AML & Financial Crime Compliance
Independent AML/CFT Audit
Know where your AML/CFT framework stands: independent testing on real files and transactions, prioritised remediation and a report for regulators and banks.
Typical deliverables
- Audit plan and agreed scope
- Summary of testing and sample results
- Audit report with rated findings for the board, regulators and banks
- Prioritised remediation plan agreed with management
- Board presentation of results
Overview
Why it matters
An independent audit shows whether your AML/CFT controls operate as designed, not only whether the policies exist, and gives you a current report when one is requested. Many AML/CFT regimes expect regulated firms to have their framework tested independently, and banks, acquirers and partners increasingly ask for the latest audit report during onboarding and periodic reviews.
Our audits test the framework end to end — from the enterprise-wide risk assessment to customer files, monitoring alerts, sanctions screening and suspicious activity reporting — independently of the people who designed and operate it, and end with a prioritised plan that tells management what to fix first.
Method
How the audit runs
- 1.
Scoping
The applicable requirements, previous findings, changes in the business and the risks that matter most, agreed before fieldwork starts.
- 2.
Design review
Risk assessment, policies, procedures and governance reviewed against the applicable law and supervisory guidance.
- 3.
Effectiveness testing
Sample testing of customer files, monitoring alerts, screening results, internal and external reports, and training records.
- 4.
Reporting
Findings rated by severity, with root causes identified and a prioritised remediation plan agreed with management.
- 5.
Follow-up
Where agreed, validation that remediation actions have been completed and evidenced, so you can show regulators and banks that findings are closed.
Coverage
What the audit tests
Governance and the MLRO function
Management oversight, the MLRO's role, resources and reporting, and how issues are escalated and resolved.
Risk assessment
Whether the enterprise-wide and customer risk assessments reflect the business and drive the controls.
Customer due diligence
Onboarding, verification, beneficial ownership, enhanced due diligence and ongoing monitoring of customers.
Monitoring and screening
Transaction monitoring scenarios and alert handling, sanctions and PEP screening, and their calibration.
Reporting and records
Internal suspicion reporting, external reports to the financial intelligence unit, and record-keeping.
Training and awareness
Content, coverage and completion of training for staff, management and the board.
Considerations
Planning an audit
- Where your regime sets the scope or format of the audit, the plan follows it from the outset.
- Banks and partners may ask for the report itself; we agree its audience with you before the audit starts, so it can be shared without rework.
- Testing is independent of the people who designed and operate the framework, which is what gives the findings weight with your board, regulators and banks.
- Findings deliver most when they feed a tracked remediation plan with owners and dates; where agreed, our follow-up validates that each action has been completed.
Jurisdictions
Supported across jurisdictions
Supported across the jurisdictions in our directory as part of our AML & Financial Crime Compliance capability, with each audit planned and tested against the AML/CFT requirements that apply there.
- Europe18
- Asia & Middle East4
- Americas & Caribbean11
- Africa & Indian Ocean6
Industries
Where we apply it
- iGaming & GamingB2C operators, B2B suppliers, platforms, aggregators and affiliates.
- Fintech & PaymentsPayment and e-money institutions, PSPs and acquirers, payment facilitators and embedded finance.
- Crypto & Digital AssetsCASPs and VASPs, exchanges, custodians, wallets, token projects and crypto payments.
- Forex & InvestmentsForex and CFD brokers, investment firms, trading and investment platforms.
- Digital Platforms & MarketplacesOnline marketplaces, digital platforms, multi-sided platforms and digital service operators.
Questions
Frequently asked
How often should an independent AML/CFT audit be carried out?
It depends on the rules that apply to you and on your risk profile. Some regimes set a frequency or expect an audit after significant change, and banks and payment partners may set their own expectations. We confirm the applicable requirement when scoping the audit.
What do regulators and banks look for in an audit report?
A clear scope and methodology, sample sizes, findings rated by severity and a remediation plan with owners and dates. We prepare the report to that standard and, where a regulator prescribes a format, in that format.
Related
Part of AML & Financial Crime Compliance
- AML & Financial Crime ComplianceAML/CFT programmes, MLRO-as-a-Service, independent AML/CFT audits, risk assessments, monitoring, sanctions and inspection support.
- MLRO-as-a-ServiceAn experienced MLRO, a deputy or support to your own MLRO, with clear accountability and decisions documented for supervisory review.
Due for an independent AML/CFT audit?
We start with your licence, your regulator and who will read the report, then send a written proposal with the audit scope, approach, timetable and fee.