An independent AML review, also called independent testing or an independent AML audit, is a periodic examination of a firm's anti-money laundering and counter-terrorist financing program by a person or team that is not responsible for designing or operating it. Its purpose is to test whether the program is appropriate for the firm's risks, complies with the law, and actually works in day-to-day operation, and to report weaknesses to senior management and the board.
In the United States, independent testing is a mandatory element of every AML program required under the Bank Secrecy Act. In the United Kingdom and the European Union, an independent audit function is required where it is appropriate given the size and nature of the business. Regulators in most other jurisdictions expect some form of independent assessment as well.
Legal requirements
United States
Rules issued by FinCEN under the Bank Secrecy Act require banks, money services businesses, broker-dealers, casinos and other covered institutions to maintain an AML program built on core elements, often called pillars: internal policies, procedures and controls; a designated compliance officer; ongoing training; independent testing; and, since the customer due diligence rule, risk-based customer due diligence. For money services businesses, the rule calls for an independent review to monitor and maintain an adequate program, with its scope and frequency commensurate with the firm's risk. Federal and state examiners, including the IRS in its Title 31 examinations of MSBs, routinely ask for the most recent review and the firm's response to its findings. Many state regulators and bank partners expect a review roughly every 12 to 18 months.
United Kingdom and European Union
The UK's Money Laundering Regulations 2017 require firms, where appropriate with regard to their size and nature, to establish an independent audit function to examine and evaluate the adequacy and effectiveness of their policies, controls and procedures. The Financial Conduct Authority expects larger and higher-risk firms to have one. EU anti-money laundering directives contain a similar requirement, which has been carried into the EU's directly applicable AML Regulation adopted in 2024.
Canada
Under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act and its regulations, reporting entities must review the effectiveness of their compliance program at least every two years, and FINTRAC examines those reviews.
Independence
The reviewer must be independent of the AML function. The review can be performed by the firm's internal audit department, by an outside consultant, or by an independent auditor. It cannot be performed by the MLRO, the BSA officer or staff who report to them, because they would be assessing their own work. Smaller firms often use external reviewers for that reason. The reviewer should report to the board or a committee of it, not only to the compliance officer.
Scope of an independent AML review
A typical review covers:
- the firm's risk assessment and whether it reflects its products, customers, geographies and channels under a risk-based approach;
- policies and procedures, compared with legal requirements and actual practice;
- customer identification, due diligence and enhanced due diligence, tested on a sample of files;
- transaction monitoring rules, alert handling and the quality and timeliness of suspicious activity reports;
- currency transaction reporting, record-keeping and sanctions screening;
- training records, the compliance officer's resources and authority, and the follow-up of previous findings;
- oversight of agents and third parties, where the firm uses them.
Findings and follow-up
The review ends with a written report that rates findings by severity and recommends corrective action. Management records its response, assigns owners and deadlines, and the board tracks remediation. Regulators treat unresolved findings from earlier reviews as a serious weakness, and an inadequate or missing independent review is one of the most commonly cited deficiencies in AML enforcement actions. For payment firms seeking bank accounts or licenses, a recent clean independent review is also a standard item requested by banking partners and regulators during due diligence.