Your Prevention Manual, Drafted by Specialists and Kept in COX
The manual your supervisor asks for, written for your business and your country, and every version kept with its approval.
The prevention manual sets out the policies and procedures with which your entity knows its clients, detects unusual operations and reports what is suspicious. The COX team in Panama, and our implementation partners in the rest of the region, draft it with you on top of your own risk assessment. Then COX keeps each version with its approval, one in force at a time.
Two Ways We Help With Your Manual
One is a service, the other is the platform. You can take both, or only one.
We draft it with you
A compliance specialist writes your manual to the norm of your country and to the way your business really works. In Panama, the COX team; in the rest of the region, an implementation partner of COX in your country.
- Diagnosis of your activity, clients, products, channels and places
- Built on your entity risk assessment, not on a template
- Reviewed with your compliance officer before it goes to the board
- Training of your staff on what the manual says
COX keeps it as evidence
In the platform, each version of the manual is a record: what it covers or what changed, who approved it, the minutes and the date from which it applies.
- One version in force at a time; the previous one stays as it was approved
- The approval is attached to the version, with its minutes
- Linked to the approved risk methodology it incorporates
- Nothing is deleted: a draft opened by mistake is cancelled with its reason
What a Prevention Manual Contains
Each norm sets its own list. These are the chapters that appear in all of them.
Who is responsible
The board that approves, the compliance officer and their duties, and how compliance reports inside the entity.
The risk-based approach
The methodology to assess the risk of the entity and of each client, and what changes with the level of risk.
Knowing the client
Identification, verification, the ultimate beneficial owner, politically exposed persons, and enhanced due diligence where the risk is higher.
Lists and freezing
Which lists are searched, when, and what is done with a confirmed match, including the freezing that United Nations lists call for.
Monitoring and reporting
Red flags, unusual operations, the analysis of each one, and the report to the financial intelligence unit, with its confidentiality.
Staff, training and record keeping
Knowing the employee, the training plan, how long records are kept, internal sanctions, and how the manual itself is reviewed.
What the Norm of Your Country Calls It
The same document goes by a different name in each country, and each law sets who approves it and when it is updated.
Panama
- Name
- The Prevention Manual for BC/FT/FPADM (capital laundering, blanqueo de capitales), the minimum standard that Resolution S-037-2026 of the SSNF sets for non-financial obligated subjects, in force from 10 November 2026.
- Approval
- The board of directors by minutes in a company, the partners in a firm, or the professional who practises alone.
- Update
- With a change in the norm, a new product or service, a new structure, the result of an SSNF supervision or a new risk profile. A copied manual does not comply.
Mexico
- Name
- The internal policies manual (Manual de Políticas Internas) of whoever carries out vulnerable activities, required by article 18 of the LFPIORPI and detailed in the General Rules.
- Time limit
- Ninety calendar days after registering; those already registered before the 2026 reform, by 1 March 2027.
- Contents
- Client risk, due diligence by risk level, PEPs, operations outside the profile, Notices (Avisos), record keeping, the compliance representative, training and audit.
Colombia
- Name
- The SAGRILAFT and the PTEE comprise a policy and a manual of procedures, one manual for LA/FT/FPADM and transnational bribery (Superintendencia de Sociedades).
- Approval
- The board of directors, or the highest corporate body where there is no board, by minutes, including every update.
- Update
- The compliance officer proposes updates at least every two years; whoever was already obliged adjusts to the 2026 rule by 31 May 2027.
Guatemala
- Name
- The Prevention Manual for LD/FT/FPADM (money or other assets laundering, lavado de dinero u otros activos), articles 12 to 15 of Decree 15-2026.
- Approval
- The highest governing body of the obligated person; in a financial group, one manual approved by the parent.
- Update
- Manuals written under the repealed Decree 67-2001 must be adapted to Decree 15-2026. University professionals and notaries have the special regime of article 42.
Dominican Republic
- Name
- The prevention manual of the non-financial obligated subjects (DGII Norm 01-2018), part of the risk-based compliance programme of Law 155-17 against money laundering (lavado de activos).
- Approval
- Senior management, and available to the DGII.
- Update
- When the norms or the business change. Not having an updated prevention manual is a serious offence under article 70 of Law 155-17.
Ecuador
- Name
- The Manual for the Prevention of Money Laundering (Lavado de Activos) and of the Financing of Crimes, articles 28 and 29 of Executive Decree 298.
- Approval
- It is approved and registered with the control body; companies under the SCVS approve it at the general meeting of shareholders.
- Update
- For companies under the SCVS, every two years or when the law changes; a new company registers it within three months of obtaining its RUC.
Venezuela
- Name
- For non-financial obligated subjects, the programme of capital legitimation (legitimación de capitales, LC/FT/FPADM) prevention is set by the norms of each control body and the guides of the UNIF, which ask professionals for their own risk assessment, policies and internal controls.
- Banks
- SUDEBAN asks banks for a manual approved by the board and reviewed every six months by the compliance officer.
How We Draft It
A manual is only as good as the risk assessment beneath it. We start there.
Diagnosis
Your activity, your clients, the products you sell, the channels through which you sell them and the places where you operate, and the norm that applies to you.
Risk assessment
The risk of your entity, measured with the methodology your board approves. In COX it is computed from your own files.
Draft
The policies and procedures written for what your business really does, chapter by chapter as your norm orders them.
Review
With your compliance officer, until each procedure says who does what, when and with which record.
Approval
Your board approves it with its minutes. The manual is yours: it carries your name and your approval.
In force
The approved version goes into COX with its minutes, your staff is trained on it, and the next change is a new version.
What the Supervisor Finds
Your business, not a template
Supervisors read a copied manual for what it is. Each procedure describes a step your staff really takes, and the record it leaves.
Every version, with its approval
Which manual was in force on a given date, who approved it and with which minutes: COX answers it without searching a drawer.
What the manual says, done in COX
Due diligence, list searches, the risk matrix, reports and training happen in the same platform, and each one leaves its evidence.
Frequently Asked Questions
Request a Proposal for Your Manual
Tell us your activity and your country: we will answer with who drafts it, the scope and the price.
Guides on this topic:
What a compliance officer does Risk matrix and heat map Risk events Acronyms and definitions