- Home
- Independent AML Audit
- Sample report
Sample report · fictitious entities
See exactly what your board will receive.
A complete sample of our independent AML audit report, for a group with an e-money institution, a MiCA crypto-asset service provider and their Swiss parent. Read it here, page by page.
Independent group AML/CFT & sanctions audit · Ireland · Bulgaria
Independent
Group AML/CFT
Audit Report
An independent test of the AML/CFT and sanctions frameworks of the two licensed companies of Group Holding Ltd. - Ireland PaymentsCo Ltd., an e-money institution and stablecoin issuer, and BG Exchange Ltd., a crypto-asset service provider - and of the shared services provided by their Swiss parent, Group Holding Ltd.
Contents
Contents
How to read this report
Supervisors
Statement (p. 4), your entity’s column in the results (p. 10), Appendices B–C. Central Bank of Ireland: IE and G findings. FSC and FID-DANS: BG and G findings.
Banking partners
Statement (p. 4), findings register (p. 11) and roadmap (p. 16).
Boards
Executive summary (p. 5), two-jurisdiction view (p. 9), high-rated findings (pp. 12–13) and AMLR readiness (p. 17).
Document control
Three boards, three countries,
one report.
Version history
| Ver. | Date | Status | Issued to |
|---|---|---|---|
| 0.1 | 23 Oct 2026 | Draft for factual accuracy | Group Head of Financial Crime; both Heads of AML |
| 0.9 | 30 Oct 2026 | Draft with management responses | CEOs of all three companies |
| 1.0 | 6 Nov 2026 | Final | Boards of all three companies |
Distribution
| Recipient | Receives |
|---|---|
| Board of Ireland PaymentsCo Ltd. | Full report; owns its entity opinion and actions |
| Board of BG Exchange Ltd. | Full report; owns its entity opinion and actions |
| Board of Group Holding Ltd. | Full report; owns group-level actions |
| Group Audit & Risk Committee | Oversight of remediation to closure |
Permitted onward disclosure
With the relevant Board’s consent, to the Central Bank of Ireland, Bulgaria’s Financial Supervision Commission, the Financial Intelligence Directorate of DANS and, under confidentiality terms, to banking and card-scheme partners. AMLA where relevant.
Confidentiality of reporting data
This report contains no customer-level or case-level information on suspicious transaction reports. STR data appear only as aggregate counts and timings. The parent is a Swiss holding company, not a credit or financial institution, so it falls outside the intra-group disclosure exemptions in Art. 39(3) of Directive (EU) 2015/849 as transposed in Ireland and Bulgaria.
Reliance and limitations
Each licensed entity receives its own opinion against its own national law; neither opinion relies on the other. Observations on the group layer are advisory, because Group Holding Ltd. is not an obliged entity.
The audit is a risk-based independent test of design and operating effectiveness. It is not a legal opinion, an ISAE 3000 assurance engagement, or a guarantee that financial crime cannot occur. Third parties may use it to inform, not replace, their own due diligence.
Engagement timetable
- Fieldwork
- 28 Sep – 16 Oct 2026 (Zug, Dublin and Sofia)
- Data cut-off
- 30 September 2026
- Final report
- 6 November 2026
- Board presentations
- 18 – 20 November 2026
Group Holding Ltd., Ireland PaymentsCo Ltd. and BG Exchange Ltd. are fictitious. All names, figures, findings and responses are illustrative. Legal and regulatory references are real and current as at 6 November 2026.
01 · Statement for competent authorities & banking partners
Independent auditor’s
statement.
To the Boards of Group Holding Ltd., Ireland PaymentsCo Ltd. and BG Exchange Ltd. - and, with each Board’s consent, to their competent authorities and banking partners
We have performed an independent audit of the AML/CFT and targeted financial sanctions frameworks of the group’s two licensed companies - Ireland PaymentsCo Ltd., an e-money institution authorised by the Central Bank of Ireland that issues a euro e-money token under MiCA, and BG Exchange Ltd., a class 3 crypto-asset service provider authorised by Bulgaria’s Financial Supervision Commission - and of the shared services provided to them by their unlicensed Swiss parent, Group Holding Ltd., for the period 1 October 2025 – 30 September 2026. The parent commissioned the audit to support harmonisation of both frameworks under one group standard.
Each entity was tested against its own national law - the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 and Central Bank guidance in Ireland; the Measures Against Money Laundering Act (ZMIP) in Bulgaria - and against directly applicable EU law - including MiCA and the travel rule for crypto-assets - EBA Guidelines and the FATF Recommendations. We also assessed readiness for Regulation (EU) 2024/1624 (AMLR), including its group-wide requirements, which apply from 10 July 2027.
Our work covered 14 interviews, 96 documents, 540 sampled items, full-population analytics on 14 data sets, a review of the blockchain analytics rules, a 150-record stress test of the shared screening engine and a replay of the shared monitoring scenarios.
Conclusion. In our opinion, the frameworks of both Ireland PaymentsCo Ltd. and BG Exchange Ltd. are Largely Effective. Group arrangements, assessed on an advisory basis, are Developing. We identified 7 findings - none critical, 2 high, 3 medium, 2 low. Both high-rated findings sit in services the parent runs for both entities - transaction monitoring and sanctions screening - and therefore affect both. Containment for both is completed or under way.
All findings were accepted. Remediation completes by 31 March 2027, ahead of the AMLR. AskRegulations will validate closure of the high-rated findings by 30 April 2027.
Independence. AskRegulations has provided no first- or second-line AML services, outsourced compliance roles or framework design to any group company in the 24 months before or during this engagement. Any support to build the harmonised framework will be delivered by a separate team, and the next independent audit by a team not involved in that work.
02 · Executive summary
Two sound institutions,
one group still being built.
Both licensed companies have accountable boards, independent AML functions and strong identity verification. The weaknesses we found sit mostly in what they share: monitoring and screening run by the parent under agreements that do not say who decides what. Fixing the shared services once fixes them for both.
Key messages
1 · Shared services need licensee control
The Swiss parent runs monitoring, screening and blockchain analytics for both licensees under IT service agreements with no AML decision rights, audit rights or confidentiality terms, and case-level STR data reached the parent’s board (G-03).
2 · Shared services concentrate risk
Three monitoring typologies were lost in the March 2026 platform migration (G-01) and a screening threshold change missed 14 of 130 test names (G-02). Both affect both entities, and both are contained.
3 · Local rules still differ - and matter
Bulgaria requires STRs before execution - hard on an exchange where crypto withdrawals settle instantly - and the CASP partly missed this (BG-01). Ireland’s dual filing with FIU Ireland and Revenue worked as required in all 52 cases. Any group standard needs local addenda until July 2027.
4 · Fiat meets crypto inside the group
The EMI banks its sister CASP: €1.1bn of fiat flowed through intra-group accounts that monitoring excluded (G-04). Fiat-to-crypto layering across two licences is the first thing supervisors and partner banks will test.
Containment actions
Screening fixed for both
Detection restored to 98.5%; both customer bases and 12 months of counterparties re-screened - no true matches.
Scenarios restored
Missing scenarios go live for both entities; lookback under way, one report already filed.
STR data ring-fenced
Case-level STR reporting to the parent stopped; aggregate MI only.
Intra-group flows monitored
Exclusion removed; the CASP’s flows through the EMI are now monitored.
03 · Group structure & profile
One parent, two licences,
shared services in between.
Group Holding Ltd.
Holding company. Provides shared services from Zug under intra-group agreements: Group Financial Crime (4 FTE), monitoring, screening and blockchain analytics, data and IT. Not an EU obliged entity.
Ireland PaymentsCo Ltd.
Authorised 2019 · issues the ABC-EUR e-money token
BG Exchange Ltd.
MiCA-authorised 12 Jun 2026 · passported to 6 EEA states
| IRELAND Ireland PaymentsCo Ltd. | BULGARIA BG Exchange Ltd. | |
|---|---|---|
| Customers | 61,400 · 58,900 retail · 2,500 business | 43,060 · 41,200 retail · 1,860 business |
| Crypto-assets | ABC-EUR token: €212m issued, €148m redeemed, €64m outstanding | Trading platform for 62 crypto-assets incl. ABC-EUR; €410m in custody |
| Activity | €2.62bn payments · 8.4m transactions | €3.1bn traded · 6.1m transactions, incl. 1.9m on-chain |
| Channels | 100% remote onboarding | 100% remote onboarding |
| AML function | 11 FTE · Head of AML & CTF Compliance (PCF-52) | 12 FTE · Head of specialised AML service (ZMIP Art. 106) |
| Supervision | Central Bank of Ireland (AML and MiCA) | FSC (MiCA and AML) and FID-DANS |
| STRs in period | 52 · filed with FIU Ireland and Revenue | 47 · filed with FID-DANS |
| Inherent risk | High - cross-border volume; token in open circulation | High - self-hosted wallets; cross-chain flows |
Context: BG Exchange Ltd. operated under Bulgaria’s MiCA transitional regime until its FSC authorisation on 12 June 2026; before that it was registered with the National Revenue Agency under ZMIP Art. 9a. Ireland PaymentsCo Ltd. holds the CASP’s client-money accounts and runs its fiat on- and off-ramp (€1.1bn in the period). Bulgaria left the FATF grey list on 30 October 2026.
04 · Scope & methodology
Tested entity by entity,
assessed as a group.
Entity compliance
Does each licensee meet its own national law and directly applicable EU law, including MiCA?
Effectiveness
Did controls - including those run by the parent - operate throughout the period?
Harmonisation & AMLR
What must change for one group standard that meets the AMLR from 10 July 2027?
In scope
- Both licensees: all eleven control areas in Section 07, including token issuance, blockchain analytics and the travel rule for crypto-assets
- Shared services run from Zug: monitoring, screening and blockchain analytics, Group Financial Crime, data feeds
- Intra-group agreements, information flows and group governance
- Follow-up of the 2025 audit findings for BG Exchange Ltd. (4 of 6 closed with evidence)
Out of scope
- Prudential, safeguarding and token-reserve requirements; market-abuse surveillance on the trading platform (MiCA Title VI)
- IT general controls beyond data completeness for AML systems
- The parent’s own compliance with AML law - it is not an obliged entity
- 01PlanBoth business models, risk assessments and data drive one test plan.
- 02Walk throughIn Zug, Dublin and Sofia; shared controls walked through once, end to end.
- 03TestSeparate samples per entity; analytics and stress tests on shared systems.
- 04ValidateFindings agreed with each Head of AML and the Group Head of Financial Crime.
- 05ReportEntity opinions, group view, roadmap and re-testing.
Sampling
Attribute sampling at 90% confidence and 10% tolerable deviation (samples of 20–40 per population), drawn separately for each entity so each opinion stands alone. Full-population analytics wherever data allowed. Appendix B lists every test.
Standards
IIA Global Internal Audit Standards (effective 9 January 2025) as applicable to an external provider. Findings recorded as condition, criteria, root cause and risk; management responses reproduced as provided; independent quality review before issue.
05 · Regulatory baseline
Two national laws today,
one EU rulebook from 10 July 2027.
| Instrument | Applies to | Status at 6 November 2026 | Use |
|---|---|---|---|
| European Union - both entities | |||
| Directive (EU) 2015/849 (AMLD4), as amended by (EU) 2018/843 | BOTH | In force · repealed 10 Jul 2027 | Baseline as transposed nationally |
| Regulation (EU) 2024/1624 (AMLR) | BOTH | In force 9 Jul 2024 · applies 10 Jul 2027 | Readiness, incl. group-wide duties (Art. 16) |
| Directive (EU) 2024/1640 (AMLD6); Regulation (EU) 2024/1620 (AMLA) | BOTH | Transposition 10 Jul 2027; AMLA operational since 1 Jul 2025 | Context |
| Regulation (EU) 2023/1114 (MiCA) | BOTH | Fully applicable since 30 Dec 2024 | Token issuance (IE); CASP services (BG) |
| Regulation (EU) 2023/1113 (transfers of funds and crypto-assets) | BOTH | Applies since 30 Dec 2024 | Tested directly |
| Delegated Regulation (EU) 2016/1675 (high-risk third countries) | BOTH | Latest amendments in force 29 Jan 2026 | Tested directly |
| EBA Guidelines: risk factors (2021/02, as amended); compliance officer (2022/05); remote onboarding (2022/15); travel rule (2024/11); restrictive measures (2024/14, 2024/15); outsourcing (2019/02) | BOTH | Applicable | Supervisory expectations |
| AMLA final draft RTS: CDD (Art. 28(1)); group-wide requirements (Arts. 16(4), 17(3)) | BOTH | Submitted to the Commission 1 Oct 2026 | Readiness reference |
| Ireland - Ireland PaymentsCo Ltd. | |||
| Criminal Justice (Money Laundering and Terrorist Financing) Act 2010, as amended | IRELAND | In force | Primary national baseline |
| Central Bank of Ireland AML/CFT Guidelines for the Financial Sector; Dear CEO letter to payment and e-money firms (Jan 2023); MiCA token white paper and Art. 60(4) notification | IRELAND | Applicable | Supervisory expectations |
| S.I. No. 110 of 2019 (beneficial ownership register); Fitness & Probity regime (PCF-52) | IRELAND | In force | Tested directly |
| Bulgaria - BG Exchange Ltd. | |||
| Measures Against Money Laundering Act (ZMIP), last amended SG 51/2026; implementing rules (PPZMIP); ZMFT | BULGARIA | In force | Primary national baseline |
| Law on Markets in Crypto-Assets (SG 54/2025); FSC as MiCA authority | BULGARIA | In force 8 Jul 2025; transition ended 1 Jul 2026 | Authorisation context |
| International | |||
| FATF Recommendations, as amended (incl. R.16, June 2025) | BOTH | Standard | R.18 underpins the audit |
The legal basis differs today. In Ireland, s.54(9) of the 2010 Act requires an independent external audit only where the Central Bank directs it in writing, although the Central Bank expects firms to test their AML framework independently. In Bulgaria the requirement flows from the internal-control system under ZMIP Art. 101 and Art. 8(4)(b) of AMLD4. From 10 July 2027, AMLR Art. 9(2)(b) requires an independent audit function - or an external expert - for both entities. This audit is built to that standard now, and from that date the same methodology runs directly against the AMLR.
06 · Two jurisdictions, one framework
Where Ireland and Bulgaria differ -
and what the group standard should say.
Harmonisation means one group minimum standard with short local addenda - never diluting the stricter local rule. Until 10 July 2027 these differences are legally binding; after that most fall away under the AMLR.
| Requirement | IRELAND Today | BULGARIA Today | Group standard (recommended) | AMLR from 10 Jul 2027 |
|---|---|---|---|---|
| Suspicious transaction reports | FIU Ireland (goAML) and Revenue (ROS), as soon as practicable; generally before proceeding (s.42) | FID-DANS, immediately and before execution; after execution only with justification (Arts. 72–73) | Decision within 2 business days; hold before execution; local filing addendum | Art. 69 - report promptly to the national FIU |
| Accountable AML role | Head of AML & CTF Compliance - pre-approved PCF-52 | Head of specialised AML service; FID notified within 7 days (Art. 106) | Group Head of Financial Crime sets standards; local heads stay accountable | Art. 11 - compliance manager (board member) and compliance officer |
| Independent audit | External audit where the Central Bank directs (s.54(9)) | Internal-control system (Art. 101); AMLD4 Art. 8(4)(b) | Annual independent audit of both entities | Art. 9(2)(b) - mandatory |
| Beneficial ownership discrepancies | Report to the RBO (S.I. 110/2019) | Report to the Registry Agency within 14 days (Art. 63a) | One workflow, routed locally | Art. 24 |
| Domestic PEPs | Domestic and foreign PEPs (s.37) | Extends to mayors and municipal council chairs (Art. 36) | Apply the wider of the two lists | Arts. 42–46 - one EU list |
| Supervisors | Central Bank of Ireland - AML, the EMI and the token | FSC - MiCA and AML; FID-DANS - FIU and inspections | One supervisory calendar for the group | National supervisors; AMLA direct supervision of selected entities from 2028 |
| Crypto-asset activity | Issues ABC-EUR; custody and transfer of its own token only (MiCA Arts. 48, 60(4)) | Class 3 CASP: trading platform, exchange, custody, transfers | One blockchain analytics standard and risk scale | Arts. 37, 40 - crypto correspondents and self-hosted addresses |
| Self-hosted wallets | Token transfers above €1,000: ownership verified under the TFR | Risk-based measures under ZMIP Art. 20a and the TFR | One verification method across both | Art. 40 |
| Sharing STR information in the group | Permitted between credit and financial institutions in the same group (tipping-off defences, ss.49–53); Swiss parent not covered | Permitted within the group under Art. 80(3); Swiss parent not covered | Case data only between the two Heads of AML under protocol; parent gets aggregates | Art. 16(3) - sharing among group obliged entities with safeguards |
How a group standard could be built · advisory
Group minimum standard
One policy, one risk methodology and scale, one country list and update clock, governed shared services. Owned by the EU parent identified under the AMLR; adopted by each licensee’s board.
Local addendum
Dual filing with FIU Ireland and Revenue, PCF-52 accountability, RBO reporting and token-specific controls. Owned by the Head of AML & CTF Compliance.
Local addendum
Pre-execution reporting to FID-DANS, the specialised AML service, ZMIP Art. 20a and the wider local PEP list. Owned by the Head of AML.
07 · Results by control area
Each entity rated on its own evidence.
| Control area | IRELAND | BULGARIA | What we found | Findings |
|---|---|---|---|---|
| 01 Governance & oversight | Largely effective | Largely effective | Accountable boards and independent Heads of AML in both; Board MI activity-based rather than risk-based. | - |
| 02 Business-wide risk assessment | Largely effective | Largely effective | Both approved and data-driven; EMI’s updated for token issuance, CASP’s for MiCA authorisation. | - |
| 03 Policies & procedures | Effective | Effective | Comprehensive and mapped to national law and MiCA in both. | - |
| 04 CDD, EDD & beneficial ownership | Largely effective | Largely effective | Strong ID&V in both; IE control-prong and RBO gaps. | IE-02 |
| 05 Ongoing monitoring & reviews | Largely effective | Largely effective | High-risk reviews overdue: IE 2.6%, BG 7.2%; within tolerance but trending up. | - |
| 06 Transaction monitoring - fiat & on-chain | Partially effective | Partially effective | Three typologies lost at migration; intra-group accounts excluded from monitoring. | G-01 · G-04 |
| 07 Sanctions & TFS | Partially effective | Partially effective | Name screening missed 14 of 130 test names; wallet screening unaffected. | G-02 |
| 08 Travel rule - funds & crypto-assets | Effective | Largely effective | IE complete for funds and token transfers; BG self-hosted checks sound, due diligence incomplete for 6 of 40 counterparty CASPs. | - |
| 09 Suspicious transaction reporting | Effective | Largely effective | Good quality in both; IE dual filing on time; BG reports after settlement without justification. | BG-01 |
| 10 E-money token issuance & redemption | Largely effective | n/a | CDD at issuance and redemption sound; address-freeze function documented but never tested. | - |
| 11 Records, training & outsourcing | Largely effective | Largely effective | Records sound; BG training overdue and outdated; intra-group services lack AML terms. | BG-02 · G-03 |
| GR Group arrangements (advisory) | Developing | Shared services lack AML terms; EMI–CASP relationship not at arm’s length; no group standard yet. | G-03 · G-04 |
What works well
- True sanctions matches handled exemplarily - both matches in the period (at BG Exchange Ltd.) frozen within an hour, notified the same day.
- Identity verification - 1 minor exception across 80 retail files in both entities.
- Data lineage - fiat and on-chain data reconciled from source to the shared platforms at 99.98%.
- Strong local accountability - both Heads of AML have direct board access and adequate teams.
Rating scale
Entity ratings: Effective Largely effective Partially effective Ineffective
Group maturity (advisory): Initial · Developing · Established · Advanced. Definitions in Appendix A.
08 · Findings
Findings register
Seven findings. G findings arise in shared services or group governance and affect both entities; IE and BG findings are specific to one entity and its national law.
| ID | Finding | Entity | Severity | Owner | Due | Maps to | Status |
|---|---|---|---|---|---|---|---|
| G-01 | Monitoring coverage lost in shared platform migration | BOTH | High | Group Head of FC | 15 Feb 2027 | AMLR Art. 26 | Containment under way |
| G-02 | Shared screening calibration; no exposure assessment | BOTH | High | Group Head of FC | 31 Jan 2027 | AMLR Art. 9(1)(b) | Fixed; re-screen done |
| G-03 | Shared services not governed as outsourcing; STR data reached the parent | BOTH | Medium | Heads of AML · Group CEO | 28 Feb 2027 | AMLR Arts. 18, 73 | STR data ring-fenced |
| G-04 | EMI–CASP relationship not risk-assessed at arm’s length | BOTH | Medium | Head of AML (IE) | 31 Jan 2027 | AMLR Arts. 26, 34 | Exclusion removed |
| BG-01 | STRs filed after execution without justification | BULGARIA | Medium | Head of AML (BG) | 31 Jan 2027 | AMLR Art. 69 | Open |
| BG-02 | AML training gaps and delays | BULGARIA | Low | Head of AML (BG) | 31 Mar 2027 | AMLR Arts. 9(2), 12 | Open |
| IE-02 | Beneficial ownership by control; RBO discrepancies | IRELAND | Low | Head of Onboarding (IE) | 31 Jan 2027 | AMLR Arts. 24, 51–53 | Open |
Observations · advisory, not rated
A group standard
Harmonisation is a business choice today. From July 2027 the EU parent identified under the AMLR is expected to run group-wide policies for both licensees, so starting now is sensible.
Who leads the group under the AMLR?
Because the parent is in Switzerland, one of the two EU licensees will act as the group’s “EU parent” from July 2027. AMLA’s draft standards choose it mainly by size: Ireland leads on customers, Bulgaria on volumes. Confirm with legal advice now.
One CDD data model
Build one customer data model for both licensees against AMLA’s final draft CDD RTS, instead of two local ones.
Bulgaria de-listing
Brief correspondent banks on BG Exchange Ltd.’s controls following FATF’s 30 October 2026 decision.
08 · Findings · High
Monitoring coverage lost in the shared platform migration
Shared service · Transaction monitoring · Owner: Group Head of Financial Crime with both Heads of AML · Due 15 February 2027
Alerts older than 30 days · Oct 2025 – Sep 2026 · IE / BG
Our lookback · missing scenarios replayed
Condition - what we found
On 3 March 2026 the parent’s shared-services team moved both licensees from a legacy rules engine to one machine-learning-assisted monitoring platform. Mapping the 41 legacy rules showed three typologies were not re-implemented: rapid pass-through (funds in and out within 48 hours at the EMI; fiat in and crypto out to self-hosted wallets at the CASP), refunds to cards not used for the original purchase (EMI), and many unrelated senders paying into newly opened accounts (both).
Neither Head of AML signed off scenario coverage; there was no parallel run, no below-the-line testing since go-live, and thresholds remain at vendor defaults. 9 of 80 sampled alert closures (11.3%) lacked adequate rationale. Alerts older than 30 days peaked at 3,210 across both entities in June 2026.
Criteria
Root cause
The migration was run as a group IT project. The intra-group service agreement is silent on model governance, so neither licensed entity owned the coverage decision.
Risk & impact
Activity in typologies rated highest in both entities’ risk assessments may go undetected and unreported, breaching s.42 (IE) and Art. 72 (BG). The lookback confirms the exposure is real but limited.
Recommendations
- 1Deploy the missing scenarios for each entity, with documented thresholds · ≤30 days
- 2Complete the lookback of all 214 would-be alerts; each Head of AML decides on reporting · ≤60 days
- 3Group monitoring model-governance standard: coverage matrix per entity, semi-annual below-the-line testing, changes approved by both Heads of AML · ≤90 days
- 4Closure-rationale template and 10% quality sampling in both teams · ≤60 days
Management response
Agreed on behalf of both entities. Scenarios go live on 14 November 2026; the lookback completes by 15 January 2027; the model-governance standard goes to both Boards by 31 January 2027.
Group Head of Financial Crime · Heads of AML (IE, BG) - 30 Oct 2026
Auditor’s view: Adequate. We will re-perform the mapping and sample lookback decisions in April 2027.
08 · Findings · High
Shared screening calibration and missing exposure assessment
Shared service · Sanctions & TFS · Owner: Group Head of Financial Crime with both Heads of AML · Due 31 January 2027
Stress test · 150 synthetic records · shared engine, production settings, test environment
| Test category | Cases | Hits | Rate | |
|---|---|---|---|---|
| Exact matches | 30 | 30 | 100.0% | |
| Minor misspellings | 25 | 24 | 96.0% | |
| Word order / name parts | 20 | 20 | 100.0% | |
| Transliteration (Cyrillic, Arabic → Latin) | 30 | 19 | 63.3% | |
| Concatenated / split names | 17 | 15 | 88.2% | |
| Entities with legal suffixes | 8 | 8 | 100.0% | |
| All true-positive cases | 130 | 116 | 89.2% | |
| Negative controls (should not alert) | 20 | 3 | 15.0% FP | |
| Re-test after fix, 30 Oct 2026 | 130 | 128 | 98.5% |
Condition - what we found
In February 2026 the shared engine’s fuzzy-match threshold was raised from 85 to 92 to cut false positives, without testing or approval by either Head of AML, and transliteration for Cyrillic and Arabic scripts was not enabled. Our stress test detected 116 of 130 true-positive cases; 11 of the 14 misses were transliterations. The setting applied to both entities. Screening of wallet addresses through the blockchain analytics tool was not affected.
Neither entity had performed the restrictive-measures exposure assessment expected under EBA/GL/2024/14, applicable since 30 December 2025.
Criteria
Root cause
Screening parameters were treated as operational tuning owned by the parent, not as controlled changes owned by the licensed entities.
Risk & impact
Designated persons’ funds could be made available in either entity - a strict-liability breach and an immediate concern for correspondent banks and card schemes.
Recommendations
- 1Calibrate the threshold by testing; enable transliteration · ≤30 days
- 2Re-screen both customer bases and 12 months of counterparties · ≤45 days
- 3Exposure assessment per entity, approved by each Board · ≤90 days
- 4Quarterly screening tests with a scorecard; parameter changes approved by both Heads of AML · ≤30 days
Management response
Agreed. Threshold set to 87 with transliteration enabled on 30 October 2026 (re-test: 98.5%). Re-screen of both entities completed 4 November 2026 with no true matches. Exposure assessments to both Boards by 31 January 2027.
Group Head of Financial Crime - 4 Nov 2026
Auditor’s view: Adequate. We confirmed the 98.5% re-test result; closure depends on the exposure assessments and the first quarterly test.
08 · Findings · Medium
Shared services not governed as outsourcing; STR data reached the parent
Shared services · Owner: each licensee’s Head of AML, with the Group CEO · Due 28 February 2027
Condition - what we found
The parent runs transaction monitoring, sanctions screening, blockchain analytics and data services for both licensees from Zug, under general IT service agreements - outsourcing to a provider outside the EU. The agreements set no AML decision rights, service levels, audit and access rights, confidentiality terms or exit arrangements, and neither Head of AML receives service reports or tests the shared controls. As G-01 and G-02 show, changes were made without either licensee’s approval. Until 1 November 2026, monthly MI to the parent’s board also included case-level STR details for both licensees.
Criteria
Root cause
Services were centralised in 2025 for efficiency and contracted as IT support, not as outsourcing of AML controls.
Risk & impact
Each licensee remains fully responsible for controls it does not govern; suspicion-related data left the EU for a company outside the intra-group disclosure exemption.
Recommendations
- 1Aggregate-only STR MI to the parent · Done
- 2AML schedules in the intra-group agreements: decisions stay with each Head of AML; SLAs, audit and access rights, confidentiality, exit · ≤60 days
- 3Monthly service reports to both Heads of AML; shared controls added to each licensee’s compliance monitoring plan · ≤90 days
Management response
Agreed. Case-level reporting to the parent stopped on 1 November 2026. AML schedules will be approved by the Boards of both licensees by 31 January 2027.
Heads of AML (IE, BG) · Group CEO - 30 Oct 2026
Auditor’s view: Adequate. This finding concerns each licensee’s duty to govern what it outsources; it does not require the parent to take on AML responsibilities of its own.
EMI–CASP relationship not risk-assessed at arm’s length
Intra-group · Owner: Head of AML & CTF Compliance (IE), with Head of AML (BG) · Due 31 January 2027
Condition - what we found
Ireland PaymentsCo Ltd. holds the client-money accounts of its sister CASP and runs its fiat on- and off-ramp; €1.1bn flowed through these accounts in the period. The relationship was opened under an intra-group procedure: no enhanced due diligence on the CASP’s AML framework, no expected-activity profile, and monitoring rules excluded intra-group accounts. The EMI also relies on the CASP’s customer due diligence without a documented reliance arrangement.
Criteria
Root cause
The relationship was treated as an internal arrangement rather than a high-risk customer.
Risk & impact
Fiat-to-crypto layering across two licences could go undetected by either entity - the pattern supervisors and partner banks test first in mixed EMI–CASP groups.
Recommendations
- 1Onboard the CASP as a high-risk business customer: EDD, expected activity, annual review · ≤60 days
- 2Monitoring scenarios for omnibus client-money accounts · ≤30 days
- 3Documented reliance and information-sharing arrangement between the two Heads of AML · ≤90 days
Management response
Agreed. The monitoring exclusion was removed on 2 November 2026; EDD and the reliance arrangement will be completed by 31 January 2027.
Heads of AML (IE, BG) - 30 Oct 2026
Auditor’s view: Adequate.
08 · Findings · Medium & low
STRs filed after execution without justification
BG Exchange Ltd. · STR · Owner: Head of AML (BG) · Due 31 January 2027
Condition - what we found
All 47 STRs filed with FID-DANS were analysed. 28 were filed after the related crypto withdrawal had settled on-chain, and 9 of those lacked the justification Art. 72(2) requires. The platform can hold a withdrawal pending an AML decision, but the hold is not linked to alert escalation and was used in only 6 cases. Median time from escalation to filing was 4 business days.
Criteria
Root cause
Withdrawal holds are not triggered by escalation, and the case workflow has no decision deadline or justification field.
Risk & impact
On-chain transfers cannot be recalled, so FID-DANS loses its power to suspend; breach of the pre-execution reporting rule.
Recommendations
- 1Automatic withdrawal hold on escalation; decision within 1 business day · ≤60 days
- 2Mandatory Art. 72(2) justification field; monthly timeliness MI · ≤30 days
Management response
Agreed. Hold linked to escalation from January 2027; procedure updated by 15 December 2026.
Head of AML (BG) - 30 Oct 2026
Auditor’s view: Adequate.
AML training gaps and delays
BG Exchange Ltd. · Training · Owner: Head of AML (BG), with HR · Due 31 March 2027
Condition & root cause
85 of 96 employees (88.5%) completed annual AML training against a 100% target; the 11 overdue include two senior managers and one board member. 7 of 18 new joiners finished AML induction after the 30-day requirement (median 47 days). Content has not been updated since 2024 - nothing on crypto sanctions evasion, the travel rule for self-hosted wallets or the AMLR - and there is no test of understanding.
Root cause: training is tracked by HR without escalation to the Head of AML or the Board.
Criteria
Recommendations
- 1Complete overdue training; escalate non-completion to managers and the Board · ≤60 days
- 2Refresh content; add a pass-mark assessment; induction before system access · ≤120 days
Agreed. Overdue training by 31 December 2026; new content and assessments from Q1 2027.
Head of AML (BG) - 30 Oct 2026
Auditor’s view: Adequate.
Beneficial ownership by control; RBO discrepancies
Ireland PaymentsCo Ltd. · CDD · Owner: Head of Onboarding (IE) · Due 31 January 2027
Condition & root cause
In 3 of 30 business files, the senior managing official was recorded as beneficial owner without documenting whether anyone exercised control by other means. Two differences from the Register of Beneficial Ownership were not reported to the RBO.
Root cause: no control-analysis template or discrepancy workflow.
Criteria
Recommendations
- 1Remediate files, report discrepancies, add template and workflow · ≤60 days
Agreed.
Head of Onboarding (IE) - 30 Oct 2026
Auditor’s view: Adequate.
09 · Remediation roadmap
Every action closes
before the AMLR applies.
All actions due
Shared services governed by both licensees; any group standard the Boards choose to adopt sits on top.
Validation of highs
We re-perform the scenario mapping, lookback sample and screening stress test.
Follow-up review
Evidence-based closure testing in both entities; short report to each Board.
First audit under the AMLR
Both entities and the group layer tested directly against the AMLR and adopted AMLA standards.
How we validate closure
- 01Evidence requestedThe owner submits an evidence pack, not a status update.
- 02Re-perform the testWe repeat the original test that raised the finding.
- 03Test after the fixA fresh sample from the post-fix population, per entity.
- 04Close or re-raiseClosed with evidence, or re-raised as a repeat finding.
10 · AMLR readiness
Sixteen AMLR requirements,
checked for both entities.
| Requirement | AMLR | IRELAND | BULGARIA | Comment |
|---|---|---|---|---|
| Compliance manager - a member of the management body | Art. 11(1) | On track | On track | Executive directors designated; mandates in Q1 2027 |
| Compliance officer appointed by the management body | Art. 11(2) | Ready | Ready | PCF-52 holder (IE); specialised service head (BG) |
| Group-wide policies, risk assessment and group compliance function | Art. 16(1)–(2) | Gap | Gap | EU parent to be identified among the licensees (Swiss head office) |
| Group information sharing with safeguards | Art. 16(3) | On track | On track | STR data ring-fenced (G-03) |
| BWRA approved by the management body | Art. 10 | Ready | On track | Two methodologies; align if harmonising |
| Independent audit function | Art. 9(2)(b) | Ready | Ready | This engagement; annual cycle agreed |
| Harmonised CDD information set | Arts. 20, 22, 28(1) | On track | On track | One data model (observation) |
| CDD updates: ≤1 year high risk, ≤5 years others | Art. 26(2) | Ready | On track | BG review backlog 7.2% |
| Beneficial ownership and discrepancy reporting | Arts. 24, 51–53 | Gap | Ready | IE-02 |
| Third-country lists and EDD | Arts. 29–35 | Ready | Ready | Central list maintained by the group |
| Prompt reporting of suspicions | Art. 69 | Ready | On track | BG-01 |
| Mitigating TFS evasion risk | Art. 9(1)(b) | Gap | Gap | G-02 exposure assessments |
| Outsourcing limits and accountability | Art. 18 | On track | On track | G-03 intra-group terms (third-country provider) |
| Crypto-asset counterparty due diligence | Art. 37 | n/a | On track | 6 of 40 counterparty CASPs incomplete (BG) |
| Transfers with self-hosted addresses | Art. 40 | Ready | Ready | TFR checks (IE); ZMIP Art. 20a (BG) |
| Record retention - five years | Art. 77 | Ready | Ready | No change |
Counts are entity-requirement pairs (31; one not applicable). AMLA’s final draft RTS on CDD and on group-wide requirements were submitted to the Commission on 1 October 2026 and are not yet adopted.
Appendix A · Rating definitions
How we rate
Entity control-area ratings
| Rating | Definition |
|---|---|
| Effective | Well designed and operated consistently. Only low-rated findings or observations. |
| Largely effective | Generally well designed and operating; weaknesses contained. No high-rated findings in the area. |
| Partially effective | One or more high-rated findings, or several medium findings indicating systemic weakness. |
| Ineffective | Controls absent or fundamentally flawed, or a critical finding exists. |
Finding severity
| Severity | Definition | Remediation |
|---|---|---|
| Critical | Ongoing breach of law or a control failure exposing the entity to serious financial crime, sanctions breach or licence risk. | Immediate; ≤30 days |
| High | Significant weakness in a key control that could let financial crime or a regulatory breach go undetected. | ≤90 days |
| Medium | Weakness reducing control effectiveness, or non-systemic regulatory non-compliance. | ≤180 days |
| Low | Minor weakness, documentation gap or alignment with forthcoming requirements. | ≤12 months |
Group harmonisation maturity (advisory)
| Level | Definition |
|---|---|
| Initial | Each entity operates independently; no shared standard. |
| Developing | Shared services exist, but group policy, governance and intra-group terms are incomplete. |
| Established | Group policy with local addenda, common methodology, governed shared services. |
| Advanced | Group framework meets AMLR Art. 16 and is independently tested each year. |
Appendix B · Testing summary
Every test, both entities
| Test | IRELAND | BULGARIA | Finding | ||||
|---|---|---|---|---|---|---|---|
| Population | Sample | Exceptions | Population | Sample | Exceptions | ||
| Entity tests | |||||||
| Retail onboarding CDD | 9,840 | 40 | 1 | 6,912 | 40 | 0 | - |
| Business KYB & beneficial ownership | 590 | 30 | 3 | 412 | 30 | 1 | IE-02 |
| EDD and PEP files | 164 | 20 | 1 | 138 | 20 | 1 | - |
| High-risk periodic reviews due | 1,580 | 100% | 41 | 1,214 | 100% | 87 | - |
| Monitoring alerts closed | 24,900 | 40 | 4 | 18,640 | 40 | 5 | G-01 |
| Monitoring alert ageing | 28,700 | 100% | 1,270 peak | 21,380 | 100% | 1,940 peak | G-01 |
| Sanctions alerts | 12,400 | 30 | 0 | 9,870 | 30 | 0 | - |
| STR timeliness and filing | 52 | 100% | 0 | 47 | 100% | 9 | BG-01 |
| Escalations closed without STR | 134 | 20 | 0 | 112 | 20 | 1 | - |
| Travel rule - incoming transfers missing data | 1,870 | 20 | 1 | 1,302 | 20 | 2 | - |
| Transfers to self-hosted wallets over €1,000 | 2,100 | 20 | 0 | 41,300 | 25 | 1 | - |
| Counterparty CASP due diligence | - | - | - | 40 | 100% | 6 | - |
| Token redemptions | 4,820 | 25 | 0 | - | - | - | - |
| Annual training completion | 128 | 100% | 3 | 96 | 100% | 11 | BG-02 |
| Induction training within 30 days | 22 | 100% | 1 | 18 | 100% | 7 | BG-02 |
| Record retrieval (closed relationships) | 1,920 | 15 | 0 | 1,480 | 15 | 0 | - |
| Shared services (parent) | |||||||
| Monitoring rules mapped to new scenarios | 41 | 100% | 3 missing | Shared - covers both entities | G-01 | ||
| Lookback of would-be alerts | 214 | 40 | 3 escalated | Shared - covers both entities | G-01 | ||
| Ledger-to-platform reconciliation | 14.5m | 100% | 0.02% | Shared - covers both entities | - | ||
| Screening stress test | 150 | 100% | 14 missed · 3 FP | Shared - covers both entities | G-02 | ||
| Blockchain analytics rules | 38 | 100% | 0 | Shared - covers both entities | - | ||
Samples drawn separately per entity so each opinion stands alone: 540 items sampled (260 at the EMI, 240 at the CASP, 40 in the shared lookback); 14 data sets analysed in full; 150 synthetic records stress-tested. Data completeness was reconciled to each entity’s ledger before testing.
Appendix C · Regulatory mapping
One control, four rulebooks
Each control area traced from the EU directive, through each national law, to the AMLR article that replaces them on 10 July 2027 and the FATF standard.
| Control area | AMLD4/5 | IRELAND CJA 2010 | BULGARIA ZMIP | AMLR | FATF |
|---|---|---|---|---|---|
| 01 Governance | Arts. 8(4)–(5), 46(4) | s.54; PCF-52 | Arts. 106, 108 | Arts. 9, 11 | R.18 |
| 02 Risk assessment | Art. 8(1)–(2) | s.30A | Arts. 95–98 | Art. 10 | R.1 |
| 03 Policies | Art. 8(3)–(5) | s.54(1)–(5) | Arts. 101–102 | Art. 9 | R.18 |
| 04 CDD, EDD, UBO | Arts. 11, 13–14, 18–23, 30 | ss.33, 37, 38A, 39; S.I. 110/2019 | Arts. 10–11, 35–46a, 63a | Arts. 19–25, 29–35, 42–46, 51–53 | R.10, 12, 19, 24 |
| 05 Ongoing monitoring | Arts. 13(1)(d), 14(5) | s.35(3) | Arts. 10, 101(2) | Arts. 20, 26 | R.10 |
| 06 Transaction monitoring | Arts. 13(1)(d), 18(2) | ss.35(3), 39 | Arts. 10, 35 | Arts. 26, 69(2) | R.10, 20 |
| 07 Sanctions & TFS | EU restrictive-measures regulations | EU regulations apply directly | ZMFT Arts. 3, 4b | Arts. 9(1)(b), 27 | R.6, 7 |
| 08 Travel rule | Reg. (EU) 2023/1113 | TFR; MiCA Art. 60(4) | TFR; Art. 20a | Arts. 37, 40 | R.15, 16 |
| 09 STR | Arts. 33, 35, 39 | ss.42, 49 | Arts. 72–74, 80 | Arts. 69, 71, 73 | R.20, 21 |
| 10 Token issuance | Arts. 11, 13 | ss.33, 35(3); MiCA Title IV | - | Arts. 19–20, 26 | R.15 |
| 11 Records, training, outsourcing | Arts. 40, 46(1) | ss.54(6), 55 | Art. 67 | Arts. 12, 18, 77 | R.11, 18 |
| Group arrangements | Arts. 39(3), 45 | ss.49–53 (tipping off) | Art. 80(3) | Art. 16 | R.18 |
Lineage
AMLD3 (2005/60/EC) → AMLD4 (2015/849) → AMLD5 (2018/843) → AMLR (2024/1624) + AMLD6 (2024/1640). Directive (EU) 2018/1673, often called “6AMLD”, is the separate criminal-law directive on predicate offences.
Sources
Official Journal texts; revised Criminal Justice Act 2010 (Law Reform Commission); ZMIP consolidated to SG 51/2026; EBA Guidelines; Central Bank of Ireland guidance; FATF Recommendations; AMLA final draft RTS (30 September 2026).
Appendix D · Team, evidence & independence
Who did the work
| Role | Experience | Focus |
|---|---|---|
| Engagement Director | 15+ years · senior AML practitioner | Opinions and sign-off |
| Lead Auditor - Ireland | 12+ years · certified AML professional | Ireland PaymentsCo Ltd. |
| Lead Auditor - Bulgaria | 12+ years · certified AML professional | BG Exchange Ltd. |
| Senior Auditor - Monitoring & Data | 8+ years | Shared platform, analytics, lookback |
| Senior Auditor - Crypto-assets & Sanctions | 8+ years | Blockchain analytics, travel rule, screening test |
| Engagement Quality Reviewer | 15+ years · independent of fieldwork | Pre-issue review |
Interviews (14)
- Parent
- Group CEO; Group Head of Financial Crime; Group CTO; Group DPO
- Ireland
- Chief Executive; Head of AML & CTF Compliance; AML analyst; Head of Onboarding; Head of Payments & Token Operations
- Bulgaria
- Executive Director (AML); Head of AML; Blockchain analytics lead; HR & Training Lead; Chief Risk Officer
Independence & objectivity
- No first- or second-line services, outsourced compliance roles or framework design for any group company in the 24 months before or during the engagement.
- Harmonisation support, if requested, delivered by a separate team; the next audit by a team not involved in it.
- No financial interest in the group; fees fixed and not contingent on findings.
- Drafts reviewed by management for factual accuracy only; ratings were not changed.
- Full access to systems, records and staff in Zug, Dublin and Sofia; no scope limitation.
Glossary
- AMLA
- EU Anti-Money Laundering Authority
- AMLR
- Regulation (EU) 2024/1624
- BWRA
- Business-wide risk assessment
- CASP
- Crypto-asset service provider
- CBI
- Central Bank of Ireland
- CJA 2010
- Criminal Justice (ML & TF) Act 2010
- EMI / EMT
- E-money institution / e-money token
- FSC
- Bulgarian Financial Supervision Commission
- FID-DANS
- Bulgarian FIU (State Agency for National Security)
- goAML / ROS
- FIU Ireland and Revenue filing systems
- MiCA
- Regulation (EU) 2023/1114
- PCF-52
- Irish pre-approved role: Head of AML & CTF
- RBO
- Irish Register of Beneficial Ownership
- RMEA
- Restrictive-measures exposure assessment
- STR
- Suspicious transaction report
- ZMIP / ZMFT
- Bulgarian AML Act / TF and PF Measures Act
Thank you
Talk to our audit team
Independent AML audit · AskRegulations
- Meeting
- Book a 30-minute call
- Web
- askregulations.com
Independent AML audit by AskRegulations
- Single-entity and group audits - EMIs, CASPs and stablecoin issuers
- Mapped to national law, AMLD4/5, the AMLR and FATF
- Full-population analytics, scenario replay and synthetic screening tests
- Reports written for boards, supervisors and banking partners
- EU and UAE based · fintech, payments, crypto and regulated gaming
Official partner of the International Compliance Association (ICA) for Bulgaria and the Balkan region.
By enhancing transparency and fostering trust, we build a safer financial future for all.
Sample report. Group Holding Ltd., Ireland PaymentsCo Ltd. and BG Exchange Ltd. are fictitious; all names, data, findings and responses are illustrative. Regulatory references are current as at 6 November 2026. © 2026 AskRegulations.
Disclaimer
Sample report · fictitious entities
This is a sample report published by AskRegulations for illustration only. Group Holding Ltd., Ireland PaymentsCo Ltd. and BG Exchange Ltd., and all data, findings and responses in it, are fictitious; any resemblance to an actual company or person is coincidental. It is not an audit, an opinion, or legal, regulatory or other professional advice, and it does not create a client relationship with AskRegulations. Regulatory references reflect our understanding as at 6 November 2026, may have changed since, and should be checked against the official texts before being relied on. The report is provided “as is”, without any warranty of accuracy or completeness. To the fullest extent permitted by law, AskRegulations, its affiliates and their staff accept no liability for any use of or reliance on this document; nothing in this disclaimer limits any liability that cannot be limited by law. AskRegulations provides independent AML/CFT audits only under a signed engagement letter, whose terms alone govern scope, reliance and liability. This document may not be reproduced, modified or distributed without our written consent. This disclaimer is governed by Bulgarian law.
01 / Contact
Tell us what you need.
Want an independent audit like this for your firm or group? Tell us about your entities and jurisdictions, and we will propose a scope.