Onboarding drifts
The same client type produces a different file every time. Nobody can say which version is correct, so the answer depends on who picks up the case.
FI Operating System
The FI Operating System for EMIs and payment institutions.
Authorisation gives you permission to operate. This is what makes the operation run: onboarding, compliance workflows, client retention, reporting and the evidence that proves all of it, built as one connected system, not a folder of policies.
- Authorisation in progress
- Onboarding is manual
- Compliance sits in one person's head
- Inspection readiness unknown
15operating modules
3functions, one system
1named owner per step
Cyprus + Europeon site and remote
The gap
Institutions rarely fail on strategy. They fail on the operating layer.
The authorisation arrives, the policies are signed, the consultants leave, and the daily work has no owner, no sequence and no evidence trail. Three symptoms show up first.
Retention leaks
After go-live, the relationship has no owner and no cadence. Growth is bought again every month instead of compounded from the book you already have.
Evidence lives in email
Decisions were made, but not recorded where an inspector, a bank or a board can read them. The work happened; the proof did not.
The system
The FI Operating System: one operating layer, three functions, fifteen modules.
The FI Operating System is the daily engine of the institution. Compliance is one domain inside it, handled properly, but not the whole product. We lead with what grows the business and make the control environment part of the same machine.
Three functions
Client Success & Commercial growth
Operations & Automation throughput
Compliance & Risk control
Fifteen modules
Commercial IntelligenceAccount ManagementPricing Strategy
Sales PlaybooksOnboarding WorkflowsSafeguarding
Regulatory ReportingIT & InfosecSanctions Screening
AML ProgrammeCDD SuiteEnhanced Due Diligence
Transaction MonitoringGovernanceInspection Readiness
One operating layer
Named owners · evidence-gated milestones · auto-escalation · weekly 360° assessments
Two roles, stated plainly
Every module is either Design & Deliver (we build the work product and stand behind the design) or Advise & Support (your function owns the duty and the outcome; we bring the method, the workflows and the review).
Where our responsibility ends
We design, build, assess and support. We do not carry regulatory liability for your operation and we do not own functions that belong to your Risk, Finance, IT or Board. The regulated outcome stays with your MLRO and your board.
The catalogue
Fifteen modules. You choose the ones that close your gaps.
Modules are the building blocks. Selection is made with us after the exploration (gap-driven and dependency-checked) and delivered as one connected system, never as loose documents.
Client Success & Commercial
What grows the book
- 01Commercial Intelligence & Profiling D&D
- 02Account Management & Retention D&D
- 03Pricing Strategy D&D
- 04Sales & Introducer Playbooks D&D
Operations & Automation
What makes it run
- 05Onboarding & Compliance Workflows D&D
- 06Safeguarding & Client Funds A&S
- 07Regulatory Reporting A&S
- 08IT & Information Security A&S
Compliance & Risk
What proves it
- 09Sanctions Screening Programme D&D
- 10AML Programme D&D
- 11Client Due Diligence Suite D&D
- 12Enhanced Due Diligence D&D
- 13Transaction Monitoring D&D
- 14Governance & Accountability A&S
- 15Inspection Readiness D&D
D&D = Design & Deliver. A&S = Advise & Support, where the owning function stays with your Risk, COO, Finance, CTO/CISO or Board. Deliverables per module, the effort per module and the full dependency map are in the catalogue.
Open the full module catalogue
Deliverables, effort and dependencies per module.
Size and mix
Modular means modular. The count sets the size; you pick the mix.
Three sizes, any combination across the fifteen modules. Effort below is indicative for a full build; your quote is a transparent hours band for your actual scope, set after the exploration.
Starter
1–3 modules
Fix the sharpest gap first
- Effort
- 15–45 hours
- Delivery
- ~2 weeks
- Example
- Sanctions screening + AML programme + account management
- One function, focused scope
- Connected to your existing workflow
- Handover pack and owner map
Professional
4–6 modules
Stand up a working operation
- Effort
- 40–110 hours
- Delivery
- 4–6 weeks
- Example
- Sanctions & AML foundation, onboarding, safeguarding, governance, account management
- Cross-functional wiring
- Automation where it pays back
- Evidence trail from day one
Enterprise
7–11 modules or the full system
Run the whole institution
- Effort
- 140–260 hours core, ~200–360 with envelope and contingency
- Delivery
- 8–12 weeks
- Example
- Onboarding, safeguarding, reporting, infosec, inspection, retention, pricing, sales
- All three functions connected
- Board-ready reporting line
- Assessment cadence from handover
Effort beyond the band bills at the standard rate. External advisors and experts are itemised at cost, invoiced directly to you, with zero markup; our margin comes from delivery hours only. Scope and price are confirmed in a written quote after the exploration.
Execution discipline
A framework that is not executed is a document.
This is the part most providers leave out. Every build carries the same mechanics, whether you take three modules or the full system.
- Single named ownerOne accountable person for the system, non-delegable.
- Every step has an ownerEach action in the workflow carries a name, not a department.
- Evidence-gated milestonesProgress is proven with an artefact, not reported in a status meeting.
- Two-period auto-escalationRepeated slippage leaves the operating level and reaches CEO or Board.
- Weekly 360° assessmentsFiles are assessed every week, with a monthly recap and a board-ready report.
The product is the FI Operating System plus execution discipline. Discipline is what makes a framework stick after the consultants leave.
What you can point at afterwards
An owner map, a workflow library, an evidence trail, an escalation record and a monthly report your board can read without translation. That is the difference between a framework and a filing cabinet.
How an engagement runs
Explore, build, assess, hand over.
A fixed-fee exploration finds the facts. Everything after it is sized from evidence, not from a sales conversation.
-
Explore
Four workshops, five stakeholder interviews, on-site observation and evidence sampling. You receive the findings and implementation recommendation: gaps severity-rated, root causes, regulator calendar and a costed build roadmap.
-
Build
You pick the size and the modules. We build the work products, wire the workflows and hand over an operating system your team can run.
-
Assess
Optional execution discipline retainer: weekly file assessments, monthly recap, board-ready report, escalation handling and a named review cadence.
-
Aftercare
Three post-handover 360° assessments at month 3, 6 and 12: status against the remediation plan, drift check and next-phase recommendations.
| Tier | Effort | Minimum term | What it covers |
|---|---|---|---|
| Low | 15 h / month | 3 months | Sanctions and AML monitoring, monthly check-in, quarterly risk review, email support. |
| Mid | 25 h / month | 6 months | Everything in Low, plus monthly risk and compliance review, weekly check-in, quarterly SOP refresh and active pipeline management. |
| Premium | 40 h / month | 6 months | Full execution discipline: real-time monitoring, weekly 360° file assessments, two weekly check-ins, fractional Head of Compliance support, board-ready monthly report, multi-bank redundancy monitoring. |
Monthly in advance, auto-renewing after the minimum term with 30 days' notice. Retainer hours are separate from build effort. A written quote confirms scope and price for your institution.
Where we work
Cyprus, and across Europe.
Payment operations are our home ground. We work on site in Cyprus and remotely with institutions operating cross-border in the EU.
Cyprus EMI operations
Operating frameworks for electronic money institutions, from authorisation readiness through to a running daily operation.
Cyprus payment institutions
Onboarding, safeguarding-adjacent workflows, reporting lines and inspection readiness for payment institutions.
Cross-border Europe
One operating model across jurisdictions: multi-bank and payment-partner redundancy, consistent files, local evidence.
The operator
Built by someone who has run the operation, not only advised on it.
5 Circles is a small practice by design: one senior operator, a defined system, and named external experts engaged when a matter falls outside it. That is deliberate. You get the person who does the work, not a rotating delivery team.
The framework behind this page was built from operating experience across corporate services, payments and regulated financial institutions, and it is used, reviewed and tightened with every engagement.
Zeno Tonnis
Founder, 5 Circles
- Former VP at a FINMA-regulated institutionSwiss regulatory environment, client operations.
- 25 years of global corporate operationsCross-border structures, banking relationships, delivery.
- Architect of FinTech & Web3 client operationsOnboarding, retention and control environments built to run.
- Payment-led, not generalistEMIs, payment institutions, banks and PSPs.
Questions
What institutions ask before the first call.
What exactly is an FI Operating System?
It is the daily operating layer of a financial institution: how clients are onboarded, screened, served, retained and reported on, with a named owner and evidence for every step. It is built as one connected system rather than a folder of policies, and it is assessed while it runs.
Is this a compliance consultancy?
Compliance is one of three functions inside the system, not the whole product. We lead with the commercial and operational side of the institution and handle compliance properly as part of the whole: sanctions, AML, due diligence, monitoring, governance and inspection readiness.
Do you replace our compliance officer or MLRO?
No. Your client formally appoints the individual and the regulator approves them; we supply the operating muscle behind the function. Where a module is Advise & Support, your function owns the duty and the outcome and we bring the methodology, the workflows and the review.
Do you provide legal advice or regulatory sign-off?
No. We design, assess and support; you execute and own the regulatory outcome. Legal and regulatory sign-off is handled by external advisors and experts, engaged directly by you and itemised at cost with no markup on our side.
Do you help with EMI or payment institution authorisation in Cyprus?
We do not file applications or hold authorisations. What we build is the operating system that makes an authorisation workable from day one: the onboarding workflows, controls, evidence and reporting an institution must run, plus support alongside your external advisors while the application is prepared.
Which institutions do you work with?
Our work is payment-led: electronic money institutions and payment institutions, plus banks and payment service providers building or scaling payment operations. We work on site in Cyprus and remotely across Europe.
How long does a build take?
It depends on the size and mix. A small build runs around two weeks, a mid-sized build four to six weeks, and an enterprise build eight to twelve weeks. The size is set after the exploration, gap-driven and dependency-checked.
How is pricing structured?
The size is the module count: one to three, four to six, or seven to eleven modules and above. Each size carries an effort in hours, and your quote is a transparent hours band for your scope. The fixed-fee exploration is credited in full when you commit to a build. Effort beyond the band bills at the standard rate.
What happens after handover?
Every build includes three post-handover 360° assessments at month 3, month 6 and month 12: status against the remediation plan, a drift check and next-phase recommendations, nine hours over twelve months. An execution discipline retainer is optional and can continue the weekly assessment.
Request a quote
Tell us where the institution is, and what is breaking.
You get a scoped hours band and a module selection, not a brochure. If the exploration is the right first step, we will say so.
- A reply from the person who would run the work.
- No sales sequence, no list, no third-party sharing.
- Your details are used to answer this request only.
Request a quote
The form is being connected. In the meantime, send a short message on LinkedIn with your institution, stage and the two or three things that cost you the most time; you will get a reply from the person who would run the work.