Compliance Gap Analysis

Compliance Gap Analysis

Structured assessment of an organization's compliance posture against one or more regulatory frameworks, producing a gap register with severity ratings, remediation priorities, and estimated effort. Used as input to compliance program design, external audit preparation, board reporting, and regulatory examination preparation.

When to use this

• An organization is entering a new jurisdiction and needs to understand the compliance build required
• A compliance programme is being refreshed after a regulatory change
• An M&A transaction requires compliance due diligence on the target
• A regulator has issued a finding or information request and the organization needs to understand its exposure
• Internal audit is scoping a compliance review and needs a framework

Inputs

Framework coverage

AML / KYC (FATF 40 Recommendations)

Core requirements:

• Customer Due Diligence (CDD): identification, verification, beneficial ownership identification (≥ 25% UBO threshold, per [[research-beneficial-ownership-lookup]])
• Enhanced Due Diligence (EDD): for high-risk customers (PEPs, high-risk jurisdictions, complex structures)
• Ongoing monitoring: transaction monitoring, periodic KYC refresh
• Suspicious Transaction Reporting (STR): to financial intelligence unit (UAEFIU, SAMA/SAFIU, BDL-SIC)
• Record keeping: 5 years minimum (most MENA jurisdictions) from end of relationship
• FATF Travel Rule: for virtual asset transfers ≥ threshold (USD/EUR/AED 1,000 equivalent), originator and beneficiary information must travel with the transfer

MENA-specific AML gaps commonly found:

• Failure to identify/verify beneficial owners beyond the direct account holder
• Inadequate PEP screening (often limited to international lists; missing local PEPs)
• No documented risk appetite for customer types and jurisdictions
• Transaction monitoring rules not calibrated to the customer's expected behavior
• DNFBP (real estate, legal, accounting) obligations often not implemented — UAE Cabinet Decision No. 10 of 2019 extended AML obligations to DNFBPs

Sanctions

Core requirements:

• Screen customers, counterparties, and UBOs against all applicable lists (per [[research-sanctions-screening]])
• Freeze assets of designated parties; file Suspicious Transaction Report
• Maintain a documented screening process, screening frequency, and match-disposition workflow
• Re-screen at meaningful events (transaction trigger, periodic refresh, news alert)

Gap patterns:

• Screening only the direct party, not UBOs
• Using a sanctions screening tool not configured for Arabic-script name matching
• No documented process for handling near-matches (screening produces false positives; the process for clearing them must be documented)
• Not re-screening existing customers when lists are updated (daily updates to OFAC SDN are common)

Data Protection

Multiple overlapping regimes may apply simultaneously:

For a full GDPR-specific review, see [[review-gdpr-readiness]].

Cross-border transfer gap (MENA): Many MENA companies use US-hosted cloud services; cross-border transfer mechanisms under KSA PDPL and UAE PDPL are still developing. Standard Contractual Clauses (SCCs) used for GDPR compliance may not satisfy KSA PDPL Article 29 requirements.

Anti-Bribery

Common gaps in MENA anti-bribery programs:

• Facilitation payments: illegal under UK Bribery Act (no exception); FCPA has a narrow exception (being narrowed by enforcement); illegal under MENA laws
• Third-party agent diligence: many MENA transactions use intermediaries; inadequate due diligence on agents is the most common FCPA/UKBA enforcement trigger
• No written anti-bribery policy; no training; no speak-up mechanism

ESG / Disclosure

Sector-specific frameworks

Review methodology

Step 1 — Framework scoping

Confirm which frameworks apply based on:

• Sectors in which the organization operates
• Jurisdictions in which it is licensed or operates
• Nature of its customer base (retail, professional, government)
• Whether it handles EU personal data (triggers GDPR)
• Whether it has US or UK operations (triggers FCPA / UK Bribery Act)

Step 2 — Current-state assessment

For each requirement within each framework, assess:

• Is there a documented policy or procedure?
• Are controls implemented in practice (not just on paper)?
• Is there evidence of training and awareness?
• Are there audit results confirming effectiveness?

Step 3 — Gap identification

For each gap, record:

• The specific requirement not met (with framework citation)
• The nature of the gap: complete absence vs partial implementation vs documentation gap vs effectiveness gap
• Evidence reviewed (or absence of evidence)

Step 4 — Severity rating

Materiality principle: distinguish "blockers" (a compliance program that is entirely absent for a mandatory framework) from "polish" (a program that exists but has minor documentation gaps). A regulator assessing a CBUAE examination will weight these very differently.

Output format

{
  "organizationProfile": "string",
  "frameworksAssessed": ["list"],
  "assessmentDate": "ISO date",
  "gaps": [
    {
      "framework": "AML | Sanctions | GDPR | UAE-PDPL | KSA-PDPL | Anti-Bribery | ESG | Sector-specific",
      "requirement": "specific requirement description with regulatory citation",
      "currentState": "description of what currently exists",
      "requiredState": "description of what is required",
      "gap": "description of the delta",
      "severity": "Blocker | Material | Moderate | Minor",
      "remediationAction": "specific action to close the gap",
      "owner": "function responsible (Legal | Compliance | IT | HR | Finance)",
      "targetDate": "ISO date",
      "estimatedEffort": "small (days) | medium (weeks) | large (months)"
    }
  ],
  "summary": {
    "totalGaps": number,
    "blockers": number,
    "material": number,
    "moderate": number,
    "minor": number
  },
  "prioritizedRoadmap": "Ordered list of top 10 remediation actions by severity + effort"
}

Limits and escalation

• This skill produces a gap register as a starting point, not a completed audit. A formal compliance audit requires on-site testing, document review, and interviews.
• For GDPR, [[review-gdpr-readiness]] provides a more detailed 10-area review.
• For sanctions, [[research-sanctions-screening]] is required for transaction-level screening.
• For AML, [[research-beneficial-ownership-lookup]] is required to complete UBO identification.
• Regulatory enforcement risk assessments require jurisdiction-qualified legal counsel.

Related skills

• [[research-regulator-guidance-lookup]]
• [[research-regulation-lookup]]
• [[research-sanctions-screening]]
• [[research-beneficial-ownership-lookup]]
• [[review-gdpr-readiness]]