On the whiteboard in the compliance war room, Jason had written the countdown.
Day 14 was in neat blue capitals. Day 13 was in slightly larger capitals. By Day 11 he had switched to red, added an exclamation mark, and drawn a small figure running away from a calendar. Nobody had asked him to draw the figure. Everybody had noticed it was getting faster.
Puan Farah Aziz, head of compliance at Bank Seri Cendana, stood in front of it with a coffee and the quiet expression of a woman who had prepared for eleven examinations and been surprised by none of them.
"Jason. The examiners will ask how we know staff answer customers from current policy. Not what the policy says. How we know they use it."
"We have the training records, Puan. Everyone did the awareness module. Even Kunci has a certificate."
"Kunci is a cartoon padlock."
"He is very compliant, Puan."
Farah allowed herself a small smile. Then she pointed at the second item on her list. The examiners would also look at technology risk. The central bank's RMiT policy document expects user activities in critical systems to be logged for audit and investigations. Whether a given system counted as critical was the bank's own classification, made in its own framework. Farah did not intend to argue about it in front of examiners. Her rule was simpler: if staff use it to answer customers, its records had better be in order.
"iKB," she said. "Show me what we can show them."
Jason opened iKB's audit trail and activity logs. For every question asked across the branches, the contact centre and the credit teams, there was a record: who asked, when, what was asked, and which approved documents were cited in the answer. He filtered the last six months and exported the results.
"Redact the customer details first," said Farah. "Names, account numbers, anything personal. The examiners need to see how we work, not who our customers are."
Jason applied the bank's redaction rules and re-ran the export. Account numbers became neat grey bars. A customer called Auntie Lim became "Customer A". Jason felt this was a demotion she would not accept.
Then he checked the retention settings, to be sure the records the examiners might ask for would still exist when they asked. They did. He added a small green tick to the whiteboard, next to the running figure, to cheer it up.
The export took a few minutes. Reading it took the rest of the afternoon.
Farah noticed the pattern first. Scattered across the six months were dozens of questions that looked oddly alike. Passbook waiver for customers aged 60 and above. Card dispute window fourteen days. SME rate band for term loans. Different branches. Different teams. Different staff. The same three entries, asked about again and again, and every time iKB had cited the current policy, which said something else.
"Jason. Why would forty people in different departments all ask about rules that ended years ago?"
Jason scrolled. "Because they all read them somewhere first?"
"Exactly. They read the old rule somewhere, it did not match what they saw on screen, and they checked." She tapped the screen. "Every one of these is a person who doubted their source. Which means the source is still out there."
This was the serious moment, and the room went quiet in a way that had nothing to do with the countdown.
The export was good news and bad news at once. Good, because it showed staff checking current policy before answering. Bad, because it showed an unofficial rule book circulating across the bank, quoting terms that had been withdrawn. Some customers must have been told the old rules before anyone checked.
Jason cleared his throat. "Puan, we could quietly remove whatever it is before the examiners arrive. They would never know."
Farah put her coffee down.
"We would know," she said. "And if an examiner finds it later, the question will not be about a cheat sheet. It will be about why we hid it." She wrote three words on the whiteboard, under the running figure: Find. Fix. Disclose. "We find it, we fix it, and we tell the examiners what we found and what we did. That is what a compliance function is for."
Jason looked at the three words, then quietly erased the exclamation mark from Day 11. It felt like the right thing to do.
Then came the snag. iKB's records could show every question staff had asked and every document it had cited. They could not show what staff had read before they asked. Paper does not leave an audit trail. Neither does a photograph forwarded in a chat group, or a tab in a personal spreadsheet.
"So we go and look," said Farah. "Every branch in the region. Every counter. Today and tomorrow."
The walk-round took two days. Jason visited nine branches and came back with a cardboard box.
Inside were laminated sheets. Twenty-three of them, all identical, all slightly yellow, all quoting the same withdrawn waiver, the same old dispute window and the same old rate bands. At Taman Melati, Encik Rahman had already removed his. He handed it over with visible relief and a note from a customer service officer called Aina, which said: Please find out who made this. The computer should not be under the sheet.
Jason laid the sheets out on the conference table in a neat grid, like evidence in a detective drama. Then he noticed something.
"Puan. They all have the same smudge in the corner. Initials, I think." He picked up the least faded one, from a branch where the counter had been out of the sun. He squinted.
"F.A."
Behind him, Puan Farah Aziz had gone very still.
"F.A.?" said Jason. "Who is F.A.? Do we have an F.A.?"
Farah looked at the grid of twenty-three laminated sheets for a long time. Outside, someone in the corridor laughed at a joke. On the whiteboard, the little figure kept running away from the calendar.
"Jason," she said at last, very calmly. "Get me the list of branch managers from 2019."
What this means for your compliance team
- iKB is an enterprise knowledge AI platform by Astiostech, a Malaysian technology company, that turns approved organisational content into governed answers with citations.
- iKB provides audit trails, activity logging, event records and exports, which can show how staff use approved policy content across departments.
- Redaction and retention rules, part of iKB's AI governance features, help keep customer details out of shared evidence and keep records available.
- The central bank's Risk Management in Technology (RMiT) policy document, issued on 25 September 2026, requires financial institutions to ensure that user activities in critical systems are logged for audit and investigations (paragraph 10.57(c)). Whether a system is critical is for each bank to classify. Source: RMiT policy document
- Audit records show what staff asked and what was cited, not what they read on paper. Finding unofficial sources still needs people on the ground.
FAQ
What is iKB? iKB is an enterprise knowledge and sovereign AI governance platform, a Malaysian technology company, that turns approved organisational content into governed answers with citations.
Does iKB keep a record of what staff ask? Yes. iKB provides audit trails, activity logging, event records and exports.
Can customer details be removed from exported records? iKB's AI governance features include redaction and retention rules, which help control what personal information appears in shared records and how long records are kept.
Does iKB make a bank RMiT compliant? No single product makes a bank compliant. iKB's audit trails, role-based access control, redaction and retention rules can be assessed by a bank as part of its own technology risk framework under the RMiT policy document.
Can iKB find unofficial cheat sheets? No. iKB records questions asked and documents cited in its own platform. Paper sheets and files outside the approved content have to be found by people, although repeated questions about old rules can hint that such sources exist.
Where can I learn more? Checkout iKB or contact the Astiostech team.
Disclaimer
This is a work of fiction. Bank Seri Cendana, its branches, compliance team, examinations and all characters are invented and do not depict any real bank, examination or regulator's action. References to the RMiT policy document describe a real, published document; the events around it are imaginary. iKB is a real product by Astiostech.
Coming up in Part 5
The 2019 branch manager list is on the table. Twenty-three laminated sheets are on the table next to it. The examiners arrive in nine days, and the person who has to brief them already knows what the list will say. The finale of The Laminated Policy. Companion article: How Banks Show Examiners Staff Use Current Policy.