Coredo

Since 2016 I have been leading COREDO as a company that turns the complexity of international regulation into a clear system of manageable solutions. During this time we have registered dozens of legal entities in the EU, the Czech Republic, Slovakia, Cyprus and Estonia, supported licensing in the United Kingdom, Singapore and Dubai, and built compliance for clients at the level regulators and banks expect. I am convinced: the foundation of sustainable international growth is a risk-oriented approach (RBA, risk-based approach), embedded in registration, licensing and day-to-day operational processes.

Risk-based approach — a pillar

Regulatory expectations for RBA in the EU, the AMLD5 and AMLD6 requirements, and FATF recommendations explicitly state: you are obliged to know the risk profile of clients, products, channels and geographies. In response we design the company’s risk management based on ISO 31000 and the COSO internal control framework, combining corporate information governance (GRC) with a clear decision-making matrix and an escalation model. This makes dialogue with auditors and banks predictable and substantive.

RBA Framework: from strategy to processes

This order is important, because automating the risk matrix without clear criteria for classifying customers by risk leads to an avalanche of exceptions and manual work. The correct sequence is design first, then control assessment and design testing, and only then launching into production with compliance KPIs and key risk indicators (KRI). The COREDO team implemented such a scheme in projects from the Czech Republic to Dubai, and as a result the risk analysis for audit became transparent, and the review and updating of the risk matrix regular and meaningful.

RBA methodology and the risk matrix

The RBA methodology starts with a taxonomy of risks: customers, products/services, distribution channels, geographies, transactions and counterparties. For each category we assess probability and impact scales (likelihood & impact), assign score weights and obtain a heatmap (risk map), where the high-risk area is immediately visible to the board. This is how we develop a risk matrix for audit that is understandable to the business, internal audit, and the external inspector.

Integration of RBA with KYC/CDD and sanctions

The RBA methodology is meaningless without being embedded into operational processes. We design the integration of RBA with KYC and CDD processes so that a customer’s risk assessment is updated on every material event: change of UBO, expansion of geography, anomalous transactions. For high-risk segments, EDD procedures are triggered automatically, additional documents are collected, sanctions screening against extended lists is activated, and suspicious activity analysis (SAR) is conducted.

Finally, data privacy and GDPR compliance: part of the architecture, not an afterthought. In the retention policy we define archiving of evidence and data storage requirements, set retention periods for cases and structure the case lifecycle (case management). This reduces the burden on the first line and increases readiness for inspections and independent review.

Choosing a Jurisdiction for RBA

The solution developed at COREDO always begins with mapping regulatory expectations and relevant licenses to the client’s business model. In the EU – the requirements of AMLD5/AMLD6, in the United Kingdom: FCA rules, in Estonia: VASP specifics, in Cyprus – the regime for payment and investment firms, in Singapore: MAS, and in Dubai, DFSA/DIFC or VARA for the crypto segment. By aligning them with the client’s risk appetite, we help choose the jurisdiction, the degree of centralization and payment routes.

Implementing RBA in a Financial Organization

My basic roadmap for clients looks like this:

• Strategy: we determine the risk appetite, establish a risk management committee and record the responsibilities of the board and the compliance director under RBA.
• Processes: we conduct process modelling, define control points, align the roles of the lines of defence and prepare a risk register.
• Design of controls: we describe client risk classification criteria, CDD/EDD procedures, sanctions screening and transaction monitoring, and configure the risk matrix and heatmap.
• Technologies: we select the AML/CFT platform architecture, assess the scalability of technical solutions, integration with ERP/CRM and banking systems, and configure thresholds and rules.
• Measurement: we define key risk indicators (KRI), metrics for the ROI of RBA implementation, investigation effectiveness metrics, as well as ROI assessment and the total cost of ownership (TCO) of RBA.
• Verification: we plan internal audit and independent review procedures, sampling methodologies for audit (statistical sampling), and scenario analysis and stress testing of risks.
• Training: we initiate change management and staff training, including for the first line and investigative analysts.

Scaling RBA in a holding company

COREDO Case Studies: crypto licenses and institutions

What is needed for RBA to work daily?

Integration with ERP/CRM and banking systems is a critically important element. Without complete data, scoring models “go blind”, and case management loses context. We often implement a centralized hub for event enrichment, configuring thresholds and triggering rules in one place, and broadcasting configuration to subsidiary entities to maintain metric comparability and manage changes.

Launch RBA: a guide for the director

First step: establish the board’s accountability and appoint a compliance director with veto power over risky launches. The risk management committee should approve the risk appetite, align the KRI and KPI metrics, and define a process map with control points. This turns RBA from an “important topic” into a management routine.

Second step: develop a risk matrix, build a heatmap, and describe the criteria for classifying clients by risk.

Third step – choose a technological solution and assess scalability. Evaluate the scalability of technical solutions, integration with current systems, configuration of rules and thresholds, and ensure change management and staff training.

COREDO: from diagnostics to operations

In projects for company registration and licensing in the Czech Republic, Slovakia, Cyprus, Estonia, the United Kingdom, Singapore and Dubai we take into account local specifics and supervisory expectations. This saves time on approvals, speeds up account openings and reduces the cost of compliance ownership thanks to the right initial architecture.

Frequently Asked Questions from Directors

Conclusions

Since 2016 I have been heading COREDO and am responsible for ensuring that entrepreneurs from Europe, Asia and the CIS launch and scale businesses in international jurisdictions quickly, transparently and with properly configured compliance. During this time the COREDO team has carried out hundreds of projects: from company registrations in the EU, the Czech Republic, Slovakia, Cyprus and Estonia to licensing in the United Kingdom, Singapore and Dubai. I see the main task as bringing together legal architecture, licensing and the AML/sanctions framework into a single operational model that withstands regulator scrutiny and does not stifle operational efficiency.

Registration abroad: sanctions and AML

When we design a group structure in the EU, the United Kingdom, Singapore or Dubai, I immediately build AML and sanctions requirements into the founding documents and processes. The right choice of jurisdiction for a specific business model reduces the burden on sanctions monitoring thanks to quality registers, predictable regulators and clear KYC/KYB practice. Our experience at COREDO has shown: if at the incorporation stage you take into account access to corporate registries, rules on beneficial owners (UBO) and local expectations for a risk-based approach (risk-based approach, RBA), the costs of subsequent sanctions screening and KYC fall dramatically.

Crypto and Payments Licensing

In licensing financial services I always link regulatory expectations with concrete technical solutions. Payment organizations, forex providers and crypto services are required not only to carry out KYC/KYB and PEP and sanctions monitoring, but also to demonstrate the manageability of the process: sanctions screening must be reproducible, explainable and independent of the individual analyst. COREDO’s practice confirms: successfully obtaining a license is accelerated by a clear demonstration of sanctions control systems, configured matching thresholds, procedures for human verification of alerts and a transparent audit trail.

Sanctions screening as a system

I see sanctions screening as a four-layer pipeline: data, matching algorithms, threshold/scoring policy and operational workflow. If each layer has data quality controls, an audit trail and demonstrable decision-making, you both reduce false positive matches and keep the risk of false negatives manageable.

Data quality and watchlist management

The foundation is up-to-date, clean sanctions lists: OFAC, EU, UN and United Kingdom. I insist on watchlist consolidation and deduplication of lists, a clear list refresh cadence and data quality controls: completeness, accuracy, freshness. When the COREDO team implements sanctions list filtering, we remove duplicates, canonicalize names (normalisation), align Unicode normalization (NFC/NFD) and standardize transliteration rules (ISO 9, BGN/PCGN). This reduces false sanctions hits long before fuzzy matching algorithms kick in.

Precise name matching without overreach

Algorithms determine which signals you receive. I usually start with fuzzy matching using Levenshtein distance, the Jaro–Winkler algorithm, n-grams and tokenization. For phonetic robustness we use Soundex and Metaphone, and for multiscript names — multiscript matching (Cyrillic Latin Arabic Chinese) with handling of diacritics and apostrophes. Tuning the name matching model for Asian and European languages is critical: Chinese and Arabic names, as well as Latinization of Slavic surnames, cause a spike in alerts without proper normalization.

Threshold policy and FP/FN calibration

Reducing false positives is not just “raising the match threshold.” I use score management and threshold policy, threshold calibration and A/B testing of thresholds and matching models. Metrics — false positive rate (FPR), precision and recall, F1-score and ROC AUC — show the trade-off between FP and FN and help select a point that matches the risk appetite and regulator expectations.

Processing flows: real-time or batch

Each business process dictates its mode. For incoming payments, real-time sanctions screening with API integration of the screening engine into processes is appropriate. For periodic customer base reviews: batch processing (batch checks) with scheduling and SLA. I build human-in-the-loop workflows and SLAs at every stage: initial automated check, alert triage and prioritization, human verification of alerts and case management for alert investigations.

False positives: rules, ML, graphs

I start with basic settings: reducing false positives by tuning match thresholds, whitelists and exceptions with clear exception management and documentation of whitelists. Then I add filters by country, birth dates, entity types and context, as well as watchlist management with targeted filtering of entities known as “false matches”.

Names, scripts and registries in Europe and Asia

Multilingualism is the main “alert generator.” In Asia we pay special attention to transliteration and name spelling variants, use transliteration tables (ISO 9, BGN/PCGN), configure Unicode normalization and rules for handling diacritics. For Arabic names we apply tokenization, n-grams and canonicalization and normalisation, and for Chinese names — romanization schemes and alternative forms.

SaaS or on‑prem: scale and security

At the architecture stage I assess how ready the business is for SaaS sanctions‑screening providers or whether it needs an on‑premise installation. Key factors: security, latency requirements, multi‑jurisdictional operations and local data laws. For high loads we use Bloom filter to speed up searches in large lists and design CI/CD practices for ML models of sanctions screening to release changes safely and predictably.

Demonstrating compliance to regulators

Sanctions screening without an audit trail does not pass review. I require a continuous audit trail and provable actions, explainability tools for matching models and a clear separation of roles: analysts, compliance managers, the CTO and data owners. Within the FATF recommendations and regulators’ expectations we organize regular audits of sanctions‑screening effectiveness, A/B testing of models, threshold updates and analyst training.

COREDO case studies: reducing false positives and screening

In Estonia we worked with a payments company that faced a flood of false sanctions hits. The COREDO team profiled the data, normalized names and transliteration, introduced watchlist consolidation and retuned fuzzy scoring. We implemented whitelists under strict exception governance and trained a supervised model on labeled alerts. The result, real-world cases reducing the number of alerts by 70% while maintaining recall on critical risks. The regulator accepted our documentation on trade‑offs and methodology with no additional requirements.

How to implement sanctions screening

• Assess compliance maturity. Apply a compliance maturity model and identify gaps in data, algorithms, thresholds, and workflow.
• Organize data. Configure watchlist consolidation, deduplication, unicode normalization, transliteration, and a golden record in MDM.
• Design algorithms. Combine deterministic matching, fuzzy matching (Levenshtein, Jaro–Winkler), phonetics, and a multiscript approach.
• Define a threshold policy. Conduct threshold calibration, A/B testing, establish a risk-based approach, and document FP/FN trade-offs.
• Build the workflow. Include human-in-the-loop, case management, alert triage, SLA, and audit trail. Integrate ERP/CRM and payment processes via API.
• Enable ML and graph. Implement supervised learning to reduce FP, unsupervised clustering for anomalies, and graph analysis of relationships.
• Reinforce controls and training. Organize regular effectiveness audits, analyst training, labeling of training data, and CI/CD for rules and models.

Answers to questions: economics and ROI

Risk management: FN under control

Reducing FP must not be done at the cost of an explosive rise in false negatives. I set threshold policies with a “safety” level of review for high‑risk segments and recommend regular retrospectives on closed cases. Exception management goes through the compliance committee, and any whitelisting and greylisting are documented and reviewed at predefined intervals. This regime keeps FN under control and shows the regulator a mature, risk‑oriented system.

COREDO: diagnostics and project support

I build the project in three steps. First, diagnostics and audit: maturity assessment, data profiling, rules inventory, measurement of FPR/precision/recall, evaluation of infrastructure and security. Then architecture and implementation: data and watchlists, algorithms and threshold policy, integrations, case management, explainability, analyst training and CI/CD deployment. And finally – support and development: regular calibration, A/B tests, expansion of jurisdictions, team training and preparation for inspections.

Conclusions

Sanctions screening and anti-sanctions compliance have stopped being a “checkbox” for regulators. It is a managed system with clear data, transparent algorithms, calibrated thresholds and a disciplined workflow that protects the business and accelerates it. When sanctions control is embedded in a company’s architecture, from registration and licensing to AML-processes and payment integrations – you gain predictability, optimal KPIs and confidence in international scaling.

I often start a conversation with entrepreneurs with a simple question: *what is your goal in choosing a new jurisdiction for an investment business*? The answer almost always comes down to a combination of three factors: regulatory predictability, access to capital, and operational efficiency. In recent years Astana International Financial Centre (AIFC) has become one of the few hubs where the balance of these factors works to the benefit of both international and regional players. During this time the COREDO team has carried out dozens of projects for legal entity registration, obtaining investment licenses, building an AML function, and launching funds within the AIFC.

AIFC legal framework: the role of AFSA

The AIFC uses a separate “AIFC legal framework” based on common law principles, with its own court, the AIFC Court, and an independent regulator, the Astana Financial Services Authority (AFSA). This provides predictability and dispute-resolution principles close to the English tradition, which is important for high-stakes and cross-border transactions. In my practice, this often reduces legal frictions between investors and managers, especially when structures from the EU and the United Kingdom are involved.

COREDO’s practice confirms that when preparing for licensing in the AIFC a “European” approach helps: product regulations, clear client categorization, documented suitability/appropriateness and transparent fees. At the same time AFSA expects all of this to be implemented into the actual operational environment – a single paper policy is not enough.

Which licenses are in the AIFC?

Investment licenses in Kazakhstan through the AIFC cover a wide range of activities, and correctly mapping a business model to the permitted types of activity saves months at the approval stage. Within the AIFC, available in particular are AIFC broker license (broker/dealer), the AIFC asset manager license (portfolio manager/asset manager), the investment adviser license, as well as the AIFC depository and custodian license. For fund activity, collective investment schemes (CIS) are provided, including closed structures for private equity and an investment fund license in the AIFC.

Over the past two years we have observed strong demand for the AIFC private equity license and the AIFC venture fund license. Such structures are convenient for cross-border capital raising, and for working with investors familiar with common law. A separate vector is the AIFC license for digital asset operations: under it custody solutions, crypto exchanges and tokenization services develop while complying with requirements for storage technologies and cybersecurity.

For non-residents, the AIFC provides an investment license, and this is a real tool for accessing regional markets while minimizing legal conflicts. Our experience at COREDO has shown that a well-designed combination of an SPV in the AIFC and an operational core in another jurisdiction helps to flexibly allocate functions while maintaining compliance with AFSA regulatory standards.

Capital, substance and fit and proper

Capital requirements for an AIFC license depend on the type of activity and the risk profile. By the typical ranges we encounter in projects, broker-dealer licenses sit at the top of the scale, while advisory and non-custodial management are lower. Capital adequacy for asset managers includes a fixed base amount and add-ons for operational risk and assets under management. I always recommend planning a “buffer” above the minimum level to smooth seasonal fluctuations and growth-related costs.

Fit and proper test for directors and senior managers at the AIFC covers experience, qualifications, reputation and compliance history. Background checks include certificates of no criminal record, verification of education, previous roles and references. I honestly warn clients: it’s better to identify and work through “grey areas” in advance than to explain them to AFSA at a late stage.

AML and KYC in the AIFC: technologies and control

AML and KYC requirements of the AIFC are based on the recommendations of FATF and integrate a risk-based approach. In practice this means an individual AML risk assessment for investment firms, client segmentation by geography and profile, as well as documentation of sources of funds. The solution developed at COREDO typically includes a risk matrix, playbooks for onboarding and instructions on procedures for detecting suspicious transactions (STR).

Modern KYC/eKYC technologies for the AIFC simplify remote onboarding, but AFSA pays attention to the quality of PEP and sanctions screening and to periodic review. We implement a transaction monitoring and AML screening system taking into account the business model profile, including scenario settings, trigger thresholds and an escalation procedure. A separate register of beneficial owners and beneficial owner verification in the AIFC are developed to resolve questions about ownership structures before submission.

Timelines and steps for registering a legal entity in the AIFC

The registration of a legal entity in the AIFC starts with choosing a form: from ordinary companies to special SPVs. Registration is carried out through the electronic portal, and the basic timeframe with a properly prepared package takes from several working days to a couple of weeks. We agree names, types of activity and constitutional provisions in advance so as not to return to the amendment stage.

In COREDO projects we prepare a corporate governance package: board provisions, audit and risk committees, a senior manager regime with role demarcation. This reduces AFSA queries and facilitates the integration of external and internal audit under IFRS.

Licensing of investment activities, timelines and costs

The timelines and cost of obtaining an AIFC license depend on the complexity of the model and the applicant’s readiness. In our experience, the advisory and regulatory phase takes 8 to 16 weeks for ‘clean’ models, while more complex combinations involving custody and dealing require 4–6 months. The cost consists of AFSA fees, legal and compliance preparation, technological solutions and hiring of key persons, as well as future ongoing compliance costs.

Preparation for an AFSA inspection (AIFC regulator) includes interviews with directors, demonstration of operational systems, testing of compliance controls and a walkthrough of the client journey. I always recommend conducting a pre-inspection simulation – in a risk-free mode we identify ‘bottlenecks’ and fix them before contacting the regulator.

CIS and SPV Fund Structures: Disclosure

For investment funds in the AIFC, open and closed collective investment schemes (CIS) are available; private placements and public offers in the AIFC are subject to different regimes. Preparing a prospectus and disclosure in the AIFC requires a description of the strategy, risks, fees and valuation procedures, as well as prospectus requirements for key metrics. Our clients value structuring SPVs and trust solutions for individual transactions when it is necessary to flexibly separate classes of assets or investors.

For closed funds pursuing private equity and venture strategies the regulatory framework remains pragmatic if governance and risk management correspond to the scale of the portfolio. Investment committees, clear management of conflicts of interest and external audit are not just a checklist but a prerequisite for LPs’ trust.

Taxes in the AIFC: incentives, transfer pricing

Transfer pricing and documentation require attention if you have a cross-border chain of services or IP. The COREDO team develops a transfer pricing policy and a supporting file with functional analysis so that regulatory and tax audits go through without surprises. Reporting under IFRS and external auditors close the loop of trust and transparency.

Digital assets: tokenization and custody

Regulation of digital assets and tokenization in the AIFC is evolving through specialized AFSA regimes and the regulatory sandbox. Licensing of crypto exchanges and custody is built around storage technologies, cybersecurity and resilience to operational disruptions. In COREDO projects we pay particular attention to custody technologies for digital assets, segregation of client funds and access recovery processes.

Smart contracts and the legal status of tokens are analyzed in every case: tokenized fund shares, debt instruments or utility models fall under different parts of the Rulebook. I recommend starting with the legal qualification of the token and only after that choosing the technology stack. The AIFC license for digital asset operations opens doors to new sources of liquidity, but requires mature risk management.

Clearing, custody and partner banks

Capital market infrastructure and clearing at the AIFC are developing in tandem with regional operators and international providers. Partner banks and custodians in Kazakhstan provide access to settlement and safekeeping of assets, and the clearing and settlement infrastructure at the AIFC is integrated with global standards. During the due diligence stage we assess connection architecture, contingency scenarios and software interfaces.

For broker-dealer licenses, issues of secondary market liquidity and market-making are important. We select models in which the risk profile aligns with capital and insurance measures, and a disclosure policy addresses questions from clients and AFSA.

Scaling cross-border capital

Cross-border capital raising through the AIFC relies on clear fund marketing rules and AIFC advertising regulations. Passporting and cross-border services restrictions require separate strategies for the EU, the UK, Singapore, and the Middle East. I recommend building marketing funnels that take local private placement regimes into account and using flexible side-letter structures for institutions.

Marketing without transparency regarding complaints and suitability leads to regulatory and reputational risk at the AIFC. Therefore I insist on balancing growth with quality control, supported by regular reporting to the board and committees.

Risk Management and Compliance System

Due diligence of investors and limited partners, counterparty checks and forensic due diligence, sanction risks and international restrictions, as well as reputational screening and KYP (Know Your Partner) are part of the standard package. For cybersecurity and data protection we build measures with GDPR compatibility in mind, including DLP, IAM, encryption and incident response plans. The senior manager regime and management accountability formalize personal accountability and improve the quality of decisions.

External and internal audit for funds provides an independent view of finances and processes. IFRS reporting and regular compliance reports for AFSA reduce the information gap and enable complex topics to be discussed in the language of facts.

COREDO cases — what worked

Recently the COREDO team supported the licensing of an investment company focused on managing portfolios of debt instruments. The client applied for non-custodial management with advisory rights. We strengthened governance, prepared a capital adequacy model and implemented a transaction monitoring system. AFSA approved the license within the stated window, and subsequent review confirmed the quality of AML controls.

A separate case — a license for a venture fund in the AIFC with a multi-strategy focused on early rounds. We drafted the fund documents, established procedures for valuing illiquid assets, and agreed the private placement memorandum and marketing materials. The solution developed by COREDO enabled the fund to quickly close the first closings from institutional LPs and to build succession planning processes at the management company level.

Finally, for a digital asset custody provider we designed the licensing, storage technology architecture and recovery scenarios. Special attention was paid to PEP and sanctions screening, segregation of funds and contingency procedures. The AIFC license for digital asset operations was approved after demonstrating technological and operational test cases.

Cost of license maintenance

Outsourcing some functions is possible and reasonable if you retain accountability. AFSA is receptive to outsourcing provided there are clear SLAs, regulator access to data, and independent oversight. It is important to conduct vendor risk assessments regularly and incorporate the results into management reporting.

Visas and personnel: how to build a team

Visas and employment of foreign personnel in the AIFC are simplified through the center’s special regimes. We plan in advance the relocation schedule for directors and the key compliance officer, taking into account document timelines and the readiness of the IT infrastructure. This reduces the risk of delays at the launch stage.

Migration of fund management to the AIFC is possible with a well-considered transfer of functions, taking into account regulatory arbitrage and legal risks when changing jurisdiction. We arrange a phased transition while maintaining client service and controls.

Exit strategies and liquidity

Exit strategies for funds registered in the AIFC depend on the asset class and investment horizon. Exit options are available: IPO in Kazakhstan, trade sale and secondary buyout, as well as listing instruments on regional exchanges. I recommend planning secondary market liquidity metrics and market making already at the fund structure stage.

Regulatory arbitrage is useful when you compare the requirements of different centers and build a hybrid structure. The key is not to lose substance and the ability to manage risks, and to properly document the reasons for the choice.

Is the AIFC suitable for your model?

Analyze client jurisdictions to account for cross-border service restrictions and local marketing requirements. Assess ROI: apply NPV and IRR to three scaling scenarios and take into account the payback period for licensing and IT. Do not leave regulatory risks and reputational risk in the AIFC in the shadows: set an acceptance threshold and a response plan.

Why COREDO is a reliable AIFC partner

Over years of working in Europe, Asia and the CIS I have learned that success in the AIFC is built on careful process calibration and attention to detail. The COREDO team is used to being accountable for results: from registering a legal entity in the AIFC and licensing investment activities in the AIFC to deploying AML/KYC and preparing for an AFSA inspection. We do not promise miraculous timelines, but we design realistic roadmaps and ensure transparency at every stage.