Policies for financial services firms
PolicyDrafters drafts the AML/KYC manual, security policies and privacy pack that a fintech or financial services firm shows its regulator and bank, at a fixed price. Each of the three services is quoted at one fixed figure between $1,200 and $5,000 before we start.
Updated
What you have to show, and to whom
- AML/KYC policy and procedure manual, for the regulator, the bank that onboards you and your auditor
- The manual's customer due diligence and transaction monitoring procedures, for the staff who run them
- Information security policy set, for the bank or partner who sends a security questionnaire and for your auditor
- Privacy policy pack, for customers and the data protection authority
- The manual's record-keeping and reporting procedures, for the examiner who samples them
The three services that draft these documents
AML/KYC manual
$3,000to $5,000
First draft in 15 working days.
An AML/KYC manual is the document that sets out how a firm assesses its money laundering and terrorist financing risk, identifies and verifies its customers, monitors their activity, reports suspicion and proves that all of it happened.
Information security policy set
$1,200to $2,500
First draft in 12 working days.
An information security policy set is the group of written policies and procedures that states how a company protects its systems and data: who may access what, how staff may use company devices, how incidents and outages are handled, which vendors may hold the data, and who owns each control.
Privacy policy pack
$1,200to $2,500
First draft in 10 working days.
A privacy policy pack is the set of public notices and internal documents that state what personal data an organisation collects, why, who receives it, how long it is kept and how people exercise their rights, drafted against each privacy law that applies, such as GDPR, the CCPA or the Nigeria Data Protection Act 2023.
What the documents have to do
An AML/KYC manual is the document that sets out how a firm assesses money-laundering risk, identifies and verifies its customers, monitors their activity and reports suspicion. It has to describe what your firm does, in the order the examiner checks it: how risk is assessed, how customers are identified and verified, how ongoing monitoring works, when enhanced measures apply, how suspicious activity is escalated and reported, how records are kept and for how long, and who is responsible for each step.
A manual that describes a different firm, or describes nothing in particular, helps neither the examiner nor the staff who have to follow it.
The information security policy set states how the firm protects its systems and who is responsible. The privacy policy pack states what personal data the firm collects, how long it is kept and how people exercise their rights. A licence application or a partner's due diligence can ask for both alongside the manual.
Regulator or licensing team
Document
What they look for
Risk assessment, due diligence tiers, monitoring, reporting, named officer
Onboarding bank or partner
Document
AML/KYC manual, information security policy set
What they look for
A manual that matches the business described in the application
Examiner or auditor
Document
AML/KYC manual procedures and record-keeping, information security policy set
What they look for
Steps that match the records sampled, retention periods stated, an owner for each control
Customers and the data protection authority
Document
What they look for
Lawful bases, retention, rights, transfers, named processors
Who needs these documents, and when
A fintech or payments firm applying for its first licence or registration, a lender or adviser whose bank or partner has asked to see the AML manual, a firm that has outgrown the policies it wrote at launch, or a group whose regulator has asked for its documentation to be brought onto one standard. The readers are the regulator, the examiner, the onboarding bank and the auditor, and each of them checks the manual against the rule it names.
What we draft
What each document is drafted against:
- The AML/KYC manual is drafted against FATF Recommendations 10, 12, 16 and 20 (The FATF Recommendations). It is also drafted against Directive (EU) 2015/849 as amended (Directive (EU) 2015/849) or the US Bank Secrecy Act with the customer due diligence rule in 31 CFR 1010.230 (31 CFR 1010.230), as they apply to you, and the rulebook of the regulator you name.
- The information security policy set is drafted against ISO/IEC 27001:2022 Annex A (ISO/IEC 27001). It includes an incident response procedure, a business continuity and backup policy and a vendor and third-party policy.
- The privacy policy pack covers GDPR, CCPA and NDPR. It is drafted against only the regimes that apply to your customers.
Each is quoted within its price band before we start, and the quote does not change. Each is drafted from your intake, reviewed by our legal team and delivered in Word and PDF with a document ID and revision block.
The guide What goes in an AML/KYC manual for a small firm? sets out the manual's ten sections in order, with the rule and record behind each, and Policy vs procedure: what is the difference? explains why the manual holds the policy and its procedures in labelled parts.
Nigerian data protection law is still known as the NDPR, but the Nigeria Data Protection Regulation 2019 was retired as an instrument by the Nigeria Data Protection Commission's General Application and Implementation Directive 2025, so the privacy policy pack cites the Nigeria Data Protection Act 2023 (section 27) and the directive (Article 27(3)).
Drafted against
- FATF Recommendations 10, 12, 16 and 20
- Directive (EU) 2015/849 as amended
- US Bank Secrecy Act and the FinCEN customer due diligence rule, 31 CFR 1010.230
- ISO/IEC 27001:2022 Annex A
- GDPR, CCPA and NDPR
- The rulebook of the regulator you name in the intake
What the intake asks
Which regulator and which licence or registration, which products you sell and to which customers, how customers are onboarded today and which tools do the checks, who the responsible officer is, how records are kept, which systems and vendors hold customer data, and which documents the regulator or the bank has already asked for. Send the request once we reply, and the documents are structured to answer it in order.
Questions about AML policies for fintech and financial services
- Which regulator is the AML/KYC manual written for?
- PolicyDrafters drafts the AML/KYC manual for the regulator you name in the intake. The manual follows the FATF Recommendations and the EU or US rules that apply to you, then that regulator's own rulebook. Firms with more than one regulator are scoped in the intake and quoted before we start.
- Our bank has asked for our AML manual before it will open an account. How quickly can we have one?
- PolicyDrafters delivers the first draft of an AML/KYC manual in 15 working days from a complete intake. The AML/KYC manual page states what the intake asks, so you can gather it before you start.
- Is an AML policy the same as an AML/KYC manual?
- An AML policy is not the whole AML/KYC manual: in the manual PolicyDrafters drafts, the AML/CTF policy is one document. The manual also carries the procedures that put the policy into practice (customer due diligence and KYC, enhanced due diligence, transaction monitoring and suspicious activity reporting), a record-keeping and training schedule and a risk assessment template.
- How much does an AML/KYC manual cost?
- An AML/KYC manual from PolicyDrafters is quoted at $3,000 to $5,000. The quote is fixed before we start and does not change.
- Does PolicyDrafters advise on whether a firm needs a licence?
- PolicyDrafters does not advise on whether a firm needs a licence. It drafts the documents a licence application or a regulator asks for, and our legal team reviews them before delivery. Whether and where a firm needs a licence is a decision for the firm and its adviser.
- What happens to an AML/KYC manual when the regulator changes a rule?
- Under the maintenance plan, PolicyDrafters tracks the rules named in the AML/KYC manual, the information security policy set and the privacy policy pack, and sends a revised document, with the changes marked, when one of them changes. Our legal team reviews the revision before it reaches you.
Guides that go deeper
What is the difference between a policy and a procedure?
A policy states the rule and who it applies to; a procedure states the steps, owners and records. Most documentation fails by mixing the two. How to keep them apart.
Updated
What goes in an AML/KYC manual for a small financial services firm?
The ten sections an examiner expects in an AML/KYC manual, in order, from business-wide risk assessment to independent review, with the rule and record behind each.
Updated
How often should company policies be reviewed, and by whom?
Annually by convention, and whenever the rule or the facts change, after an incident or an audit finding. Who reviews, who re-approves, and how the review is recorded.
Updated