Independent AML Review
An independent AML review is the periodic examination of a firm’s anti-money-laundering program by someone who is not responsible for running it. In the United States it is a mandatory element of the program; in the United Kingdom and European Union it is required where the size and nature of the business make it appropriate.
Also called: independent testing · AML audit
The review is a check on the program, not on individual customers. A reviewer takes the firm’s risk assessment, reads the policies, and then tests whether the two match reality: sampling onboarding files, examining how transaction monitoring alerts were investigated and closed, reading escalation and reporting decisions, checking screening configuration and training records, and confirming whether the findings of the previous review were actually fixed.
What independence means here
Independent of the function under review — not necessarily external to the company. The US money services business rule says so in terms: the review may be carried out by an officer or employee of the business, so long as it is not the person designated to run compliance. An internal auditor, a qualified employee from a different part of the business, or an outside firm can all do it. The one person who cannot is the compliance officer who runs the program, and a report they drafted with someone else’s signature on it does not cure that.
How often is not fixed by rule. The US requirement is only that the scope and frequency of the review be commensurate with the risk of the financial services provided, which leaves the firm to set an interval and defend it. Either way the rationale has to be documented, and a firm that cannot say when its last review happened, or produce it, has effectively not had one.
Why it matters commercially
The report is a document other people ask for. A sponsor bank reviewing a money services business wants the most recent independent AML review at onboarding and again at periodic review. A licensing regulator may ask for it. An acquirer doing diligence often reads it before the policies, because it is the only document in the pack written by someone with no incentive to flatter the AML program. Findings carried forward unclosed year after year read as a governance problem, not a compliance one.
In practice
“Independent” means independent of the function being reviewed, not necessarily external to the company — the US rule lets an officer or employee do it, provided it is not the person designated to run compliance. No frequency is set by rule; the scope and timing have to match the risk of the services provided, and the reasoning has to be written down.
Example
A remittance company’s compliance manager writes the policies, runs the monitoring, and each year drafts a review of the program that the CEO signs. That is not an independent review: the person assessing the work is the person who did it. Assigning it to an internal auditor with no compliance role, or commissioning an outside firm, would satisfy the requirement.
Commonly confused with
| Term | How it differs |
|---|---|
| AML Program | The program is the set of controls a firm runs; the independent review is the periodic test of whether those controls work as written. |
| Regulatory examination | An examination is conducted by a supervisor on its own authority and can lead to enforcement; an independent review is commissioned by the firm and the report belongs to the firm. |
See also
- AML ProgramAn AML program is the documented set of controls a regulated firm must maintain to detect and deter money laundering. In the United States it is conventionally described as four pillars: written policies and procedures, a designated compliance officer, staff training, and independent review. Other regimes frame the same components differently.
- Compliance OfficerA compliance officer is the individual a regulated firm formally designates as responsible for its anti-money-laundering program — the person named on a licensing application, asked for by a bank during onboarding, and interviewed by an examiner. In the United States the role is often called the BSA officer.
- Anti-Money LaunderingAnti-money laundering, usually shortened to AML, is the body of law, regulation and internal controls requiring financial firms to detect, prevent and report attempts to disguise the origin of criminal proceeds. It is an obligation placed on the firm, not a product the firm can buy.
- Transaction MonitoringTransaction monitoring is the ongoing review of customer activity — automated rules and models plus human investigation — against what the firm expected that customer to do and against known laundering patterns. Activity that does not fit produces an alert for someone to work.