Field notes
Short writing from our Kuala Lumpur practice on financial controls inside mobile banking applications.
The maker-checker matrix is not the path in the application
Why a laminated dual-control table can look complete while a live transfer still releases from a single login.
The payee change that never entered the cooling-off queue
How an account-number amendment on a second device can pass every later transfer approval and still be a control failure.
Reversals that never reach the committee
Staff unlock and force-post paths are not a scandal. Unreviewed ones are.
A demo build is not an audit trail
Vendor walkthroughs show how the process is supposed to look. Sampled customer instructions show how it ran.