A model group protocol

Checklist

• One AML/CFT programme document approved by the boards of both entities, with a Singapore annex mapped to PSN02 and a Swiss annex mapped to the SRO regulations, each annex cross-referenced to the common core.
• A group risk assessment that identifies the customers, products and corridors shared between the entities and the risks arising from the group structure itself, supplementing each entity's own assessment.
• One customer-acceptance policy applying the stricter rule in each row of the divergence table, with a documented list of the exceptions where jurisdiction-specific rules apply (sanctions lists, freeze mechanics, filing procedures).
• One onboarding process generating both entities' documentation from a single data collection, with the Swiss forms built in.
• Separate screening, risk rating and monitoring in each entity, run on shared systems with entity-level access controls and entity-level audit logs.
• A reliance agreement between the entities meeting PSN02 para. 9 and the Swiss delegation rules, reviewed annually.
• A risk-event notification protocol that defines what each entity tells the other on a report, an exit, a freeze or a sanctions hit, in terms that respect s. 57 CDSA and Art. 10a AMLA.
• An intra-group data-transfer agreement satisfying the FADP, the PDPA and Art. 273 SCC, with customer consent language in both entities' terms.
• A single counterparty VASP register and travel-rule configuration applying the full information set and proof of control for unhosted wallets.
• A ten-year retention rule for all compliance records in both entities.
• A coordinated audit calendar under which the Swiss SRO audit and the Singapore independent audit share a findings register and the remediation of each finding is applied in both entities.
• A group compliance committee meeting at least quarterly with both compliance officers and board representation from each entity, minuted.