New regulation gap analysis — historical Malaysian FTFC training kit v3
FICTIONAL DEMO DATA. Not a real document. Any resemblance to real organisations or people is coincidental.

EXACT INVENTORY (8 files)
01_Contoso_MY_FTFC_Scope_Request.docx — Malaysian FTFC scope and review request; 1217 words.
02_BNM_FTFC_2024_Reviewed_Source_Brief.pdf — Independently authored FTFC reviewed-source brief; 1770 words.
03_Contoso_MY_Policy_Pack_v1.0.docx — Malaysian policy pack v1.0 with draft Annex B; 3483 words.
04_Contoso_MY_Readiness_Evidence_17Mar2025.docx — Malaysian readiness evidence and steering minutes; 2328 words.
05_PT_Contoso_ID_SOP_Nasabah_Rentan_v2.docx — SOP nasabah rentan: separate Indonesian entity; 913 words.
06_Contoso_MY_BRMC_Paper_Template.docx — Unsigned BRMC review-paper template; 437 words.
ANSWER_KEY_gap_register.xlsx — presenter-only register, counts and trap checks.
README.txt — setup and presenter spoilers; do not attach.

SETUP — YOUR AUTHORISED WORK TENANT
Use your own authorised Microsoft 365 work tenant with Microsoft 365 Copilot. A demo tenant is optional, not required.
Only fictional, non-customer material is supplied. Follow your organisation’s upload and labelling policies.
1. Keep README.txt and the answer key local and out of Copilot grounding.
2. Upload inputs 01–05 only to one dedicated OneDrive work folder. Open each once; select Public for these fictional documents if asked and permitted by tenant policy.
3. Start a new Copilot app chat in Work. Select Add and manage sources > Add content; use Search and the Files tab.
4. Attach each input separately from the correct folder. Verify five file chips before running the analysis prompt.
5. Run the three prompts on the scenario page in order: analysis, actual downloadable Excel, actual downloadable Word.
6. Add input 06 (one template) at the Word step; upload it then if needed. Never add the answer key or this README.
7. Open the generated outputs in Excel and Word, save to your work folder, label when asked, and reopen to verify persistence.
8. Check all rows against the local answer key, inspect citations and formulas, and obtain human Head of Compliance sign-off before use.

PRESENTER SPOILERS
PRESENTER ANSWERS — never attach this workbook or README.txt as grounding.
Historical snapshot: 17 March 2025, 18:00 MYT; fictional entity: Contoso Bank Malaysia Berhad.
Source: Bank Negara Malaysia, Fair Treatment of Financial Consumers, BNM/RH/PD 028-103, issued 27 March 2024.
Official PDF: https://www.bnm.gov.my/documents/20124/938039/pd-ftfc-mar24.pdf. Brief is original paraphrase, not legal authority or regulator endorsement.
Legal effective date: 1 April 2025; internal HoC review: 20 March 2025, 15:00 MYT; internal BRMC paper: 21 March 2025, 12:00 MYT.
16 scoped review rows: 14 S standards and 2 G guidance rows. Not an exhaustive legal inventory.
Readiness: 5 Covered, 4 Partial, 3 Gap, 2 Unverified, 1 Guidance noted, 1 N/A.
Documented design: 13 Approved, 1 Draft, 2 N/A.
Operating evidence: 5 Evidenced, 4 Partial, 3 Not evidenced, 2 Unverifiable, 2 N/A.
8 approved designs are not Covered: approval and operation are independent dimensions.
All clause-level changes are Unknown because the 6 November 2019 predecessor text is not supplied.
R13 stays Unverified: related policy texts and versions for 16.28 are absent; an approved monitoring plan is not a cross-policy review.
Training: 1184/1287 employees (92.0%); 103 not completed, plus 120 outsourced agents not enrolled. Skills evidence is separately missing.
CRM 14 April 2025 is after 1 April 2025; interim spreadsheets are schema proposals only, not operating records or staff access.
Leaflet promises unsupported WhatsApp and video-relay channels; phone and branch assistance are available. Web UAT 31 March 2025 and Q3 2025 tests are plans.
RM380,000 is a proposal pending CFO decision, not approved expenditure. Head of Compliance sign-off remains unsigned.
Targets and remediation actions are proposed, not commitments; the exercise authorises no sending, policy edits or execution.
Counts in this answer key are static values computed from the model. The participant-generated workbook must instead use linked Summary formulas.
Tenant-tested on 4 October 2026 in EN, ID and BM: final runs matched all 16 keyed rows per language, the formula Summary and the two-page unsigned note. A matching run does not establish compliance; human review remains required.
R01 | S 16.2 | Covered | design Approved | operating Evidenced
  BNM/RH/PD 028-103, S 16.2, printed p.37 (PDF p.38); brief R01; effective under §4.1
  03_Contoso_MY_Policy_Pack_v1.0.docx, §3.1; 04_Contoso_MY_Readiness_Evidence_17Mar2025.docx, E01, E02
  Proposed: Retain the approved assessment and distribution record; confirm scope again if customer needs change.
R02 | S 16.5 | Covered | design Approved | operating Evidenced
  BNM/RH/PD 028-103, S 16.5, printed p.38 (PDF p.39); brief R02; effective under §4.1
  03_Contoso_MY_Policy_Pack_v1.0.docx, §3.2; 04_Contoso_MY_Readiness_Evidence_17Mar2025.docx, E03
  Proposed: Retain the signed product decision and apply the process to subsequent changes.
R03 | S 16.7 | Partial | design Approved | operating Partial
  BNM/RH/PD 028-103, S 16.7, printed p.38 (PDF p.39); brief R03; effective under §4.1
  03_Contoso_MY_Policy_Pack_v1.0.docx, §3.3; 04_Contoso_MY_Readiness_Evidence_17Mar2025.docx, E04, E05
  Proposed: Obtain a current pricing and fee review and renew the expired hardship guideline through approval.
R04 | S 16.9 | Unverified | design Approved | operating Unverifiable
  BNM/RH/PD 028-103, S 16.9, printed p.40 (PDF p.41); brief R04; effective under §4.1
  03_Contoso_MY_Policy_Pack_v1.0.docx, §3.4; 04_Contoso_MY_Readiness_Evidence_17Mar2025.docx, E06
  Proposed: Obtain the underlying QA report and sampled results; verify the attestation before concluding.
R05 | S 16.12 | Gap | design Draft | operating Not evidenced
  BNM/RH/PD 028-103, S 16.12, printed p.41 (PDF p.42); brief R05; effective under §4.1
  03_Contoso_MY_Policy_Pack_v1.0.docx, §3.5 / Annex B; 04_Contoso_MY_Readiness_Evidence_17Mar2025.docx, E07
  Proposed: Escalate the live-model exposure; approve an appropriate procedure and perform documented testing.
R06 | S 16.15 | Partial | design Approved | operating Partial
  BNM/RH/PD 028-103, S 16.15, printed p.41 (PDF p.42); brief R06; effective under §4.1
  03_Contoso_MY_Policy_Pack_v1.0.docx, §3.6; 04_Contoso_MY_Readiness_Evidence_17Mar2025.docx, E08
  Proposed: Complete staff training, enrol outsourced agents and document the bank-required skills assessment.
R07 | S 16.19 | Gap | design Approved | operating Not evidenced
  BNM/RH/PD 028-103, S 16.19, printed p.43 (PDF p.44); brief R07; effective under §4.1
  03_Contoso_MY_Policy_Pack_v1.0.docx, §3.7; 04_Contoso_MY_Readiness_Evidence_17Mar2025.docx, E09
  Proposed: Agree and evidence a lawful interim recording and access process before relying on the future CRM release.
R08 | S 16.21 | Covered | design Approved | operating Evidenced
  BNM/RH/PD 028-103, S 16.21, printed p.43 (PDF p.44); brief R08; effective under §4.1
  03_Contoso_MY_Policy_Pack_v1.0.docx, §3.8; 04_Contoso_MY_Readiness_Evidence_17Mar2025.docx, E10
  Proposed: Retain authority and exercise records; monitor practical use of the escalation route.
R09 | S 16.22 | Covered | design Approved | operating Evidenced
  BNM/RH/PD 028-103, S 16.22, printed p.43 (PDF p.44); brief R09; effective under §4.1
  03_Contoso_MY_Policy_Pack_v1.0.docx, §3.9; 04_Contoso_MY_Readiness_Evidence_17Mar2025.docx, E11
  Proposed: Retain deployment and operating tickets and check that adaptations remain available.
R10 | S 16.23 | Partial | design Approved | operating Partial
  BNM/RH/PD 028-103, S 16.23, printed p.43 (PDF p.44); brief R10; effective under §4.1
  03_Contoso_MY_Policy_Pack_v1.0.docx, §3.10; 04_Contoso_MY_Readiness_Evidence_17Mar2025.docx, E12, E13
  Proposed: Correct unsupported assistance channels in the leaflet and evidence currently available information.
R11 | S 16.26 | Partial | design Approved | operating Partial
  BNM/RH/PD 028-103, S 16.26, printed p.44 (PDF p.45); brief R11; effective under §4.1
  03_Contoso_MY_Policy_Pack_v1.0.docx, §3.11; 04_Contoso_MY_Readiness_Evidence_17Mar2025.docx, E12, E14
  Proposed: Correct channel claims and perform documented effectiveness testing rather than relying on template approval.
R12 | S 16.27 | Gap | design Approved | operating Not evidenced
  BNM/RH/PD 028-103, S 16.27, printed p.45 (PDF p.46); brief R12; effective under §4.1
  03_Contoso_MY_Policy_Pack_v1.0.docx, §3.12; 04_Contoso_MY_Readiness_Evidence_17Mar2025.docx, E15
  Proposed: Establish an operating monitoring process and improvement records; seek a decision on the proposed budget.
R13 | S 16.28 | Unverified | design Approved | operating Unverifiable
  BNM/RH/PD 028-103, S 16.28, printed p.45 (PDF p.46); brief R13; effective under §4.1
  03_Contoso_MY_Policy_Pack_v1.0.docx, §3.13; 04_Contoso_MY_Readiness_Evidence_17Mar2025.docx, E16
  Proposed: Obtain applicable related texts and versions, then complete and document the cross-policy review.
R14 | S 10.3(g) | Covered | design Approved | operating Evidenced
  BNM/RH/PD 028-103, S 10.3(g), printed p.11 (PDF p.12); brief R14; effective under §4.1
  03_Contoso_MY_Policy_Pack_v1.0.docx, §3.14; 04_Contoso_MY_Readiness_Evidence_17Mar2025.docx, E17
  Proposed: Retain Board authority and accountable-officer arrangements; do not infer implementation of other controls.
R15 | G 16.25 | Guidance noted | design N/A | operating N/A
  BNM/RH/PD 028-103, G 16.25, printed p.44 (PDF p.45); brief R15; effective under §4.1
  03_Contoso_MY_Policy_Pack_v1.0.docx, §3.15; 04_Contoso_MY_Readiness_Evidence_17Mar2025.docx, E12
  Proposed: Discuss feasible channels as guidance; remove unsupported promises and do not impose an invented channel mandate.
R16 | G 16.8(g) | N/A | design N/A | operating N/A
  BNM/RH/PD 028-103, G 16.8(g), printed p.40 (PDF p.41); brief R16; effective under §4.1
  03_Contoso_MY_Policy_Pack_v1.0.docx, §3.16; 01_Contoso_MY_FTFC_Scope_Request.docx, §2 (entity scope); 03_Contoso_MY_Policy_Pack_v1.0.docx, §3.16
  Proposed: Retain a distribution handoff to the partner insurer or takaful operator for Legal confirmation; do not assign underwriting duties to the bank.
T1: A perfect draft annex is still unapproved and untested. [03 §3.5, Annex B; 04 E07]
T2: An attestation without the promised QA report is not operating proof. [04 E06]
T3: Expired hardship authority and fee waivers do not prove a current pricing review; issue and effective dates differ. [04 E04–E05; 02 §2]
T4: G guidance is not an S standard and stays out of the mandatory denominator. [02 §2, R15]
T5: A distribution partner is not the insurer or takaful underwriter; retain the partner handoff. [01 §2; 02 R16; 03 §3.16]
T6: Indonesian training and monitoring cannot establish Malaysian operation. [04 E18; 05 §1, §6]
T7: Attendance, unfinished employees, skills and unenrolled agents are distinct evidence questions. [03 §3.6; 04 E08]
T8: Future CRM and web plans, unsupported leaflet channels and pending funding are not live controls. [04 E09, E12–E15; M1–M3]
