Risk Transformation
Design and improve risk operating models, frameworks, governance, roles, data and technology.

Risk & Compliance
Translate agreed regulatory requirements into coordinated business change.
Overview
Regulatory implementation connects requirements with the processes, systems, data, controls and people affected by them.
Capmark works alongside legal, compliance, risk and business teams to assess gaps, define the changes required and coordinate implementation. We establish responsibilities, dependencies and the evidence needed to assess completion.
Where requirements overlap, we help align control and reporting work rather than create unnecessary parallel programmes.
What we do
We map obligations to the processes, systems, data, controls and owners they affect. The output is a practical delivery baseline: what must change, who owns it, what evidence is needed and which deadlines matter.
We design and implement the controls that discharge the obligation, including ownership, operating procedure, testing approach, evidence standard and reporting route. Controls are built to operate in the business, not sit in policy.
We build the data model, lineage, reconciliations and controls behind regulatory reporting. Data remediation is scoped into the programme from the start, so reports can be traced from source system to submission.
We map overlapping obligations into a single control inventory. Each control has an owner, evidence standard, test approach and the rule references it supports, reducing duplicated control work across regimes.
We sequence delivery by materiality, deadline and implementation risk. Each tranche closes with evidence that shows what changed, how it was tested and where the control now operates.
What to expect
A Senior Practitioner leads from day one. The first weeks establish the obligation baseline: what the rule requires, which controls address it today, where evidence is thin and which data gaps block compliance.
We then sequence delivery with compliance, risk, technology and business owners, closing each tranche with evidence structured around the regulator’s assessment criteria.
Engagements range from focused gap analysis to full regulatory-change delivery ownership.
Scoped by regime and complexity, sequenced as a structured delivery programme. Resilience delivery (service mapping, impact tolerances, recovery) sits under Operations & Performance.
Establish the current state, the constraints, the risks and the value at stake.
Shape the target model and the business case with the executives who own the outcome.
Stand up the team, the plan and the governance around the outcome.
Design, build and test the change, with the business alongside.
Cutover, hypercare and handover, so the business runs it under its own control.
The same five stages on every engagement, led by senior practitioners end to end. How we work
Impact
6+ regulatory regimes
Delivered
Basel III/IV, MiFID II, EMIR, MAR, Dodd-Frank, APRA CPS/APS standards
0 repeat findings
Where remediation evidence was accepted
on prudential and conduct programmes where Capmark led the implementation
Client result

Capital Markets · Surveillance
A Leading Global Investment Bank · Trade Surveillance
We helped take market-abuse surveillance from risk assessment and vendor selection through to live platforms across exchange-traded and OTC flow, aligned to market-abuse and market-integrity obligations, with tuning to reduce false positives.
Read the case study
Insights
Get in touch
Tell us what you are working through and the expertise you need.