What Regulators Are Really Looking For in an AML Examination
Pathik Shah
In an AML examination, regulators are looking for evidence that the institution understands its ML/TF risks, applies proportionate controls, escalates and reports suspicious activity, maintains effective governance, and can prove that the compliance programme works in practice.
A practitioner guide for compliance officers and MLROs on the shift from technical compliance to effectiveness assessment in AML examinations, covering the five elements most consistently tested, evidence that examiners value, and how to prepare for an effectiveness-based examination. Written by Pathik Shah for AML Guild.
AML Expert
Get tailored guidance on your compliance obligations, SAR filing, or AML program review.
- The shift from technical compliance to effectiveness assessment
- The five things examiners test most consistently
- What examiners are not primarily looking for
- The evidence that examiners value most
The Shift from Technical Compliance to Effectiveness Assessment
In earlier phases of AML/CFT supervision, regulatory examinations were primarily concerned with technical compliance: did the institution have the required policies? Was the CDD process documented? Were STRs being filed? These questions remain relevant, but they are now the floor rather than the ceiling of regulatory assessment. The modern risk-based supervisor assesses whether the documented programme is actually producing the outcomes it is designed to produce.
The FATF effectiveness methodology, which underpins the mutual evaluation process and which many mature supervisors have incorporated into their examination frameworks, assesses eleven immediate outcomes. For financial institutions, the most directly relevant outcomes concern the degree to which they understand their risks, apply risk-based measures, detect and report suspicious activity, and are effectively supervised. The examiner who is applying this framework is not asking whether a policy exists. They are asking whether the policy is producing the intended result.
The Five Things Examiners Test Most Consistently
1. Whether the Risk Assessment Drives the Programme
The business risk assessment, or institutional risk assessment, is the foundation of the risk-based approach. The examiner will assess whether the risk assessment is genuine and current, whether it reflects the actual products, customers, channels, and geographies of the institution, and most importantly whether the programme design follows from the risk assessment. A risk assessment that identifies high-risk customers but whose findings are not reflected in the enhanced CDD and monitoring processes is not driving the programme. It is a document that exists independently of the programme it is supposed to inform.
When I design a programme, the risk assessment has to visibly drive everything downstream, or it is just a document. Examiners can tell within minutes whether the enhanced CDD and monitoring follow from the risk assessment, so I make that linkage explicit in the policy and in the controls themselves.
Jyoti Maheshwari | CAMS, ACA, AML/CFT Practitioner, AML Guild
2. Whether the Monitoring System Is Working
Transaction monitoring is one of the most consistently examined elements of the AML programme, and one of the most consistently found to have weaknesses. The examiner will test whether the monitoring rules are calibrated to the risk profile of the institution, whether they are generating alerts at a rate consistent with the expected risk exposure, whether those alerts are being investigated to an adequate standard, and whether investigations that identify genuine concern are being escalated to the STR/SAR or suspicious activity reporting process, depending on the jurisdiction. The monitoring system that has not been tuned since implementation, that generates alerts at a rate inconsistent with the institution's risk profile, typologies, historical alert volumes and peer expectations where available, or whose alerts sit in a queue awaiting investigation for weeks or months, is likely to raise serious supervisory concern.
3. The Quality of STR/SAR Filings
Regulators assess both the quantity and quality of STR filings. The quantity assessment looks at whether the filing rate is consistent with the expected rate given the institution's size and risk profile. The quality assessment looks at whether filed STRs are specific, factually grounded, and analytically useful, or whether they are vague, formulaic, and filed primarily as a risk management precaution rather than as a genuine intelligence contribution. An institution that files a large volume of low-quality STRs is not necessarily in a better examination position than one that files a smaller volume of well-constructed reports.
4. The Governance of the Programme
The examiner will review whether the board and senior management are adequately informed about the state of the compliance programme. This means looking at the management information provided to the board, the minutes of any board or audit committee meetings that address compliance matters, and the degree to which the information presented accurately reflects programme weaknesses rather than only programme achievements. The compliance officer who presents only positive compliance metrics to the board and withholds evidence of programme deficiencies is creating a governance failure that regulators specifically test for.
5. The Independence and Seniority of the Compliance Function
The examiner will assess whether the MLRO or chief compliance officer has the seniority, resources, and independence required to perform the role effectively. This includes reviewing whether the compliance officer has direct access to the board, whether the compliance function is adequately resourced relative to the risk profile of the institution, and whether there are any structural or cultural factors that limit the compliance officer's ability to escalate concerns or make independent decisions. The compliance function that is structurally subordinate to the commercial operation, or that lacks the resources to perform its obligations, is a governance weakness that examiners take seriously.
What Examiners Are Not Primarily Looking For
Understanding what examiners are not primarily testing is as useful as understanding what they are. Examiners in most modern supervisory frameworks are not primarily looking for technical breaches of specific regulatory provisions, unless those breaches are evidence of a systemic programme failure. A single STR that was filed a day late in an otherwise well-functioning reporting process may not, by itself, be treated in the same way as a systemic pattern of late filings. The same institution that has a pattern of late filings, or that has never reviewed whether its filing rate is consistent with its risk profile, is carrying a very different examination risk.
Examiners are also not primarily looking to catch the compliance officer out on specific technical knowledge. The examination is an assessment of the institution's programme, not a test of the compliance officer's individual expertise. The compliance officer who does not know the precise answer to a specific question but who can demonstrate that the programme is well-governed, well-documented, and genuinely effective, is presenting a stronger picture than the one who can recite the technical provisions but whose programme does not reflect them in practice.
The Evidence That Examiners Value Most
The evidence that carries most weight in a modern AML examination is evidence of genuine operational engagement with the compliance programme: alert investigation records that show substantive analysis rather than formulaic closure notes; STR decision memos that demonstrate the reasoning behind the decision to file or not file; board and committee minutes that show genuine oversight of the programme rather than passive receipt of information; and training records that demonstrate not only that training occurred but that it was relevant to the specific roles of the people trained.
From my governance and CDD work, the evidence examiners trust most is the unglamorous kind: investigation notes that show real analysis and minutes that record genuine challenge. I tell teams to let the board see the problems, because a record that only ever reports good news reads as a governance gap, not a clean programme.
Dipali Vora | CAMS, ACA, AML/CFT Practitioner, AML Guild
The evidence that carries least weight is documentation that appears to have been created for the examination rather than as a record of genuine compliance activity: policies that have never been reviewed since they were written, procedures that do not reflect the actual process as it operates, risk assessments that have not been updated to reflect significant changes in the business, and management information that presents a uniformly positive picture without any evidence of the problems that any real compliance programme encounters.
How to Prepare Evidence Before the Examination
Examiners draw their conclusions from records, not assurances. An institution that can produce the following evidence quickly, and show that it reflects day-to-day practice rather than examination preparation, is in a far stronger position. The table maps each core evidence area to the documents worth assembling before notice arrives.
| Evidence area | What to prepare |
|---|---|
| Risk assessment | Latest EWRA/BRA, methodology, board approval, link to controls |
| CDD and EDD | Sample files, EDD approvals, source of funds / source of wealth records |
| Screening | Screening logs, match decisions, escalation records, list update process |
| Transaction monitoring | Rule inventory, tuning records, alert ageing, investigation notes |
| STR/SAR governance | STR register, decision memos, filing records, non-filing rationale |
| Governance | Board packs, minutes, MI, issue escalation records |
| Training | Training plan, attendance, role-specific materials, assessment results |
| Independent review | Audit reports, health check reports, remediation tracker |
| Remediation | Open and closed findings tracker, action owners, target dates, completion evidence, validation records, overdue action explanation |
Frequently Asked Questions
Everything you need to know about AML examinations and how AML Guild supports your business.
The notice period varies by regulator and examination type. Announced examinations typically come with several weeks of advance notice. Thematic reviews may be announced with less notice. Unannounced or short-notice examinations are possible in most jurisdictions, particularly where a regulator has specific concerns about an institution. The institution should maintain the programme in examination-ready condition at all times rather than relying on advance notice to prepare.
A regulated institution is generally expected to cooperate with its supervisory authority and provide accurate, complete and timely information during an examination. If the compliance officer has concerns about privilege, confidentiality, self-incrimination, legal interpretation or the scope of a request, the matter should be escalated through the agreed legal or governance protocol rather than answered informally or avoided.
- Pre-Examination Preparation: The 90-Day Readiness Programme
- When the MLRO Says No and the CEO Says Yes: Managing the Disagreement Professionally
- How to Read a FATF Mutual Evaluation Report
- Find expert support for AML examination preparation
Dealing with this in your own business? Put a vetted, CAMS-certified AML/CFT professional from AML Guild on it and get hands-on support that holds up to scrutiny. Find your expert at amlguild.com.
Work With Pathik Shah Through AML Guild
Pathik Shah and the AML Guild network provide on-demand, CAMS-certified AML/CFT support for regulated businesses, from building and remediating compliance programmes to preparing for regulatory examination and selecting the right technology.