FAQ
The questions users, IT security teams and reviewers ask most, answered in short. Each answer links to the page that explains the rule in full.
Risk Core
Section titled “Risk Core”What can a parent company see of a subsidiary’s data?
Section titled “What can a parent company see of a subsidiary’s data?”Only what the subsidiary has validated or approved, sent upward by report-up. The parent reads it and cannot create, edit, approve or close the subsidiary’s records. See Report-Up-Only and Subsidiary-Independence.
Where is the data held, and who owns it?
Section titled “Where is the data held, and who owns it?”The database is hosted in Singapore (AWS ap-southeast-1), encrypted in transit and at rest. Each company’s data is kept separate from every other company’s. The data belongs to the client, is exported on request and is deleted at contract end; Qirin X acts as data processor under a Data Processing Agreement. See Security and data.
I lost my phone. How do I sign in?
Section titled “I lost my phone. How do I sign in?”Ask your administrator to reset your authenticator. At your next sign-in you enrol the authenticator app again. The reset is recorded in the audit log. See Signing in.
Which standards is Risk Core built to serve?
Section titled “Which standards is Risk Core built to serve?”COSO ERM (2017) and ISO 22301:2019, with Basel Level-1 event types for loss events. The mapping shows which module serves each component and clause. See Standards mapping.
ERM Core
Section titled “ERM Core”Can I type a score, a tier or a band?
Section titled “Can I type a score, a tier or a band?”No. Inherent and residual scores, materiality tiers, KRI bands and criticality tiers are computed by the system from the inputs. See Computed, never typed.
Can the same person prepare and approve an RCSA filing?
Section titled “Can the same person prepare and approve an RCSA filing?”No. You cannot review or approve your own filing: the action does not appear for you, and the database refuses it. See Submission and sign-off.
What do we file for a month with no losses?
Section titled “What do we file for a month with no losses?”A formal nil return, so that silence is never mistaken for a clean month. The period freezes when the RMC accepts the report. See Monthly loss report and nil return.
Can a loss in a foreign currency or a digital asset be recorded?
Section titled “Can a loss in a foreign currency or a digital asset be recorded?”Yes. Each amount is entered in the currency the loss arose in, digital assets in their own unit, and converted to THB under the group’s FX policy. See Amounts, currencies and FX.
BCP Core
Section titled “BCP Core”Do staff need to install an app?
Section titled “Do staff need to install an app?”No app store is involved. BCP Core is a web app that staff add to their phone’s home screen, then allow notifications, because every change of BCP level is pushed to every staff phone. See Install and notifications.
Is my location tracked?
Section titled “Is my location tracked?”No. Location is shared only for a check-in where you turn it on, and it is asked for each check-in. See Check-in.
Can the parent company change our BCP level?
Section titled “Can the parent company change our BCP level?”No. A group advisory from the parent is shown beside your own level. It never changes your level and never pushes to your staff; your BCP head orders your level. See Group advisory is display-only.
What happens when an incident is closed?
Section titled “What happens when an incident is closed?”Check-in stops, a draft loss event is created in ERM Core for the Entity Risk Manager to complete, and the incident timeline is ready to export. See Closing an incident.
KYC Core
Section titled “KYC Core”Which identity documents are accepted?
Section titled “Which identity documents are accepted?”A Thai national ID card or an NFC passport. See Identity proofing.
What happens to an application the applicant does not finish?
Section titled “What happens to an application the applicant does not finish?”A draft with no activity for 60 minutes — 72 hours once the applicant’s e-mail is verified — that holds nothing that must be kept is removed. If the applicant closes the tab sooner, the e-mail link leads back into the same application. See Records and retention.
Does an SMS ever carry a link?
Section titled “Does an SMS ever carry a link?”No. SMS carries one-time codes and notices that need no click. Notices with links go by e-mail. See KYC Core.
CDD Core
Section titled “CDD Core”Does CDD Core replace our customer master?
Section titled “Does CDD Core replace our customer master?”No. CDD Core is an index, not a second customer master. Customer particulars stay in the source system; CDD Core owns the results of due-diligence work. See 1 Core System.
Does CDD Core file to AMLO directly?
Section titled “Does CDD Core file to AMLO directly?”No. There is no system-to-system link to AERS: officers file. For DA Dealers the system prepares the AERS XML file. See Who it is for and Letters and regulatory filings.
Who signs a High-risk customer?
Section titled “Who signs a High-risk customer?”The maker proposes, the checker signs, and senior management approves: Maker → Checker → Approver. Low and Medium need Maker → Checker. See New-customer approval.
In whose name are NDID, DOPA and the AMLO lists connected?
Section titled “In whose name are NDID, DOPA and the AMLO lists connected?”In the institution’s own name. QX connects as its outsourced IT provider, separately for each institution, and never shares one connection across institutions. See Integrations.
Agent Core
Section titled “Agent Core”Where do the figures come from?
Section titled “Where do the figures come from?”From the fund platform’s daily fee and holdings files, never from manual transaction entry. See Agent Core.
Is an agent paid while their licence is missing or expired?
Section titled “Is an agent paid while their licence is missing or expired?”No. No earning accrues while the investment consultant licence is missing or expired. See Licence gate.
Can a period close with a difference?
Section titled “Can a period close with a difference?”No. The Finance Approver approves only when the reconciliation difference is 0.00. See Period close, payout and tax.
Trading Core
Section titled “Trading Core”Is Trading Core shared between clients?
Section titled “Is Trading Core shared between clients?”No. Each client runs Trading Core in its own environment, and its data stays there. See Deployment and licensing.
Must Trading Core use 1 Core System as its back office?
Section titled “Must Trading Core use 1 Core System as its back office?”No. It connects to 1 Core System or to the client’s own back office through the same signed event feed and link interface. See Deployment and licensing.
When does a deposited digital asset become available?
Section titled “When does a deposited digital asset become available?”Only after every required check has passed. Incoming digital assets are always credited as held first. See Wallets and custody.