An independent AML audit is the moment your framework stops being a set of documents and becomes evidence. Done well, it gives your board, your supervisor and your banking partners confidence that financial crime risk is under control. Done badly, it produces a list of surprises.
Here is how to prepare, step by step.
What an independent AML audit actually tests
Auditors look at two things for every control. Design: is the control right for your risks? Operating effectiveness: does it work, consistently, in practice?
They typically cover:
- governance, oversight and the role of the MLRO
- your business-wide risk assessment
- customer due diligence and KYB, including ongoing monitoring
- transaction monitoring and sanctions screening
- internal reporting and suspicious activity reports
- record keeping and staff training
From July 2027, the EU Anti-Money Laundering Regulation (AMLR) applies directly across member states and expects in-scope firms to have their internal policies, procedures and controls independently tested, in a way that fits their size and nature.
Start with a clear scope
Agree the scope before anyone opens a file. A good scope names the entities and jurisdictions in scope, the products and customer types, the period under review and the regulatory baseline: EU rules, national law and your supervisor’s guidance.
A sharp scope is the single best predictor of a useful audit. Vague scopes produce vague findings.
Build your evidence pack
Most of the preparation is gathering evidence that controls are operating. Auditors will ask for:
| Area | What auditors ask for |
|---|---|
| Governance | Board and committee minutes, MLRO reports, management information |
| Risk assessment | Your business-wide risk assessment and how it drives controls |
| Due diligence | Customer files, risk scores, enhanced due diligence decisions |
| Monitoring | Alert volumes, rules and thresholds, closure rationales, backlogs |
| Reporting | Internal reports, SAR decisions and timelines |
| Training | Training plans, completion records, role-specific content |
Expect sample testing
Auditors test samples of real files and alerts. They check that each decision follows your procedures, that the rationale is written down and that similar cases were treated consistently. Gaps in documentation are the most common finding, even when the underlying decision was right.
Understand how findings are rated
Each finding should come with a rating (high, medium or low), the root cause, a clear recommendation, an owner and a deadline. Ask for root causes, not just symptoms. “Files incomplete” is a symptom; “no checklist for corporate customers” is a cause you can fix.
Turn findings into a remediation plan
Supervisors and banking partners often read the remediation plan more closely than the findings. Prioritise high-rated items, assign named owners, set realistic dates, track progress at board level and plan follow-up testing to prove the fixes work.
If you want to see what a full report looks like, read our sample audit report.
Keep it independent
Independence is not a formality. Whoever audits your framework must not have designed or operated it. If an adviser helped build your controls, a separate team must carry out the audit.
Frequently asked questions
How often should we have an independent AML audit?
Most supervisors expect a regular cycle, commonly once a year, scaled to your size and risk. Check your national rules and any conditions attached to your licence.
Can an external firm carry out the audit?
Yes. EU rules allow the independent audit function to be carried out by an external expert, provided it is independent of the activities it tests. National rules can add requirements, so check them first.
How long does an audit take?
Usually several weeks from scoping to final report. The number of entities, jurisdictions and sample sizes are the main drivers.
Discussion 0
No comments yet. Start the discussion.