AML Audit: What Is Checked and How to Prepare the Report

A search for "AML audit" or "AML audit for investment companies" almost never comes from abstract interest in compliance. Behind it is usually a specific trigger: a regulator has asked for an independent assessment, a partner bank has made an audit a condition of continuing the relationship, an investor wants the real state of AML controls before a deal, or the board cannot recall when the system was last checked. This article sets those scenarios aside and looks at the tool itself: what an independent AML audit checks, how to prepare for one, and what the final report must contain for a bank, regulator or buyer to accept it.

At COREDO, since 2016 we have carried out independent AML audits and supported their outcomes for EMIs, PSPs, crypto-asset providers, investment firms and corporate companies across the EU. If this is the exact check you need, that is covered by our AML audit service; the rest of this article sets out what the work involves and how to prepare for it.

When does a company need an AML audit

An independent review of the AML system usually becomes relevant in one of six situations. A regulator's request — a scheduled or unscheduled inspection after which the regulator expects independent confirmation that the issues found have been fixed. Onboarding with a bank or payment partner — large banks and PSPs increasingly require an independent AML audit report as part of counterparty due diligence, rather than taking a "working system" presentation on trust. A licence application or renewal — the licensing authority wants more than a policy on paper: confirmation that procedures are applied in practice. A change of beneficial owner — once control changes, banks and regulators typically want a separate review, because the risk profile has formally reset. Due diligence before a business sale — the buyer wants the real state of AML controls before, not after, the deal. A scheduled internal review — even without an external trigger, the system needs periodic independent assessment, because procedures that worked a year ago may have drifted from how the business now operates.

What an independent AML audit checks

An independent AML audit is not a re-read of the policy; it tests whether the system works in practice the way it is described on paper. Whatever the size of the business, the review almost always covers the same set of areas:

• The business-wide risk assessment — whether it is current against actual products, customers, channels and geography; we set out the logic for building such a matrix for an audit in our article on the risk-based approach and the RBA risk matrix.
• Policies and procedures — the AML/KYC policy, CDD/EDD procedures, monitoring and suspicious-activity response: whether they are a document people work by, rather than formal text.
• Governance and the role of the MLRO — whether a responsible person has been designated at management-body level, whether the compliance officer has direct access to the board, and whether the operational compliance function is separate from the independent review.
• CDD/EDD and KYC files — a sample review of customer files: whether the required documents were collected, a risk rating assigned, and enhanced due diligence applied where required.
• Transaction monitoring and alert handling — whether monitoring scenarios are calibrated to the actual risk profile and alerts are closed by clear rules rather than arbitrarily; we go into more detail on this process in our article on case management for AML alerts.
• Sanctions and PEP screening — how current the lists are, how often matches are reviewed, and how false positives are handled.
• STR/SAR reporting to the FIU — whether there is a documented process for deciding "file or not file", and whether filing deadlines are met.
• Staff training — whether it runs regularly rather than once at hiring, and whether completion is documented; what the regulator checks here is covered in our article on AML training for employees.
• Document and record retention — whether retention periods for customer files and transactions are met, and how records are later deleted.
• IT infrastructure and tools — whether the screening and monitoring software covers the actual volume and complexity of operations, or whether the system still relies on spreadsheets and manual reconciliation where volume no longer allows this.

The regulatory basis for this list is not an invention of auditors. The Interpretive Note to FATF Recommendation 18 includes an independent audit function that tests the operation of the internal-control system among the required elements — alongside an ongoing staff training programme. At EU level, Regulation (EU) 2024/1624 (AMLR), Article 9, requires obliged entities to maintain internal policies, procedures and controls, and provides for an independent audit function to test them — a function that may be carried out by an external expert.

How to prepare for an AML audit

The quality of the audit depends directly on how well organised the document and data package is before the work starts. In practice, the minimum preparation package includes:

1. the current business-wide risk assessment, with the date of its last review;
2. the AML/KYC policy and the CDD/EDD, monitoring, alert-handling and STR/SAR filing procedures;
3. documents appointing the MLRO/compliance officer and recording responsibility at management-body level;
4. a sample of customer files (KYC/KYB) for the period under review, including cases of enhanced due diligence;
5. transaction-monitoring and sanctions-screening logs and reports, including the history of alert handling;
6. the register of STR/SAR filed (and considered but not filed), with the reasoning behind each decision;
7. the staff training programme and records for the last cycle;
8. the record-retention policy and evidence that it is actually followed;
9. the report of the previous internal or external audit and the status of its recommendations.

The auditor almost always works with a sample rather than the entire set of operations and customers: a typical approach is to take a random sample and then add a targeted sample of higher risk (new products, large or unusual transactions, high-risk-rated customers). Being ready to supply specific files and logs on request, rather than averaged statistics, speeds the work up. The second essential element of preparation is interviews with key staff: the MLRO, the operational team, and sometimes a management-body member responsible for AML/CFT. The auditor compares what the procedure says with what the people who work by it every day report — this is usually where the gaps between document and practice surface.

What the AML audit report must contain

A report that a bank, a regulator or a business buyer will accept as serious confirmation, rather than a formal piece of paper, usually contains five mandatory blocks. Scope — which legal entities, products, period and areas were included in the review, and what was left out. Methodology — how the sample was drawn, which documents and systems were examined, who was interviewed, and against what standard or set of criteria compliance was assessed. Findings by severity — each deviation classified (for example critical / significant / minor), with a description of the specific fact rather than a general assessment of "broadly fine". Remediation plan — for each finding: who is responsible for fixing it, by what deadline, and what outcome will count as closing the point. Management summary — a separate one-to-two-page section for the board and external recipients of the report, without which it is awkward to show the report to a bank or investor directly.

A report without a remediation plan naming owners and deadlines is not really an audit report but a list of observations — and a missing remediation plan is what most often triggers a repeat review soon after.

Internal or external audit — and which one banks and regulators accept

Formally, what regulators require is independence of the audit function, not necessarily an external one: this follows directly from the logic of FATF Recommendation 18 and Article 9 of the AMLR, both of which describe an independent function that may be performed by an external expert, without making this mandatory. At governance level, the EBA Guidelines on the role of the AML/CFT compliance officer (EBA/GL/2022/05) clearly separate the compliance officer's operational function (the second line of defence) from the independent audit function (the third line) — these are different roles, and the regulator does not expect them to be combined in one person.

In practice, partner banks and investors ahead of a major deal more often want to see an external report: it is easier to trust, because the person doing the work is not assessing their own. Internal audit has its own role — ongoing control between external reviews — but it does not replace an independent external assessment where a counterparty requests one. We cover the difference between the two formats, and when each is chosen in the EU, through our AML audit service; and the model where the audit itself is outsourced, in our article on outsourced AML audit.

Typical AML audit findings

The set of typical findings repeats from company to company with little variation:

• The risk assessment was not updated after a change in products or markets — the document is unchanged since launch, even though the business has long since changed.
• A policy exists, but the process runs differently — staff carry out tasks "as they are used to", not by the documented procedure.
• Board-level responsibility exists only on paper — the designated director does not receive regular AML-risk reports and does not act on them.
• Monitoring and screening thresholds were set once and never revisited, even though the volume and profile of transactions has changed.
• There is no documented reasoning for STR/SAR decisions — particularly where the decision was "do not file".
• Training was delivered once, at hiring, with no repeat cycle and no confirmation that the material was understood.
• Previous audit recommendations were never closed — one of the findings that regulators and banks react to most sharply, because it points to a systemic gap between finding a problem and fixing it, not a one-off mistake.

What to do next

If the system has never had an independent review, or the previous report was never closed out with a remediation plan, the sensible first step is an AML audit: it will show where the document diverges from practice before a bank or regulator sees it. If the audit shows that there is not enough resource to run the AML function operationally, that is covered by AML support and outsourcing. If what's needed is a permanent responsible person with access to the management body, not a full-time position, that role can be covered by an outsourced MLRO. Specific findings on staff training and on the quality of customer files are addressed respectively through AML training and KYC/KYB screening. If the audit shows that, in substance, there is no system yet, it is worth starting with the step-by-step plan in "AML Compliance Implementation: Plan, Documents, Roles and Timelines", and with an example of such a project end to end in the case study "AML System Development from Scratch".

Frequently asked questions

How long does an AML audit take?

No regulatory text sets a single standard for duration — the timeline depends on the size of the business, the number of jurisdictions, and how ready the documents are before the work starts. The data-gathering and analysis stage usually takes longer than the interviews; in our experience at COREDO, the better organised the document package is, the shorter the review cycle.

How does an AML audit differ from an ordinary internal compliance check?

An independent audit tests whether the system works in practice and produces a separate report with findings and a remediation plan for external recipients — a bank, a regulator, an investor. An internal compliance team's ongoing checks are part of day-to-day first- and second-line operational work, not a substitute for the third, independent line.

Can an internal employee carry out an independent AML audit?

No, not if that employee is also responsible for the operational work of the function being reviewed — that contradicts the very idea of independence on which both FATF Recommendation 18 and EBA/GL/2022/05 are built. The audit can be carried out by a separate internal unit with no operational duties in the AML function, or by an external expert.

What does the regulator do with an AML audit report?

It depends on the context in which the report was requested: during a scheduled or unscheduled inspection, the regulator usually checks the audit's findings against its own observations and verifies whether the remediation plan has been closed; for a licence application or renewal, it treats the report as part of the package confirming the system's readiness for supervision.

What if the audit identifies critical findings?

A critical finding does not automatically mean a bank or regulator will refuse to proceed — it means a remediation plan must follow, with a deadline and a named owner, and that the deadline will need to be confirmed in fact, not only on paper. A report without such a plan for critical points is what most often triggers a repeat review soon after.