Last October a Mumbai broker, newly obliged by the SEBI AML Master Circular refresh in consultation, told me his firm had decided to "do PMLA properly this year". Over coffee I asked him what Week 1 looked like. He waved his hand and said something about "getting a policy drafted and training the team". That was a programme destined to stall at Week 3.
A ten-week AML build is not a mystery. It has four phases, each with one verb and one deliverable set, bracketed by four checkpoints. If you cannot answer the question "which phase are we in and what verb is this week," you are drifting. The shape has worked for me on an NBFC, on a VDA SP, on an insurance intermediary and on a CA firm newly caught by S.O. 2036(E). It will work for you.
Phase 1 (Weeks 1-2): Appoint
The verb is Appoint. The deliverables are the Principal Officer and Designated Director appointment resolution, the FIU-IND registration on FINnet 2.0, the written scoping document agreed with the Board, and the stakeholder RACI naming who is Accountable, Responsible, Consulted and Informed by role for each strand of the programme.
You will not have a policy yet. You will not have scenarios yet. You will not have training. That is correct. If you try to draft a policy on Day 3 before you have the authority to approve it, the policy will be redrafted four times before Week 5 and nobody will trust the final version.
Phase 1 ends with Checkpoint 1, a short Board meeting at the end of Week 2 that formally receives the appointment, the FIU-IND registration confirmation, the scoping document and the RACI. Minutes are signed. The Principal Officer now has the authority to proceed.
Phase 2 (Weeks 3-5): Draft
The verb is Draft. This is the heaviest phase. The deliverables are the internal AML policy, the CDD procedure covering the Rule 9 three tiers [L5-C1], the beneficial-ownership tracing worksheet at the post-2023 thresholds [L5-C2], the EDD questionnaire for high-risk categories, the sanctions screening SOP, the STR narrative template, the record-retention schedule layering PMLA with the sectoral regulator overlay, and the 24-hour STR filing checklist.
Phase 2 is also the right time to freeze onboarding of high-risk new relationships. I recommend a short Board-approved pause on new PEP, non-resident and complex-ownership-structure onboardings for Weeks 3 to 5 while the policy is being drafted. The business will object. The right response is that the pause is for three weeks only and that onboarding will resume at Checkpoint 2 under the new policy.
Phase 2 ends with Checkpoint 2, a formal policy-approval Board meeting at the end of Week 5. The policy is approved by resolution. The CDD procedure is approved by the Audit Committee. The STR workflow is signed off by the Principal Officer and the CTO. The onboarding freeze lifts the next morning.
Phase 3 (Weeks 6-8): Operate
The verb is Operate. The deliverables are a trained branch and operations team, a running transaction-monitoring queue with scenarios tuned on dry-run data, a working sanctions screening run against UNSC 1267 [L5-C3] and MHA UAPA Section 51A [L5-C4], three practice STR filings on real alerts, and the first monthly CTR, NTR and CBWTR filings under Rule 7 [L5-C5].
Phase 3 is where most programmes break. The scenarios will produce too many false positives. The branches will escalate everything or nothing. The STR narratives will be weak on the first draft. Treat these as expected. Build a daily alert triage review in Week 6. Hold a mid-phase retrospective in the middle of Week 7. Expect to adjust scenarios twice before Week 8.
Phase 3 ends with Checkpoint 3, an internal operations review at the end of Week 8 that measures false-positive ratios, STR time-to-file against the Rule 7 seven-working-day window, and training completion rates. The Principal Officer signs the review.
Phase 4 (Weeks 9-10): Review
The verb is Review. The deliverables are a mock FIU inspection run by an external advisor or by an internal audit team, a Board briefing deck summarising programme health, a twelve-month operating calendar covering monthly, quarterly, half-yearly and annual tasks, and the written handover package the Principal Officer owes a successor.
The mock inspection is non-negotiable. It costs a day of your advisor\'s time and reveals the policy gaps the drafter did not know existed. By the time a real inspector arrives you will have closed them.
Phase 4 ends with Checkpoint 4, a full Board sign-off at the end of Week 10. The Board receives the programme health deck, the operating calendar and the risk register. The Audit Committee adopts the twelve-month calendar. The engagement is now programme, not project.
Three programme killers to disarm in Week 2
Unclear Principal Officer authority. If the appointment letter is silent on the authority to access records, direct freezes and sign STRs, you will spend Phase 2 negotiating authority instead of drafting. Fix this in the resolution.
No documented Board decision log. If the Board has not minuted the appointment, the scoping document and the RACI, Phase 2 drafts have no traceable mandate. Fix this at Checkpoint 1.
No onboarding posture agreed. If the business and the compliance function enter Phase 2 with different assumptions about whether high-risk new relationships continue during the drafting pause, every policy decision becomes a fight. Fix this in Week 2 with a written three-week onboarding posture.
Five failure modes practitioners repeat on sequencing
Trying to run all four phases in parallel. The phases are sequential for a reason. Appointment unlocks authority. Authority unlocks drafting. Drafting unlocks operation. Operation unlocks review. Skip a step and the next step has no foundation.
Over-scoping the first programme. Keep the first ten weeks tight. You can add FATCA, CRS, correspondent-banking deep-dive and sanctions-list consolidation in the next quarter.
Under-training branches. The policy that lives only in the Principal Officer\'s laptop is a theoretical policy. Phase 3 training is where it becomes a working one.
Letting alerts drown the Principal Officer in Phase 3. Tune the scenarios twice. Agree a daily triage window. Document the closed alerts for the Section 70 defence.
No calendar after Week 10. The programme must run forever. Checkpoint 4 is the start, not the end.
Your artifact from Lesson 5
Draw the ten-week engagement map for your organisation on one page. Four phases, four verbs, four checkpoints, with the deliverables and owners for each. Save it as Artifact 5 in your capstone workbook. We will revisit this map at the end of each module as a cross-check against drift. If the module you are reading does not fit into one of the four phases, your programme has drifted.
The 2-click version
You have three honest routes to deliver the ten-week programme on your reporting entity. Route one is to run the course templates manually with your in-house team, using the artifacts you build across Modules 1-12. The templates are complete and the engagement is doable with a two-person team. Route two is to run the programme inside the dcomply Compliance Suite, which pre-wires the capstone artifacts (policy, CDD workflow, STR, retention schedule, calendar) as live tools rather than Word documents. Route three is to engage Decipher done-for-you, where our team runs the Appoint-Draft-Operate-Review cycle on your entity, with you reviewing at each checkpoint. Pick the route that matches your bandwidth. The course is the same.