What to Expect During an AML Program Review: A Step-by-Step Guide

An AML program review - whether conducted by an internal auditor, an external compliance consultant, or a regulatory examiner - follows a consistent structure. Understanding that structure in advance allows you to prepare effectively and to present your program in the most favorable light. The review process is not adversarial; it's an evaluation of whether your program meets the regulatory standard. Preparation is the most effective way to ensure a positive outcome.

The review typically begins with a document request. The reviewer will ask for your written AML program, your most recent risk assessment, your training records for the past 12 to 24 months, your CTR and SAR filing history, your independent testing reports, and your customer due diligence records. Organizing these documents in advance - in a clear, accessible format - signals program maturity and makes the review process more efficient.

The document review phase evaluates the adequacy of your written program against the regulatory standard. The reviewer is looking for: completeness (are all five elements present?), specificity (does the policy describe actual procedures?), currency (has the program been updated recently?), and consistency (does the policy match what the business actually does?). Gaps in any of these dimensions will generate findings.

The transaction testing phase involves sampling actual transactions to evaluate whether your monitoring and reporting procedures are working. The reviewer will select a sample of transactions - typically including some that should have generated CTRs or SARs - and evaluate whether the appropriate actions were taken. Transaction testing is where programs that look good on paper often reveal operational failures.

The staff interview phase evaluates whether your employees understand their compliance obligations. Reviewers typically interview front-line staff, the BSA officer, and senior management. The questions focus on: do employees know what suspicious activity looks like? Do they know how to escalate concerns? Do they know the filing obligations that apply to their role? Staff who cannot answer these questions reveal a training program that hasn't achieved its objective.