Products / Compliance X-Ray
See your program the way an examiner reads it.
An expert-led diagnostic of your compliance framework, across every jurisdiction you operate in, with technology doing the reading. We trace the whole chain, from obligation to risk, policy, procedure, control, evidence, testing and issue, and show where it holds, where it breaks and what matters most.
Who it’s for
For programs that have grown in layers.
- A framework built over years by different people, where nobody is certain everything still connects.
- A firm facing an examination, an acquisition, a new market or a new license that needs the program to hold together under someone else’s reading.
- A new compliance officer inheriting a program and wanting an honest picture in the first month.
- A firm regulated in more than one country, where the rulebooks overlap and the framework has to answer to all of them at once.
What you get
What you receive.
Findings ordered by significance, not by volume, and a plan that separates what must be fixed now from what can reasonably wait.
Executive diagnostic
A short management view of program health, the major exposures and the themes that run through them.
Heat map
Exposure across regulatory domains, entities and jurisdictions, on one page.
Regulatory coverage map
The connections, and the broken connections, between the requirements that apply to you and your policies, procedures, controls, owners, evidence and testing.
Prioritized findings
Each material finding with its regulatory context, the evidence behind it, the exposure it creates and the action we recommend.
Remediation roadmap
What needs attention immediately, what to remediate in the next 30 to 90 days, what to strengthen over three to six months, and what belongs in a longer plan.
Executive readout
A working session with senior Taft practitioners to challenge the findings, answer your questions and agree the priorities.
Options
Three depths.
Every X-Ray is configured around your business model, regulated activities, licenses, products, customers, entities and jurisdictions. There is no generic checklist.
Focused X-Ray
- One regulatory area, entity, jurisdiction or specific concern
- Typically five to seven business days
Compliance X-Ray 360
- End-to-end assessment across your applicable framework
- Typically 10 to 15 business days
Global X-Ray
- Multiple entities, licenses, regulators and jurisdictions
- Group requirements against local ones
- Typically three to six weeks
Gap analysis and health check
A compliance program gap analysis that follows the evidence.
This work goes by several names: a compliance gap analysis, a compliance health check, an independent compliance program assessment, a multi-jurisdiction compliance review. The X-Ray is one engagement under all of them. It takes the obligations that apply to you, follows each one through policy, procedure, control, owner and evidence, and records where the chain holds and where it breaks.
Gap analysis
Each requirement in scope traced to the policy, control and evidence that answer it. A requirement with nothing behind it is recorded as a missing link, with the exposure it creates.
Health check
A periodic test of whether the program still matches the business: its products, customers, entities and jurisdictions as they are now, not as they were when the manual was written.
Independent assessment
The X-Ray assesses the program and its supporting evidence. It is not an audit or an attestation.
Multi-jurisdiction review
Where several regulators apply, the X-Ray identifies what applies and assesses how the requirements work together, so the framework can answer to all of them at once.
What we check
Every area that applies to you, and none that does not.
The scope is set by what you do and where you are licensed. Within it, we look at the areas below wherever they apply.
Regulatory framework and licensing
Regulatory perimeter, licenses, registrations, obligations, commitments and regulatory change.
Governance and accountability
Board and management oversight, chief compliance officer and MLRO responsibilities, committees, escalation, reporting and accountability.
Compliance risk management
Risk assessments, regulatory mapping, policies, procedures, controls, monitoring, testing and issue management.
Financial crime
Anti-money laundering and counter-terrorist financing, customer due diligence at every level, sanctions, transaction monitoring, suspicious activity, fraud controls and financial crime governance.
Conduct, markets and customer protection
Conflicts, fiduciary obligations, market conduct, suitability and Regulation Best Interest, communications, consumer protection, disclosures and complaints.
Operational, data and technology risk
Third parties, outsourcing, operational resilience, ICT, data, cybersecurity dependencies and technology-enabled controls.
AI and emerging regulation
AI governance, use-case risk, accountability, controls and the requirements now arriving.
Built for more than one regulator
One business. Several rulebooks. One consolidated view.
A firm often answers to more than one regulator, with requirements that overlap and sometimes conflict. The X-Ray identifies what applies and assesses how the requirements work together. Depending on scope, that can include:
United States
SEC, FINRA, FinCEN, OFAC, CFTC, CFPB, and federal and state banking requirements.
European Union
The AML framework and AMLR, MiCA, MiFID II, DORA, the EU AI Act, GDPR and consumer protection.
United Kingdom
FCA and PRA rules, the Consumer Duty, financial crime, operational resilience, and data and conduct requirements.
Other markets
The local frameworks that follow from your footprint, licenses and activities.
When to X-Ray
Eight moments when the picture matters.
Before an examination
Trace the program to its evidence before the examination.
After regulatory change
Understand what DORA, AMLR, the Consumer Duty, the AI Act or another new requirement changes for your firm in particular.
Before a new market or license
Find out whether the framework you have can carry the expansion.
After an acquisition or restructuring
Surface inconsistent obligations, policies, controls and governance across the combined business.
After rapid growth or a new product
See whether compliance kept pace with the business.
After a change of compliance leadership
Give new leadership a clear view of what they inherited.
When issues keep recurring
Learn whether isolated problems share a structural cause.
As a periodic health check
Test whether the program still reflects your business, your risks and your obligations.
One map, illustrated
Obligation, policy, control, owner, evidence. Three links from an invented firm.
This example is illustrative. The firm is fictional: a US money transmitter, registered with FinCEN, that sends consumer payments abroad. The obligations are paraphrased from binding federal rules that apply to a business like this one; they do not apply to every firm. The policies, controls, owners and records are invented. One link is intact, one has no owner, and one rests on a control the firm cannot evidence.
Link 1: intact
Obligation: designate a person to assure day-to-day compliance with the anti-money laundering program. Policy: names the BSA officer as that person and lists the duties. Control: appointment by board resolution, and a quarterly report from the BSA officer to the board. Owner: the BSA officer. Evidence: the dated resolution and four quarterly reports in the board minutes. Reading: the chain holds. Source: 31 CFR 1022.210(d)(2) (eCFR, up to date as of November 5, 2026), https://www.ecfr.gov/current/title-31/subtitle-B/chapter-X/part-1022/subpart-B/section-1022.210
Link 2: no owner
Obligation: report blocked property to OFAC within 10 business days from the date it becomes blocked. Policy: says blocked payments are reported to OFAC, but not who files the report. Control: the screening tool stops a matched payment and opens an alert. Owner: none. Alerts go to a shared mailbox, and no person or role is assigned to file the report or track the deadline. Evidence: alert logs, and no record of who filed what. Reading: the chain breaks after the alert. Source: 31 CFR 501.603(a)(1) and (b)(1)(i) (eCFR, up to date as of November 5, 2026), https://www.ecfr.gov/current/title-31/subtitle-B/chapter-V/part-501/subpart-C/section-501.603
Link 3: unsupported control
Obligation: train appropriate personnel on their responsibilities under the program, including the detection of suspicious transactions to the extent the business must report them. A money transmitter must report suspicious transactions. Policy: annual training for all customer-facing staff. Control: an annual online module. Owner: the BSA officer. Evidence: the slides exist, but there are no completion records for the last cycle. Reading: the control is described, not evidenced, so it is treated as unsupported. Source: 31 CFR 1022.210(d)(3) (eCFR, up to date as of November 5, 2026), https://www.ecfr.gov/current/title-31/subtitle-B/chapter-X/part-1022/subpart-B/section-1022.210. Source: 31 CFR 1022.320(a)(1) (eCFR, up to date as of November 5, 2026), https://www.ecfr.gov/current/title-31/subtitle-B/chapter-X/part-1022/subpart-C/section-1022.320
What the map becomes
In a real X-Ray a broken link that matters becomes a finding, with its regulatory context, the evidence behind it, the exposure it creates and the action we recommend. In this example the fixes leave the existing records as they are. Link 2 gets a named owner from a stated date. For Link 3, the missing completion records are not recreated after the fact: their absence is recorded in a separate, dated note, and the next cycle’s completions are recorded as they happen.
X-Ray, RiskReady or an audit
Three different questions.
The X-Ray asks whether the program holds together. RiskReady asks how much risk is left once the controls are taken into account. An audit or independent test asks whether a defined scope meets a defined standard. Each answers its own question, and none stands in for another.
Compliance X-Ray
Follows each obligation through policy, procedure, control, owner and evidence. You receive a coverage map, findings ranked by significance and a remediation roadmap.
RiskReady
Measures the inherent risk in products, customers, geographies and channels, assesses the controls that address it, and states the residual risk that is left. You receive the risk assessment, a heat map, an action plan, and the methodology and board paper.
An audit or independent test
Some rules require independent testing. A US money services business must provide for independent review to monitor and maintain an adequate anti-money laundering program. FinCEN’s program rule for banks lists independent testing for compliance, by bank personnel or an outside party, among the minimum elements. Both are binding federal rules. The X-Ray does not replace either, and it is not an attestation. Source: 31 CFR 1022.210(d)(4) (eCFR, up to date as of November 5, 2026), https://www.ecfr.gov/current/title-31/subtitle-B/chapter-X/part-1022/subpart-B/section-1022.210. Source: 31 CFR 1020.210(a)(2)(ii) (eCFR, up to date as of November 5, 2026), https://www.ecfr.gov/current/title-31/subtitle-B/chapter-X/part-1020/subpart-B/section-1020.210
Which comes first
If nobody is sure the program connects, start with the X-Ray. If it connects and the question is how much risk remains, start with RiskReady. Either can stand alone. Where a rule requires independent testing, the X-Ray can show what to fix before the test. It cannot be the test.
How it runs
How it runs.
Scope
We establish your entities, activities, products, licenses, regulators and jurisdictions, and settle what applies before assessing anything.
Analyze
Technology reads the regulations, policies, procedures, risk assessments, controls, testing, findings and evidence, and flags inconsistencies, missing connections and controls without evidence. This is where the speed is.
Challenge
Taft practitioners test what exists on paper against how the program operates. Does the control exist? Who owns it? How does it work? What happens when it fails? Can you prove it operated? Has it been tested?
Prioritize
We separate drafting imperfections from genuine regulatory exposure and rank the findings by significance. This is where the judgment is.
Act
The findings become a remediation roadmap: what to address now, what comes next and what can reasonably wait.
Questions
Asked before, answered plainly.
- Does AI do the assessment?
- No. AI does the reading and the mapping, across more documents and faster than a team reads by hand. Flagging a missing link is not the same as making a compliance judgment. Which requirements apply to you, whether the business does what the policy says, whether a finding is a drafting issue or a material exposure, and what to do about it: those calls are made by experienced chief compliance officers, former regulators and industry practitioners. Nothing reaches you unreviewed.
- Is this an audit?
- No. It is an independent, technology-enabled reading of how your compliance program connects, from obligation to evidence, and what to do next. It does not replace the independent testing your regulator may require, and it is not an attestation.
- Is the X-Ray a compliance gap analysis or a health check?
- Both names describe it. As a gap analysis it traces each requirement in scope to the policy, control and evidence that answer it. As a health check it asks whether the program still fits the business. The X-Ray does both in one engagement, across every jurisdiction in scope, and ranks what it finds by significance.
- How is our documentation handled?
- Through a secure channel, under a confidentiality agreement, and used for nothing other than your engagement. The details are agreed before anything is shared.
The Compliance X-Ray is an assessment by compliance practitioners assisted by analysis tools. It is not an audit, not legal advice, and it does not replace independent testing required by your regulator.