How to Pass an AML Audit: Complete Checklist

A bank, payment processor, institutional partner, or regulator can request an AML review at any point after you're operating - not just at onboarding. Most founders who fail this haven't skipped AML entirely; they built a program that exists on paper but wouldn't survive someone actually checking it.

What a real review checks

• Is the written AML program specific to your actual business? A generic template rarely survives scrutiny - reviewers can tell.
• Is customer due diligence actually being performed, not just described? A policy that says KYC happens and a system that actually enforces it are different things.
• Is there evidence of ongoing monitoring, not just onboarding checks? A one-time check at signup with nothing after is a common gap.
• Is sanctions screening running and documented? See the sanctions screening guide for what this needs to include.
• Is there a designated compliance function? Someone needs to be accountable, by name, even at a small company.
• Are records retained and retrievable? If asked for six months of screening records, could you produce them today?
• Has the program been reviewed/updated recently? A program written once at launch and never revisited is a red flag on its own.

The most common reason foreign-owned businesses fail this

Not fraud, and rarely bad intent - usually it's a program that was built to satisfy a checkbox rather than to actually function, often because it was set up quickly to get a bank account approved and never revisited once the business was operating. Reviewers can tell the difference between a program built to be used and one built to be shown once.

Next step

If you're not confident your AML program would hold up if a bank, partner, or regulator asked to see it today, that's worth finding out on your own terms, not theirs.

See what a real AML/KYC framework includes →

---

Related reading: AML/KYC Readiness Checklist for a US Launch · AML/KYC Framework for Crypto & Forex · OFAC Sanctions Screening