The perimeter was never mapped
Firms can describe their products but not the registered functions those products rely on. “Can we do this under our registration?” has no documented answer, so it gets answered by assumption under commercial pressure.
§ Recholam Consult Limited
Compliance Frameworks That Hold Up Under Inspection
Insight. Integrity. Impact.
Governance, risk, AML/CFT/CPF and compliance advisory and training for financial institutions and capital market operators in Nigeria and West Africa.
- Experience
- 16 years
- Markets
- UK · Nigeria
- Credentials
- FCCA · CAMS · ISO 31000 · CDPO
- Based in
- Lagos and London
Principal-led. Every engagement directed personally, from scoping to sign-off.
Training delivered for
- FMAN Fund Managers Association of Nigeria
- IAPM Investment Advisers & Portfolio Managers
- CCOCIN Chief Compliance Officers of CMOs
- Quest Merchant Bank ISA 2025, Aug 2026
§ 1.0 — What we find
Three Gaps We Find in Almost Every Review
Across ISA 2025 readiness work, association training and in-house reviews, the same three recur. An inspection finds them first.
Obligations without owners
Policies exist. What is missing is the register linking each obligation to a named owner, a control that operates, and evidence that can be produced on request.
Oversight that leaves no trail
Boards discuss risk. The minutes rarely record the challenge, the decision and what happened next, which is all a supervisor gets to review.
§ 1.0a — Self-check
Would Your Firm Pass These Eight Questions?
Answer for your own firm. Nothing is sent anywhere; the result stays on this page.
§ 1.1 — Why Recholam
Built Inside the Function
Operated it, then advised on it
Enterprise risk leadership inside a UK group that owns one of the country’s largest airports, runs a light rail network and holds commercial property, and risk and compliance leadership inside Nigerian capital market firms. Frameworks built by someone who has had to operate them and defend them.
FCCA · CAMS · ISO 31000 · CDPO
Audit and finance, financial crime, risk management, data protection. The four areas a vendor due-diligence questionnaire covers.
Principal-led, with a bench
Every engagement is directed personally. Specialist associates are added by scope and named to you before they join, so capacity matches the mandate.
§ 2.0 — Practices
Three Practices
Grouped by where regulatory exposure sits in a firm, rather than split into separate service lines.
Governance & Board
- Governance frameworks and committee structures
- Policy architecture and accountability mapping
- Board and management reporting
- Inspection and examination readiness
- Regulatory change governance
Risk & Compliance
- ISO 31000-aligned enterprise risk management
- Compliance programmes and obligations registers
- AML/CFT/CPF frameworks and testing
- Data protection and NDPA compliance
- Compliance monitoring, testing and reporting
Capability & Training
- Board and executive governance workshops
- Role-based compliance and AML training
- Annual refresher programmes with assessment
- Train-the-trainer and curriculum licensing
- Self-paced modules for scale
Investment and risk due diligence for capital raises, M&A and investment decisions is added to any of the three by scope.
§ 2.1 — Who we work with
Built for SEC-Registered Firms and Their Boards
CMO
Fund & portfolio managers
CIS obligations, supervisory fees, unitholder reporting, capital tiers.
CMO
Brokers & dealers
Client asset segregation, nominee accounts, reporting calendars.
CMO
Trustees
Code of Conduct for Trustees, CIS trustee duties, trust-deed breach reporting.
CMO
Issuing houses & investment advisers
Perimeter, conflicts, Sukuk and non-interest mandates.
FI
Merchant & investment banks
ERM frameworks, AML/CFT/CPF programmes, board reporting.
Board
Boards & committees
Risk appetite, oversight evidence, director training.
Assoc.
Industry associations
Member training programmes with assessment and CPD records.
Infra
Infrastructure & public sector
Enterprise risk and governance for aviation, transport, property and selected public bodies.
§ 3.0 — Method
Five Stages, Five Deliverables
Most firms enter at Assess. Training-only programmes enter at Implement.
- 1
Assess
Gap analysis against ISA 2025, SEC rules, AML/CFT/CPF obligations and ISO 31000.
Deliverable- Gap register
- Prioritised remediation plan
- 2
Design
Frameworks, policies and controls built around the firm’s licensed activities.
Deliverable- Policy suite
- Obligations register
- Control library
- 3
Implement
Controls embedded with named owners, staff trained, escalation routes tested.
Deliverable- Trained teams
- Live controls and RACI
- 4
Monitor
Risk-based monitoring and control testing, reported so the board can act on it.
Deliverable- Monitoring plan
- Test results
- Board reporting pack
- 5
Sustain
Regulatory change tracked, material revalidated, framework refreshed annually.
Deliverable- Change log
- Annual refresher
- Framework review
§ 4.0 — Track record
What We Were Brought in to Fix, and What Stayed Behind
Client identities are withheld under engagement confidentiality. Named references are provided at proposal stage with the client’s consent.
Compliance effort pointed at the wrong risks
Gap analysis, a risk-based compliance management plan, and compliance effort redirected to the firm’s highest-exposure obligations. The firm now runs an obligations register with named owners and monitors against it.
Regulatory reporting late and unowned
Rebuilt the reporting calendar, assigned ownership for each return, and added a pre-submission review. Filing timeliness is now a standing metric instead of a post-deadline discovery.
Risk framework disconnected from the board
Redesigned the enterprise risk management framework against SEC requirements and ISO 31000, linking risk appetite, risk register, control testing and board reporting.
Ongoing
Closing out post-completion matters on a private equity transaction for a Nigerian financial services firm, while training its risk and compliance team on the underlying processes.
§ 4.1 — Training
Training, and Who Has Commissioned It
- Fund Managers Association of Nigeria (FMAN)
- Association of Investment Advisers & Portfolio Managers (IAPM)
- Committee of Chief Compliance Officers of Capital Market Operators in Nigeria (CCOCIN)
Quest Merchant Bank Limited
Investments and Securities Act (ISA) 2025 regulatory overview, delivered to the bank’s risk, compliance and business teams.
Board & executive workshops
Governance and risk literacy for the people who approve and oversee, pitched at decision level.
Role-based staff training
Separate tracks for front office, operations, compliance and internal audit. Each role trains on its own decisions.
Annual refresher & assessment
A scored assessment with a published marking scheme. Completion means a pass, not attendance.
Structured for CPD
Attendance records, assessment results and completion certificates, issued for members to file against CPD requirements.
§ 4.2 — The curriculum
A Complete Curriculum, Not a Slide Pack
Every programme runs on a curriculum maintained in-house, with 35 regulatory sources tracked by issuer, version and dependent module. Twenty-three are flagged dynamic and revalidated before each delivery.
Facilitator decks
Compliance in Practice, AML/CFT/CPF in Practice, and an Annual Refresher, all built for Nigerian capital markets.
Guide & casebook
Session timings, discussion prompts, model answers and Nigeria-specific red-flag and perimeter cases.
Workbook & job aids
Escalation contacts, decision templates and per-module notes the participant keeps and uses.
Assessment & marking
A scored assessment with a published marking scheme and a defined pass standard.
Practitioner toolkit
Risk register, obligations register, monitoring planner and escalation quick guides, in working format.
Source & governance
Every requirement traced to its source, with a revalidation routine so thresholds and lists stay current.
§ 5.0 — Regulatory watch
What We Are Tracking for Capital Market Operators
Recent changes and the recurring deadlines that most often slip. Each item is traced to its primary source in the Recholam source register.
Recent developments
- SEC Rules on Shariah Advisory Services
Non-interest products need an SEC-registered Shariah adviser, with SEC notified within 5 business days of appointment.
- Revised minimum capital guidelines
Existing operators must meet the new capital for each registered function by 30 June 2027. Board-approved capitalisation plans were due 30 April 2026.
- Nigeria leaves the FATF grey list
Delisting does not reduce obligations. Supervisors now expect the programme to keep working without an action plan driving it.
- NDPC General Application and Implementation Directive
Registration tiers, DPO reporting, DPIAs for digital financial services, and compliance audit returns by 31 March.
- Investments and Securities Act 2025
The new capital markets law reshaping SEC oversight, registration, disclosure and enforcement.
Next deadlines
From today
Event-driven
- 24 hrsSuspicious transaction report to the NFIU (MLPPA 2022 s.7)
- 24 hrsSanctions match: freeze, report and file an STR (TPPA 2022 s.54)
- 72 hrsPersonal data breach to the NDPC (GAID 2025 Art 33)
- 5 daysSponsored individual exit notified to SEC (SEC Rules r.35)
A general guide to common obligations for SEC-registered operators with a December year end. It is not legal advice; obligations depend on your registered functions.
§ 6.0 — How to engage
Three Ways to Start
Each one scoped, fee-agreed and documented before work begins. No open-ended time and materials.
Regulatory Health Check
2–3 weeks · Fixed fee
A review of governance, risk and compliance posture against ISA 2025, SEC rules and AML/CFT/CPF obligations.
You receive
- Gap register
- Prioritised remediation plan
- Board-ready summary
Training Programme
Half-day to three days · Fixed fee per cohort
Board, management or role-based training from the Recholam curriculum, tailored to your products and licensed activities.
You receive
- Workbooks and job aids
- Scored assessment
- Completion and CPD records
Framework Build or Retainer
8–12 weeks, or monthly retainer
Design and implementation of a governance, ERM or AML/CFT framework, or a compliance advisory retainer with a defined monthly commitment.
You receive
- Policy suite and registers
- Monitoring plan
- Board reporting
§ 7.0 — Who delivers
Who Delivers, and on What Terms
Oluwasegun Ilesanmi, FCCA, CAMS
Fellow, ACCA (FCCA) · Certified AML Specialist (CAMS) · ISO 31000 Lead Risk Manager · Certified Data Protection Officer (CDPO, PECB) · Global MBA, Hult International Business School
Sixteen years leading risk, compliance and governance across financial services, infrastructure and consulting in the UK and Nigeria.
Where that experience comes from- Enterprise risk leadership across a UK airport, light rail and property portfolio
- Risk and compliance leadership in Nigerian capital markets firms
- Independent regulatory compliance advisory for UK financial services clients
- Delivery model
- Directed personally throughout. Associates are engaged by scope and named to you before they join.
- Confidentiality
- Our NDA or yours executed before information is shared. Client identities are never used in marketing without consent.
- Data protection
- Client data held under a documented retention and deletion policy, directed by a Certified Data Protection Officer.
- Conflicts
- A conflict check is run and confirmed in writing before any engagement is accepted.
§ 8.0 — Questions
Questions Firms Ask Before Engaging
Who will actually do the work?
Segun Ilesanmi directs every engagement personally, from scoping to sign-off. Where a mandate needs extra specialists, associates are added by scope and named to you before they join.
How are fees set?
Every engagement is scoped and fee-agreed in writing before work starts. A Health Check and each training cohort carry a fixed fee. Framework builds run 8–12 weeks on an agreed fee, or as a retainer with a defined monthly commitment. There is no open-ended time and materials.
What happens after the first call?
Within five working days you receive a Health Check proposal with a fixed fee, a fixed duration and defined outputs. If you do not need one, you get a straight answer saying so.
Can training be run in-house for our staff only?
Yes. Programmes run from half a day to three days for board, management or role-based cohorts, tailored to your products and licensed activities. Each comes with workbooks, a scored assessment and completion records.
Do you only work with capital market operators?
Most of the work is for financial institutions and capital market operators in Nigeria and West Africa. Enterprise risk and governance advisory is also offered to infrastructure and real-asset owners and to selected public-sector clients.
How is our information protected?
An NDA, ours or yours, is signed before information is shared. Client data is held under a documented retention and deletion policy, and a conflict check is confirmed in writing before any engagement is accepted.
§ 9.0 — Next step
The Next Step Is a Forty-five-Minute Call
You describe your activities, your licensed functions and what is currently worrying you. Within five working days you receive a Health Check proposal with a fixed fee, fixed duration and defined outputs, or a straight answer that you do not need one.
Generalinfo@recholamconsult.com
Nigeria+234 802 356 8605
United Kingdom+44 749 406 7851
LinkedInrecholam-consult-limited
“Insight. Integrity. Impact.”
Recholam Consult Limited · Based in Lagos and London
Privacy noticeHow Recholam Consult handles your personal dataLast updated 24 October 2026
Who we are
Recholam Consult Limited (“Recholam”, “we”) is the data controller for personal data collected through this website and in our correspondence with you. We are based in Lagos and London. For any privacy question or request, email segun@recholamconsult.com with “Privacy” in the subject line. Our data protection work is directed by a Certified Data Protection Officer.
This notice is written to meet the Nigeria Data Protection Act 2023 and the NDPC General Application and Implementation Directive 2025, and, for people in the UK, the UK GDPR and the Data Protection Act 2018.
What we collect
- Enquiries. If you email or call us, or use the enquiry form, we receive what you choose to share: usually your name, role, firm, email address, phone number and the subject of your enquiry. The form does not send anything itself. It prepares an email that you send from your own email account.
- Self-check answers. These stay in your browser and are not sent to us. They are included in an email only if you complete the self-check and then send us an enquiry from the form.
- Technical data. This site uses no analytics, advertising or tracking cookies. Fonts are loaded from Google Fonts, so your browser shares your IP address with Google when the page loads. Our hosting provider may keep standard server logs for security.
Why we use it, and on what basis
- To reply to your enquiry and prepare a proposal: steps you ask us to take before a possible engagement, and our legitimate interest in responding to business enquiries.
- To deliver and administer an engagement or training programme, including attendance, assessment and completion records: performance of our contract with you or your firm.
- To keep records we are required to keep, such as accounting and tax records: legal obligation.
- To send you occasional regulatory updates: only with your consent, which you can withdraw at any time.
We do not sell personal data, use it for automated decision-making, or use client identities in marketing without consent.
Who we share it with
We share personal data only with service providers that support our work, such as email, document storage and website hosting providers, under contract. Associates engaged on an engagement are named to you before they join and are bound by confidentiality. We may disclose data where the law requires it.
International transfers
Because we operate in Nigeria and the United Kingdom, and some service providers hold data elsewhere, your data may be transferred between countries. Where it is, we rely on the transfer bases the NDPA 2023 and UK GDPR allow, such as adequacy decisions or contractual safeguards.
How long we keep it
We keep data under our documented retention and deletion policy. Enquiries that do not lead to an engagement are deleted within 12 months of our last contact. Engagement and training records are kept for the period our contracts, accounting obligations and professional requirements need, then deleted.
Your rights
You can ask us to give you access to your personal data, correct it, delete it, restrict or object to its use, or transfer it to you or another organisation. You can withdraw consent at any time. We reply within one month. If you are unhappy with how we handle your data, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng) or, in the UK, the Information Commissioner’s Office (ico.org.uk). We would appreciate the chance to resolve it with you first.
Security
We protect personal data with access controls, encrypted storage and transmission, and confidentiality agreements. If a breach is likely to put your rights at risk, we will notify the regulator within 72 hours and tell you without undue delay.
Changes
We will update this notice when our practices change and show the date of the latest version above.