AML testing preparation and evidence tools
AML audit checklist 2026 with 40 checks and free templates
Published · Last updated
An anti-money laundering (AML) audit checklist should connect each control to the evidence that shows whether it worked. Actigy BPO’s AML Audit Evidence Kit provides 40 practical checks across 10 areas, plus an editable checklist, sampling log and findings tracker. It helps teams prepare records, test selected controls and follow remediation through to verified closure.
Test the live process against the policy. Inspect completed customer files for missing evidence, reconcile monitoring feeds and retest repaired controls. A reviewer should be able to reconstruct the work, identify the rule applied and locate the authorized decision.
This guide is designed for compliance operations teams at banks and financial technology businesses preparing for review. It uses US bank sources as its main reference and identifies selected UK, EU and virtual-asset differences. A fintech label does not establish which rules apply. The regulated entity, licence, activity and jurisdiction determine that. Adapt this planning aid with your compliance lead and qualified independent reviewer. It is not a legal opinion, regulator-approved checklist or independent audit report.
Download the free Actigy BPO AML Audit Evidence Kit. The Excel file includes the 40 checks, editable result fields, a findings tracker and a sampling log. No email is required. Use the checklist below without downloading anything.
What belongs in an AML audit checklist?
Actigy BPO’s checklist covers governance, risk assessment, customer identification, enhanced due diligence, screening, monitoring, investigations, records and suppliers, training, and findings closure. For every applicable check, record the owner, evidence reference, test performed, result and next action. Mark a check not applicable only when the rationale has been reviewed.
The checklist is an original editorial tool. Its test procedures are suggested ways to inspect evidence, rather than a list of 40 legal requirements. The linked sources explain the underlying regulatory context. Your audit scope may need additional modules for cash reporting, correspondent banking, information sharing, transfers, specific products or local rules.
What the latest available evidence means for audit preparation
These figures describe different populations. They are useful context for choosing tests, but they are not comparable scores of AML effectiveness.
| Measure | Reported result | Scope and audit implication |
|---|---|---|
| Suspicious activity reports | 4.8 million in FY2025, versus 4.3 million in FY2022 | FinCEN rounded filing totals. Inspect reporting quality and timeliness. More filings do not establish more detected crime. S03 |
| Currency transaction reports | 21.5 million in FY2025 | FinCEN filing total. Include cash-reporting controls where applicable. S03 |
| Travel Rule legislation | 83 percent in 2026, versus 73 percent in 2025 | FATF surveyed jurisdictions. A law on the books does not prove operational implementation. S04 |
| Clients lost through slow onboarding | 70 percent of surveyed firms in 2025 | Fenergo surveyed 600 senior decision-makers across banks, asset managers and fund administrators in the UK, US and Singapore. Test stalled handovers and evidence requests. S05 |
| Use of advanced AI in AML and KYC | 82 percent in 2025 | Fenergo self-reported adoption. Adoption does not establish control quality. Inspect validation, source traceability and human review. S05 |
| Rising mobile-channel fraud targeting | 96 percent of surveyed financial institutions | LexisNexis Risk Solutions’ 2026 study covered 319 fraud and risk professionals in the US and Canada. This is fraud context, not an AML detection rate. S07 |
| Financial crime compliance cost | US$61 billion in the US and Canada | Historical LexisNexis and Forrester estimate published in 2024, based on 2023 fieldwork. The regional sample was 160 respondents. Do not present it as 2026 spending. S06 |
| Fiscal year | SAR filings, millions |
|---|---|
| FY2022 | 4.3 |
| FY2023 | 4.6 |
| FY2024 | 4.7 |
| FY2025 | 4.8 |
Source: FinCEN Year in Review FY2025. These are rounded filing counts, not unique crimes, customers or convictions.
Use the figures to understand workload and select areas for testing. Then trace selected records from source data to the decision. Filing counts and completed-task totals alone cannot establish that a control worked.
Changes to account for in the 2026 review
US beneficial ownership verification
FinCEN’s order dated 13 February 2026 allows covered institutions to limit beneficial-owner identification and verification to the first account opening, later facts that reasonably question the reliability of existing ownership information, and updates required by risk-based ongoing due diligence. Other applicable obligations continue. S02
For an audit, test those triggers. Check whether the procedure, system logic and staff instructions agree. Do not assume that every repeat account requires a fresh verification, or that repeat accounts can bypass all ownership controls. Keep customer due diligence (CDD) separate from corporate beneficial-ownership reporting obligations.
Reporting guidance and proposed rules
The Federal Financial Institutions Examination Council (FFIEC) section on suspicious activity reports (SARs) directs readers to the newer interagency FAQs, including those issued in October 2025, for certain reporting topics. Use those FAQs when assessing continuing activity and documentation of a decision not to file. A firm can adopt useful internal records without mislabelling each record as a legal requirement. S12 S13
FinCEN also published a new AML/CFT program proposal in April 2026, superseding its 2024 proposal. Record proposals in the change register, but confirm final status and applicable dates before changing mandatory audit criteria. This checklist does not treat the proposal as an effective rule. S17
UK and EU scope
UK regulation 21 addresses an independent audit function where appropriate to the size and nature of the business. That qualification matters when setting scope. In the EU, Regulation 2024/1624 generally applies from 10 July 2027, with a later date for football clubs and agents. A 2026 review should distinguish current obligations from readiness work for future requirements. S15 S16
Virtual assets
FATF’s July 2026 update reports progress on Travel Rule legislation while highlighting implementation and supervision gaps. Where virtual assets are in scope, test the actual transfer-information workflow, counterparty controls and exception handling against applicable local rules. Do not infer compliance from a vendor feature or national adoption statistic. S04
Before testing, define scope and preserve independence
Write a short scope memo that identifies the legal entities, review period, products, systems and exclusions. Name the decision-maker for scope disputes. Agree how sensitive evidence will be accessed and how urgent findings will be escalated. Keep the original source records intact.
For US banks, FFIEC guidance calls for qualified independent testing and reporting to the board or an appropriate board committee. It gives 12 to 18 months as an example of a periodic interval. The frequency should reflect the bank’s risk and changes in its business. It is not a universal annual rule for every institution. S01
Operational quality assurance checks the work being delivered. Independent testing assesses the control environment with appropriate separation. If a team prepares files or operates a queue, do not assume that the same team can independently audit that work. Actigy BPO’s role described here is operational preparation and remediation support.
The AML audit checklist: 40 checks
Use the following checks as a starting point. Each group links to source context, while the specific test steps are Actigy BPO’s proposed procedures. Record actual results in the downloadable workbook. Do not infer a pass from the existence of a policy.
Governance and audit scope
Reference context: S08. Tailor the test to the applicable obligations and approved audit scope.
| Check | Evidence to request | Suggested test |
|---|---|---|
| G01 Define the entity and rules | Entity register, licences, product map and obligation inventory | Trace each in-scope product and jurisdiction to an accountable owner. Record exclusions and why they apply. |
| G02 Confirm decision authority | Approved AML program, delegation matrix and committee records | Compare actual approvals with permitted authority. Check escalation cover during absence. |
| G03 Set an independent review | Audit charter, reviewer credentials and conflict declaration | Check whether reviewers operate, design or approve the controls they are testing. Resolve conflicts before relying on conclusions. |
| G04 Define the period and follow-up | Scope memo, prior findings and change register | List period, systems, acquired books and open issues. Explain what is excluded and who will test it. |
Risk assessment and change
Reference context: S08. Tailor the test to the applicable obligations and approved audit scope.
| Check | Evidence to request | Suggested test |
|---|---|---|
| R01 Match risk to the customer book | Risk assessment and customer, product and geography inventories | Reconcile the assessment population to current business activity. Investigate unmapped segments. |
| R02 Review risk rating overrides | Methodology, override log and approval history | Select overrides in both directions. Check evidence, authority and impact on review frequency. |
| R03 Track regulatory changes | Change register, applicability analysis and implementation records | Trace a recent relevant change from assessment through procedure, system configuration and training. |
| R04 Test emerging exposures | New product approval, typology review and control mapping | Select an applicable emerging risk, such as digital-asset exposure, and check its assigned controls and owner. |
Customer identification and ownership
Reference context: S09. For check C02, also use the 2026 order S02. Tailor the test to the applicable obligations and approved audit scope.
| Check | Evidence to request | Suggested test |
|---|---|---|
| C01 Reperform identity checks | Customer file, verification evidence and exception history | Compare captured identity fields with source evidence and the applicable CIP or KYC procedure. |
| C02 Test ownership triggers | Ownership evidence, relationship history and current CDD policy | For covered US institutions, test first-account, reliability-concern and risk-based update triggers under FIN-2026-R001. |
| C03 Resolve conflicting data | Customer declarations, registry extracts and discrepancy records | Follow conflicting names, ownership or identifiers to a recorded resolution or named escalation. |
| C04 Control failed verification | Pending queue, restrictions and approved exception records | Review unresolved and rejected cases as well as completed ones. Trace the approved outcome. |
Enhanced review and refresh
Reference context: S10. Tailor the test to the applicable obligations and approved audit scope.
| Check | Evidence to request | Suggested test |
|---|---|---|
| D01 Support enhanced due diligence | Risk trigger, source evidence and approval record | Select high-risk relationships. Check that the enhanced work addresses the actual risk and follows policy. |
| D02 Make refresh triggers visible | Review schedule and event-triggered refresh queue | Check scheduled and event-driven updates, including changes in ownership or activity. |
| D03 Measure overdue work | Ageing report, risk tier and escalation records | Reconcile overdue counts to source cases. Review oldest high-risk items and approved interim controls. |
| D04 Separate file repair from acceptance | Remediation record, QA result and client decision | Trace a repaired file to QA and any separate customer decision. Preserve unresolved gaps. |
Sanctions and screening
Reference context: S11. Tailor the test to the applicable obligations and approved audit scope.
| Check | Evidence to request | Suggested test |
|---|---|---|
| S01 Verify list coverage and updates | Applicable-list inventory, update logs and failed update alerts | Trace a relevant list update to the screening engine and any required rescreening. |
| S02 Test matching behaviour | Approved test cases, configuration and change history | Run controlled known-match and non-match tests, including permitted spelling variants. Record limitations. |
| S03 Review hit dispositions | Screening result, identifiers, rationale and approval | Select cleared and escalated hits. Check that evidence supports the decision within authority limits. |
| S04 Separate screening risk types | Sanctions, PEP and adverse-media procedures | Confirm distinct handling for sanctions restrictions, politically exposed persons and media risk. |
Monitoring and data integrity
Reference context: S12. Tailor the test to the applicable obligations and approved audit scope.
| Check | Evidence to request | Suggested test |
|---|---|---|
| M01 Reconcile source data | Transaction totals, interfaces, rejected records and ingestion logs | Reconcile counts and values across the source and monitoring population. Investigate missing records. |
| M02 Map scenarios to risk | Scenario inventory, typologies and threshold approvals | Link active scenarios to applicable risks. Inspect gaps, disabled rules and unexplained exclusions. |
| M03 Challenge changes and automation | Change approvals, validation evidence and version logs | Replay agreed test cases after a rule or model change. Include override handling and approved human review. |
| M04 Inspect work outside alerts | Below-threshold tests, manual referrals and rejected records | Use risk-based targeted testing to check what alert-only samples would miss. State the limits of the test. |
Investigation and reporting
Reference context: S13. Tailor the test to the applicable obligations and approved audit scope.
| Check | Evidence to request | Suggested test |
|---|---|---|
| I01 Trace a case chronology | Alert, investigation steps, evidence and disposition timestamps | Reconstruct selected cases from detection to authorized outcome. Assess unexplained delays. |
| I02 Test reporting obligations | Applicable reporting rules, due-date logic and filing acknowledgements | Check selected filing decisions and deadlines against the entity-specific requirements and current guidance. |
| I03 Check narrative evidence | Draft, source transactions and reviewer comments | Compare material statements with source records. Verify authorized review of any automated draft. |
| I04 Protect reporting confidentiality | Access list, transfer controls and training evidence | Test access restrictions and approved sharing routes. Use redacted references in general-purpose audit logs. |
Records and outsourced operations
Reference context: S08. Tailor the test to the applicable obligations and approved audit scope.
| Check | Evidence to request | Suggested test |
|---|---|---|
| O01 Retrieve the evidence | Retention schedule, source links and access logs | Retrieve a historical sample under approved access. Check integrity and applicable retention requirements. |
| O02 Confirm supplier authority | Contract, task matrix, location and subcontractor register | Compare actual outsourced work with agreed scope, approved locations and escalation boundaries. |
| O03 Test permissions and handovers | User roles, leaver logs and shift handover records | Sample access changes and cases crossing teams. Confirm the next owner and outstanding actions. |
| O04 Check quality and continuity | QA plan, defect log, incident records and contingency test | Review reopened cases and recurrence. Test an agreed operational disruption scenario. |
Training and operational capacity
Reference context: S14. Tailor the test to the applicable obligations and approved audit scope.
| Check | Evidence to request | Suggested test |
|---|---|---|
| T01 Match learning to responsibilities | Role inventory, curriculum and training assignments | Compare training requirements with actual duties and access permissions. |
| T02 Test competence after change | Completion records, case exercises and coaching logs | Check a recent procedure change using a relevant case exercise and follow-up on errors. |
| T03 Check backlog drivers | Intake, completions, reopened work and staffing records | Break ageing down by risk tier and pending reason. Identify whether the constraint is staffing, evidence or decisions. |
| T04 Provide escalation cover | Named decision owners, coverage plan and escalation tests | Check whether urgent issues can reach an authorized decision-maker during staffed hours. |
Findings and verified closure
Reference context: S01. Tailor the test to the applicable obligations and approved audit scope.
| Check | Evidence to request | Suggested test |
|---|---|---|
| F01 Write reproducible findings | Condition, criteria, cause, impact and supporting references | Ensure another reviewer can reproduce the exception from restricted evidence references. |
| F02 Assign risk and action | Severity rationale, owner, action plan and due date | Use the approved severity method. Link the remedy to the root cause and interim risk control. |
| F03 Retest the repair | Changed control, implementation evidence and new sample | Separate implementation from validation. Retest against the original failure condition. |
| F04 Report residual exposure | Open issues, overdue actions and governance minutes | Report repeat findings, overdue high-risk work and accepted residual risks to the correct governance body. |
How to select an audit sample
Actigy BPO’s sampling log records the population, period, selection method, sample size and limitations. It keeps the reason for selecting a case visible, so the results can be interpreted correctly.
Start by validating the population. A sample from an incomplete export cannot test the records that never reached it. Reconcile the export with the source system, retain the extraction date and document exclusions. Use secure record identifiers rather than customer names in general-purpose planning files.
Combine selections appropriate to the audit objective. A random selection can inspect routine work. Targeted selections can examine higher-risk cases, overrides, overdue work, new systems or known failure points. Include closed and escalated cases. Where monitoring completeness is being tested, examine relevant activity outside the alert queue as well.
Illustrative example, not a prescribed sample size: an institution selects 60 files from a population of 2,000. Forty are randomly selected and 20 are targeted high-risk files. Six files have defects: two in the random group and four in the targeted group. The combined sample defect rate is 6 ÷ 60, or 10 percent. It is a description of that sample, not a valid estimate that 10 percent of all 2,000 files are defective. Keep the two selection methods separate and let the auditor determine whether expansion is needed.
A documented sample plan should explain the objective, population, selection method, risk coverage and reason for the sample size. There is no universal number in this guide that makes a sample sufficient. If you need statistical inference, use a design and calculation appropriate to the population and intended confidence.
Build an evidence pack a reviewer can follow
The Actigy BPO evidence chain connects the source record, applicable rule, work performed, authorized decision and subsequent validation. Keep those links together. A screenshot of a completed task usually cannot explain the whole chain.
For each tested item, retain a restricted reference to the original evidence, the procedure version, performer and reviewer, timestamps, unresolved questions and final disposition. A later reviewer should be able to understand what was known at the time. Preserve the difference between a missing document, an incomplete review and a decision awaiting client approval.
When missing or inconsistent customer evidence is the main problem, Actigy BPO’s KYC remediation service can support file repair against the client’s approved standard. For routine lifecycle maintenance after a repair project, KYC refresh and periodic review addresses a different operating need. Keep both populations identifiable in management reporting.
Turn findings into verified remediation
A useful finding states the condition observed, the applicable criteria, the cause where established, the potential impact, and the evidence reference. Avoid vague instructions such as “improve KYC.” They do not identify what must change or how closure will be judged.
Illustrative finding: in a targeted review of 20 high-risk files, four lacked the documented approval required by the firm’s policy. The finding should identify the affected population and whether the problem is missing evidence, missing approval or a failed workflow. Those are different conditions. The compliance owner determines the immediate treatment of affected relationships. The remediation team repairs the workflow and records. A suitably independent reviewer then tests the repair.
Use the tracker to record severity under your approved method, the accountable owner, due date, interim control, action taken and validation evidence. Keep an issue open until the required validation and authorized closure are recorded. An implementation date alone is not a closure decision.
Report open high-severity issues alongside completion measures. Ninety-nine closed items do not offset one unresolved material gap. Review repeat findings to see whether the original root cause was addressed.
Metrics that explain progress
| Metric | Definition | Interpretation |
|---|---|---|
| Sample evidence completeness | Tested records with all required evidence ÷ tested records | Measures evidence availability in the sample, not overall legal compliance |
| Sample defect rate | Defective tested records ÷ tested records | Report selection method, defect definition and period |
| Overdue high-risk reviews | Open high-risk reviews past their approved due date | Separate missing evidence from pending decisions |
| Reopened case rate | Reopened completed cases ÷ completed cases in the defined cohort | State the observation window and reason for reopening |
| Verified closure rate | Findings validated and formally closed ÷ findings in the defined cohort | Exclude actions merely labelled implemented |
Set targets from the institution’s obligations, risk and operating baseline. This guide supplies definitions, not invented industry benchmarks or a regulator-approved readiness score.
A 30-day audit preparation plan
The following sequence is a planning example. Actual scope and deadlines depend on the audit mandate and severity of the issues. Urgent reporting or risk actions must not wait for a preparation timetable.
| Timing | Accountable owner | Output |
|---|---|---|
| Days 1 to 5 | Compliance lead and independent reviewer | Scope, applicable rules, independence assessment and evidence request |
| Days 6 to 10 | Operations and data owners | Reconciled populations, evidence references and known-gap register |
| Days 11 to 20 | Authorized reviewer and control owners | Completed agreed tests, documented exceptions and immediate escalations |
| Days 21 to 30 | Remediation owners and independent validator | Prioritized actions, retest evidence for completed repairs and an open-issue report |
Where Actigy BPO can support the work
Actigy BPO supports defined AML and KYC operations under client-approved procedures. Relevant scopes include alert-review backlogs, screening-hit review, case documentation and customer-file remediation. The client retains risk policy, customer decisions and regulatory filing decisions. These services can help assemble and repair evidence for review, while the independent auditor retains the audit judgment. S18 S19
| Operating problem | Relevant Actigy BPO service | Decision retained by the client |
|---|---|---|
| Alert queue or case-documentation backlog | AML outsourcing | Monitoring policy, authority limits and filing decisions |
| Deficient CDD or EDD files | KYC remediation | Risk ratings, acceptance, restrictions and exits |
| Scheduled or event-driven customer updates | KYC refresh | Review rules and resulting customer decisions |
| Onboarding review capacity | KYC outsourcing | Required checks, exception approvals and acceptance |
Scope an AML or KYC remediation pilot with Actigy BPO. Share the queue type, approximate volume, known evidence gaps and required coverage. Agree the permitted work, QA criteria, escalation owner and acceptance conditions before live processing. Discuss your scope. See how Actigy BPO works for the process-audit and paid-pilot approach.
Related Actigy BPO guides
Use the customer-level KYC checklist
Frequently asked questions
What is the difference between an AML checklist and an AML audit?
A checklist organizes the areas to inspect. An audit applies a defined scope, appropriate independence, testing and professional judgment to reach a conclusion. Downloading or completing Actigy BPO’s checklist does not create an audit opinion.
How often should an AML audit take place?
The answer depends on the entity and applicable rules. For US banks, FFIEC guidance describes risk-based frequency and gives 12 to 18 months as one example. Significant changes or deficiencies may justify more frequent testing. Confirm sector-specific requirements before adopting an interval. S01
What documents should be prepared?
Start with the approved program, risk assessment, procedures, system and scenario inventories, reconciled case populations, evidence references, training records and prior findings. The reviewer should tailor the request to the audit objective. Keep confidential material in approved systems.
Can AML audit preparation be outsourced?
Defined evidence preparation and remediation work can be assigned to an external provider under approved controls. Actigy BPO offers operational support for this work. Confirm access, scope and accountability, and assess any independence conflict before using an operating provider for assurance.
Is there one AML audit checklist for every country?
No. Terms such as BSA/AML, AML/CFT and suspicious transaction reporting sit within different legal regimes. Use the 40 checks as an organizing tool, then map each one to the obligations that apply to the specific entity and activity.
How should the downloadable template be used?
Save a working copy in your approved environment. Set applicability and the test plan before entering results. Use restricted evidence IDs, not sensitive customer data or SAR contents. Track findings to retest and authorized closure. The blank workbook contains no client data and no pre-filled pass results.
For customer-file preparation, use Actigy BPO’s KYC checklist and decision record. This audit guide then examines the evidence and controls behind that work.
Download the Actigy BPO working files
Download the AML Audit Evidence Kit Excel workbook
Download the source and data notes CSV
Download the chart data CSV for the separate FinCEN filing series and FATF legislation percentages.
For a narrative record alongside the Excel kit, download the supplemental AML audit workpaper (Word). It contains scope and independence fields, an individual test record and a remediation closure log.
Methodology and source notes
Actigy BPO compiled this guide from public regulatory material, official statistics, research-provider publications and its public service descriptions, checked on 18 October 2026. The checklist, test suggestions, evidence chain and planning timetable are original editorial tools. They have not been presented as findings from an Actigy BPO client study or endorsed by a regulator.
Public figures retain their original measurement periods and scope. Fenergo and LexisNexis figures are vendor research and include self-reported responses or estimates. FinCEN filing counts are administrative data. FATF percentages concern surveyed jurisdictions. These sources should not be combined into a single effectiveness score. Recheck current rules and source revisions before using the guide for a live audit.
Suggested citation: Actigy BPO. AML Audit Checklist 2026 with 40 Checks and Free Templates. Research checked 18 October 2026. Link to the canonical article when citing this toolkit or its original graphics.
Reuse: You may reuse the original Actigy BPO checklist and graphics with clear attribution and a link to this article. Underlying third-party data remains subject to its original source terms. Do not imply regulatory endorsement or remove scope notes.
Sources
S01. FFIEC. BSA AML Independent Testing. Current manual checked 2026-10-18.
S02. FinCEN. Exceptive Relief Order FIN 2026 R001. 2026-02-13.
S03. FinCEN. Year in Review FY 2025. FY2025 data; 2026 publication.
S04. FATF. Seventh targeted update on virtual assets and VASPs. 2026-07-16.
S05. Fenergo. Financial Crime Industry Trends 2025. Published 2025-10-07; fieldwork August 2025.
S06. LexisNexis Risk Solutions and Forrester Consulting. True Cost of Financial Crime Compliance US and Canada. Published 2024-02-21; fieldwork May to June 2023.
S07. LexisNexis Risk Solutions. True Cost of Fraud Study 2026 North America. 2026 edition; fieldwork dates not given on landing page.
S08. FFIEC. BSA AML Internal Controls. Current manual checked 2026-10-18.
S09. FFIEC. Customer Identification Program. Current manual checked 2026-10-18.
S10. FFIEC. Customer Due Diligence. Current manual checked 2026-10-18.
S11. OFAC. Framework for OFAC Compliance Commitments. 2019-05-02; checked 2026-10-18.
S12. FFIEC. Suspicious Activity Reporting. Current manual checked 2026-10-18.
S13. FinCEN and federal banking agencies. Suspicious Activity Report FAQs. 2025-10-09.
S14. FFIEC. BSA AML Training. Current manual checked 2026-10-18.
S15. UK legislation. Money Laundering Regulations 2017 regulation 21. Current text checked 2026-10-18.
S16. EUR Lex. Preventing abuse of the financial system from 2027. Regulation EU 2024/1624; checked 2026-10-18.
S17. FinCEN. Proposed AML CFT program rule fact sheet. April 2026.
S18. Actigy BPO. AML outsourcing. Live page checked 2026-10-18.
S19. Actigy BPO. KYC remediation. Live page checked 2026-10-18.