NovaPay: From 23/100 to CBN-Compliant in 6 Weeks

NovaPay, a Series A payment service provider, came to StackWeaver with 14 open findings across 5 CBN AML requirements and an audit deadline approaching. Six weeks later, their posture score was 100/100. This is how — and why the result held after the deadline passed.

The starting position

NovaPay's controls were largely documented, not enforced. KYC ran at signup but not on risk triggers; transaction monitoring existed but retained no evidence of having run; STR filing depended on a person noticing. The posture score of 23/100 reflected a real gap between policy and operation.

The approach: engineer, then evidence

1. Weeks 1–2 — Baseline. Mapped every control to CBN AML requirements and classified each as documented or enforced.
2. Weeks 3–5 — Engineer the gaps. Converted the highest-risk administrative controls into enforced ones: real-time monitoring with retained evidence, threshold-driven STR detection wired to a filing workflow, re-verification on risk triggers.
3. Weeks 4–6 — Wire evidence. Routed control outputs into a mapped, tamper-evident store, so proof accumulated automatically.

The outcome

• Posture score improved from 23/100 → 100/100.
• All 14 CBN AML findings remediated and documented with source-captured evidence.
• Automated STR/CTR detection and filing deployed before the deadline.
• Timeline: 6 weeks, versus a 9–12 month industry norm.

Why it held

Because the fixes were engineered controls emitting continuous evidence — not documents — NovaPay did not decay back toward 23/100 after the deadline. They had moved up the TEMM toward continuous operation. This is the entire argument for continuous compliance, demonstrated on a real deadline.

The step-by-step method is documented in the CBN AML Implementation Guide; the commercial engagement is CBN AML Compliance Readiness.