Establish shorter remediation times and demonstrable evidence of operating effectiveness.
● Establish processes and procedures to reduce operational loss and reputational risk whilst maintaining clear audit trails to improve on regulator confidence.
