AML Audit

An AML audit is an examination of a financial institution's anti-money laundering (AML) controls by people who did not design or run them. It checks whether the AML program matches the firm's risks, whether staff follow it, and whether it actually catches and reports suspicious activity. Banks, money transmitters, crypto exchanges, broker-dealers, casinos and other obliged entities commission AML audits, and supervisors read the reports.

In US law the formal requirement is called "independent testing", and the specific review that satisfies it is described in the entry Independent AML Review. "AML audit" is the broader everyday term: it covers that annual or periodic test, internal-audit reviews of financial-crime controls, and targeted audits after a problem, and it is distinct from an examination by a regulator, which assesses the firm from outside.

Many countries make cars pass a regular roadworthiness test. The owner may service the car carefully, but an outside mechanic still checks the brakes, lights and tyres against a set list and writes down anything that fails. The certificate means something because the tester did not do the servicing.

An AML audit is that roadworthiness test for a firm's defences against dirty money. The auditor picks real customer files and payments, checks whether the right questions were asked and the right alerts were raised, and reports what is broken so it can be fixed before a regulator or a criminal finds the gap.

• United States. The Bank Secrecy Act (BSA) program rules list independent testing as one of the core program pillars for banks. For a money services business, 31 CFR 1022.210 requires an independent review whose scope and frequency match the risk of the services offered; it may be performed by an employee, provided that person is not the designated compliance officer.
• United Kingdom. Regulation 21 of the Money Laundering Regulations 2017 requires an independent audit function, where appropriate to the size and nature of the business, to examine and evaluate the firm's AML policies, controls and procedures.
• International standards. FATF Recommendation 18 expects financial groups to maintain an independent audit function to test their AML/CFT programs, following the risk-based approach.

Large banks usually use their internal audit department, the third of the "three lines" in governance models, sometimes supported by specialists. Smaller banks, fintechs and money transmitters typically hire an outside firm or an experienced consultant. What matters is independence and competence: the auditor must not report to the AML compliance officer whose work is being tested, and should understand payment flows, transaction monitoring systems and the relevant law. Audits are separate from supervisory work such as state money transmitter examinations or an IRS Title 31 audit, although examiners rely heavily on the audit reports. The audit's results also feed the firm's wider compliance management system, alongside second-line compliance testing and the compliance risk assessment.

1. Planning. The auditor reads the AML risk assessment, prior findings and recent business changes, and focuses on the highest-risk areas.
2. Walkthroughs. Staff demonstrate key processes such as onboarding, alert handling and SAR decisions.
3. Sample testing. Files are selected and checked against policy: customer due diligence and enhanced due diligence, sanctions screening results, alert closures, CTR filings and SAR timeliness.
4. Systems review. The auditor checks that data feeds into monitoring and screening are complete and that scenarios and thresholds were tuned with evidence.
5. Governance review. Training records, board reporting, staffing levels and the status of earlier findings are examined.
6. Reporting. Findings are rated, management responses and deadlines are agreed, and the report goes to senior management and the board or audit committee.

US rules set no fixed interval. The FFIEC BSA/AML Examination Manual says the frequency of independent testing should be commensurate with the bank's risk profile and overall risk management strategy; earlier editions described testing generally every 12 to 18 months as a sound practice, and annual testing remains common for higher-risk institutions. Sponsor banks often require their fintech partners and agents to provide an annual audit report as a contract condition.

Typical findings include outdated risk assessments, incomplete customer files, backlogs of unreviewed alerts, late SARs and other regulatory reporting failures, monitoring rules that miss key products, and gaps in recordkeeping requirements. Each finding needs an owner, a remediation plan and evidence of closure, which the next audit verifies. Unresolved or repeat findings are a warning sign to supervisors and frequently appear in enforcement actions. An audit is only as useful as its follow-up: a clean report on a narrow scope can give false comfort, so boards should ask what was not tested as well as what passed.

• The Money Laundering Regulations 2017, regulation 21 (legislation.gov.uk)
• FinCEN: Guidance