How to Choose an AML
Compliance Firm
Not every AML firm delivers what it promises. This four-part guide covers the red flags to watch for, the questions to ask before you hire, the standard a real program review must be held to, and what to do if yours fell short.
Template policies
fail the moment an examiner asks a specific question about your business
Up to $286,184
per willful BSA violation (31 CFR 1010.821), the cost of a bad program
Examiners test
your program operationally, they don't just read the policy document
Four Articles. One Complete Framework.
Read them in order for the full picture, or jump to the article most relevant to where you are right now.
Part 1
Why Getting an AML Policy Without a Risk Assessment First Is a Major Red Flag
If an AML firm hands you a finished compliance policy before they have spent serious time understanding your business, that is not a service, it is a liability. A policy built without a proper risk assessment is a template with your name on it.
Part 2
Questions to Ask Before Hiring an AML Compliance Firm
Not every AML consulting firm delivers what it promises. Some sell templates as custom programs. Some lack the industry-specific expertise your business actually needs. These are the 10 questions that separate the firms worth hiring from the ones worth avoiding.
Part 3
What a Real AML Program Review Should Include (And What to Do If Yours Didn't)
A genuine AML program review is not a document scan. It is a structured evaluation of whether your program actually works, not just whether it exists on paper. Here is the standard it should have been held to.
Part 4
What Happens After a Bad AML Program Review: A Recovery Checklist
You had a review. The report came back with findings, or you have since realized the review itself was inadequate. Either way, you are now in recovery mode. This is the step-by-step checklist for what to do next.
6 Warning Signs of a Template Mill
These are the signals that a firm is selling pre-written documents rather than building a genuine risk-based program for your business.
Delivered on a defined timeline
A genuine risk assessment takes days, not hours. Same-day or next-day delivery is a template.
Minimal intake process
A short questionnaire or single phone call cannot gather enough information for a risk-based program.
Price too low for the scope
A few hundred dollars reflects template customization, not original professional analysis.
Can't describe their methodology
A legitimate firm can explain their risk assessment process in specific terms. Vague answers are a red flag.
No industry-specific experience
Generic frameworks fail industry-specific examinations. Ask for examples from your sector.
No written findings report
A real review produces a written report with specific gaps, severity ratings, and remediation timelines.
What a Legitimate Engagement Looks Like
A properly sequenced AML program engagement always follows this order. The risk assessment comes first, everything else is built on top of it.
Risk Assessment First
A written analysis of your products, customer base, and geographic footprint, before a single policy is written.
Custom Policy Build
Internal controls, CDD procedures, and monitoring thresholds derived directly from your risk assessment findings.
All 5 BSA Elements
Internal controls, independent testing, BSA officer, training, and CDD, all evaluated against your industry standard.
Written Findings Report
Specific gaps, severity ratings, responsible parties, and realistic remediation timelines, not a certificate.
How Soflo Consulting is Different
Every engagement starts with a genuine risk assessment. No exceptions.
We do not maintain a template library. Every AML program we build starts with a structured analysis of your specific products, customers, and geographic footprint, and the policy we write is derived directly from that assessment. Our deliverables include a written findings report with specific gaps, severity ratings, and remediation timelines. We also offer ongoing support so your program stays current as your business and the regulatory environment evolve.
Common Questions
How do I know if my current AML policy was built from a template?
Ask your provider for the written risk assessment that preceded the policy. If they cannot produce one, or if the risk assessment is a brief intake form rather than a structured analysis of your products, customers, and geography, your policy was almost certainly built from a template. You can also compare your policy to a generic BSA policy for your industry, if the language is nearly identical, it is a template.
What is the difference between a program review and independent testing?
A program review evaluates whether your program structure meets regulatory requirements, it is diagnostic. Independent testing evaluates whether your controls are actually working as designed, it is operational. Both are required. A program review does not satisfy the BSA's independent testing requirement, and independent testing does not substitute for a program review.
How often should an AML program be reviewed?
At minimum, annually. Additionally, any material change to your business, new products, new customer segments, geographic expansion, significant staff turnover, or a change in the regulatory environment, should trigger an immediate review of the affected program elements. Examiners check the dates on your risk assessment and policy documents.
What happens if a regulator finds my policy was built from a template?
The most serious finding is the gap between what your policy says and what your business actually does. A template policy describes a generic business, not yours, which means the gap between policy and practice is almost guaranteed. This inconsistency is one of the findings most likely to escalate from a Matters Requiring Attention letter to a formal enforcement action with civil monetary penalties.
Can I fix a template policy without starting over?
Yes, but it requires real work. The first step is commissioning a genuine risk assessment. The second step is evaluating your existing policy against the assessment findings and identifying the gaps. The third step is revising the policy to reflect your actual risk profile. This is less expensive than building from scratch, but it is not trivial, and it is far less expensive than discovering the gaps during a regulatory examination.
My last AML review came back with serious findings. What should I do first?
The first step is to read the findings report carefully and translate each finding into operational terms, not just what the report says, but what an examiner would actually see if they walked in tomorrow. Then triage: sort findings into critical, significant, and minor. Critical findings are structural deficiencies that could generate a formal enforcement action, a missing independent testing function, a BSA officer without adequate authority, a risk assessment that has not been updated in years. Address those first, regardless of how easy the minor ones are to fix. The second step is to commission a genuine risk assessment if your prior review did not produce one, because remediating without knowing the full scope of your gaps means you will fix some things and miss others. Part 4 of this series walks through the complete recovery process step by step.
Stop guessing whether your AML program is real.
Soflo Consulting builds risk-based AML programs that hold up under examination, starting with a genuine risk assessment of your specific business, every time.