Inside an AML inspection: what examiners actually ask

Most firms prepare for an AML inspection by re-reading their policies. Examiners, meanwhile, are preparing to test whether those policies describe anything that actually happens. That gap — between the documented framework and the operated one — is where the majority of findings live.

The request list arrives first

Before anyone visits, you will receive a document request: the enterprise-wide risk assessment, the AML/CFT policy suite, the client risk classification methodology and a sample of client files, training records, goAML reporting logs, and minutes of the committees your policies say exist. Two observations from experience. First, the sample is not random — examiners select files that test your hardest cases: high-risk classifications, PEP relationships, accounts with unusual activity. Second, the speed and order of your response is itself evidence: a firm that takes three weeks to assemble its own risk assessment has already made a finding against itself.

The interviews are the real inspection

Documents establish what should happen; interviews establish what does. The MLRO will be asked to walk through a real escalation — not the procedure, a specific case. Front-line staff will be asked how they would recognise and report suspicion, and their answers will be compared with the training records. Board members are increasingly interviewed too, and “we delegate that to compliance” is recorded verbatim, unfavourably.

The three recurring findings

Risk assessments that do not drive anything. An EWRA that never changed a control, a limit or a classification is a document, not an assessment.

Classification without consequence. High-risk clients whose files show the same monitoring as low-risk ones.

Remediation that closes on paper. Prior findings marked complete whose fixes cannot be evidenced on the current sample.

What preparation actually looks like

Rehearse the file walk-through, not the policy recital. Run a mock inspection on your own hardest files. Close remediation with evidence, not memos. And brief the board with the questions they will personally face. Firms that do these four things do not merely pass inspections — they change how the regulator classifies them for the next cycle.

TrueNorth’s Financial Crime & AML practice runs mock inspections and inspection-response support for SCA, CBUAE, DFSA and VARA regulated firms.