What an AML Health Check Review Should Reveal

A regulator rarely sees a compliance programme as it appears in a policy document. It sees the evidence created by real decisions: client files, risk ratings, screening records, escalation logs, training records and governance minutes. An AML health check review tests whether those elements tell a consistent, defensible story – before an inspection, audit finding or suspicious activity exposes a gap.

For MLROs, compliance officers and senior leaders, this is not a document-refresh exercise. It is a focused assessment of whether the firm’s financial crime framework operates as intended, reflects its actual risk exposure and can withstand scrutiny. Done well, it gives decision-makers a clear view of where remediation is needed, what can be improved through operational discipline and which weaknesses require investment or governance attention.

What an AML health check review is designed to do

An AML health check is an independent, risk-led review of the controls that support anti-money laundering and counter-financing of terrorism obligations. Its purpose is to establish whether the programme is proportionate to the business, aligned with applicable regulatory standards and embedded in day-to-day operations.

It is not necessarily the same as a formal internal audit. Internal audit provides assurance against a defined audit plan and often follows established testing methodology. A health check can be more diagnostic. It helps an organisation identify the areas most likely to concern a regulator, assess readiness for a forthcoming audit or inspection, and prioritise action before weaknesses become formal findings.

The scope should reflect the firm’s business model. A payment institution processing cross-border transactions faces different risks from a corporate service provider onboarding complex ownership structures, or an online gaming operator managing customer behaviour at scale. A generic checklist may identify obvious omissions, but it will not determine whether controls are calibrated to the firm’s actual customers, delivery channels, jurisdictions, products and transaction profile.

Start with the risk assessment, not the policy library

Most AML frameworks are built on a risk-based approach. That makes the Business Risk Assessment, or BRA, the logical starting point for a meaningful review. The BRA should explain the risks the organisation faces and the controls it relies on to manage them. If it is outdated, too high-level or disconnected from operational practice, the rest of the framework is vulnerable.

A review should test whether the BRA considers relevant risk drivers, including customer types, geographical exposure, products and services, distribution channels, delivery methods and transaction activity. It should also consider whether the assessment captures changes in the business. A new market, outsourced onboarding model, higher-risk client segment or revised product offering can alter the risk profile materially.

The key question is not whether a BRA exists. It is whether its conclusions lead to appropriate outcomes. Higher-risk relationships should trigger enhanced due diligence, more senior approval, closer monitoring and more frequent review where justified. Lower-risk cases may support simplified measures, but only where the rationale is clear and permitted. If risk ratings are assigned inconsistently or do not affect the customer journey, the framework may be compliant in form while ineffective in practice.

Look for alignment across the control framework

A defensible programme has a clear line from risk assessment to policy, procedure, systems and evidence. For example, if a firm identifies elevated risk from politically exposed persons, the procedures must explain how PEPs are identified, assessed, approved and monitored. Screening tools, case-management workflows and staff guidance must then support those procedures.

Misalignment often appears in subtle ways. The policy may require adverse media screening, but files may not show when it was performed, what sources were reviewed or how potential matches were resolved. A risk methodology may refer to country risk, while frontline teams use an informal list that has not been approved or reviewed. These gaps matter because regulators assess both the design and operating effectiveness of controls.

Test client onboarding where risk decisions are made

Client onboarding is where a firm demonstrates that it understands who it is doing business with and why the relationship is acceptable. An effective review should sample files across risk categories, jurisdictions, business lines and onboarding periods. File testing should be sufficiently targeted to reveal patterns, rather than relying on a small selection of straightforward cases.

The review should assess whether customer identification and verification are complete, whether beneficial ownership has been identified and corroborated appropriately, and whether the purpose and intended nature of the relationship are understood. For corporate clients, this includes assessing whether ownership and control structures have been traced beyond superficial documentation where risk warrants it.

It should also test the quality of rationale. A file can contain every required document and still fail to demonstrate an informed decision. Consider a client with complex cross-border ownership, a high-risk jurisdictional connection or a business model involving substantial cash exposure. A conclusion of low or standard risk without a reasoned explanation is unlikely to stand up to challenge.

Where enhanced due diligence is required, evidence should show more than a label. The record should support the source of wealth and source of funds assessment, approval by the appropriate level of seniority, additional screening and the frequency of ongoing review. The depth of enquiry should be proportionate. Excessive documentation with no analytical purpose creates operational burden without improving control quality; insufficient enquiry creates regulatory and reputational exposure.

Review screening, monitoring and escalation as connected controls

Screening and transaction monitoring are frequently treated as technology questions. They are governance questions as well. A health check should examine whether sanctions, PEP and adverse media screening rules are appropriate, whether alerts are resolved consistently and whether records demonstrate the basis for closure or escalation.

False positives are expected, particularly in high-volume environments. The concern arises when teams close alerts using generic comments, lack sufficient information to make an informed decision or cannot evidence quality assurance. Equally, an overly restrictive system configuration may suppress meaningful alerts. The right threshold depends on the firm’s risk appetite, customer base and available investigative capability.

Transaction monitoring needs similar scrutiny. Scenarios, thresholds and review frequencies should derive from the organisation’s risk assessment and known typologies relevant to its sector. A firm should be able to explain why a scenario exists, what behaviour it is intended to detect, how changes are governed and how effectiveness is assessed. Monitoring that produces a large volume of low-value alerts can distract investigators from genuine risk.

Escalation arrangements should connect these controls to the MLRO and wider governance structure. Staff must understand when concerns require escalation, how internal reports are documented and how decisions are recorded. Confidentiality, tipping-off restrictions and clear decision ownership are essential. A well-written suspicious activity reporting procedure is of limited value if staff do not recognise red flags or fear that escalation will be treated as an operational failure.

Assess governance, training and management information

AML compliance cannot sit solely with the MLRO. Senior management remains accountable for ensuring that adequate resources, oversight and challenge are in place. A review should therefore assess committee structures, reporting lines, meeting records, issue ownership and the timeliness of management information.

Useful management information does not merely count completed checks. It helps leaders understand risk and control performance. This may include overdue periodic reviews, high-risk client population trends, alert ageing, screening outcomes, training completion, quality assurance results, internal reporting volumes and open remediation actions. The metrics should prompt decisions, not create a reporting burden with no practical use.

Training also requires more than attendance records. Staff in onboarding, operations, customer-facing roles and senior management need content relevant to their responsibilities. Targeted training following a control change, regulatory development or identified weakness is often more effective than repeating generic annual material. Testing comprehension can provide stronger evidence that employees can apply procedures under pressure.

Turn findings into a credible remediation plan

The value of an AML health check review lies in what happens next. Findings should be prioritised according to regulatory impact, financial crime exposure, customer impact and the feasibility of remediation. A minor documentation inconsistency and a systemic failure to apply enhanced due diligence should not receive the same treatment.

Each action should have a clear owner, deadline, required resource and measurable completion criterion. Vague actions such as “improve monitoring” or “update procedures” invite delay and make closure difficult to evidence. A stronger action defines the change, the affected population, the approval route, the testing required and the point at which management can accept that the risk has been reduced.

Some issues can be corrected quickly through revised templates, clearer guidance or targeted file remediation. Others may require changes to systems, outsourcing arrangements, staffing or governance. The right response depends on the root cause. Re-training staff will not resolve a poorly designed workflow, and a new system will not fix unclear risk appetite or inconsistent leadership challenge.

For organisations operating under sustained regulatory scrutiny, an independent perspective can provide the clarity needed to move from awareness to action. Complipal approaches health checks as an opportunity to strengthen the full control environment, translating regulatory expectations into practical improvements that teams can operate and leaders can defend.

A useful review should leave the organisation with more than a list of defects. It should provide a realistic route to stronger decisions, clearer accountability and evidence that compliance is being managed as a continuing business responsibility.