Is Your AML Programme Inspection-Ready? A Practical Checklist
Rajesh Kumar
An AML programme is inspection-ready when you can show, quickly and with evidence, that it is designed around your risks and that it operates in practice. Check eight areas: governance, risk assessment, policies, customer due diligence, screening and monitoring, reporting, training and records. For each one, apply the one-hour test: if a reviewer asked for the evidence, could you produce it within an hour?
Key takeaways
- Reviewers test evidence, not intentions. A policy you cannot show is being followed carries little weight.
- Apply the one-hour test to every area: can you produce the proof quickly and in an orderly way?
- Sample your own files regularly. Reviewers pick their own, so find the problems first.
- Most findings are not exotic. They are out-of-date assessments, thin customer files and undocumented decisions.
- A 30-day focused effort closes most of the gaps that matter before an inspection.
What inspections and independent reviews look at
Supervisors and independent reviewers generally work in the same three ways. They read your documents, they test a sample of your customer files, alerts and decisions, and they talk to your people. Inspections may be planned or may come at short notice, and they may look at the whole programme or at one theme. The exact approach differs between supervisors and sectors, so read the guidance that applies to your licence. The preparation below works whichever it is.
The consistent feature is that reviewers want evidence that the programme works in practice. A well-written manual is a starting point. What persuades is a customer file that shows the checks were done, a screening alert that was cleared with a reason, a suspicious activity concern that was escalated and decided, and staff who can explain what they would do.
The one-hour test
For each area below, ask yourself a simple question. If a reviewer asked for the evidence today, could you put it in front of them within an hour, in an orderly state? If the answer is no, you have found a gap that is worth closing, even if the underlying work was done. Evidence that exists but cannot be found counts for little on the day.
The checklist: eight areas and the evidence to hold
1. Governance
- A named Compliance Officer or MLRO, with the supervisor's approval where it is required, and a named deputy.
- A clear description of the role, its authority and its reporting line to the board.
- Regular written reporting to management or the board, and minutes showing it was discussed.
- Where the role is outsourced, the written agreement, the scope and evidence that you monitor the arrangement.
2. Business risk assessment
- A current, approved business risk assessment based on your own data.
- Evidence it was reviewed when the business changed.
- An action plan with owners and dates, and proof the actions were completed.
- A visible link between its findings and your procedures.
3. Policies and procedures
- Written policies and procedures that match what your staff actually do.
- A version history, an approval record and a review date.
- Role-specific instructions, such as an onboarding checklist and an escalation route.
- Evidence that staff know where to find them.
4. Customer due diligence
- Complete files for individuals and companies: identity, purpose of relationship, source of funds where relevant and the people behind each legal entity.
- Evidence of beneficial ownership checks that go to the natural persons, not only to the first corporate layer.
- A risk rating for each customer with the reasons, and enhanced measures for higher-risk ones, including senior approval.
- Ongoing review dates that are actually met.
5. Screening and monitoring
- Evidence that customers, owners and counterparties are screened against the lists you are required to use, at onboarding and afterwards.
- Every alert cleared or escalated with a recorded reason, a name and a date.
- A method for re-screening when lists change, and proof it runs.
- Monitoring rules suited to your business, tested and adjusted, with a record of how alerts were reviewed.
6. Reporting
- Registration on the FIU's goAML platform and current users.
- An internal reporting form and a log of concerns, decisions and reports filed.
- Reasons recorded for decisions not to file.
- Evidence of prompt reporting, and of responses to follow-up requests.
7. Training
- A training plan covering all staff, with deeper content for roles such as onboarding, sales and the compliance team.
- Attendance records, dates, content and, where used, test results.
- Evidence that new joiners are trained promptly.
- Examples of content that reflects your actual business, not only generic material.
8. Records and data
- A retention schedule that meets the period your supervisor requires.
- Secure storage, and the ability to retrieve a customer file, a screening result or a report quickly.
- Clear ownership of each record type.
- A documented approach to data accuracy, so that what you hold is up to date.
How reviewers sample, and how to do it first
Reviewers rarely accept a list you have chosen. They select customers, alerts and decisions themselves, often weighted towards higher-risk ones, and they follow each from beginning to end. They check dates, consistency and reasoning. They ask whether what is written in the file matches what happened.
You can copy the method. Each month, pick a handful of files: one from each of your risk levels, one introduced customer, one that has been open a long time and one onboarded recently. Walk each through the full process. Was the identity evidence complete and in date? Were owners identified? Was the rating justified? Was screening done and recorded? Was periodic review on time? Write down the gaps, fix them and keep the log. A log showing you found and fixed your own problems is itself good evidence.
Interviews: prepare your people
Reviewers speak to staff as well as managers. They ask practical questions: what would you do if a customer refused to say who owns the company, if a screening alert looked like a possible match, if a colleague asked you to speed up an onboarding or if a customer behaved oddly with cash. Staff who answer confidently, and in line with the procedure, show that training works. Staff who say they would ask someone else, without knowing whom, show the opposite.
Run short, informal practice sessions. Use realistic scenarios from your own business. Make sure everyone knows who the compliance officer is, how to reach them and that they will never be penalised for raising a concern.
Findings that recur
Reviews turn up many of the same issues, and that is useful because it means they can be prevented. The most common ones tend to be the following.
- A business risk assessment that is out of date or not tied to your data.
- Customer files with missing or expired documents and incomplete beneficial ownership evidence.
- Screening that happens but is not recorded, or alerts closed without reasons.
- Decisions about suspicious activity that are not written down.
- Training that is generic, infrequent or not tracked.
- A compliance officer without enough time, authority or independence.
- Outsourced services that nobody monitors.
- Procedures that describe a process that is not actually followed.
A 30-day plan to close the gaps
- Week one: scope and baseline. Walk through the eight areas and mark each green, amber or red using the one-hour test. Appoint an owner for every amber and red item.
- Week two: fix the foundations. Update the business risk assessment if it is stale, confirm governance and approvals and make sure registration and users on the FIU platform are current.
- Week three: repair the files. Sample customer files, close the obvious gaps, collect missing documents and record ratings with reasons. Review a month of screening alerts and make sure each has a recorded outcome.
- Week four: people and proof. Run training or refresher sessions, practise interview scenarios and assemble an evidence folder organised by area so that anything can be produced quickly.
Self-assessment or independent review?
A self-assessment, done honestly, is valuable and costs little. Its weakness is that people tend to rate their own work generously and miss what they have become used to. An independent review by someone who did not design or run the programme gives a fresh view, tests the evidence rather than the intentions and gives you a record that you asked the hard question yourself. Many firms do a self-assessment each quarter and bring in an independent reviewer once a year or ahead of a known inspection. Independence matters: the reviewer should not be the person who runs your day-to-day compliance.
Where Adventant fits
Adventant carries out independent AML reviews and audits and provides inspection support and remediation that test your programme against the areas above and give you a ranked list of findings with practical fixes. We can also help close the gaps afterwards, from policies and procedures to customer due diligence and staff training. Use the form below to start a conversation. This article is general information, not legal advice.
Frequently asked questions
What do AML inspectors usually ask for first?
Practices differ between supervisors, but the business risk assessment, the policies and procedures, evidence of governance and a sample of customer files are common starting points. Have your evidence organised so that you can produce it quickly.
How much notice will I get?
It varies. Some reviews are announced in advance and some come at short notice. The safest approach is to stay ready all the time, using regular self-checks rather than a last-minute scramble.
What is the most common weakness?
Missing or thin evidence. Work is often done but not recorded, so the firm cannot show it. Customer files with gaps, screening outcomes without reasons and undocumented decisions on suspicions appear regularly.
Should staff be interviewed during a review?
Reviewers often speak to staff as well as managers. Practise realistic scenarios so people know what to do and whom to ask, and so they feel able to raise concerns.
Is an independent review required?
Requirements depend on your sector and supervisor, so check the guidance that applies to you. Even where it is not required, an independent review is a sensible way to test whether the programme works and to prepare for supervisory attention.