Client question walkthrough

What should be the starting point of the platform? Pre-initial meeting (soft KYC) or after the first meeting is held — meeting reconciliation? What exact event changes a prospect from advising into a formal onboarding client file?

Who may reopen a returned, declined, or withdrawn onboarding case?

No dedicated “reopen” screen in the current MVP — policy decision. Case list / overview still useful for discussing case lifecycle statuses.

Should one canonical client have separate cases/events for each fund, share class, subscription?

Related UI: case overview and multi-case inventory. Same topic returns as Q23.

How frequently should we sync the calendar into the portal?

After sync, if a meeting was held but is not yet classified (investor meeting vs anything else), how fast should we start pinging front desk? How long should we continue via email? When does an unresolved meeting become due or overdue? Define reminder cadence, channels, recipients, escalation levels, and stop conditions.

Seed default (prototype): L1 at 2 days (meeting owner, email) → L2 at 5 days (+ compliance, email+in-app) → L3 at 10 days (+ superadmin). Client should confirm or replace this cadence.

What should be the entrypoint for creating a new client file inside the portal?

• a. Meeting reconciliation
• b. Manually adding a new client file

When reconciling a meeting, how do we identify the prospect against an existing CRM (e-way) client? Notes with “e-way ID: 123456”? Or a searchable dropdown of CRM clients with fuzzy match?

Current local MVP uses deterministic CRM mocks. Dropdown vs note-ID is the client decision; UI can support either.

If the client is not found in CRM, may front desk create a new client file from the platform? Or must we always reference CRM first? If we allow platform create, do we also create the client in CRM?

Policy + integration contract decision. Use the meeting detail + integrations screen for context.

4. If we referenced a CRM client, do all clients already have a BCIF we can pre-populate?

5. When we create/update a BCIF in the portal, should we write back / update CRM BCIF (portal holds latest)?

5.1 Which differences may front desk resolve without asking the client? (punctuation, abbreviations, transliteration, address formatting, whitespace…)

5.2 Which differences must return to the client for correction + new signature? (legal name, UBOs, directors, authority, classification, SoW/SoF, PEP/sanctions…)

5.3 Can Najeeb directly override Anas’s proposal with a recorded reason, or must he return it to Anas?

5.4 May Compliance correct information supplied by the client, or only reject/return it?

5.5 When a client correction is required, should the existing invitation be revoked automatically and a new version issued?

5.1–5.5 are primarily policy rules. Screens show where the decision is exercised, not the rule text itself.

Should portal users see if the client opened a link? Should the link be password protected? Can users expire / regenerate the link? Auto-expire vs front-desk-defined lifetime?

6.1 Which questionnaire declarations and field wording must exactly match approved DFSA COB language?

6.2 Which e-sign / e-undertaking method has Ajeej Compliance/legal approved? Typed name, OTP, DocuSign/Adobe Sign, qualified cert, or wet signature?

Mostly legal/compliance policy. Client portal screenshot shows current prototype signing approach (typed name + declarations).

Should we send an email notification to front desk when the link is submitted?

Related surfaces: questionnaire tab status + reminder / notification channels. Decision is email product policy.

How should portal users (front desk / compliance / CEO) authenticate? Email/password vs “Sign in with Microsoft” (Entra ID), or both?

Do we need to let front desk upload documents and attach them to client files?

For screening, what should happen if something is found?

10.1 Exactly which parties must be screened for each client type? (entity, individual, directors, signatories, UBOs, shareholders, controllers, settlors, trustees, protectors, beneficiaries, connected parties…)

10.2 Is the ownership threshold exactly 10% inclusive, and how are nominees, indirect holdings, and acting-in-concert interests aggregated?

10.3 Who may clear a false positive, and is four-eyes approval required for every dismissal or only defined categories?

10.1–10.3 are policy/matrix decisions. Provider credentials are listed under “Materials we still need”.

11. What exactly do we send to Administrator handoff (Maple/Carta), and how (email)?

12. How do we check the response (email monitoring)?

Turnaround / reminders / escalation (12.1); Maples vs Carta same or separate workflows (12.2); retention format (12.3); hard blocker if delayed (12.4); RBA override by Compliance (12.5); can Administrator reject + reopen paths (12.6); who prepares/checks/approves/sends pack (12.7); which Administrator per fund/share class (12.8).

Mostly operating-model decisions. Administrator tab + RBA tab are the discussion anchors.

13. Which meetings go into the Marketing registry? Only investor meetings? Exact conditions?

13.1 What does “ESCALATE” mean in the current Marketing Registry source?

13.2 Exact columns, filters, evidence, export format, and annual submission process?

14. Which conditions force High regardless of arithmetic? (PEP, jurisdiction, product, adverse info, ownership complexity, sanctions association…)

15. Exactly which cases require CEO approval? High only, PEP regardless, Medium, exceptions…?

16. Should CEO/SEO be able to return to Compliance, finally reject, or both as distinct outcomes?

17. If CEO/SEO returns a case, what must be revised and who resubmits?

18. Who records the final onboarding outcome after CEO/SEO evidence is complete? (Prototype: Compliance)

18.1 / 18.2 Prerequisites for first “green light”; is there a second/final green light?

19. What exact event means a subscription is accepted, released, funded, and completed? (May be separate states owned by different parties.)

20. After final release, which corrections are permitted and who may reverse or supersede the event?

Subscription lifecycle also appears via integration events; confirm event vocabulary with operations.

Do we need to migrate any existing client/BCIF data?

Data-migration decision — no product screenshot required. Users / roles matrix is adjacent.

22. Can one client have concurrent subscriptions across different funds/share classes? How should conflicts be handled?

23. Should one canonical client have separate cases/events for each fund, share class?

How frequently should we run periodic screening? Which entities should be checked? Should we send email if something is flagged?

Can you confirm this is the right order, and what you’d call each step in the product?

1. BCIF sections 1–7 (front office)
2. Section 8 classification (compliance, with the DFSA rule number)
3. Client questionnaire (with the professional-client sub-options)
4. Fix any mismatch between our classification and what the client picked
5. Sanctions questionnaire (entity + individual)
6. Light / preliminary screening
7. Green light to the fund administrator so they can release the subscription form and collect KYC
8. We receive the KYC pack (from their portal)
9. Choose simplified / standard / enhanced due diligence
10. Full screening / full DD
11. If something bad turns up, we can decline here without doing risk rating
12. Risk rating (compliance can override the score)
13. If high risk → CEO or executive director approval
14. Final compliance decision / green light / client summary

Is Section 8 done once by compliance before the client questionnaire, and then updated if the client disagrees? Or do we wait until after the questionnaire before treating classification as final?

Sanctions timing is confusing today. In the call you said you want a sanctions questionnaire before light screening. You also said the fund admin already sends the entity sanctions form with the subscription pack, and the client returns it signed with the KYC docs. Which is the real gate? Who sends it (front office, compliance, or the admin)? Do we still need our own portal step, or is the admin’s signed copy enough?

Can you send the current entity sanctions form (the real one you use)?

You want the same idea for individuals (them + immediate family). That form doesn’t exist yet. Who writes and signs off the wording? What counts as “immediate family”? Anyone else covered?

How should people sign — type name in the portal, upload a wet-signed PDF, DocuSign-style, or any of those?

For companies with offices in more than one country: what exactly do they have to declare (branches, rep offices, etc.), and do they need to attach anything?

You offered to send the DFSA rulebook bits for deemed and assessed professional clients, with the subcategories highlighted. Please send that. We’ll use it as the list in the form.

Does the client pick one subcategory only, or can they tick more than one? You said the form fields don’t change by subcategory — still true?

If compliance’s Section 8 answer doesn’t match what the client picked on the questionnaire, who fixes it? Front office proposes, compliance approves, send the client a new link? Same process as other field mismatches?

Should Section 8 always store the exact DFSA rule number, not just “deemed” / “assessed”?

What’s in light screening vs full screening? Who gets checked, what data you need, which tools/lists, what we keep on file when it’s done.

If light screening is messy (possible hit, unclear name match), can we still green-light the fund admin, or does that block the go-ahead until compliance clears it?

When full screening finds something bad, can you confirm this tree:

1. Talk to senior management first
2. Either accept them as high risk (and maybe ask for more KYC), or decline
3. If we decline, sometimes tell the fund directors
4. If it’s bad enough, file a SAR with the UAE FIU and DFSA

Who is allowed to record each of those in the system? Should the system force the senior-management step before anyone tells the fund admin?

The fund admin also screens and sometimes sends their findings with the pack. How do you want us to capture that next to our own screening results?

We’ll change “send pack to administrator” to “give them the green light so they can release the subscription form and collect KYC.” What does that green-light message actually say today, and how do you send it (email?)?

How do you usually find out the pack is ready on their portal? How should the system log who downloaded what, and when?

Docs aren’t one-size-fits-all. For a simple individual you listed things like subscription form, FATCA/CRS, passport, address proof, source of wealth, sometimes a CV. For multi-layer companies, nominees, trusts, foundations, SPVs it gets heavier. Prefer a flexible checklist (add/remove docs) rather than one fixed pack for everyone?

Who at Ajeej chases the fund admin for extra documents? Should every chase be logged in the portal?

You said you don’t send KYC packs to the fund admin. Separately: front office emails the classification questionnaire to the client today. Should the portal send that email, or just keep a record that it was sent?

For complex structures you have to KYC every layer (directors, shareholders, trustees, foundation members, etc.). Should the system treat each of those people/entities as their own party for docs and screening? Including when foundation members are PEPs?

After the KYC pack arrives, before risk rating, you want a required choice: simplified / standard / enhanced. Is that decided as soon as the pack is in, so it drives how deep full DD goes?

What rules should auto-suggest the level? (e.g. regulated job or listed/gov company → simplified; PEP / complex structure / bad news → enhanced; industry like shipping/chemicals vs regulated finance.) Goal was less personal judgment, more policy.

What docs are required for each level? When you can’t get a second ID (diplomats, royals, etc.), what’s allowed?

Can compliance override the DD level itself (not just the risk score)? If yes, do they need a written reason / second person? Or should the system not allow overriding the level?

You said roughly:

• Simplified: rare refresh (once, or after a few years)
• Standard: every 2–3 years
• Enhanced: every 6 months

Should the system set reminders automatically from that? Who gets them, and what happens if a review is missed?

No risk rating until full DD is done cleanly. If we decline on bad findings, we never score them. Correct?

You said the risk factors need more silos. Which ones should we add (industry, country, structure complexity, PEP, adverse news, …)?

Compliance can override the calculated risk. Do they always need a reason logged? Second approval? Does medium risk need anyone above compliance, or only high risk goes to CEO / exec director?

If an existing client moves from low to medium (or similar), should the system automatically change their review schedule and required docs?

Official bands are only low / medium / high — no fourth “medium-high” status in the system. OK?

You and Ahmed said the flow breaks when news is bad or packs are incomplete. Can you sketch the main bad paths after the fund-admin step (missing docs, their findings, our findings, chase more docs, accept as high risk, decline, tell directors, SAR) and who owns each?

After a decline: what status should the case have, how do we make sure no money/subscription proceeds, who gets notified?

Demo flow: Anas proposes which value wins when BCIF and the client disagree → Najeeb confirms or sends it back. Keep that two-step check, change it, or drop it?

Once you’ve already accepted the BCIF early on, can you still send BCIF back to front office later, or at that point only the questionnaire can be reopened?

For auditors/regulators, what do you need to see in the history (every proposal, every return to client, every version)?

Who are the real first users and roles (Anas, Saleem, you, Tarek, directors, anyone else)?

Do you want a proper file repository on each client (many uploads), or is that optional?

You’re bringing in a third party next month on process/forms. What can we hardwire now as configurable policy, and what should we wait on (DD rules, risk factors, form templates)?

With heavier personal liability for compliance and CEO, what does the system need to prove later — who decided what, when, on which evidence, and why any override happened?

• Form fields don’t change by subcategory
• Sanctions should be separate from the client questionnaire
• Light screening then full screening after the KYC pack
• Risk rating only after full screening (unless you decline earlier)
• Compliance can override risk; high risk needs CEO/ED
• You want less discretion, more policy in the system
• Non-onboarding meetings can be marked as something else