{"id":10668,"date":"2025-11-04T00:34:00","date_gmt":"2025-11-04T00:34:00","guid":{"rendered":"https:\/\/www.amlcc.com\/?p=10668"},"modified":"2026-08-20T11:07:35","modified_gmt":"2026-08-20T11:07:35","slug":"what-to-expect-during-an-aml-review","status":"publish","type":"post","link":"https:\/\/www.amlcc.com\/bb\/what-to-expect-during-an-aml-review\/","title":{"rendered":"What to expect during an AML review"},"content":{"rendered":"\n

What to expect during an AML review<\/h1>\n\n\n
\"Lisa<\/div>
Lisa Simms<\/span>

Director and Founder of AMLCC and AMLCC Consult<\/h3><\/div><\/div><\/div><\/div>\n\n\n
\"What<\/figure><\/div><\/div>\n\n\n\n
\n
\n

If you’re regulated for anti-money laundering (AML) purposes, you should expect a compliance review at some point. <\/p>\n\n\n\n

Whether it’s carried out by a government body or your professional supervisor, the purpose is the same: to assess whether your business is meeting its AML obligations, built from the international standards FATF<\/a> sets and written into your country’s own law.<\/p>\n\n\n\n

That might sound daunting but it doesn’t need to be. Knowing what reviewers look for, and having the right evidence ready, makes the process far smoother.<\/p>\n\n\n\n

Who carries out AML reviews<\/strong><\/h2>\n\n\n\n

Every country that implements FATF’s standards needs to designate at least one supervisor responsible for checking that AML-regulated businesses are meeting their obligations. <\/p>\n\n\n\n

FATF\u2019s Recommendation 28 sets out that designated non-financial businesses and professions (DNFBPs) need to be subject to effective systems for monitoring and ensuring compliance. This can be by a dedicated regulator, a professional body or another competent authority.<\/p>\n\n\n\n

How many bodies do this, and what they’re called, varies by country. Some have a single regulator covering every sector. Others split supervision across multiple professional bodies and government departments, coordinated by a central oversight function.<\/p>\n\n\n\n

How the review process works<\/h2>\n\n\n\n

You’ll likely to be asked to provide a list of documents and may be invited to grant read-only access to your AML system (for AMLCC users, this takes seconds). Depending on your supervisor, the review may be:<\/p>\n\n\n\n

Remote, where evidence is reviewed digitally and discussed over calls<\/p>\n\n\n\n

On-site, where the reviewer visits your office to interview staff and examine files<\/p>\n\n\n\n

They’ll typically:<\/p>\n\n\n\n

    \n
  1. Request your key AML documents, including your current and historic\u00a0Business Risk Assessments<\/a>,\u00a0AML Policies, Controls and Procedures<\/a>\u00a0(PCPs), training logs and sample client files.<\/li>\n\n\n\n
  2. Interview key people, usually your\u00a0Money Laundering Reporting Officer<\/a>\u00a0(MLRO) or Money Laundering Compliance Officer (MLCO), and sometimes front-line staff.<\/li>\n\n\n\n
  3. Test compliance in practice, to check whether what’s written in your policies is actually followed day-to-day.<\/li>\n\n\n\n
  4. Provide feedback or an action plan, setting out areas for improvement or follow-up.<\/li>\n<\/ol>\n\n\n\n

    What reviewers will look for<\/strong><\/h2>\n\n\n\n

    A review focuses on two broad areas: your AML framework and evidence that it works effectively. <\/p>\n\n\n\n

    Supervisors\u00a0no longer just look at whether your AML documentation\u00a0exists. The question now is can your business show it understands the inherent risk<\/a>, acts proportionately and has reduced that risk as a result?<\/p>\n\n\n\n

    1. Your business framework: policies, risk assessments and controls<\/strong><\/h3>\n\n\n\n

    Reviewers will assess whether your AML documentation meets the requirements set out in FATF’s Recommendation 18, as implemented in your country’s law. They’ll look for:<\/p>\n\n\n\n