AML audit as a tool to protect the director

Nikita Veremeev

28.12.2025 | 6 min read

Updated: 28.12.2025

I’m often asked: is it possible to build an international business so that the director doesn’t wake up at night worrying about fines for AML/CFT violations and AML compliance?

Over the years of working at COREDO: from the EU and the United Kingdom to Singapore and Dubai, I have observed one pattern: where a director truly understands how an AML compliance audit works and how it protects him personally, the business scales faster, banks and investors are more willing to join the project, and regulators see the company as a partner rather than a potential source of problems.

In this article I’ll break it down:

• how an AML audit minimizes the director’s AML liability;
• when and for whom an external AML audit is needed in the EU and Asia;
• how to calculate the ROI of outsourced AML audit;
• which weaknesses the audit most often uncovers and how to turn them into a strategic advantage;
• how to use the results of an AML program evaluation in dialogue with banks and investors.

AML audit: protection for the director

Legally, in many jurisdictions in Europe, Asia and the CIS it is the director and the board of directors who bear ultimate responsibility for AML/CFT violations:

• incorrect AML risk assessment;
• absence or mere formality of internal AML controls;
• ignoring requirements for customer due diligence (CDD) and the UBO verification process;
• weak transaction monitoring AML;
• violations in sanctions-list screening and handling of PEPs.

In practice, the regulator, the bank or law enforcement authorities look at three things:

1. Whether an AML program was formalized and approved (policies, procedures, internal AML/CFT control rules).
2. Whether it was regularly reviewed through an AML compliance audit (internal or independent).
3. Whether the director responded to the results: did the director approve a plan of remedial actions and oversee its implementation.

If these three points are documented, the director gains real protection:

• you can demonstrate good faith and deliberate risk management;
• there are arguments to reduce fines and mitigate sanctions;
• the regulator has fewer grounds to allege personal negligence.

What tasks does an AML audit solve for a business and its director?

In essence, an AML audit of the business answers several key questions for the director:

• How well does our current AML program comply with regulatory requirements (5MLD in the EU, BSA in the USA, local laws in Singapore, Dubai, Estonia, Cyprus, etc.)?
• Are our internal AML controls working in practice, or does everything rest on a single compliance officer?
• What scenarios could lead to regulatory fines, account freezes, sanctions, or banks refusing service?
• What needs to be changed within realistic timeframes so that I, as the director, can confidently sign reports and answer to shareholders and investors?

At COREDO, the team usually focuses on four areas:

1. AML audit policies and procedures
   • compliance with local and international standards (5MLD, FATF, BSA, CFT measures);
   • the structure of internal AML/CFT control rules;
   • documented roles and responsibilities: director, compliance officer, BSA officer, operations teams.
2. Audit of AML control systems and processes
   • how KYC / CDD and KYC enhancement actually work for high-risk clients;
   • the quality of AML UBO audit and the UBO verification process;
   • AML audit of PEP and sanctions screening: tools, frequency, documentation of results;
   • parameters of transaction monitoring systems and responses to alerts.
3. Evaluation of AML program effectiveness (AML program evaluation)
   • how well the risk-based approach is implemented in AML, not just described;
   • the correctness of AML risk assessment by countries, products, and client segments;
   • AML staff training, knowledge testing, rotation of responsibilities.
4. Protecting the director and reducing liability
   • documenting that the director approved the AML policy, received reports, requested adjustments;
   • board of directors reporting protocols on AML/CFT issues;
   • building an evidence base for mitigating regulatory fines.

Independent AML audit: when is it mandatory?

In a number of EU and Asian countries, for certain categories of businesses an independent AML audit (external) is either required by law or strongly expected by regulators and banks.

Most often this applies to:

• banks and licensed payment institutions;
• virtual asset providers (crypto licenses, VASP);
• forex brokers and investment companies;
• licensed fintech providers;
• related entities in jurisdictions of the EU, the United Kingdom, Singapore, Dubai, Cyprus, and Estonia.

A separate group of cases that the COREDO team regularly works with:

• rapid growth of the customer base and expansion into new countries (scaling the business in the CIS, Asia, Africa);
• banks’ compliance requirements when opening or reviewing accounts;
• requests from investors or funds for investor Due Diligence AML before a funding round or an M&A transaction
• preparation for a thematic regulatory inspection or a response to comments already received.

In such situations an external AML audit serves as:

• independent confirmation that the director sees and manages risks;
• a tool to protect the director from AML fines: you have a report from an independent expert with a date, findings, and a plan of remedial actions;
• an argument in negotiations with banks and investors: the audit shows the maturity level of the system, not just a polished presentation.

How an AML audit reduces a director’s risk

If you imagine a typical company with a financial license in the EU or Asia, the director’s path to reducing risks through an audit looks like this:

1. Proactive AML audit (proactive audit)

   The director does not wait for a regulator’s visit and commissions a proactive AML audit themselves.

   • defines objectives: business protection, AML, reduction of personal liability, preparation for licensing/scaling;
   • determines the scope: a full audit or, for example, a focus on CDD, UBO and PEP in high-risk regions.
2. Diagnosis and gap analysis
   At COREDO we start with the current state:
   • analysis of the existing AML policy;
   • interviews with the compliance officer and operational teams;
   • selective review of client files (AML audit of CDD, UBO, PEP);
   • review of transactions from the perspective of AML/CFT and sanctions.
3. Identification of risks to the director
   We always dedicate a separate section in the report specifically to the director’s AML responsibility:
   • in which areas there is a high risk of claims against the director for lack of control;
   • which processes pose a threat to personal liability, not just to the company;
   • what gaps exist in board reporting and risk management documentation.
4. Corrective action plan (remedial actions)

   At this stage many COREDO clients see where the audit turns into practical protection:

   • a clear list of tasks: what needs to be changed in CDD, UBO verification, PEP screening, monitoring;
   • prioritization: which measures are critical to reduce the director’s personal risks within the coming months;
   • allocation of responsibility: who is responsible for implementation, how they report to the director regularly.
5. Formalization of the director’s and the board’s role

   To protect the director, it is important that decisions are not only made but also formalized:

   • minutes of meetings where the director approves the AML policy and the remedial actions plan;
   • regular board of directors reporting on AML/CFT;
   • compliance officer KPIs related to AML.
6. Follow-up AML audit and scaling

   In 6–12 months it makes sense to conduct a follow-up AML program evaluation:

   • check how the implemented measures are working;
   • adjust the AML risk-based approach taking into account new countries, products, PEPs and transactions;
   • prepare an updated package for banks, regulators and investors.

COREDO Case Studies: How Audit Protects

Case studies from COREDO’s practice: how audit truly protects — real client stories in which an independent review became not a «paper obligation», but a tool of legal and financial protection. Through concrete examples you will see how a properly conducted audit prevents sanctions, lowers risks for directors, and protects businesses in challenging situations.

Protecting the director of an EU payment company from sanctions

Client: a licensed payment services provider in the EU with plans to expand into Asia. Growth of operations, geographic expansion, emergence of clients from countries with elevated AML/CFT risk.

Problem: the correspondent bank requested detailed information on AML compliance, hinting at possible limit restrictions. The director understood that any incident would lead to questions directed at him personally.

Solution developed by COREDO:

• an independent AML compliance audit focusing on:
  • UBO AML audit for complex corporate structures;
  • PEP AML audit for clients from CIS countries and Asia;
  • review of transaction monitoring systems settings and sanctions filters;
• revision of the AML risk-based approach taking into account the planned expansion into new markets;
• updating internal AML/CFT control rules and redistributing responsibilities among the director, compliance officer, and BSA officer.

Crypto company in Asia: AML and UBO/PEP checks

Client: a crypto platform licensed in an Asian jurisdiction, targeting clients from Europe, Asia, and Africa.

Main challenges:

• complex UBO structures in African jurisdictions;
• a high proportion of PEPs among clients;
• regulatory requirements for regular CFT audits (countering the financing of terrorism).

The COREDO team implemented the following approach:

• a full AML audit for directors with a focus on personal liability and risk areas;
• AML CDD audit for clients from Africa and the CIS: in-depth verification of sources of funds, business models, and ownership structure;
• configuration of PEP screening tools and sanctions screening procedures to meet regulatory expectations;
• preparation of an updated AML/CFT policy taking a risk-based approach to clients from specific countries.

For the director, we additionally:

• compiled a package of documents demonstrating his involvement in approving and overseeing the AML program;
• developed a periodic board reporting framework for key AML KPIs;
• outlined a communication scenario with the regulator in the event of any incident.

ROI from AML audit and outsourcing

Many executives ask a direct question: how to calculate the ROI from conducting an AML audit for the business and from AML audit outsourcing?

1. Reducing direct regulatory risks
   • fines, sanctions, license restrictions;
   • temporary suspension of operations, account freezes;
   • costly remedial programs under strict regulatory supervision.
2. Access to banks and financial infrastructure
   • simplified KYC procedures by banks when you already have a recent AML audit report;
   • increased limits and expanded product range;
   • reduced likelihood of unexpected de-risking decisions by correspondent banks.
3. Investor and partner confidence
   • AML audit as proof to banks and investors of the maturity of corporate governance;
   • passing investor AML due diligence without protracted delays and contentious issues;
   • higher business valuation in deals: sustainable AML compliance, this is a protected cash flow.
4. Internal impact and scaling
   • reduction of operational losses due to errors in CDD, UBO and PEP checks;
   • optimization of the compliance team’s work and transaction monitoring IT systems;
   • ability to enter new countries and segments painlessly, including the CIS, with controlled AML/CFT and PEP risks.

COREDO’s practice shows: a properly structured AML audit pays off not only by avoiding fines, but also by providing access to more favorable banking, investment and partnership opportunities.

Weaknesses of an AML Program in an Audit

1. Formal AML risk assessment
   • risk assessments are not linked to actual countries, products, and channels;
   • the risk-based approach is declared but not implemented in CDD and monitoring procedures.
2. Insufficient depth of CDD and KYC enhancements
   • superficial verification of source of funds and wealth;
   • lack of a clear process for enhanced due diligence on higher-risk clients.
3. UBO verification process lacking sufficient checks
   • complex ownership chains are formally described but not verified down to the real ultimate beneficial owner;
   • weak AML auditing of UBOs for structures involving offshore or high-risk jurisdictions.
4. PEP screening and sanctions
   • outdated or unadapted PEP screening tools;
   • sanctions screening does not cover secondary sanctions and local lists;
   • incorrect classification of PEPs and their connections, lack of enhanced monitoring.
5. Internal AML controls and operational execution
   • there are regulations, but employees act on their own;
   • AML training for employees is conducted irregularly or only “for the record”;
   • weak link between alerts from the monitoring system and real managerial decisions.
6. Reporting to regulators and board reporting
   • unsystematic approach to reporting: the director receives fragments of information instead of a holistic picture;
   • insufficient documentation of AML/CFT decisions at the board of directors level.

How to use AML audit results

A strong competitive advantage comes not simply from having the report, but from the ability to properly integrate it into corporate governance.

What I recommend directors focus on:

• Integration into corporate governance
  • include the key audit findings on the board’s regular agenda;
  • link top management KPIs to the implementation of the remedial actions plan;
  • use the audit as a basis for updating the company’s risk appetite.
• Communication with banks
  • provide banks with excerpts from the audit as part of the company’s dossier;
  • show how you are implementing the recommendations, especially regarding CDD, UBO and sanctions;
  • update the information when there are material changes in the business model.
• Working with investors and partners
  • demonstrate that you treat AML/CFT as part of strategic management, not merely a legal burden;
  • use the report as part of the data room in M&A transactions or when raising capital.
• Scaling across the CIS, Asia and Africa
  • adapt a risk-based AML approach to account for PEP risks and weak state control systems in particular jurisdictions;
  • implement uniform CDD, UBO and PEP control standards across all subsidiaries;
  • synchronize local AML/CFT requirements with the group AML policy.

Where should a director start an AML audit?

If simplified to concrete steps, the recommendation for the director is as follows:

1. Define the objective: protecting the director, preparing for licensing, scaling, requests from a bank/investor.
2. Order a proactive AML audit externally if you need an independent perspective and credibility with regulators and partners.
3. Ensure the report includes:
   • a clear picture of AML/CFT and sanctions risks;
   • emphasis specifically on the director’s AML responsibilities;
   • a practical, prioritized plan of remedial actions.
4. Formalize decisions at the board level and establish accountability.
5. Schedule a follow-up audit in 6–12 months.

Conclusion: how to turn upsells into systematic profit growth

If you sum up the whole guide, it becomes clear: increasing the average order value is not a single “magic” tool, but a system of interrelated mechanics, each of which amplifies the others. Upsell, cross-sell, bundles, minimum order amount, loyalty program, AI recommendations and work on the checkout path deliver maximum effect only when combined, not individually.

Sustained AOV growth starts when:

• upsells are integrated into the user journey from the product page to checkout;
• each offer is based on data (behavior, segment, LTV), not intuition;
• all hypotheses are tested via A/B tests and control groups;
• ROI is calculated not by feel, but by a formula that takes margin and the customer lifecycle into account.

How to start right now

If you turn this material into concrete steps, I recommend the following sequence:

1. Record the current AOV, CR and LTV — this is your baseline.
2. Launch one mechanic with the maximum potential (an upsell in the cart or bundles).
3. Set up an A/B test and a control group.
4. Scale only after a confirmed incremental effect.
5. Add AI recommendations and loyalty programs once the basic mechanics are already delivering results.

The goal — growth in net profit and LTV, not pretty numbers in the report.

If you want to understand, which exact upsell and cross-sell mechanics will deliver the maximum ROI in your store, start with an audit of the checkout path and order structure. In most projects it’s already visible at this stage where the “low-cost” +20% to AOV are — without risk and without complex implementations.