August 2026
[email protected]
+44 7563 115980 (phone and WhatsApp)
An independent test of whether your anti-money laundering framework works in practice.
An independent AML audit examines whether a firm’s anti-money laundering policies, controls and procedures are adequate and are working, and recommends what to fix. The Money Laundering Regulations 2017 require firms to have an independent audit function where appropriate to their size and nature.
We test your framework against the Money Laundering Regulations, the FCA’s expectations and your own policies.
See also: Financial crime services · Outsourced MLRO
| Deliverable | What it contains | Who relies on it |
|---|---|---|
| Audit report | Scope, method, findings ranked by severity and recommended actions | Board, MLRO, FCA |
| File testing results | Each sampled customer file and alert, with the result and the gap found | MLRO, operations |
| Action plan | Each action with an owner and a target date | Board, MLRO |
| Follow-up confirmation | Evidence that completed actions work | Board, banks, FCA |
Tell us where you are and where you want to be.
[email protected]
+44 7563 115980 (phone and WhatsApp)
Regulation 21 of the Money Laundering Regulations 2017 requires firms, where appropriate with regard to the size and nature of the business, to establish an independent audit function. That function examines and evaluates the adequacy and effectiveness of the firm’s policies, controls and procedures, makes recommendations and monitors that they are followed.
The FCA has written to payment, e-money and other firms about common weaknesses it finds: risk assessments that do not reflect the business, weak customer due diligence, monitoring that is not tuned to the firm’s customers and slow escalation of suspicion.
The audit is carried out by people who do not run the controls being tested. Where we already support a firm’s financial crime framework, we say so in the report and keep the audit team separate from that work.
The Money Laundering Regulations 2017 require an independent audit function where appropriate to the size and nature of the business. For most payment, e-money and crypto firms the FCA expects one, and banks and partners often ask to see the latest report.
Most firms commission one each year, and again after a significant change such as a new product, market or MLRO.
The function must be independent of the people who run the controls. Many firms without an internal audit team use an external adviser to provide it.
You receive each finding with a recommended action. Most findings are fixed by the firm with an owner and a deadline. Serious failings may need to be reported to the FCA, and we will tell you if a finding falls into that category.
Yes, including blockchain analytics, wallet screening and Travel Rule controls.