What Should an AML Controls Review Examine?

1. Start with the business and its risk

Begin with the firm's activities rather than a standard checklist. Consider its products and services, customer and counterparty types, distribution channels, transaction patterns, jurisdictions, systems and operating environment. Which features could expose the business to money laundering or terrorist financing, and where might its controls need to act? The FCA's SYSC 6.3 says relevant firms' systems and controls should enable them to identify, assess, monitor and manage money laundering risk, proportionate to the nature, scale and complexity of their activities. It also requires a regular assessment of whether those systems remain adequate.

This step tests whether the risk picture is specific enough to guide decisions. A broad statement that a firm faces 'low risk' tells little unless its products, customers, geographies and operations support that view. The FCA's 2025 review reported cases where firms could not explain how identified risks were mitigated or evidence conclusions about risk and control effectiveness.

2. Trace risks into control objectives and ownership

For each material exposure, ask what the firm expects to prevent, detect or manage. Controls may include due diligence, monitoring, sanctions checks, escalation, records, staff procedures or safeguards around new products and business change. Trace the connection from risk to policy or procedure, then to the people and systems that carry it out. For shared, outsourced or group controls, clarify who operates, monitors and resolves exceptions.

Check whether design is proportionate: are roles clear, do procedures cover ordinary and unusual cases, and does the control reach relevant activity and data? Does management information make exceptions or backlogs visible to someone able to act? A process map can clarify these links, but cannot prove a control works.

• Risk and control objective: what exposure is this measure intended to address?
• Ownership: who performs, oversees, challenges and escalates the control?
• Coverage: which products, customers, transactions, data and locations are in scope?
• Evidence: what records show the control operated and the result was handled?

3. Examine operation through evidence

A review can use walkthroughs, procedures, management information, testing records, exception logs and a proportionate sample of cases or transactions. For each example, ask whether relevant information was available, steps were followed, decisions were reasoned and recorded, and issues reached the right person. Include routine cases and exceptions where relevant. A sample illustrates operation within its limits; it cannot establish performance across every case.

Evidence should support the conclusion. A completed checklist may show a step was recorded, but not whether it was suitable or a concern was handled. The FCA describes good practice in using qualitative and quantitative information, documenting methods and actions, and testing or refreshing processes after change. FATF Recommendation 18 describes programmes with policies, controls, training and an audit function, proportionate to risk and business size.

4. Separate findings and decide what they mean

A useful finding explains the gap between intended control and observed evidence. It distinguishes design weakness, inconsistent operation, unclear ownership, an evidence limitation or insufficient testing. It should identify the risk affected and any connected controls, giving management a basis to choose further evidence, testing, a design change or tracked remediation.

Risk assessment, governance and remediation answer related but distinct questions: what exposures exist, how leaders oversee decisions, and how known deficiencies are addressed. A controls review asks whether specified arrangements connect to business risks and operate as intended. Conclusions are limited to agreed scope and evidence; a review does not certify compliance with every AML obligation.