Compliance, Privacy, Retention & Residency Studio

Risk-based compliance and privacy policy packs — KYC/UBO profiles, screening thresholds, retention schedules, legal holds and residency/transfer rules — with non-overridable legal minimums, versioned by jurisdiction. Used by the MLRO, privacy, legal, records and security owners.

CFG-07 CMP-02 CMP-04 CMP-06 CMP-07 UX-25

Resolution explorer Diff & simulation

Active policy packs

UAE-FED · DXB · ADGM tagged

Pending approval

2 retention · 1 screening

Protected floors

non-overridable minimums

Retention schedules

2 with active legal hold

Blocked validations (7d)

floor violations — see below

Next scheduled activation

01 Aug

PP-CMP-2026.2 · 00:00 GST

Risk factor matrix — v2026.2 (Active)

ActiveOpen risk workspace

Factor	Example trigger	Weight	Override at branch
Customer type PEP, complex structure, NPO	PEP (foreign) — Falcon Trading FZ-LLC UBO check	30	Not permitted
Geography FATF high-risk / monitored	Counterparty residence on FATF grey list	25	Not permitted
Product	Off-plan resale, cash-intensive lease	20	Stricter only
Channel	Non-face-to-face onboarding	15	Stricter only
Transaction size	> AED 2,000,000.00 single payment	10	Stricter only
Total weight		100

Risk bands & periodic review

Active

Band	Score	Due diligence	Review frequency	Approval
Low	0–29	Standard CDD	36 months	KYC Checker
Medium	30–59	Standard CDD + source of funds	24 months	KYC Checker
High	60–79	EDD + senior sign-off	12 months	MLRO (Ahmed Al Blooshi)
Very high	80–100	EDD + relationship approval + monitoring	6 months	MLRO + Legal

Screening sources & match thresholds — SCR-2026.1

Active since 01 Mar 2026Screening review queue

List / source	Feed licence	Match threshold	Auto-clear below	On confirmed match	Rescreen SLA	Floor
UN Consolidated (sanctions) via sanctions sync	Licensed feed · daily delta	85	60	Immediate hold — no tipping-off	24 h after delta	Non-overridable
UAE Local Terrorist List	Licensed feed · intraday	85	60	Immediate hold + report	4 h after delta	Non-overridable
EU / OFAC consolidated	Licensed feed · daily	88	65	Hold pending MLRO decision	24 h after delta	Non-overridable
PEP database	Sentinel Screening Ltd · weekly	90	70	EDD + senior approval	7 d	Stricter only
Adverse media	Sentinel Screening Ltd · weekly	92	75	Analyst review	7 d	Configurable
Internal blocklist	Company-maintained	80	—	Route to MLRO	Immediate	Company scope

Draft RET-2026-D4 blocked — CFG-VAL-FLOOR-001 (legal minimum violated) Proposed retention of 3 years for record class “AML/KYC evidence” is below the active legal minimum of 5 years from the latest applicable trigger (UAE AML/CFT/CPF 2025 baseline, pack PP-CMP-2025.3). Validation failed on 16 Jul 2026 14:22; the draft cannot be submitted for approval. Extensions and legal holds may lengthen but never shorten the protected minimum.

View validation evidence

Retention schedules by record class

14 schedulesPrivacy rights workspace

Record class	Trigger event	Legal floor	Configured	Disposal mode	Legal hold	Status
AML / KYC evidence IDs, UBO proofs, screening decisions	End of relationship / transaction	5 y	7 y	Certified destruction	—	Active
AML cases & reports goAML packs, case files	Case closure	5 y	8 y	Certified destruction	Hold LH-2026-002	Active
Contracts & signed instruments	Contract end / release	5 y	10 y	Archive then destroy	—	Active
Financial ledgers & tax invoices	Fiscal year close	5 y	7 y	Archive then destroy	—	Active
Call recording media separate from call metadata — see Comms studio	Recording date	—	2 y	Secure purge	Hold LH-2026-003	Active
Marketing consent logs	Consent withdrawal	—	3 y	Secure purge	—	Active
CCTV / access logs (facilities)	Capture date	30 d	90 d	Rolling purge	—	Active
AML / KYC evidence — draft RET-2026-D4	End of relationship	5 y	3 y	—	—	Validation failed
HR & payroll records — draft RET-2026-D5	End of service	2 y	6 y	Certified destruction	—	Pending approval

Active legal holds

2 active

Hold	Scope	Imposed by	Since	Status
LH-2026-002 AML case CAS-2026-114 (Falcon Trading FZ-LLC)	Cases, KYC evidence, correspondence	Ahmed Al Blooshi (MLRO)	03 May 2026	Hold — disposal suspended
LH-2026-003 Dispute — unit PR-B-2110 lease	Call recordings, contracts, receipts	Mariam Al Suwaidi (Legal)	21 Jun 2026	Hold — disposal suspended
LH-2025-007 Regulator enquiry (closed)	Listing evidence, permits	Mariam Al Suwaidi (Legal)	02 Nov 2025	Released 12 Feb 2026

Records under retention by class

as of 17 Jul 2026

KYC evidence41.2k

Contracts24.6k

Tax invoices21.7k

Call media11.3k

Consent logs8.5k

AML cases2.1k

Class	Records	Due for disposal (90d)
KYC evidence	41,204	312
Contracts	24,617	1,088
Tax invoices	21,733	0
Call media	11,309	2,450 2 held
Consent logs	8,522	640
AML cases	2,148	0

Data classes, lawful basis & residency rules — PRV-2026.1

Active

Data class	Purpose / lawful basis	Approved region	Processor(s)	Cross-border condition	Rights workflow
KYC documents & IDs Emirates ID 784-19●●-●●●●●●●-●, passports	AML legal obligation	UAE only (me-central-1)	Platform DMS	Deny — no route	Access only (no erasure before floor)
Customer contact & preferences	Contract + consent	UAE primary	Messaging BSP (UAE PoP)	SCC + privacy approval TRF-009	Access · rectify · erase
HR & payroll data	Employment contract / labour law	UAE only	WPS agent bank	Deny — no route	Access · rectify
Call recording media	Consent + legitimate interest	UAE only	Media custodian store	Deny — no route	Access (custodian mediated)
AI prompts & retrieval context	Service provision	UAE region providers	AI gateway (console)	Masked/pseudonymised only · TRF-011	n/a — 30 d purge
Anonymised analytics	Legitimate interest	Any approved region	BI warehouse	Aggregate only, k ≥ 20	n/a
Screening queries & results	AML legal obligation	UAE + EU (provider)	Sentinel Screening Ltd	SCC + DPA ref DPA-2025-114	Restricted — no data-subject disclosure

Consent & rights workflow parameters

Active

Rights request SLA *

Statutory response window; escalation at day 21.

Identity verification for requests *

Applies to external portal rights requests.

Consent withdrawal propagation

Synced to DND & preferences.

Minimisation rule

Collection outside the allowlist is rejected.

Draft Validated Pending approval Scheduled Active

Compliance policy pack versions

Full lifecycle console

Version	Jurisdiction tags	Content hash	Maker	Approver	Effective	State
PP-CMP-2026.2 Screening threshold + retention refresh	UAE-FED DXB	`sha256:9f31…c2ae`	Yusuf Karim	Ahmed Al Blooshi (MLRO)	01 Aug 2026	Scheduled
PP-CMP-2026.1 Residency rules for AI providers	UAE-FED	`sha256:4be0…77d1`	Yusuf Karim	Pending — Ahmed Al Blooshi	—	Pending approval
PP-CMP-2025.3 UAE AML/CFT/CPF 2025 baseline seed	UAE-FED DXB ADGM	`sha256:b7a4…e913`	System seed	Ahmed Al Blooshi (MLRO)	01 Jan 2026	Active
RET-2026-D4 Retention change — AML evidence 3 y	UAE-FED	`sha256:16dd…09f4`	Grace Okafor	—	—	Validation failed — CFG-VAL-FLOOR-001
RET-2026-D5 HR record retention 6 y	UAE-FED	`sha256:c05a…41b8`	Yusuf Karim	Pending — Noura Saeed	—	Pending approval
PP-CMP-2025.2 Pre-baseline screening thresholds	UAE-FED	`sha256:aa02…3d67`	Yusuf Karim	Ahmed Al Blooshi (MLRO)	01 Sep 2025	Superseded
PP-CMP-2025.1-R Rollback activation of 2024.4 known-good	UAE-FED	`sha256:7c19…88e0`	Vikram Nair	Ahmed Al Blooshi (MLRO)	14 Feb 2025	Rolled back → superseded
SCR-2025-D9 Proposed PEP threshold 95 (too lax)	UAE-FED	`sha256:52fb…1a20`	Yusuf Karim	Ahmed Al Blooshi (MLRO)	—	Rejected — reason recorded

Submit PP-CMP-2026.1 for independent approval

Reason for change *

Independent approver *

SoD enforced: maker Yusuf Karim cannot approve his own material version. Approval binds content hash sha256:4be0…77d1.

Static render mockup — no live data. Source: ERP Modern Development Specification v2.0 · Covers: CFG-07 (compliance, privacy, retention & residency policy studio), with configuration catalogue refs CMP-02, CMP-04, CMP-06, CMP-07 and UX-25. Legal floors per UAE AML/CFT/CPF 2025 baseline; five-year AML record minimum enforced (CFG-VAL-FLOOR-001).