The annual independent AML audit your regulator expects. FinCrime specialists test your policies, procedures and controls against EU and local law, then give your board a clear, rated report with a remediation plan.
01 / Why it matters
An independent audit is the proof that your AML framework works, not just that it exists on paper.
Is it mandatory for us?
The law
Obliged entities need an independent test of their AML policies, procedures and controls. Under the EU AML Regulation, an external expert may carry it out.
Read the legal basisOur bank keeps asking for it.
Your partners
Partner banks, payment schemes and investors ask for your latest independent AML report before they onboard or renew.
See what you receiveWe have an inspection coming.
Your supervisor
Gaps found in an audit come with a remediation plan. Gaps found in an inspection come with findings, deadlines and sometimes fines.
See how the audit works02 / Scope
We test design and operating effectiveness across your whole AML framework, against the EU AML Regulation, your national AML law and your supervisor’s guidance.
Board approval, the compliance manager and officer roles, and the management information your board receives.
Methodology, risk factors and how the assessment drives your controls.
Mapped against the AMLR, national law and supervisory guidance, and checked for gaps.
KYC, KYB, beneficial ownership and EDD, tested on samples of real customer files.
Scenarios, thresholds and alert handling, tested for design and effectiveness.
Lists, matching logic, hit handling and escalation.
Internal escalation, MLRO decisions and timely reports to the FIU.
Blockchain analytics, wallet screening and transfer data under Regulation (EU) 2023/1113.
Staff training, record keeping and oversight of any outsourced AML tasks.
03 / Approach
A structured, risk-based audit, run by specialists who have worked AML operations themselves.
A risk-based plan, sample sizes and the regulatory baseline for each jurisdiction you operate in.
Your policies, risk assessment, procedures and governance documents.
Walkthroughs, interviews and sample testing of files, alerts and reports.
Findings rated by severity, each with a root cause and a practical recommendation.
A board-ready report and an agreed remediation plan, with follow-up testing on request.
04 / Independence
An audit is only worth something if it is truly independent. These rules apply to every engagement.
01
Before every engagement we check for conflicts, and each report includes a statement of independence. If we run your AML operations or wrote your policies, we will tell you, and that work should be audited by another firm.
02
Some member states require certain AML reports from an approved statutory auditor or set other conditions. We confirm the rules for your jurisdiction at the start and, where required, work alongside your statutory auditor.
05 / Deliverables
A clear opinion on the design and effectiveness of your AML framework
High, medium and low, each with a root cause and a recommendation
Ready for your regulator, auditors and partner banks
When firms call us
06 / FAQ
At a glance
An objective test of your anti-money laundering framework: whether your policies, procedures and controls are well designed, meet your legal obligations and work in practice. It is separate from your financial statement audit and is carried out by financial crime specialists.
For most regulated firms, yes. EU law requires obliged entities to have an independent audit function that tests their AML policies, procedures and controls, in proportion to their size and nature. Under Article 9 of the EU AML Regulation (Regulation (EU) 2024/1624), which applies from 10 July 2027, firms without their own independent audit function may have this test carried out by an external expert. Until then, the national laws that transpose the EU AML directives apply.
EU law allows the test to be carried out by an external expert who is independent of the work being tested. Some member states add conditions, for example requiring certain reports from an approved statutory auditor. We confirm the rules for your jurisdiction before we start.
Most firms audit their AML framework every year. Your national rules, your supervisor’s expectations and your risk profile set the exact frequency and scope.
Not for the work we provided. Auditing our own work would compromise independence. If we run your AML operations or wrote your policies, another firm should audit that work, and we will tell you so upfront.
A board-ready report with rated findings and root causes, management responses, an agreed remediation plan and an evidence pack you can share with your regulator, auditors and partner banks.
Yes. For CASPs we also test crypto-specific controls, including blockchain analytics, wallet screening and the Travel Rule under Regulation (EU) 2023/1113.
We perform independent AML audits for firms regulated in EU member states, against the EU AML Regulation, your national AML law and the guidance of your supervisor. Outside the EU, tell us your jurisdiction and we will confirm whether and how we can help.
07 / Contact
Due for your annual AML audit, or preparing for an inspection? Tell us your jurisdiction and business model, and we will propose a scope.