Compliance gap analyzer · free AI skill

Maps current compliance policies against a specified regulatory framework (BSA/AML, NYDFS Part 500, UDAAP, GLBA, and similar), identifies every gap, and produces a prioritized remediation list with severity ratings…

Purpose

Produce a clause-by-clause gap analysis between an organization's current compliance posture and a named regulatory framework — surfacing every missing, partial, or unevidenced control, rating each gap by regulatory and operational risk, and converting findings into a prioritized remediation plan an examiner would recognize as defensible.

When to Use

Invoke this skill when the user asks to:

Assess whether current policies meet a specific regulation (e.g., NYDFS Part 500, BSA/AML)
Prepare for an upcoming regulatory exam, audit, or independent review
Identify what's missing after a new rule or amendment takes effect
Validate or stress-test an existing compliance program before attestation
Build a remediation roadmap with priorities and owners
Translate a regulatory framework into a control checklist mapped against current state

Inputs Required

Before starting, collect:

Target framework: The regulation or standard to measure against (e.g., BSA/AML, NYDFS 23 NYCRR Part 500, UDAAP, GLBA Safeguards Rule, Reg E)
Institution type & size: Bank, fintech, MSB, BaaS sponsor, etc. — and approximate asset size or transaction volume (drives which requirements apply and thresholds)
Current state inputs: Existing policies, procedures, controls, or program documents — pasted text, summaries, or a description of what exists
Known weak spots: Areas the team already suspects are deficient
Recent regulatory activity: Any prior exam findings, MRAs, consent orders, or audit comments
Scope boundary: Full program review or a specific domain (e.g., only transaction monitoring, only governance)

If institution type or size is missing, assume a mid-size fintech with a bank partner and flag any requirements whose applicability depends on those facts.

Instructions

Step 1: Decompose the Framework Into Testable Requirements

Break the named framework into its discrete, citeable obligations. Do not work from a vague summary — enumerate specific requirements with their source citation.

For each requirement, record: the citation (section/subsection), the plain-language obligation, and whether it is a mandatory control, a documentation requirement, or a governance/oversight requirement.
Group requirements into the framework's natural domains. Examples:
BSA/AML: CIP, CDD/EDD, beneficial ownership, transaction monitoring, SAR filing, CTR filing, OFAC/sanctions screening, recordkeeping, BSA Officer designation, independent testing, training, risk assessment
NYDFS Part 500: cybersecurity program (500.02), policy (500.03), CISO (500.04), pen testing/vuln assessment (500.05), audit trail (500.06), access privileges (500.07), risk assessment (500.09), MFA (500.12), incident reporting (500.17), CISO annual certification (500.17(b))
UDAAP: deceptive acts, unfair acts, abusive acts, marketing/disclosure review, complaint handling, fee transparency, fair-lending intersections
Note any threshold-dependent or exemption-eligible requirements (e.g., Part 500 limited exemptions, MSB-specific BSA obligations).

Step 2: Assess Current State Against Each Requirement

For every requirement, classify the institution's current posture into one status:

Met — control exists, is documented, and is evidenced
Partial — control exists but has a defined deficiency (no evidence of operation, outdated, scope gap, or no testing)
Missing — no control or documentation exists
Unverifiable — claimed but no supporting documentation provided

For Partial and Unverifiable items, state precisely what is missing — distinguish a policy gap (the rule isn't written), a procedure gap (no how-to/operational detail), an execution gap (exists on paper, no evidence it runs), and an oversight gap (no testing, reporting, or governance over it).

Step 3: Rate Each Gap by Risk

Assign every Partial, Missing, or Unverifiable item a priority using two dimensions:

Regulatory severity: How likely is this to draw a finding, MRA, or enforcement action?
Critical — mandatory control central to the rule; common enforcement trigger (e.g., missing SAR procedures, no MFA, no CISO designation)
High — required control with material examiner scrutiny
Medium — required but lower-frequency finding
Low — best-practice or documentation polish
Remediation effort: Quick (policy edit / weeks) / Moderate (process build / 1–2 quarters) / Heavy (system, staffing, or vendor change / 2+ quarters)

Compute a Priority Rank that sorts Critical-severity items first regardless of effort, then sequences the rest by severity-then-effort (favoring high-severity, low-effort "fast wins" early).

Step 4: Build the Gap Register

The Remediation Action must be specific and doable — name the artifact to create or fix (e.g., "Draft and board-approve a transaction monitoring tuning procedure with documented threshold rationale"), not "improve monitoring."

Step 5: Summarize and Sequence Remediation

Executive summary (4–6 sentences): overall readiness posture, count of gaps by severity, and the single highest-risk exposure.
Top 5 priority actions: the items to start this quarter, each with the gap it closes and why it ranks first.
Phased roadmap: Phase 1 (0–30 days, Critical + fast wins), Phase 2 (30–90 days, High), Phase 3 (90+ days, Medium/Heavy).

Output Format

Structure: Executive summary → framework domains covered → full Gap Register table → Top 5 priority actions → phased remediation roadmap
Length: 1,000–1,500 words plus the Gap Register table
Format: Prose summary sections plus a structured table for the Gap Register; roadmap as phased lists
Sections: Executive Summary → Requirements Decomposition (by domain) → Gap Register (table) → Top 5 Priority Actions → Phased Remediation Roadmap
Tone: Compliance specialist — precise, citation-grounded, examiner-aware; no hedging, no generic risk-speak

Quality Checklist

Before delivering output, verify:

[ ] Every gap row includes a specific regulatory citation (section/subsection), not just the framework name
[ ] Each gap is classified by both status (Met/Partial/Missing/Unverifiable) and gap type (policy/procedure/execution/oversight)
[ ] Every Partial/Missing/Unverifiable item carries a severity rating with implicit or stated enforcement reasoning
[ ] The Gap Register is sorted by Priority Rank with Critical items at the top
[ ] Remediation actions name a concrete artifact or fix — none say only "improve" or "review"
[ ] Threshold- or exemption-dependent requirements are flagged where applicability is uncertain

Notes

The most common Critical findings are missing or untested controls that exist on paper — weight execution and oversight gaps heavily, not just documentation gaps.
When current-state input is thin, default to flagging items as Unverifiable rather than assuming they're Met; an examiner will treat "no evidence" the same way.
For BSA/AML, the independent testing, risk assessment, and SAR/CTR filing controls draw the most enforcement attention — scrutinize these first.
This analysis is a structured readiness assessment, not legal advice; recommend validation by counsel or a qualified independent reviewer before relying on it for an attestation or filing.

How to use this skill

This file is a Claude Code skill in Anthropic's standard format — markdown with YAML frontmatter at the top.

Installing in Claude Code:

~/.claude/skills/<folder-name>/SKILL.md — auto-loads in every session anywhere on your machine (recommended for skills you'll use across multiple projects)
<your-project>/.claude/skills/<folder-name>/SKILL.md — auto-loads only when working in that project (recommended for project-specific skills)

Restart Claude Code or open a new session to register.

Using in Claude.ai, ChatGPT, Gemini, or other AI tools:

Drag this file into a new chat, or copy and paste its contents
Send your task or request as your next message — the AI will apply the skill where it fits

For Claude Code skill details: https://docs.anthropic.com/en/docs/claude-code/skills