Sophie DEWAELE

– Gather and clarify requirements and business needs with the Product Owner, Compliance and Operations teams – Translate business needs into functional specifications, acceptance criteria, and process flows within an Agile framework. – Prepare and execute functional, regression, and UAT test cases. – Create/fine-tune business rules for mappings between local and central databases; – Provide user support daily and contribute to change management for teams based both in Luxembourg and abroad. – Requirements documentation (business requirements, functional specifications, user stories) – Test plan and test cases (functional, regression, UAT) – Data mapping documents (existing mappings updates + new mappings) – Change management communications (release notes, user notifications, key updates) – Risk issue analysis and remediation proposals – Agile delivery artifacts (sprint backlog inputs, review demos, documentation updates)

Scope: Set-up of the Risk management, Regulatory and Compliance Value Chain to empower multidisciplinary teams (Business & IT) to collaborate within the same business domain containing processes and supporting IT products. – Ambition and storylines: Define High-Level Ambition, Digital Storylines and Roadmap; – Governance: Identify members and build a team (Business and IT lead, Business representatives, Project Managers), confirm the modus operandi as well as the Decision & Voting Mechanism; – Scope and operating model: Validate the Value Chain Scope for Processes & IT Products; – Demand Management and Capacity planning: List the projects and initiatives and validate a prioritization mechanism, Monitor Impact and Benefits for each project, produce reporting; – Change Management and Communication: Awareness session on roles and responsibilities, organization of training sessions, MS Teams Channel animation.

Scope: The mission was completed in two phases, encompassing the analysis of recurring hits and exceptions, followed by the activation of new screening lists, quantitative analysis, and implementation of new exceptions. – Analyze recurring false hits in the sanctions screening tool and define exceptions to reduce false positives, enabling 1st line teams to focus on higher-value tasks; – Conceptualize, modify, and develop rules and models to address emerging trends, suspicious patterns, and red flags; – Evaluate existing models and scenarios, conducting tuning, optimization, and validation of models and scenarios; – Design and support the implementation and modification of Financial Crime Compliance Tools within the bank; – Coordinate and perform testing in collaboration with Compliance, business/operations, and IT teams

Scope: – Data analysis for the reporting of inactive accounts and safe-deposit boxes (Law of 30 March 2022); – Error analysis of the daily extract to the CSSF for all payment accounts and bank accounts identified by IBAN and safe-deposit boxes and actions to achieve a 0% error rate (Law of 30 March 2022; – Improvement of the in-house Tax risk rating tool following a gap analysis carried out by the Compliance department with the key points reported. – Data quality checks and change; – Front office data entry guidelines; – Business analysis on IT change, approval by Compliance and Tax department followed by non-regression testing based on completed development; – Assessment of AS-IS processes in the organization and design of TO-BE processes to gain efficiency and be in line with change requirements.

– Preparation for the integration of sustainability risk into risk management; – Product governance to consider client's ESG preferences; – Identification of all processes, design of the most impacted processes for interactive interviews; – Website amendment and documents disclosures.

Scope: Brainstorming, roadmap, SWOT, elaboration of the specifications, expression of needs, testing. – Record of processing activities with personal data; – Carrying out data protection impact assessment (DPIA); – Implementing appropriate security measures (IT); – Creation of a record of all personal data breaches; – Procedures update and creation of new procedures related to GDPR obligations.

Regulatory project "Sécurité financière" for application of new AML/KYC rules 4 phases: initiating - budget & timing validation, roadmap, development monitoring, closing. Scope: Implementation of a new Circular letter introducing AML/CFT qualitative questionnaire; expression of needs, leading steering and project committee throughout the project, producing relevant reporting for the sponsor. Deliverables: Delivery of a new tool on schedule, budget, and aligned with business goals and initiating a new digital project.

Scope: Control framework implementation Mifid II & PRIIPS (DPM, Advisory and Execution services): pre-trade suitability test, loss report, best execution, target market, KI(I)D remittance. Tasks: Control Design in line with business and risk requirements, sample, substantive testing, communication and reporting, follow-up on actions.

Scope: Risk assessment reviews for 150 clients, KYC data input into the screening tool, processes and policies updates. Monitoring & detecting suspicious transactions (fraud, market abuse, insider trading) and press review: initial check and alerts monitoring

– Conduct eligibility assessments for Internal Funds, aligning client profiles and portfolio types with internal restrictions and regulatory requirements – Monitor and follow up on discretionary management mandates – Maintain and update funds and asset managers databases – Process life insurance policy operations (subscriptions, top-ups, surrenders, amendments) – Perform AML/KYC analysis on incoming files (verification of client identity and address, source of funds, geographic and economic origin, FATCA compliance) – Handle business partner requests – Prepare and execute Business Continuity Plan (BCP) testing exercises – Perform second-level compliance controls and monitor action plans to mitigate major operational risks – Conduct risk assessments of outsourced activities (Solvency II) – Assistance in the development of risk management framework (elaboration of a risk matrix) – Compliance Monitoring Plan: due diligence, organizational aspects, delegation and outsourcing – Fulfillment of the annual AML questionnaire – Internal audit on specific topics (3rd line of defense): EMIR, Mifid II, GDPR – Filling for CSSF license (PFS) and Ministre des finances – Evaluation of outsourced IT service providers