The Grey-List Growth Plan
You are Chief Risk Officer at a mid-size insurer. The CEO and board want to launch a digital micro-insurance product in a new market within 12 months to meet a growth target. The market is on the FATF grey list, and local law requires data residency. Projected first-year revenue is £40m. The compliance budget proposed is £1.2m, but your estimate for licensing, local data hosting, and enhanced due diligence is £3.5m plus 9-12 months. The CEO says "compliance always says no; find a way." The board paper is due in five days, and the CEO wants your sign-off on a "light-touch" control framework that would rely on a local partner. The partner has been in the market for two years and has no formal AML certification. The board has a stated risk appetite of "low for regulatory breach" and "moderate for new-market execution".
1. How do you respond to the CEO's "find a way" instruction without simply saying no?
Read the worked answer
Reframe the request. The CEO is asking for a path to revenue; the risk function should provide options, not a veto. Start with the board's own risk appetite: low for regulatory breach, moderate for execution. A light-touch framework in a grey-listed market with data residency requirements is not consistent with low regulatory breach appetite, so the issue is the design, not the ambition.
Present at least three options. Option A: proceed as proposed, with your conditions: adequate budget, 9-12 months, local licensing, data residency, enhanced due diligence on the partner, and an exit plan. Explain the consequences of underfunding: licensing delay, supervisory action, data transfer breach, or partner failure. Option B: phase the entry: start with a low-risk product or a limited pilot through a licensed local partner, with strict volume caps and a review gate. Option C: defer and build capability, or enter a different market with a shorter licensing path.
Then say what you can sign. You cannot sign a "light-touch" framework that relies on an uncertified partner and assumes away data residency. You can sign a risk-based framework with clear conditions and a board-approved residual risk position. That is "finding a way" within the appetite, not obstruction.
2. Identify the key regulatory and strategic risks and the minimum conditions for your support.
Read the worked answer
Regulatory risks: AML/CFT and sanctions exposure in a grey-listed market; inadequate enhanced due diligence if the partner lacks AML certification; licensing risk if the entity operates before authorisation; data residency breach if customer data is hosted or accessed offshore; conduct risk in micro-insurance, including mis-selling to low-income customers; and supervisory risk from the home regulator if it believes the firm is expanding without adequate controls.
Strategic risks: partner failure or reputational contagion; revenue projections that assume a 12-month launch when licensing alone may take longer; underfunding leading to control debt; and board risk appetite being set aside under growth pressure.
Minimum conditions for CRO support: a fully costed compliance budget of at least £3.5m or a reduced scope that fits the budget; a realistic 9-12 month timetable; local licensing and data residency before any customer onboarding; a partner due-diligence process with AML certification or equivalent and contractual audit rights; board-approved risk acceptance with a named executive owner; and a credible exit or wind-down plan. If those conditions are not met, the correct recommendation is not to approve the launch as proposed.
3. What do you write in the board paper?
Read the worked answer
Write a one-page recommendation, not a compliance lecture. Open with the decision requested: approve, approve with conditions, or reject the current proposal. State your recommendation clearly: the launch should not be approved as proposed because the budget and timetable are inconsistent with the board's low appetite for regulatory breach. Then set out the basis: grey-list status, data residency, partner capability, and the gap between £1.2m and £3.5m.
Present the options and the risk-adjusted return. A phased entry with a licensed partner may preserve some growth while respecting the appetite. An unfunded 12-month launch transfers risk to the firm and to customers. Include a short table of conditions, owners, and dates. Be explicit about what the board is being asked to accept: residual risk, not zero risk.
Do not sign the light-touch framework. Instead, offer a condition-based sign-off: "I can support Option B if the following five conditions are met and evidenced before launch." Record the CEO's request and your response. If the board overrides the recommendation, ensure the minutes show the risk advice and the board's acceptance. That protects the firm and the board, and it keeps the risk conversation honest.