# AML Independent Test Report: [Entity name] [Test period]

> Report of an independent test of an anti-money laundering and counter
> terrorist financing (AML/CFT) programme, including sanctions controls:
> scope, independence, sampling, results by programme area, findings with
> ratings, management responses and an overall conclusion for the board.
> It covers the independent testing pillar of the US bank programme rule
> (31 CFR 1020.210(a)(2)(ii)), the independent audit function of EU law
> (Directive (EU) 2015/849 Article 8(4)(b) as transposed, and Regulation
> (EU) 2024/1624 (AMLR) Article 9(2)(b) from 2027-07-10) and the UK Money
> Laundering Regulations 2017 (regulation 21). The FinCEN AML/CFT programme
> rule published as a proposal on 2026-04-07 is not law; check its status.
> The example bank, Fernhollow Bank, is fictional. Replace every
> `[bracketed]` value and every row marked *Example*. Obtain the law and
> the regulator guidance for the normative text. This is a document format,
> not legal, audit or compliance advice.

<!--
Guidance: How to use this template
- Use it for the periodic independent test of the whole AML/CFT and
  sanctions programme, performed by internal audit or by a qualified
  outside party. For one internal audit engagement on any subject, use
  the Internal Audit Engagement template
  (`compliance/iia-internal-audit-engagement`). For an ISO 19011
  management-system audit, use the Internal Audit Program
  (`compliance/internal-audit-program`). Those templates can host your
  working papers; this file is the report.
- Fill sections 2 to 4 (scope, independence, approach) and have them
  approved before fieldwork. Sections 5 to 10 record results per
  programme area. Section 12 is the finding register; section 13 is the
  conclusion read by the board.
- Test operating effectiveness, not only design. A policy that matches
  the law but is not followed is a finding.
- Common pitfall: a report that only counts exceptions. Explain the root
  cause, the risk it creates and what the bank must change.
-->

## Document control

<!-- Guidance: Record who performed and supervised the test and who receives the report. The board (or its audit or risk committee) must be able to see that the tester was independent and competent. -->

| Field | Value |
|---|---|
| Document ID | [IT-AML-2026] *(Example)* |
| Entity | [Fernhollow Bank, head office and US branch] *(Example, fictional)* |
| Test period (activity reviewed) | [2025-07-01 to 2026-06-30] *(Example)* |
| Fieldwork dates | [2026-07-06 to 2026-08-28] *(Example)* |
| Performed by | [Internal Audit, financial crime audit team / External firm name] |
| Version | [1.0] |
| Status | [Planning / Fieldwork / Draft / Final / Follow-up] |
| Owner | [@lead-tester] |
| Approvers/reviewers | [@chief-audit-executive], [@quality-reviewer] |
| Report recipients | [Audit Committee, Risk Committee, CEO, MLRO / BSA Officer] |
| Last updated | YYYY-MM-DD |
| Classification | [Confidential; contains references to SAR/STR cases, restricted annex] |
| Prior test report | [IT-AML-2025] *(Example)* |

### Approvals

| Stage | Role | Name | Decision | Date |
|---|---|---|---|---|
| Scope and plan | Chief Audit Executive | [@name] | [Approved] | YYYY-MM-DD |
| Draft report | Chief Audit Executive | [@name] | [Released for responses] | YYYY-MM-DD |
| Management responses | MLRO / BSA Officer | [@name] | [Agreed] | YYYY-MM-DD |
| Final report | Chief Audit Executive | [@name] | [Issued] | YYYY-MM-DD |
| Board receipt | Audit Committee chair | [@name] | [Noted] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 0.1 | YYYY-MM-DD | [@lead-tester] | Scope and plan |
| 0.9 | YYYY-MM-DD | [@lead-tester] | Draft for management responses |
| 1.0 | YYYY-MM-DD | [@lead-tester] | Final report |

## Contents

- [1. Executive summary and overall rating](#1-executive-summary-and-overall-rating)
- [2. Scope, period and legal basis](#2-scope-period-and-legal-basis)
- [3. Independence and competence](#3-independence-and-competence)
- [4. Approach, sampling and rating scales](#4-approach-sampling-and-rating-scales)
- [5. Risk assessment](#5-risk-assessment)
- [6. Governance, policies and the reporting officer](#6-governance-policies-and-the-reporting-officer)
- [7. Customer due diligence and enhanced due diligence](#7-customer-due-diligence-and-enhanced-due-diligence)
- [8. Transaction monitoring and suspicious activity reporting](#8-transaction-monitoring-and-suspicious-activity-reporting)
- [9. Sanctions screening](#9-sanctions-screening)
- [10. Training, record keeping and other controls](#10-training-record-keeping-and-other-controls)
- [11. Prior findings follow-up](#11-prior-findings-follow-up)
- [12. Findings register and management responses](#12-findings-register-and-management-responses)
- [13. Conclusion and board reporting](#13-conclusion-and-board-reporting)
- [14. Traceability matrix](#14-traceability-matrix)
- [15. Glossary and references](#15-glossary-and-references)
- [Standard and licence note](#standard-and-licence-note)

## 1. Executive summary and overall rating

<!-- Guidance: Purpose: the page the board reads. Give the overall rating, the two or three issues that matter most and whether prior issues were fixed. Pitfall: an executive summary that repeats the scope instead of stating the conclusion. -->

Write this section last. State the overall rating first, then explain it
in plain language: what works, what does not, and what the exposure is if
nothing changes. Mention any limitation on scope that affects the
conclusion. Keep it to one page so that a non-specialist board member can
read it in a few minutes and know what to ask management.

*Example summary (fictional):* Fernhollow Bank's AML/CFT and sanctions
programme is rated **Needs improvement**. Governance, the reporting
officer function, training and record keeping operate effectively. The
main weakness is the backlog of enhanced due diligence and periodic
reviews for high-risk customers: 1,310 of 10,000 high-risk customers (13.1%)
were overdue at period end (2026-06-30), so the bank was monitoring
these relationships on outdated information. Management's catch-up
cut the backlog to 290 (2.9%) by 2026-09-30, the figure reported
against board metric RAS-CMP-01 in the Risk Appetite Statement
(`finance/risk-appetite-statement`), still above the 2.0% appetite;
the finding stays open until the automated triggers are live. Two of 25 sampled suspicious
transaction reports were filed after the internal deadline, and the
sanctions screening test missed three of 150 transliterated name
variants. Two of three prior findings are closed and validated; the
third (high-risk periodic review timeliness, PF-2025-03) is open and
repeats as IT-F-001, which the board should treat as a governance
matter. Six new findings are raised: one High, three Medium and two
Low.

| Area | Rating | Key point |
|---|---|---|
| Risk assessment | Satisfactory with exception | Instant payments not yet assessed (IT-F-006) |
| Governance and reporting officer | Satisfactory | Board reporting quarterly, resources adequate |
| CDD and EDD | Needs improvement (repeat High finding) | High-risk review backlog (IT-F-001), beneficial ownership gaps (IT-F-002) |
| Transaction monitoring | Satisfactory with exception | Closure rationale quality (IT-F-005) |
| SAR/STR process | Satisfactory with exception | Timeliness (IT-F-003) |
| Sanctions screening | Satisfactory with exception | Transliteration gaps (IT-F-004) |
| Training and records | Satisfactory | 96.4% completion |
| Overall | **Needs improvement** | |

## 2. Scope, period and legal basis

<!-- Guidance: Purpose: define what was tested and against which requirements. Base the scope on the bank's own risk assessment, not on last year's work program. Pitfall: scoping out a high-risk business line or branch without saying so. -->

The independent test covers the whole programme over the test period,
unless a risk-based rotation is approved by the board and documented. In
the United States, 31 CFR 1020.210 requires a bank's programme to include
independent testing for compliance, which may be performed by bank
personnel or by an outside party; the frequency is risk-based, and
examiners use the FFIEC BSA/AML Examination Manual to assess the work.
In the EU, Directive 2015/849 Article 8(4)(b) (as transposed) requires an
independent audit function where appropriate to the size and nature of
the business. From 2027-07-10 AMLR Article 9(2)(b) requires internal
controls and an independent audit function to test the internal
policies, procedures and controls, with the possibility of using an
external expert, and AMLA guidelines will say when that is appropriate.
The UK Money Laundering Regulations 2017, regulation 21, contain the UK
equivalent where appropriate to size and nature. The FinCEN programme
rule proposal of 2026-04-07 would restate the US programme components;
until a final rule is published, test against the current rule and note
any planned changes.

| Field | Value |
|---|---|
| Legal entities and branches | [Fernhollow Bank head office (EU); US branch] *(Example)* |
| Business lines in scope | [Retail, SME, corporate banking, trade finance, correspondent banking, payments] *(Example)* |
| Business lines out of scope (with reason) | [Asset management subsidiary, tested by its own auditor] *(Example)* |
| Programme areas | Risk assessment, governance, CDD/EDD, monitoring, reporting, sanctions, training, records, information sharing |
| Requirements tested against | National AML law (transposing Directive 2015/849); 31 CFR Chapter X for the US branch; EBA/GL/2024/14 for restrictive measures; internal AML/CFT Programme Policy (`compliance/aml-cft-programme-policy`) |
| Systems in scope | [Core banking, onboarding, screening, transaction monitoring, case management] *(Example)* |
| Scope limitations | [None / describe] |

## 3. Independence and competence

<!-- Guidance: Purpose: show that the people testing did not design or run the controls they tested and had the skills to judge them. Pitfall: the first line or the compliance function testing its own work and calling it independent. -->

Independence means the testers have no responsibility for the controls
under review and report to a body that can act on the results without
management filtering. Internal audit staff who previously worked in the
financial crime function should not test areas they ran within the last
twelve months, or whatever cooling-off period your internal audit
charter sets. An outside party should not test controls it designed or
operates under another engagement. Record any threat to independence and
how it was managed.

Competence means the team understood AML/CFT law, the bank's products and
customers, and the technology used for monitoring and screening. Where
the test includes model or data aspects of monitoring systems, add a
specialist or rely on the model validation (see Model Validation Report,
`ai-data/model-validation-report`) and state the reliance.

| Team member | Role | Relevant experience | Independence confirmation |
|---|---|---|---|
| [@lead-tester] *(Example)* | Lead | [Financial crime audit, eight years] | [No operational AML role in last 3 years] |
| [@data-auditor] *(Example)* | Data analytics | [Audit analytics, SQL] | [Confirmed] |
| [@external-specialist] *(Example)* | Sanctions screening specialist | [Screening tuning reviews] | [No consulting work for the bank's screening vendor setup] |

Statement: *"The test team confirms that it had no responsibility for the
design or operation of the controls tested during the test period and
had unrestricted access to records, systems and staff."*

## 4. Approach, sampling and rating scales

<!-- Guidance: Purpose: let a reader judge whether the conclusions are supported. Describe population, sample size, selection method and exception rule for every test. Pitfall: unexplained sample sizes, or samples drawn only from the period when controls were known to work. -->

The test combines interviews and walkthroughs (design), sample testing
(operating effectiveness) and full-population data analytics where data
permit. Sampling follows the internal audit methodology. Select samples
across the whole test period and across business lines and branches in
proportion to risk; add a targeted high-risk sample on top of the random
sample. Define in advance what counts as an exception, and test every
attribute for every item, so that the exception rate means something.

| Test ID | Population | Size | Sample | Selection | Exceptions | Rate |
|---|---|---|---|---|---|---|
| T-CDD-01 *(Example)* | New customers onboarded | 4,820 | 60 | 40 random, 20 high-risk targeted | 5 | 8.3% |
| T-EDD-01 *(Example)* | High-risk customers | 10,000 | 25 | Random | 3 | 12.0% |
| T-EDD-02 *(Example)* | High-risk periodic reviews due | 10,000 | 10,000 | Full population analytics | 1,310 overdue | 13.1% |
| T-TM-01 *(Example)* | Alerts closed without escalation | 18,600 | 45 | Random, stratified by scenario | 2 | 4.4% |
| T-SAR-01 *(Example)* | SAR/STR filed | 610 | 25 | Random | 2 late, 1 narrative weak | 8.0% late |
| T-SAR-02 *(Example)* | Escalated cases closed without filing | 380 | 20 | Random | 0 | 0.0% |
| T-SAN-01 *(Example)* | Synthetic test names (screening effectiveness) | 150 | 150 | Designed test set | 3 missed | 2.0% |
| T-TRN-01 *(Example)* | Staff required to train | 2,500 | 2,500 | Full population | 90 not completed | 3.6% |

Rating scales used in this report:

| Finding rating | Meaning |
|---|---|
| High | A requirement is not met or a key control fails in a way that exposes the bank to a material risk of facilitating financial crime or of regulatory breach; fix as a priority, target within 3 months *(Example target)* |
| Medium | A control operates inconsistently or has a design gap; risk is contained by other controls; target within 6 months |
| Low | Improvement to efficiency, documentation or resilience; target within 12 months |

| Area or overall rating | Meaning |
|---|---|
| Satisfactory | Controls designed and operating effectively; Low findings only |
| Satisfactory with exception | Effective overall, with Medium or Low findings in specific processes |
| Needs improvement | One High finding (flag it if it repeats a prior finding) or several Medium findings in one area; programme still functions |
| Unsatisfactory | Several High findings or a programme pillar not functioning |

## 5. Risk assessment

<!-- Guidance: Purpose: test whether the business-wide risk assessment is current, complete and drives the programme. Pitfall: accepting a risk assessment that is up to date on paper but ignores new products or channels launched in the period. -->

Check that the business-wide risk assessment covers customers, products,
services, transactions, delivery channels and geographies; uses current
inputs such as the national risk assessment, the EU supranational risk
assessment and, for the US branch, the National AML/CFT Priorities; and
was approved by senior management. Then test the link to the programme:
higher-risk areas should have stronger controls, more monitoring
scenarios and more frequent reviews. Compare the products launched in the
period with the assessment. Use the AML Business Risk Assessment
(`compliance/aml-business-risk-assessment`) and the Customer Risk Rating
Methodology (`compliance/customer-risk-rating-methodology`) as the
documents under test.

| Test step | Result *(Example)* |
|---|---|
| Assessment approved and dated within the policy cycle | Approved by the Management Board 2026-02-18 |
| Inputs current (national and supranational assessments, typologies) | Yes |
| New products and channels in period assessed | No: instant credit transfers launched 2026-03 not assessed (IT-F-006) |
| Residual risk ratings drive monitoring coverage | Yes for 11 of 12 risk areas |
| Customer risk rating model validated in period | Yes, validation report 2026-01 |

## 6. Governance, policies and the reporting officer

<!-- Guidance: Purpose: confirm the board and senior management oversee the programme and the reporting officer has authority, independence and resources. Pitfall: confirming the appointment exists without testing whether management information reaches the board and leads to decisions. -->

Review the policy framework and its approval, the appointment and role of
the reporting officer (MLRO in the EU and UK, BSA Officer in the US,
compliance officer and responsible board member under AMLR Article 11
from 2027-07-10), the resources of the financial crime function and the
management information provided to the board. Read a sample of board and
committee minutes to see whether AML matters were discussed, challenged
and acted upon. Interview the reporting officer about escalation routes
and any instance where the officer's advice was overruled.

| Test step | Result *(Example)* |
|---|---|
| AML/CFT Programme Policy approved and reviewed in period | Approved 2025-11-20 |
| Reporting officer appointment, authority and access to the board | Confirmed; direct reporting line to the Risk Committee |
| Staffing compared with workload | Two vacancies filled in 2026-04; backlog remains (see IT-F-001) |
| Management information to the board, at least quarterly | Four reports in period, covering backlog, SAR/STR volumes and findings |
| Annual reporting officer report | Issued 2026-03 |

## 7. Customer due diligence and enhanced due diligence

<!-- Guidance: Purpose: test that customers are identified, verified, understood and risk-rated, and that high-risk customers get enhanced measures and timely reviews. Pitfall: testing that documents are present without testing that beneficial owners were actually verified and that the purpose of the relationship is understood. -->

For each sampled customer, test identification and verification,
beneficial ownership (identification and reasonable verification of
owners and controllers), purpose and intended nature of the relationship,
risk rating, screening at onboarding and, for high-risk customers,
enhanced measures such as source of wealth and funds, senior management
approval and enhanced monitoring. For existing customers, use analytics
on the full population to find overdue periodic reviews and missing
data. Templates under test: KYC and CDD Profile
(`compliance/kyc-cdd-profile`) and EDD Memo (`compliance/edd-memo`).

| Attribute tested (T-CDD-01, T-EDD-01) | Exceptions *(Example)* |
|---|---|
| Identity verified with acceptable evidence | 0 of 60 |
| Beneficial owners identified and verified to policy standard | 4 of 60 (IT-F-002) |
| Purpose and expected activity recorded | 1 of 60 (IT-F-002) |
| Risk rating calculated and approved | 0 of 60 |
| EDD source of wealth corroborated | 2 of 25 (IT-F-001) |
| Senior management approval before onboarding high-risk customer | 1 of 25 approved 9 days after account opening (IT-F-001) |
| Periodic review of high-risk customers within 12 months | 1,310 of 10,000 overdue at 2026-06-30 (IT-F-001) |

The overdue reviews ranged from 1 to 7 months late; 290 of the 1,310 were
more than 3 months late *(Example)*. Root cause: reviews are triggered by
a calendar report that is worked manually, and the 2025-Q4 onboarding
peak absorbed the review team.

## 8. Transaction monitoring and suspicious activity reporting

<!-- Guidance: Purpose: test that monitoring covers the risks, alerts are worked well and on time, and suspicions are reported promptly with good narratives. Pitfall: testing alert handling but not whether the scenarios cover the risks in the risk assessment. -->

Coverage: compare the scenario inventory with the risks in the business
risk assessment, and check that data feeding the monitoring system is
complete (reconcile transaction counts from source systems to the
monitoring system for a sample of days). Use the Transaction Monitoring
Scenario Specification (`compliance/transaction-monitoring-scenario-spec`)
for the scenario documentation under test. Under SR 26-2 (2026-04-17,
replacing SR 11-7) and OCC Bulletin 2026-13, which also rescinded the
2021 interagency statement on model risk for BSA/AML systems, US
monitoring models are governed under the bank's general model risk
framework; state whether you relied on a model validation.

Alert handling: for each sampled closed alert, check that the analyst
reviewed the relevant history, the closure reason is specific and
supported, and the alert was closed within the service level.

Reporting: for sampled reports, test timeliness against the legal
deadline and the internal target, quality of the narrative against the
SAR/STR Narrative template (`compliance/sar-str-narrative`), approval by
the reporting officer and confidentiality. For escalated cases closed
without a report, check that the decision is reasonable. In the United
States the 2025-10-09 FinCEN and agency FAQs state that a written record
of a no-file decision is not legally required; test against the bank's
own policy, which in this example still requires a short rationale.

| Test step | Result *(Example)* |
|---|---|
| Scenario coverage of assessed risks | 11 of 12 risk areas covered; instant payments not covered (IT-F-006) |
| Data completeness reconciliation (5 sample days) | Reconciled, no differences |
| Closed alerts with specific, supported rationale | 43 of 45 (IT-F-005) |
| Reports filed within internal target | 23 of 25 (IT-F-003) |
| Reports filed within legal deadline (US branch, 30 days) | 4 of 4 US branch reports |
| Narrative quality sufficient | 24 of 25 |
| No-file decisions reasonable and documented per policy | 20 of 20 |
| Tipping-off controls (access restriction, customer letters) | Operating |

## 9. Sanctions screening

<!-- Guidance: Purpose: test that customers and payments are screened against the right lists, promptly after list updates, with settings that find realistic name variations. Pitfall: accepting vendor assurance about matching quality without running your own test names. -->

Test list management (which lists, how quickly updates are loaded),
screening scope (customers, beneficial owners, payments, trade documents),
matching effectiveness, alert handling, escalation of true matches,
freezing and reporting. For EU entities, also check the restrictive
measures exposure assessment and policies required by EBA/GL/2024/14,
applicable since 2025-12-30, and the Sanctions Compliance Procedure
(`compliance/sanctions-compliance-procedure`) and Sanctions Exposure
Assessment (`compliance/sanctions-exposure-assessment`).

A matching effectiveness test uses a designed set of test names: exact
list entries, common misspellings, transliterations, reordered names,
truncated names and names with added noise. Run the set through the
production configuration (or a validated copy) and compare results with
the expected outcome. Report detection rates by variation type, not only
in total.

| Test step | Result *(Example)* |
|---|---|
| List updates loaded within internal target (2 hours EU and OFAC, 4 hours national and UK, per SAN-LST-001 to 004) | 52 of 52 updates sampled |
| Test names detected (T-SAN-01) | 147 of 150 (98.0%); 3 transliteration variants of non-Latin names missed (IT-F-004) |
| Payment screening before release | Confirmed in walkthrough |
| True match handling and reporting | 29 true matches in period; 10 sampled, all frozen, blocked or rejected and reported within the regime deadline (EU competent authority, OFAC 10 business days) |
| Exposure assessment approved | Yes, 2026-01 |

## 10. Training, record keeping and other controls

<!-- Guidance: Purpose: cover the remaining programme elements. Pitfall: reporting training completion without checking that content fits the role and the risks. -->

Training: check that content is current, targeted by role and risk, and
that completion is tracked with consequences for non-completion. Record
keeping: test that CDD records and transaction records are retained for
the legal period (five years in the EU and US for most AML records, 10
years for records subject to OFAC regulations under 31 CFR 501.601;
check local law) and can be retrieved promptly. Information sharing: test
group-wide policies and any information-sharing arrangements against the
legal gateways available. Employee screening: where national law
requires it, check screening of relevant staff.

| Test step | Result *(Example)* |
|---|---|
| Training completion | 2,410 of 2,500 (96.4%); non-completers escalated to line managers |
| Role-based content for high-risk roles | Yes, trade finance and correspondent banking modules |
| Retrieval test of 10 closed-account files older than 4 years | 10 of 10 retrieved within 2 days |
| Group information-sharing procedure | In place, approved by legal |

## 11. Prior findings follow-up

<!-- Guidance: Purpose: confirm that management fixed what it promised. Validate closure with evidence, do not accept self-certification. Pitfall: closing a finding because the action plan was delivered, without testing that the risk was reduced. -->

| Prior ID | Finding | Agreed action | Status | Validation evidence |
|---|---|---|---|---|
| PF-2025-01 *(Example)* | Alert backlog above 30 days | Additional analysts, scenario tuning | Closed, validated | Backlog under 10 days for six consecutive months |
| PF-2025-02 *(Example)* | Correspondent banking reviews incomplete | Complete reviews of 14 respondents | Closed, validated | 14 of 14 reviews completed and approved |
| PF-2025-03 *(Example)* | High-risk periodic review timeliness | Workflow automation | Open, overdue | Automation delayed to 2027-Q1; issue repeats as IT-F-001 |

A repeat finding is a governance issue as well as a control issue; say so
in the conclusion and inform the board.

## 12. Findings register and management responses

<!-- Guidance: Purpose: one row per finding with condition, criteria, root cause, risk, recommendation, owner and date. Management writes the response in its own words. Pitfall: recommendations that restate the condition ("complete the reviews") without addressing the root cause. -->

Write each finding with five elements: the condition (what you found),
the criteria (the requirement or policy), the root cause, the effect or
risk, and the recommendation. Agree facts with management before the
draft goes out. Management responses must name an accountable owner and
a realistic date; where management accepts the risk instead, record who
accepted it and at what level.

| ID | Rating | Condition | Criteria | Root cause | Recommendation | Management response, owner, date |
|---|---|---|---|---|---|---|
| IT-F-001 *(Example)* | High | 1,310 of 10,000 high-risk periodic reviews overdue; 2 of 25 EDD files lacked corroborated source of wealth; one late senior approval | Policy: 12-month review for high risk; national law EDD measures | Manual trigger, insufficient capacity, repeat of PF-2025-03 | Automate triggers, clear backlog with a time-bound plan, escalate repeat to board | Agreed. Backlog cleared by 2026-12-31; automation 2027-03-31. [@head-kyc] |
| IT-F-002 *(Example)* | Medium | 4 of 60 files without verified beneficial owner; 1 without purpose | Policy and national law on beneficial ownership | Checklist allows submission with missing fields | Make fields mandatory, remediate the 5 files | Agreed, 2026-11-30. [@head-onboarding] |
| IT-F-003 *(Example)* | Medium | 2 of 25 reports filed 6 and 9 days after internal target | Internal target and prompt-reporting requirement | Approval queue when reporting officer absent | Named deputies with authority; daily queue report | Agreed, 2026-10-31. [@mlro] |
| IT-F-004 *(Example)* | Medium | 3 transliteration variants missed | Screening standard; EBA/GL/2024/14 | Transliteration rules not enabled for one script | Enable rules, retest, rescreen customer base | Agreed, 2026-12-15. [@sanctions-lead] |
| IT-F-005 *(Example)* | Low | 2 of 45 closures with generic rationale | Alert handling procedure | Free-text field without guidance | Closure reason codes plus mandatory note | Agreed, 2027-03-31. [@tm-lead] |
| IT-F-006 *(Example)* | Low | Instant payments not assessed nor covered by scenarios | Risk assessment procedure: new product approval | New product process skipped AML sign-off | Assess product, add scenarios, fix approval workflow | Agreed, 2027-01-31. [@head-fcc] |

## 13. Conclusion and board reporting

<!-- Guidance: Purpose: the formal opinion and what the board must do with it. Pitfall: an opinion that does not mention repeat findings or scope limitations. -->

State the overall conclusion in one paragraph, list the matters the
board should monitor, and set the date of the follow-up review. Report
the result to the board or the committee to which the tester reports,
and keep evidence that it was received and discussed. In the United
States, examiners will look at whether the board received the results
and whether management corrected the issues; in the EU and UK the
supervisor will expect the same evidence through the reporting officer's
annual report and board minutes.

*Example conclusion:* On the basis of the work performed, the AML/CFT
and sanctions programme of Fernhollow Bank for the period 2025-07-01 to
2026-06-30 is rated Needs improvement. The programme is designed in line
with applicable requirements and most controls operate effectively, but
enhanced due diligence and periodic review of high-risk customers did not
operate effectively, for the second consecutive year. The board should
monitor the backlog plan monthly until closure. Internal Audit will
validate IT-F-001 in 2027-Q2.

## 14. Traceability matrix

<!-- Guidance: Purpose: show that every programme requirement was tested and where the result is. Pitfall: requirements with no test, which leave gaps nobody notices. -->

| Requirement | Source (by number) | Test IDs | Result | Finding |
|---|---|---|---|---|
| Internal controls / policies | 31 CFR 1020.210(a)(2)(i); Dir. 2015/849 Art. 8; AMLR Art. 9 | Sections 5, 6 | Effective | IT-F-006 |
| Independent testing | 31 CFR 1020.210(a)(2)(ii); AMLR Art. 9(2)(b) | This report | Performed | |
| Designated compliance officer | 31 CFR 1020.210(a)(2)(iii); AMLR Art. 11 (from 2027-07-10) | Section 6 | Effective | |
| Training | 31 CFR 1020.210(a)(2)(iv) | T-TRN-01 | Effective | |
| Customer due diligence and beneficial ownership | 31 CFR 1020.210(a)(2)(v); 1010.230; Dir. 2015/849 Arts 13, 18 | T-CDD-01, T-EDD-01, T-EDD-02 | Not effective | IT-F-001, IT-F-002 |
| Suspicious activity reporting | 31 CFR 1020.320; Dir. 2015/849 Art. 33 | T-TM-01, T-SAR-01, T-SAR-02 | Partly effective | IT-F-003, IT-F-005 |
| Restrictive measures | EBA/GL/2024/14; OFAC regulations for US branch | T-SAN-01 | Partly effective | IT-F-004 |
| Record keeping | Dir. 2015/849 Art. 40; 31 CFR 1010.430 | Section 10 | Effective | |

## 15. Glossary and references

<!-- Guidance: Define the terms your board readers will meet. Cite rules by number and date; obtain the official text for the normative wording. -->

Glossary:

- **Independent test**: an objective review of the AML/CFT programme by
  people who do not run it; called independent audit function in EU law.
- **Operating effectiveness**: whether a control worked as designed
  throughout the period, tested with samples or full-population data.
- **Exception**: a sampled item that fails a tested attribute.
- **Repeat finding**: an issue reported before and not fixed.
- **EDD**: enhanced due diligence for higher-risk customers.
- **MLRO / BSA Officer**: the person responsible for the programme and
  for reporting suspicions.

References (as of 2026-10; check the current official versions):

- 31 CFR 1020.210, Anti-money laundering program requirements for banks;
  31 CFR 1020.320; 31 CFR 1010.230.
- FFIEC BSA/AML Examination Manual, section on BSA/AML independent
  testing (public domain).
- FinCEN, proposed rule on AML/CFT programmes, 2026-04-07 (proposal, not
  in force).
- FinCEN and agencies, SAR FAQs, 2025-10-09.
- Federal Reserve SR 26-2 and OCC Bulletin 2026-13, model risk
  management, 2026-04-17.
- Directive (EU) 2015/849, Articles 8, 13, 18, 33 and 40 as transposed;
  Regulation (EU) 2024/1624 (AMLR), Articles 9 and 11, applying from
  2027-07-10.
- EBA/GL/2024/14 on restrictive measures, applicable from 2025-12-30.
- UK Money Laundering Regulations 2017 (SI 2017/692), regulation 21.
- FATF Recommendation 18 (internal controls), name and number only.
- Related templates: Internal Audit Program (ISO 19011)
  (`compliance/internal-audit-program`), Internal Audit Engagement
  (`compliance/iia-internal-audit-engagement`), Internal Audit Charter
  and Plan (`compliance/internal-audit-charter-and-plan`), AML/CFT
  Programme Policy (`compliance/aml-cft-programme-policy`), SAR/STR
  Narrative (`compliance/sar-str-narrative`), Model Validation Report
  (`ai-data/model-validation-report`).

## Standard and licence note

Based on the US bank programme and reporting rules (31 CFR Chapter X),
FinCEN and FFIEC publications and Federal Reserve and OCC guidance, which
are US federal works in the public domain, on EU law (Directive (EU)
2015/849, Regulation (EU) 2024/1624, EUR-Lex) and EBA guidelines (reuse
with acknowledgement), and on the UK Money Laundering Regulations 2017,
all described in original wording. FATF Recommendations and internal
audit standards are cited by name and number only. The structure,
rating scales, sample sizes and the Fernhollow Bank results are original
and fictional; sample sizes are illustrative and must come from your own
methodology. Check the current official texts and regulator guidance
before use. This is a document format, not legal, audit or compliance
advice. Template licence: MIT.