An AML audit is easy to mistake for a financial audit, and the two answer different questions. A financial audit ends in an opinion on whether the accounts are free of material misstatement. An AML audit tests controls: whether customers were identified, alerts were worked, reports went out on time and the program fits the risks it was written for, measured against the Bank Secrecy Act in the US or the Money Laundering Regulations (MLRs) in the UK.
Nor does every firm have to test once a year. The examination manual US bank examiners work from puts it plainly: "There is no regulatory requirement establishing BSA/AML independent testing frequency." Broker dealers and futures firms do face a fixed minimum, set by their self regulatory organizations. In each case the tester measures the firm against its own written program, which starts with its AML policy.
What does an independent anti money laundering audit test?
For banks, the FFIEC BSA/AML examination manual sets the purpose: assess compliance with the BSA against the bank's risk profile, and judge whether the program as a whole is adequate. The manual, published by the Federal Financial Institutions Examination Council, lists eight areas a test may review:
- Risk assessment, against products, services, customers and geographies.
- Policies, against that risk profile.
- Adherence to those policies.
- Records and reports: the customer identification program (CIP), customer due diligence (CDD) and beneficial ownership, SARs, CTRs and exemptions, information sharing requests.
- Suspicious activity process, from alert to filing.
- Systems: complete and accurate data and processes behind the program.
- Training, tailored to each role.
- Past findings, fixed in time.
For area 5 the manual gives its own example. The tester may take filed SARs and judge their accuracy, timeliness, completeness and fit with the bank's procedures.
In the UK, regulation 21(1)(c) gives the independent audit function three duties: evaluate whether the firm's policies, controls and procedures are adequate and effective, make recommendations, and monitor whether the firm acts on them. From 10 July 2027, Article 9(2)(b) of the European Union's AML Regulation requires an independent audit function to test a firm's policies, procedures and controls, or an external expert where the firm has no such function.
What is a BSA audit?
A BSA audit means the same test under US banking rules. 31 CFR 1020.210 lists "Independent testing for compliance to be conducted by bank personnel or by an outside party" among a bank's minimum program elements, and the OCC's rule for national banks, 12 CFR 21.21(d)(2), sets the same duty. Both rest on the Bank Secrecy Act. Neither rule sets an interval. Examiners judge whether the scope and the frequency fit the bank's risk profile.
Who can conduct an AML audit, and how often?
Internal audit, outside auditors, consultants or other qualified independent parties can perform the test, the FFIEC manual says. A bank without an audit department may use qualified staff "who are not involved in the function being tested", and outside testers should not also deliver the bank's training or write its policies. Whoever tests reports straight to the board or a board committee. Community banks with lower risk may share a tester under the agencies' 2018 interagency statement on sharing BSA resources.
FinCEN's proposed program rule of 10 April 2026 spells independence out further. The AML/CFT officer and anyone who reports to that officer "would generally not be considered sufficiently independent", and a firm's regulators do not count as outside parties. Testing "should be based on objective criteria", and FinCEN expects testers to bring "the expertise and experience necessary".
FINRA already has a rule. Under Rule 3310 and its Supplementary Material .01, three people may not test a broker dealer's program: the person who performs the function being tested, the designated AML compliance person, and anyone who reports to either. So if the AML officer also runs internal audit, someone else has to test.
How often is an AML audit required?
It depends on the regime (Table 1). For banks, the FFIEC manual asks for testing fitted to risk and gives every 12 to 18 months as an example, plus a test when the risk profile, systems, staff or processes change significantly. FINRA and the NFA, the self regulatory organizations (SROs) here, fix a minimum. In the UK, the FCA tells its firms to read the MLRs with its Financial Crime Guide and the Joint Money Laundering Steering Group (JMLSG) guidance.
Table 1. Who must test, how often and who may test, by regime (as of November 2026)
| Regime | Rule | How often | Who may test |
|---|---|---|---|
| US banks | 31 CFR 1020.210; 12 CFR 21.21(d)(2) for OCC banks | No set interval; FFIEC example every 12 to 18 months, or after a significant change | Staff not involved in the function, or an outside party; reports to the board |
| Money services businesses | 31 CFR 1022.210(d)(4) | Scope and frequency commensurate with risk | Staff may review, except the designated compliance officer |
| Loan or finance companies | 31 CFR 1029.210(b)(4) | Commensurate with the risks of products and services; agents and brokers tested too | A third party, or any staff except the compliance officer |
| Broker dealers (FINRA) | FINRA Rule 3310(c) and .01 | Once per calendar year; every second year if the firm handles no customer business | Not the person tested, the AML compliance person, or anyone reporting to them |
| FCMs and IBs (NFA) | NFA Interpretive Notice 9045 | At least every 12 months for most; every two years if solely proprietary or inactive | Own staff or others who do not perform or oversee AML functions |
| UK firms under the MLRs | MLRs 2017, regulation 21(1)(c) and (10) | No set interval; an audit function where size and nature make it appropriate, judged with the risk assessment. EMIs and payment firms report on controls to senior management at least annually (21(7)(d)) | An independent audit function |
| EU obliged entities from 10 July 2027 (football agents and professional football clubs from 10 July 2029) | AMLR Article 9(2)(b) | No set interval | The independent audit function, or an external expert where there is none |
AML audit checklist questions 1 to 15: what evidence do governance, customers and screening need?
An AML compliance checklist lists what a program must contain. An AML audit checklist asks for proof that each part works, so these 30 questions double as the request list for your next test. A sector checklist for banks, crypto firms, mobile payment providers or fintechs changes mainly the rule column; a few rows, such as CTRs and 314(a) requests, apply only where the rule reaches the firm. Most answers come from four records: the policy and board file, the customer file, the alert and case record, and the training and findings log. When screening, monitoring and cases run on one AML platform, the third record holds most of them.
Table 2. Governance (questions 1 to 5)
| Question | Evidence the auditor asks for | Where it lives | Rule |
|---|---|---|---|
| 1. Is the program written, board approved, and is that version in use? | Signed program, dated board minute, version history | Policy file, board minutes | 12 CFR 21.21(c)(1); AMLR Art 9(2) |
| 2. Does the risk assessment match products, services, customers and geographies? | Current assessment, its data inputs, approval | Risk assessment file | FFIEC manual, independent testing |
| 3. Was it updated after a new product, market or merger? | Change log, product approvals, update date | Product approval file | FFIEC manual; FinCEN proposal, April 2026 |
| 4. Is there a named AML compliance officer with enough staff and budget? | Appointment, job description, staffing plan | Board minutes, HR file | 31 CFR 1020.210(a)(2)(iii); MLRs reg 21(1)(a) and (3); OCC CFSB order, Art X |
| 5. Does the board see AML management information and act on it? | Board packs, minutes with decisions and follow up | Board and committee minutes | FFIEC manual; MLRs reg 21(7)(d) for EMIs and payment firms, to senior management |
Table 3. Know your customer and CDD (questions 6 to 10)
| Question | Evidence the auditor asks for | Where it lives | Rule |
|---|---|---|---|
| 6. Was each customer verified within a reasonable time of account opening? | Sampled files with document and verification dates | Onboarding record | 31 CFR 1020.220(a)(2)(ii) |
| 7. Are beneficial owners identified and verified when the rule requires? | Ownership forms, verification evidence, the trigger used | Customer file | FinCEN exceptive relief, 13 February 2026 |
| 8. Does each customer carry a risk rating with a reason, and are overrides approved? | Rating, the factors behind it, override approvals | Customer risk record | 31 CFR 1020.210(a)(2)(v) |
| 9. Is enhanced due diligence (EDD) applied where the policy says? | High risk sample with source of funds and senior approval | Customer file | FFIEC manual (adherence) |
| 10. Is customer information updated on a risk basis? | Review dates against the policy cycle, overdue list | Periodic review form and log | 31 CFR 1020.210(a)(2)(v)(B) |
Table 4. Screening (questions 11 to 15)
| Question | Evidence the auditor asks for | Where it lives | Rule |
|---|---|---|---|
| 11. Which lists are screened, when, and are transaction records kept 10 years? | List set, screening triggers, retention setting | Screening setup, search log | 31 CFR 501.601 (OFAC) |
| 12. Who set each matching threshold, and on what test? | Threshold values, approval, test results | Screening setup, change log | FFIEC manual (systems) |
| 13. Is every cleared match recorded with a reason and a name? | Sample of cleared matches | Alert and case record | FFIEC manual (adherence) |
| 14. Is PEP and adverse media screening run as the policy says? | Policy section, sample of PEP hits and outcomes | Customer file, case record | FFIEC manual (adherence) |
| 15. Does the screened population reconcile to the customer book? | Screened count against the core system count, exceptions | Screening system, core extract | FFIEC manual (systems) |
In a firm that is growing, start with questions 2 and 3. FinCEN's April proposal would have financial institutions update their risk assessment promptly when a change significantly alters their risk, and it names new products, services and customer types as examples. An assessment that still describes last year's product list fails question 2 before a single file is sampled.
The screening setup gets its own test in questions 12 and 15. The FFIEC's systems area asks whether the data and processes behind the program are complete and accurate. A tester therefore asks who set each threshold and on what evidence, then counts the screened names against the customer book.
AML audit checklist questions 16 to 30: what evidence do monitoring systems, reports, training and records need?
Table 5. Monitoring (questions 16 to 20)
| Question | Evidence the auditor asks for | Where it lives | Rule |
|---|---|---|---|
| 16. Do monitoring rules cover the risks the assessment names? | Map of rules to risks, gaps | Rules library, risk assessment | OCC CFSB order, Art II and VII |
| 17. When was each rule last tuned, by whom, on what evidence? | Rule tuning record, approval, alert counts before and after | Rule change log | OCC CFSB order, Art VII |
| 18. Does every source system feed monitoring? | Feed map, record counts reconciled | Data feed records | FFIEC manual (systems) |
| 19. Are automatically closed alerts sampled? | Closure logic, sample results | Alert record | OCC CFSB order, Art II (3) |
| 20. How old is the alert backlog against the SAR deadline? | Aging report, oldest open alerts | Case queue | 31 CFR 1020.320(b)(3); OCC CFSB order, Art VII |
Table 6. Investigations and reports (questions 21 to 25)
| Question | Evidence the auditor asks for | Where it lives | Rule |
|---|---|---|---|
| 21. Does each closed alert show the reason, the evidence and the reviewer? | Sample of closed alerts | Case record | FFIEC manual; OCC CFSB order, Art VII |
| 22. Were SARs filed within 30 days, or 60 with no suspect? | Detection and filing date per SAR | Case record, filing log | 31 CFR 1020.320(b)(3) |
| 23. Are SAR narratives complete, and are UK internal reports decided on? | Narrative sample; the nominated officer's decisions | Filing log | FFIEC manual; MLRs reg 21(5) |
| 24. Are CTRs filed and exemptions reviewed? | CTR filings, exemption list and its reviews | Filing log | FFIEC manual |
| 25. Were 314(a) requests searched and answered on time? | Request log, search dates, matches reported | Information sharing log | 31 CFR 1010.520(b)(3); OCC CFSB order |
Table 7. Training, records and findings (questions 26 to 30)
| Question | Evidence the auditor asks for | Where it lives | Rule |
|---|---|---|---|
| 26. Is training role based, with completion records? | Training plan by role, completion records | Training system | FFIEC manual (training) |
| 27. Are records kept five years, and can they be retrieved? | Retrieval test on a sample | Records archive | 31 CFR 1010.430(d); OFAC 10 years, 501.601 |
| 28. UK: are relevant employees screened before and during appointment? | Screening records for relevant staff | HR file | MLRs reg 21(1)(b) |
| 29. Was every past finding fixed and validated? | Findings tracker with owner, date, validation evidence | Findings log | OCC CFSB order, Art IX; MLRs reg 21(1)(c)(iii) |
| 30. Was this test independent and reported to the board? | Tester's reporting line, engagement letter, board minute | Audit file | FinCEN proposal, April 2026; FFIEC manual; FINRA Rule 3310 .01 |
Several of these rows cite the CFSB case in the next section. An automatic closure rule makes a decision no analyst sees, so question 19 has the tester sample what it closed. Question 20 rests on the SAR clock in 31 CFR 1020.320(b)(3): a bank files no later than 30 calendar days after initial detection, and never later than 60 when it needs time to identify a suspect.
Records run on two clocks. BSA records are kept five years, while OFAC's rule keeps transaction records available for at least 10 years, so the retrieval test in question 27 takes one file from each period.
Open findings come first. UK regulation 21(1)(c)(iii) makes monitoring the firm's follow through on recommendations a duty of the audit function, so the findings of the last test are the first rows of question 29 to close. Question 30 asks about the tester: who ran the test, and whom that person reports to.
What happened when a bank's independent test missed the risk?
The OCC's consent order with Community Federal Savings Bank of Woodhaven, New York, was signed on 24 April 2026 and released on 21 May 2026. The bank neither admitted nor denied the findings.
Since 2020 the bank had grown its payment processing line significantly for its size, with heavy wire and ACH activity that included cross border flows with foreign financial institutions. Its alert thresholds "had not been adequately tuned" to that line. An automated triage system closed "a very high percentage of all ingested alerts", among them alerts that should have been escalated.
Article II (5) of the order reads: "The Bank also had weak independent testing for BSA/AML. For example, the Bank's internal auditor failed to identify BSA/AML program weaknesses." The auditor had also failed to scope in its audit work and to test the high risk areas effectively. The order lists weak independent testing beside systemic internal control breakdowns and weak BSA staffing, and it cites violations of the SAR rule and of the 314(a) information sharing rule.
Article IX sets the remedy: a testing program that meets 12 CFR 21.21(d)(2), its effectiveness reviewed by the board at least annually, every deficiency reported promptly to the board or audit committee, and an audit function that "reviews and validates corrective action promptly".
Scope is where the test failed. The FFIEC manual tells testers to tailor the test to the areas the risk assessment marks as greatest risk, and an audit plan copied from last year misses the line that grew. Independent testing failures also recur among the biggest AML fines: an untested monitoring rulebook, a weak audit program.
Which 2026 rule changes reach the AML audit?
- 13 February. FinCEN's exceptive relief limits beneficial owner verification to the first account opening, doubt about earlier information, and the firm's risk based procedures.
- 10 April. FinCEN proposed a program rule that centers testing on effectiveness, and the OCC, FDIC and NCUA published a companion proposal. Comments on both closed on 9 June.
- 21 May. The OCC released the CFSB order.
- 9 July. The Federal Reserve Board published its own proposal; comments closed on 8 September.
- As of 9 November. No final program rule is in the Federal Register. FinCEN's would take effect 12 months after it is issued.
- Next. The EU AML Regulation applies from 10 July 2027, and to football agents and professional football clubs from 10 July 2029. AMLA's Article 9(4) guidelines, due by 10 July 2026, were not on its instruments page as of its 7 October update.
How does an internal or outside AML audit run, from request list to closed finding?
An audit moves through eight stages, and the scope is fixed before the first document request.
Table 8. One AML audit, from scope to validation
| Stage | Input | Output | Who decides |
|---|---|---|---|
| 1. Scope | Risk assessment, past findings, changes since the last test | Scope memo and test plan | Tester |
| 2. Request list | The 30 questions, sample periods | Document and data requests | Tester |
| 3. Walkthrough | Process owners, live systems | Notes on how each control runs | Tester |
| 4. Sampling and transaction testing | Customer, alert, case and filing samples | Results per control | Tester |
| 5. Findings | Exceptions with evidence | Draft findings with severity | Tester |
| 6. Management response | Draft findings | Owner, action and date per finding | Management |
| 7. Board report | Final findings, overall conclusion | Report to the board or committee | Board or committee |
| 8. Validation | Evidence of each fix | Finding closed or reopened | Audit function |
Stages 6 to 8 are where findings get fixed or linger. The FFIEC manual has the board, or its committee, and staff track deficiencies and document progress, and the CFSB order made validating each fix the audit function's job. Between audits, KPIs and control tests show whether a fix holds.
What goes in an AML audit report?
The FFIEC manual expects the report to document the scope, the procedures performed, the transaction testing completed and the findings. It typically carries "an explicit statement" on the bank's overall compliance with BSA requirements, or at least enough for a reader to reach a conclusion on the program's adequacy. Violations and policy exceptions go to the board or its committee in a timely manner, and the workpapers stay available for examiners. A UK audit function's report adds recommendations, the second of its three duties.
Where does the evidence sit when the compliance program runs on one platform?
Most of the 30 answers are records the compliance software writes as the work happens. On complead, formerly Sanction Scanner, they sit in these places:
- Search log (questions 11 and 13). Each screening search is stored with the user, the search terms, the timestamp and the result, including searches that found nothing.
- Matching thresholds (question 12). Fuzzy match thresholds can be set for each list type and for each single list.
- Risk ratings (question 8). "The model version that produced the rating is stamped on it, so the file stays defensible after the model has moved on."
- Rules (questions 16 and 17). In the rules engine, each rule and edit is versioned and can be rolled back in one click, and the change record names who changed what, when and why. Backtests replay 30, 60 or 90 days of real history and report the alerts, the clearance rate and the true positives a rule would have produced.
- Alerts and agent output (questions 19 and 21). Each alert carries the fired rule and the matched signals. Agent output arrives with evidence, a work log and a narrative in the examiner's format; a person decides, and the record keeps the name.
- Monitored population (question 15). API triggers start or stop ongoing monitoring name by name, so a name that no longer needs screening drops out.
- Filings (question 22). complead provides "Reporting support within case management", and the approval and submission stay with the firm's own team.
- The request list itself (stage 2). The period's decisions with their reviewers, overrides, parameter history and filings export as one period end evidence pack rather than being compiled by hand. It is the same pack whether the board, internal audit or the supervisor asks.
Before the request list goes out, decide who runs the next test. If that person reports to the AML officer, FinCEN's proposal would generally not treat the test as independent, and FINRA's rule already bars that tester at a broker dealer. Name the tester and write down the reporting line first, since question 30 is answered from both.
