Our lawyers map every obligation that applies to your licence, sector and markets, translate it into plain operational requirements, and connect each one to a control your teams can evidence.
The problem
Most compliance programmes grow by accretion: a new circular, a new policy, a new tab in the tracker. After a few years nobody can say with confidence which control satisfies which rule — until an inspection asks.
Our answer
We build a single register of your obligations, written in language operations teams can act on, with an owner, a control and an evidence requirement against each line. It lives in ENKAYT Govern, so it stays current as the law moves.
Line-by-line mapping of statutes, directions, circulars and licence conditions to the business units they bind.
A clear view of where current policies and controls fall short, ranked by regulatory exposure.
Policies that say what the regulator expects and what staff actually do, without contradicting each other.
Responses to inspections, show-cause letters and information requests, drafted and reviewed by counsel.
Risk-based testing plans that produce evidence a supervisor will accept.
Reporting that tells directors what is assured, what is not, and what decision is needed from them.
Every requirement starts from a cited source. Software organises the work; it doesn't decide what the law says.
A control counts when it produces evidence, not when someone ticks a box saying it operated.
Effort follows exposure. Low-risk obligations get lightweight checks; material ones get depth.
You know your position before the supervisor does.
New rules are mapped against existing controls, so you see the delta instead of starting over.
Each obligation has a named owner and a review date.
One control can satisfy several frameworks, so teams stop testing the same thing three times.
Confirm licences, markets, products and the regulatory perimeter.
1–2 weeks
Build the obligations register and link it to existing policies and controls.
3–6 weeks
Close the gaps in order of exposure, drafting and testing as we go.
Ongoing
Quarterly monitoring and board reporting from live evidence.
Quarterly
Licensed commercial bank7 monthsSample
A bank tested overlapping controls separately for each framework. We merged them into a single library traced to the underlying obligations.
Something else on your mind? Ask a specialist.
No. We strengthen it. Most clients keep ownership in-house and use us for legal interpretation, the obligations register and periodic independent assurance. Where a team is still being built, we can provide interim support.
We work across Sri Lankan sector regulators and statutes as well as international frameworks such as ISO/IEC 27001, ISO 37301, GDPR and PCI DSS. Scope is confirmed during the first consultation.
No. Advisory work stands on its own. The register can be delivered in the platform or exported to tools you already use.
A two-week gap assessment shows your exposure by regulation and business unit, with a remediation plan you can take to the board.