Building an investor controls appendix that survives counsel review

Investor counsel reading a Taiwanese fintech data room is not looking for marketing claims about culture. They want to see whether open regulatory findings have owners, whether incident logs are complete, and whether the AML programme description matches the product actually live with customers.

Lead with the programme map

Open with a one-page map: licences held or sought, products in scope, and the named compliance officer. Then attach the current policy index with effective dates. Orphan policies without owners are a frequent diligence flag.

Put metrics next to caveats

Alert volumes, SAR counts, and training completion rates help — but only with context. A sudden drop in alerts after a rule change needs a sentence explaining calibration, not silence. Counsel will ask; better to pre-empt the question.

Keep remediation visible

A short table of open findings with target dates reads as maturity. A folder that pretends nothing is unfinished reads as risk. In diligence pack engagements we often rewrite this table first, because it sets the tone for every later question.