How to Scope an AML Gap Analysis

When an AML review goes off course, it is rarely because the testing was weak. More often, the scope was too broad to be useful, too narrow to satisfy regulators, or disconnected from the way the business actually operates. That is why knowing how to scope an AML gap analysis matters at the outset. A well-scoped exercise gives decision-makers a clear view of control weaknesses, regulatory exposure and remediation priorities without wasting time on low-value review areas.

For regulated firms, especially those operating across onboarding, payments, gaming, corporate services or other higher-risk sectors, scope is not an administrative detail. It determines whether the outcome will stand up to audit scrutiny and whether the business can act on the findings with confidence. The aim is not to produce another checklist. The aim is to assess whether your AML framework works as designed, aligns with current obligations and reflects the real risk profile of the organisation.

What scoping an AML gap analysis should achieve

An AML gap analysis compares your current framework against applicable legal, regulatory and internal standards. Scoping decides what will be assessed, against which criteria, over what period and across which business areas. If this is done properly, the review becomes practical and defensible. If it is done poorly, findings become vague, remediation becomes expensive and senior management receives little more than a high-level assurance statement with limited operational value.

A good scope should answer four basic questions. Which obligations and standards are in scope? Which entities, products, channels and geographies are covered? Which controls will be tested in design and operation? And what evidence will be used to support conclusions?

Those questions sound straightforward, but the right answer depends on the maturity of the business, the regulator involved, the pace of change in the operating model and the purpose of the review. A pre-inspection readiness assessment should not be scoped in exactly the same way as a post-acquisition review or an annual control health check.

How to scope an AML gap analysis using a risk-based approach

The most reliable starting point is the firm’s inherent AML risk. That means looking first at the business model rather than the policy library. If the organisation serves high-risk customers, operates in multiple jurisdictions, relies on non-face-to-face onboarding or uses intermediaries, the scope should reflect those realities. There is little value in spending disproportionate time on low-risk legacy procedures while material onboarding or transaction monitoring exposures remain lightly tested.

Begin with the business risk assessment, customer base, delivery channels and product mix. These should show where the highest exposure sits. Then map those risk areas to the AML control framework. This usually includes governance, enterprise-wide risk assessment, customer risk rating, CDD and EDD, sanctions and PEP screening, transaction monitoring, suspicious activity reporting, record keeping, staff training, quality assurance and management information.

Not every control area needs the same depth of review. That is where proportionality matters. For example, a payment institution with rapid customer onboarding and high transaction volumes may require deeper testing of customer acceptance, trigger events, ongoing monitoring and alert governance. A corporate service provider may need a more detailed review of beneficial ownership verification, source of wealth assessment and higher-risk structure approvals. Scope should follow risk, not habit.

Start with the regulatory perimeter

Before testing a single control, define the regulatory perimeter. That includes the laws, rulebooks, guidance, thematic findings and internal standards against which the review will be assessed. For firms serving the Maltese market, this may include local AML requirements, sector-specific obligations and wider European expectations where relevant. For groups operating internationally, it may also involve parent-company standards and jurisdiction-specific variations.

This matters because AML gaps do not only appear where a control is missing. They also appear where a control exists but does not meet the required standard in a given jurisdiction. A group policy may appear comprehensive but still fail local requirements on timing, approvals, escalation thresholds or documentation standards.

At this stage, it is also sensible to clarify whether the analysis will assess legal compliance only, or broader control effectiveness and governance maturity as well. The latter is usually more valuable because many regulatory issues arise from execution failures, unclear ownership or weak oversight rather than policy omissions alone.

Define the operating boundaries

Once the regulatory benchmark is clear, define what parts of the business are in scope. This should include legal entities, branches, outsourced arrangements, products, services, distribution channels and relevant third parties. It should also cover the review period. Testing six weeks of onboarding files may not tell you much about a control environment that changed twice over the year.

The key is to avoid false comfort. A scope that excludes manual workarounds, exceptions processing or outsourced onboarding may miss the very areas where controls break down. Equally, a scope that tries to include every entity and every workflow in one exercise can become so diluted that findings lose meaning.

A more effective approach is to separate core control areas from peripheral ones. Core areas are those with direct exposure to customer acceptance, transaction risk, suspicious activity identification and regulatory reporting. Peripheral areas may still be reviewed, but with lighter testing or through management enquiry and document review rather than deep sample testing.

Decide what kind of testing the scope requires

One of the biggest scoping mistakes is treating all gap analyses as desktop exercises. Some can be, particularly if the objective is a high-level regulatory alignment review. But where the purpose is to assess practical exposure, document review alone is not enough.

For most firms, a meaningful AML gap analysis should test both control design and control operation. Design testing asks whether the policy, procedure or workflow is fit for purpose. Operational testing asks whether staff follow it consistently and whether systems support it properly. You need both. A well-written procedure is of limited value if onboarding teams bypass key checks under commercial pressure or if monitoring alerts are not resolved within agreed timeframes.

The scope should therefore specify the testing method for each area. That may include policy and procedure review, walkthroughs, file sampling, system observations, interviews, exception analysis and governance paper review. The choice depends on the risk involved and the confidence level management needs from the outcome.

Build the scope around decision points, not just documents

A strong AML framework is shaped by decisions: whether to onboard a client, when to escalate an alert, who approves higher-risk relationships, when to refresh CDD and whether a matter meets the threshold for internal or external reporting. If the scope only lists documents to be reviewed, it can miss the quality of those decisions.

That is why it is useful to frame scoping around critical control points. In onboarding, for instance, the review should look at risk classification logic, documentary verification, beneficial ownership assessment, source of funds and source of wealth requirements where relevant, sanctions and PEP handling, and approval authority. In ongoing monitoring, it should cover trigger events, periodic review cycles, alert handling, investigation quality and escalation routes.

This approach produces findings that are easier to translate into action. It tells management where decisions are weak, inconsistent or unsupported, rather than simply stating that documents need updating.

Calibrate for materiality and remediation value

Not every gap deserves the same treatment. Scoping should take account of materiality from the start. That means thinking ahead about what kinds of findings would matter to regulators, internal audit, senior management and the board.

A missing reference in a procedure manual is not equivalent to incomplete beneficial ownership verification on high-risk clients. Likewise, a delayed training attestation is not the same as a broken escalation route for suspicious activity. A good scope allows enough depth in material areas to distinguish administrative weaknesses from genuine control failures.

This also improves remediation planning. If the scope is aligned to business-critical risks, the resulting recommendations can be prioritised in a way that supports operational resilience rather than creating a long, undifferentiated action log. That is often where advisory-led reviews add the most value. Firms need findings they can implement and defend, not simply observations they must absorb.

Common scoping errors to avoid

The first error is copying last year’s scope without considering regulatory change, business growth or incident history. AML risk moves. Your scope should too.

The second is focusing too heavily on policy completeness and not enough on execution. Regulators regularly identify firms with formally adequate documentation but inconsistent customer risk assessments, weak monitoring or poor escalation discipline.

The third is failing to involve the right stakeholders early enough. Compliance should shape the scope, but operations, legal, risk, product and technology teams often hold the detail that reveals where controls actually succeed or fail.

The fourth is setting a scope that is so ambitious it cannot be completed properly. Breadth creates comfort only when there is enough depth to support conclusions.

A practical way to frame scope approval

Before the review begins, the scope should be documented and approved in clear terms. That document should set out the objective, regulatory benchmark, in-scope business areas, review period, testing methods, sampling approach, exclusions and reporting format. It should also explain why certain areas are prioritised. That rationale matters, particularly if the review is later examined by internal audit, external reviewers or regulators.

For many firms, the real benefit comes when the scope is positioned not as a one-off exercise but as part of a broader compliance maturity plan. That is the difference between reactive remediation and controlled improvement. Complipal’s approach is built around that principle: define risk clearly, test controls where they matter and turn findings into actions the business can own.

If you are deciding how to scope an AML gap analysis, aim for precision over breadth and evidence over assumption. The strongest reviews are not the ones that cover everything. They are the ones that tell you, clearly and credibly, where your exposure sits and what needs to change next.