No.2 - RISQED - Is Your RISK Framework Built to Address the JFSC Financial Crime Feedback

Introduction

• Part 1 of 4 of a RISQED series on risk management for Jersey-registered persons [below this part] provides an overview of how it provides a solution to risk management; later pieces go in depth on financial crime, data protection, and sustainability.
• This is part 2 of 4 in a series on risk management for Jersey-registered persons; it looks at Financial Crime Risk and how RISQED can help

Financial Crime Risk

• On 29 June 2026, the JFSC published its 2025 Financial Crime Examination Feedback, five days after quietly revising its Guidance Note on Compliance Monitoring for the first time since 2013.
• Read together, the message is consistent:
• Firms can usually point to the individual pieces of a financial crime framework, but struggle to show the pieces are connected, current, and owned.
• That's the gap RISQED is built to close, not by replacing judgement, but by giving the business risk assessment (BRA), the controls that mitigate it, and the people accountable for it, a single structure to live in.
• https://www.comsuregroup.com/media/mx1dgh2g/10851-comsure-risqed-brochure-4pp-lr-for-linkedin.pdf

The BRA needs a methodology, not a moment in time

• The JFSC found BRAs
• Hadn't been reviewed as the business changed,
• That omitted risks the Handbook requires (proliferation financing came up repeatedly), and
• That recorded a risk without recording what mitigated it or how risks compounded together.
• Tellingly, the revised Compliance Monitoring Guidance names the enterprise-wide risk assessment (EWRA) specifically as the risk assessment type "required under AML/CFT/CPF regulations to identify and mitigate financial crime risks at an organisational level";
• This isn't a rebrand of the BRA,
• It's the JFSC being explicit about what a firm-wide financial crime risk assessment needs to achieve.
• RISQED is built as a BRA methodology first, rather than a template that goes stale the day it's signed off; RISQED will
• Provide a consistent structure for identifying inherent risk and the risk owners,
• Document (and link) the controls that mitigate it
• Allow you to revisit both through your integrated CMP and as the business or its environment changes,

Control effectiveness is where "adequate" becomes evidenced.

• The JFSC doesn't prescribe a specific scoring model for control effectiveness; it never has. What its revised Compliance Monitoring Guidance does require is that
• Firms can show controls are "operating as intended" and
• That testing surfaces the "strengths and weaknesses across the control framework."
• Where firms fell short in the 2025 examinations,
• It was rarely that they'd misidentified a risk.
• It was that their policies didn't explain how to apply the control.
• Their compliance monitoring plan (CMP) couldn't evidence the control had been tested.

RISQED scores risk on probability and impact   

• The same two factors the JFSC uses in its own risk-based supervision approach, starting from the gross position, adjusting for the controls and treatment applied, and then moving again once CMP testing confirms whether those controls are actually working.
• A test result doesn't just get filed; it visibly moves the risk position it relates to.
• We haven't built this because the JFSC mandated a formula; it hasn't. We built it to meet guidance proportionately and defensibly for every firm, at a price point designed for firms replacing spreadsheets, not for those budgeting for enterprise GRC builds.

Risk owners need to be named, not implied

• The JFSC's MLCO/MLRO findings weren't about competence; they were about visibility.
• Conflicts of interest that existed but weren't logged. Resourcing gaps nobody had formally assessed. Board reporting that happened but was never documented so that oversight couldn't be evidenced after the fact.

RISQED addresses this structurally:

• Risks in the platform sit against clear ownership: who's responsible, accountable, consulted, and informed, so your MLCO and MLRO aren't just named somewhere in a P&P; they're visibly attached to the risks they own, with conflicts, resourcing, and reporting sitting alongside them.

The pattern the JFSC keeps describing is

• A financial crime framework in which the BRA, the controls, and the people responsible for both aren't visibly connected.
• RISQED's job is to make that connection structural, rather than something you reconstruct manually when an examiner asks for it.
• We'll go deeper on DATA PROTECTION AND SUSTAINABILITY in the updates that follow this update.

Book a demo:

• yes@comsuregroup.com [Comsure is the distributor of RISQED] | Sunil   07797 936464 | Mathew   07797 747490

RISQED is BETA, in active development, and now being used. If you're evaluating it against a specific regulatory requirement, we're happy to walk through exactly how it maps to your framework.

Part 2 (sources):

• RISQED website and brochure below
• https://www.comsuregroup.com/media/mx1dgh2g/10851-comsure-risqed-brochure-4pp-lr-for-linkedin.pdf
•  JFSC 2025 Financial Crime Examination Feedback (published 29 June 2026)
• https://www.jerseyfsc.org/media/y1rllx0d/2025-financial-crime-examination-feedback.pdf
•   Guidance Note: Compliance Monitoring, revised 4 June 2026 (7-step CMP cycle, EWRA definition, probability/impact language)
• https://www.jerseyfsc.org/media/ekynybkh/gn-compliance-monitoring.pdf
•   Trust Company Business Code of Practice (Principle 3, "all the risks... as a business enterprise")
• https://www.jerseyfsc.org/media/ek1hb0k3/cop-trust-company-business-code-of-practice.pdf
•   Guidance Note: Sustainable Finance (Principle 3 climate risk, Principle 7 fair claims, baseline good practice)
• https://www.jerseyfsc.org/media/k0imweot/gn-sustainable-finance.pdf
•   JFSC's Risk-Based Supervision framework (inherent/causal/impact risk, impact × probability)
• https://www.jerseyfsc.org/industry/risk/risk-based-supervision/
•   Codes of Practice landing page
• https://www.jerseyfsc.org/industry/codes-of-practice/
• JFSC Cyber-security - All financial services businesses are exposed to cyber risks. They need to be aware of the threats and defend themselves effectively if a cyber event occurs.
• https://www.jerseyfsc.org/industry/risk/cyber-security/