Assessment: Mittenda Limited IE · Regulation: EU 2023/1113 · Roles: PSP, Intermediary PSP, CASP, Intermediary CASP
Stage 4 — Treatment
ISO 31000:2018 §6.5 — Risk treatment — what this requires
ISO 31000:2018 §6.5 — Risk treatment
The purpose of risk treatment is to select and implement options for addressing risk. Risk treatment involves an iterative process of: formulating and selecting risk treatment options; planning and implementing risk treatment; assessing the effectiveness of that treatment; deciding whether the remaining risk is acceptable; and, if not acceptable, taking further treatment.
Track the treatment plans created from Treat decisions through their lifecycle: start work, complete, or lapse them. A plan that isn't closed is overdue when its target date, or the date of any of its actions, has passed. Plan content (option, owner, steps) is captured on each risk's decision page. Stage state: In progress
Plan status
Treatment plans recorded against in-scope risks.
Treatment plans
Sorted with overdue and active plans first. Advance each plan as remediation progresses — every change is recorded on the audit trail.
- Open Reduce R-CROSSBORDER-LOW-VALUE-MINIMUM-INFO-NOT-ACCOMPANYING-TRANSFERCross-border low-value minimum information not accompanying transfer
Amend MTD-STD-04 §3.4 so the reduced data set applies only where the payee's PSP is established outside the Union. Add the unique transaction identifier route and state how linked transfers are added up at initiation.
Remediation owner: Demo User Review owner: Demo UserTarget date: target 2027-01-04 - Open Reduce R-ORIGINATOR-NAME-NOT-ACCOMPANYING-TRANSFEROriginator name not accompanying transfer+1 more — all 2 actions, on the risk's page
- Confirm in the design note that outgoing transfers on Garnet and Osprey take the verified legal name, never the display name. Make sure an Osprey transfer cannot leave on a name the overnight synchronisation has not yet updated.
Remediation owner: Demo User Review owner: Demo UserTarget date: target 2027-01-04 - Open Reduce R-ORIGINATOR-VERIFICATION-DEEMING-WRONGLY-INVOKEDOriginator-side verification deeming wrongly invoked
Amend MTD-STD-04 §3.5 so the deeming applies only where the payer's identity was verified and the verification records are retained, or where AMLD Article 14(5) applies. Record per transfer which condition was relied on.
Remediation owner: Demo User Review owner: Demo UserTarget date: target 2027-01-04 - Open Reduce R-PERSONAL-DATA-NOT-DELETED-UPON-EXPIRYPersonal data not deleted upon expiry of the five-year retention period
Either align the transaction-record period in MTD-POL-02 §3.1 to five years, or record the national-law provision and AML/CFT purpose that permit the further two years. Give the legal-hold exception in §3.2 a stated basis and an upper limit.
Remediation owner: Demo User Review owner: Demo UserTarget date: target 2027-01-04 - Open Reduce R-REPORT-TO-AML-CTF-COMPETENT-AUTHORITY-FAILEDReport to AML/CFT competent authority failed
Extend MTD-STD-04 §4.1 to define repeated failure, set graduated steps up to rejection, restriction or termination, and require a report to the competent authority within three months of identification.
Remediation owner: Demo User Review owner: Demo UserTarget date: target 2027-01-04
Treatment sign-off
Advance plans as remediation progresses. Lock when the treatment baseline is agreed and ready for sign-off.