Most independent AML audits identify findings. That’s the point of the exercise – a review that finds nothing should be able to demonstrate that its testing was sufficiently robust, not simply that the program looked clean on paper. What’s useful is understanding which AML audit findings show up again and again, because those are the gaps many regulated entities are quietly carrying right now.
This article groups 27 of the most common AML audit findings into nine categories, based on recurring themes observed across our independent AML audits, regulatory examinations, public enforcement actions and industry practice.
Quick Answer
The most common AML audit findings cluster around a few root causes: policies that look fine on paper but aren’t followed consistently, risk assessments and customer risk ratings that go stale, thin documentation that can’t show an examiner’s reasoning and governance structures that don’t give the compliance function real authority. None of these are exotic. Most are fixable within one review cycle if they’re caught early.
Why AML audit findings matter more than the audit itself
A finding is not a failure. It’s information. The real risk isn’t having AML audit findings – almost every regulated entity does. The real risk is not knowing about them until a regulator finds them first, at which point the same gap becomes an enforcement matter instead of a fixable line item.
This is exactly why an independent AML audit exists as a distinct control: someone with no stake in the program’s current design has to look at it honestly and say what they see.
The 27 most common AML audit findings, by category
Governance
- The compliance officer’s ability to file a SAR/STR was subject to inappropriate business-line approval or commercial influence, which compromised independent compliance judgment. (Exact filing authority norms vary by jurisdiction, but business interference in the decision is the common thread.)
- Board oversight was infrequent and lacked meaningful challenge on AML effectiveness. Annual reporting alone often falls short of what regulators expect from larger or higher-risk entities and sessions never produced a documented discussion of whether the program was actually working, only whether it existed.
- Compliance resourcing hadn’t scaled with the business, based on its own documented risk assessment and growth. Headcount and technology reflected last year’s transaction volume, not the current one.
Enterprise-Wide Risk Assessment (EWRA)
- The risk assessment was a generic template, not tailored to the entity’s actual customers, products, channels or geographic footprint.
- It hadn’t been refreshed after a new product or market launch, so genuinely new exposure was invisible to the rest of the program.
- The document listed inherent risks but never mapped controls against them to calculate actual residual risk.
KYC / Customer Due Diligence
- Identity verification documents were missing or expired in a meaningful share of the customer files sampled.
- Enhanced due diligence wasn’t consistently triggered for higher-risk customer types, even where the entity’s own risk assessment said it should be.
- Customer information was never refreshed on a periodic or event-driven basis and files still reflected onboarding-day facts years later.
Customer Risk Rating
- Risk ratings didn’t match the stated methodology. Several customers labeled as “low risk” even though they met multiple criteria the entity’s own policy defined as “high risk.”
- Risk scores were static. They were never recalculated after material changes in customer behavior, ownership or activity.
- The rating model leaned on a single factor, often geography, instead of a blended view of product, channel and customer type.
Sanctions and PEP Screening
- Sanctions and PEP list updates weren’t implemented promptly following official list changes and no documented procedure governed how quickly updates had to go live.
- Alert dispositions lacked documented rationale. Analysts marked matches as false positives without recording why.
- Matching thresholds were left at vendor defaults, never tuned to the entity’s actual name-matching risk.
Transaction Monitoring
- Monitoring thresholds hadn’t been reviewed since implementation, despite real shifts in transaction volume and customer mix.
- A backlog of open alerts sat well past the entity’s own internal service-level targets for investigation.
- Alert closure notes were too thin to reconstruct the reasoning behind them. E.g. “No issue found,” with no supporting detail.
STR / SAR Reporting
- Reports were not filed within the applicable regulatory or internal reporting timeframes, with no documented explanation for the delay.
- Report narratives lacked the specificity law enforcement typically needs – dates, amounts, patterns and the red flags actually observed.
- Decisions “Not to file” were inconsistently documented, making it hard to show the reasoning behind a “no SAR/STR” outcome later.
Training
- Training completion records didn’t reliably prove attendance or comprehension and only that an email had been sent.
- Content was generic, not tailored to the entity’s actual risk profile or the red flags most relevant to its business.
- Front-line, customer-facing staff received the same training as back-office compliance staff, with no role-specific content.
Record Keeping
- Retention periods fell short of the jurisdiction’s minimum requirement for certain transaction and customer records.
- Evidence that management had reviewed and closed prior findings was missing or incomplete.
- Records were scattered across multiple systems with no central index, slowing retrieval during the audit and by extension, during any real regulatory request.
Lessons for other regulated entities
A few patterns cut across all 27 items, regardless of category.
Most gaps aren’t exotic, they’re execution gaps. Almost none of these findings involve a missing policy. They involve a policy that exists but wasn’t consistently followed, tested or updated.
Static documents are the common thread. Risk assessments, customer risk ratings and screening configurations all tend to be set once and never revisited, even as the underlying business changes around them.
Documentation is where good decisions go to die. Investigators and analysts often make the right call and then fail to write down why, which means a genuinely sound decision looks indefensible on paper.
Governance authority is the finding behind the findings. When a compliance officer lacks real independence or resourcing, most of the other 26 items become more likely, not less.
While every AML program is unique, the observations above reflect recurring themes identified across our independent AML reviews and commonly cited regulatory expectations in multiple jurisdictions.
A practical AML audit checklist
Use this as a fast self-assessment before your next independent AML audit or effectiveness review. If you can’t answer “Yes” with evidence, treat it as a gap.
- Is your compliance officer’s SAR/STR filing decision free from inappropriate business-line approval or commercial influence?
- Has your enterprise-wide risk assessment been updated since your last new product, market or major customer segment?
- Does every customer risk rating match your own written methodology?
- Are KYC files refreshed on a periodic or event-driven basis, not just at onboarding?
- Are sanctions and PEP list updates implemented promptly, with a documented procedure governing turnaround time?
- Are transaction monitoring thresholds reviewed periodically and whenever material changes occur in customer behavior, products or transaction volumes?
- Is your open-alert backlog within your own stated service-level targets?
- Are SAR/STR filings consistently made within applicable regulatory and internal reporting timeframes?
- Do your report narratives include enough detail for a third party to follow the reasoning?
- Can you prove staff completed AML training, not just that it was sent?
- Do records meet your jurisdiction’s minimum retention period?
- Can you show that last cycle’s audit findings were actually closed?
Frequently Asked Questions (FAQ)
How many findings is normal in an AML independent audit?
There are no fixed number and a low finding count isn’t automatically good news – it can mean the audit scope was too narrow. What matters more than the count is whether findings are tracked, prioritized by risk and closed before the next review cycle.
What are the most common AML audit findings?
There’s no single universal answer, but among the most common are weaknesses in customer due diligence, customer risk rating consistency, documentation quality and transaction monitoring. These appear across nearly every AML audit finding report, regardless of sector or jurisdiction.
Can AML audit findings lead to regulatory action on their own?
Findings from your own independent audit are not, by themselves, an enforcement event. They become a bigger problem when the same gaps are still open at the next audit cycle or when a regulator finds them first during an examination.
How quickly should we fix AML audit findings?
Prioritize findings based on risk, not the order in which they were identified. High-risk issues such as weaknesses affecting independent SAR/STR decision-making, delays in sanctions list updates or unrated high-risk customers should have a documented remediation plan with clear owners and target completion dates, rather than a general commitment to “address them.”
Need an Independent AML Audit?
If any of these 27 items sound familiar, that’s normal and it’s exactly what an independent AML audit is designed to surface before a regulator does. Compliance7 performs independent AML audits and effectiveness reviews for financial institutions, VASPs and DNFBPs, mapped to FATF standards and applicable requirements under the BSA, EU AMLR/AMLD6, UK AML framework, RBI/SEBI, Australia’s AML/CTF regime, etc.
Request an AML Health Check or book an independent AML audit with Compliance7’s team.
