1. Purpose
The purpose of this circular is to describe how NLA engagement may occur after licensing and what minimum readiness a licensee is expected to maintain. Licensees should be able to produce records and system evidence without delay.
2. Periodic reporting (baseline)
Licensees should maintain an internal reporting pack that can be submitted on request and, where applicable, at scheduled intervals agreed during the licensing process.
| Report area | Minimum contents | Typical evidence |
|---|---|---|
| Governance | Key responsible persons, role mapping, changes since last period, approvals log. | Org chart, board/committee notes, decision register. |
| Client outcomes | Complaints summary, response timelines, remediation themes, recurring issues. | Complaints log, templates, closure notes. |
| Financial crime controls | CDD/EDD volumes, alerts, escalations, sanctions screening outcomes, exceptions. | Case files, alert metrics, screening logs. |
| Technology & security | Incidents, uptime, access logs, material changes, vendor changes, backups. | Incident register, change log, access audit trails. |
| Scope adherence | Product/service list, marketing claims, jurisdictions served, restrictions used. | Website versions, approval records, geo controls. |
3. Information and data requests
- Requests may be routine (periodic) or event-driven (e.g., incidents, complaints, material changes).
- Responses should be complete, time-stamped, and mapped to the exact request items.
- Where data is produced from systems, include the source system, filters used, and extraction date/time.
Common request themes (non-exhaustive)
Scope and product mapping, onboarding and screening evidence, complaints handling records, access logs, incident records, change approvals, outsourcing/vendoring arrangements, and proof of disclosure language used.
4. Material events and escalation
Licensees should treat certain events as material and ensure they are recorded, investigated, and, where applicable, communicated through the established engagement channels.
- Security incidents impacting confidentiality, integrity, availability, or customer data.
- Significant operational outages, payment rail disruptions, or platform interruptions.
- High-impact complaints themes, repeated claims of misleading communications, or large remediation events.
- Key management/person changes, ownership/control changes, or major outsourcing changes.
5. On-site readiness (or equivalent review)
Where an on-site visit or structured operational review is scheduled, licensees should ensure key staff and evidence are available. Reviews may occur physically or remotely, depending on circumstances.
- Provide a nominated point of contact and document coordinator.
- Prepare an evidence pack aligned to the visit scope (controls, logs, policies, sample cases).
- Ensure access to systems needed to demonstrate audit trails (read-only is acceptable).
6. Channels and response handling
- Use the official engagement channel specified at licensing (or subsequent written updates).
- Where submissions are made via Registered Agents, ensure the agent has the complete evidence pack.
- Maintain a record of submissions, acknowledgements, and follow-up actions.