AML Independent Test Report Template (BSA Pillar, EU AMLR Art. 9)

AML Independent Test Report: [Entity name] [Test period]

Report of an independent test of an anti-money laundering and counter terrorist financing (AML/CFT) programme, including sanctions controls: scope, independence, sampling, results by programme area, findings with ratings, management responses and an overall conclusion for the board. It covers the independent testing pillar of the US bank programme rule (31 CFR 1020.210(a)(2)(ii)), the independent audit function of EU law (Directive (EU) 2015/849 Article 8(4)(b) as transposed, and Regulation (EU) 2024/1624 (AMLR) Article 9(2)(b) from 2027-07-10) and the UK Money Laundering Regulations 2017 (regulation 21). The FinCEN AML/CFT programme rule published as a proposal on 2026-04-07 is not law; check its status. The example bank, Fernhollow Bank, is fictional. Replace every [bracketed] value and every row marked Example. Obtain the law and the regulator guidance for the normative text. This is a document format, not legal, audit or compliance advice.

Document control

Approvals

Revision history

Contents

• 1. Executive summary and overall rating
• 2. Scope, period and legal basis
• 3. Independence and competence
• 4. Approach, sampling and rating scales
• 5. Risk assessment
• 6. Governance, policies and the reporting officer
• 7. Customer due diligence and enhanced due diligence
• 8. Transaction monitoring and suspicious activity reporting
• 9. Sanctions screening
• 10. Training, record keeping and other controls
• 11. Prior findings follow-up
• 12. Findings register and management responses
• 13. Conclusion and board reporting
• 14. Traceability matrix
• 15. Glossary and references
• Standard and licence note

1. Executive summary and overall rating

Write this section last. State the overall rating first, then explain it in plain language: what works, what does not, and what the exposure is if nothing changes. Mention any limitation on scope that affects the conclusion. Keep it to one page so that a non-specialist board member can read it in a few minutes and know what to ask management.

Example summary (fictional): Fernhollow Bank's AML/CFT and sanctions programme is rated Needs improvement. Governance, the reporting officer function, training and record keeping operate effectively. The main weakness is the backlog of enhanced due diligence and periodic reviews for high-risk customers: 1,310 of 10,000 high-risk customers (13.1%) were overdue at period end (2026-06-30), so the bank was monitoring these relationships on outdated information. Management's catch-up cut the backlog to 290 (2.9%) by 2026-09-30, the figure reported against board metric RAS-CMP-01 in the Risk Appetite Statement (finance/risk-appetite-statement), still above the 2.0% appetite; the finding stays open until the automated triggers are live. Two of 25 sampled suspicious transaction reports were filed after the internal deadline, and the sanctions screening test missed three of 150 transliterated name variants. Two of three prior findings are closed and validated; the third (high-risk periodic review timeliness, PF-2025-03) is open and repeats as IT-F-001, which the board should treat as a governance matter. Six new findings are raised: one High, three Medium and two Low.

2. Scope, period and legal basis

The independent test covers the whole programme over the test period, unless a risk-based rotation is approved by the board and documented. In the United States, 31 CFR 1020.210 requires a bank's programme to include independent testing for compliance, which may be performed by bank personnel or by an outside party; the frequency is risk-based, and examiners use the FFIEC BSA/AML Examination Manual to assess the work. In the EU, Directive 2015/849 Article 8(4)(b) (as transposed) requires an independent audit function where appropriate to the size and nature of the business. From 2027-07-10 AMLR Article 9(2)(b) requires internal controls and an independent audit function to test the internal policies, procedures and controls, with the possibility of using an external expert, and AMLA guidelines will say when that is appropriate. The UK Money Laundering Regulations 2017, regulation 21, contain the UK equivalent where appropriate to size and nature. The FinCEN programme rule proposal of 2026-04-07 would restate the US programme components; until a final rule is published, test against the current rule and note any planned changes.

3. Independence and competence

Independence means the testers have no responsibility for the controls under review and report to a body that can act on the results without management filtering. Internal audit staff who previously worked in the financial crime function should not test areas they ran within the last twelve months, or whatever cooling-off period your internal audit charter sets. An outside party should not test controls it designed or operates under another engagement. Record any threat to independence and how it was managed.

Competence means the team understood AML/CFT law, the bank's products and customers, and the technology used for monitoring and screening. Where the test includes model or data aspects of monitoring systems, add a specialist or rely on the model validation (see Model Validation Report, ai-data/model-validation-report) and state the reliance.

Statement: "The test team confirms that it had no responsibility for the design or operation of the controls tested during the test period and had unrestricted access to records, systems and staff."

4. Approach, sampling and rating scales

The test combines interviews and walkthroughs (design), sample testing (operating effectiveness) and full-population data analytics where data permit. Sampling follows the internal audit methodology. Select samples across the whole test period and across business lines and branches in proportion to risk; add a targeted high-risk sample on top of the random sample. Define in advance what counts as an exception, and test every attribute for every item, so that the exception rate means something.

Rating scales used in this report:

5. Risk assessment

Check that the business-wide risk assessment covers customers, products, services, transactions, delivery channels and geographies; uses current inputs such as the national risk assessment, the EU supranational risk assessment and, for the US branch, the National AML/CFT Priorities; and was approved by senior management. Then test the link to the programme: higher-risk areas should have stronger controls, more monitoring scenarios and more frequent reviews. Compare the products launched in the period with the assessment. Use the AML Business Risk Assessment (compliance/aml-business-risk-assessment) and the Customer Risk Rating Methodology (compliance/customer-risk-rating-methodology) as the documents under test.

6. Governance, policies and the reporting officer

Review the policy framework and its approval, the appointment and role of the reporting officer (MLRO in the EU and UK, BSA Officer in the US, compliance officer and responsible board member under AMLR Article 11 from 2027-07-10), the resources of the financial crime function and the management information provided to the board. Read a sample of board and committee minutes to see whether AML matters were discussed, challenged and acted upon. Interview the reporting officer about escalation routes and any instance where the officer's advice was overruled.

7. Customer due diligence and enhanced due diligence

For each sampled customer, test identification and verification, beneficial ownership (identification and reasonable verification of owners and controllers), purpose and intended nature of the relationship, risk rating, screening at onboarding and, for high-risk customers, enhanced measures such as source of wealth and funds, senior management approval and enhanced monitoring. For existing customers, use analytics on the full population to find overdue periodic reviews and missing data. Templates under test: KYC and CDD Profile (compliance/kyc-cdd-profile) and EDD Memo (compliance/edd-memo).

The overdue reviews ranged from 1 to 7 months late; 290 of the 1,310 were more than 3 months late (Example). Root cause: reviews are triggered by a calendar report that is worked manually, and the 2025-Q4 onboarding peak absorbed the review team.

8. Transaction monitoring and suspicious activity reporting

Coverage: compare the scenario inventory with the risks in the business risk assessment, and check that data feeding the monitoring system is complete (reconcile transaction counts from source systems to the monitoring system for a sample of days). Use the Transaction Monitoring Scenario Specification (compliance/transaction-monitoring-scenario-spec) for the scenario documentation under test. Under SR 26-2 (2026-04-17, replacing SR 11-7) and OCC Bulletin 2026-13, which also rescinded the 2021 interagency statement on model risk for BSA/AML systems, US monitoring models are governed under the bank's general model risk framework; state whether you relied on a model validation.

Alert handling: for each sampled closed alert, check that the analyst reviewed the relevant history, the closure reason is specific and supported, and the alert was closed within the service level.

Reporting: for sampled reports, test timeliness against the legal deadline and the internal target, quality of the narrative against the SAR/STR Narrative template (compliance/sar-str-narrative), approval by the reporting officer and confidentiality. For escalated cases closed without a report, check that the decision is reasonable. In the United States the 2025-10-09 FinCEN and agency FAQs state that a written record of a no-file decision is not legally required; test against the bank's own policy, which in this example still requires a short rationale.

9. Sanctions screening

Test list management (which lists, how quickly updates are loaded), screening scope (customers, beneficial owners, payments, trade documents), matching effectiveness, alert handling, escalation of true matches, freezing and reporting. For EU entities, also check the restrictive measures exposure assessment and policies required by EBA/GL/2024/14, applicable since 2025-12-30, and the Sanctions Compliance Procedure (compliance/sanctions-compliance-procedure) and Sanctions Exposure Assessment (compliance/sanctions-exposure-assessment).

A matching effectiveness test uses a designed set of test names: exact list entries, common misspellings, transliterations, reordered names, truncated names and names with added noise. Run the set through the production configuration (or a validated copy) and compare results with the expected outcome. Report detection rates by variation type, not only in total.

10. Training, record keeping and other controls

Training: check that content is current, targeted by role and risk, and that completion is tracked with consequences for non-completion. Record keeping: test that CDD records and transaction records are retained for the legal period (five years in the EU and US for most AML records, 10 years for records subject to OFAC regulations under 31 CFR 501.601; check local law) and can be retrieved promptly. Information sharing: test group-wide policies and any information-sharing arrangements against the legal gateways available. Employee screening: where national law requires it, check screening of relevant staff.

11. Prior findings follow-up

A repeat finding is a governance issue as well as a control issue; say so in the conclusion and inform the board.

12. Findings register and management responses

Write each finding with five elements: the condition (what you found), the criteria (the requirement or policy), the root cause, the effect or risk, and the recommendation. Agree facts with management before the draft goes out. Management responses must name an accountable owner and a realistic date; where management accepts the risk instead, record who accepted it and at what level.

13. Conclusion and board reporting

State the overall conclusion in one paragraph, list the matters the board should monitor, and set the date of the follow-up review. Report the result to the board or the committee to which the tester reports, and keep evidence that it was received and discussed. In the United States, examiners will look at whether the board received the results and whether management corrected the issues; in the EU and UK the supervisor will expect the same evidence through the reporting officer's annual report and board minutes.

Example conclusion: On the basis of the work performed, the AML/CFT and sanctions programme of Fernhollow Bank for the period 2025-07-01 to 2026-06-30 is rated Needs improvement. The programme is designed in line with applicable requirements and most controls operate effectively, but enhanced due diligence and periodic review of high-risk customers did not operate effectively, for the second consecutive year. The board should monitor the backlog plan monthly until closure. Internal Audit will validate IT-F-001 in 2027-Q2.

14. Traceability matrix

15. Glossary and references

Glossary:

• Independent test: an objective review of the AML/CFT programme by people who do not run it; called independent audit function in EU law.
• Operating effectiveness: whether a control worked as designed throughout the period, tested with samples or full-population data.
• Exception: a sampled item that fails a tested attribute.
• Repeat finding: an issue reported before and not fixed.
• EDD: enhanced due diligence for higher-risk customers.
• MLRO / BSA Officer: the person responsible for the programme and for reporting suspicions.

References (as of 2026-10; check the current official versions):

• 31 CFR 1020.210, Anti-money laundering program requirements for banks; 31 CFR 1020.320; 31 CFR 1010.230.
• FFIEC BSA/AML Examination Manual, section on BSA/AML independent testing (public domain).
• FinCEN, proposed rule on AML/CFT programmes, 2026-04-07 (proposal, not in force).
• FinCEN and agencies, SAR FAQs, 2025-10-09.
• Federal Reserve SR 26-2 and OCC Bulletin 2026-13, model risk management, 2026-04-17.
• Directive (EU) 2015/849, Articles 8, 13, 18, 33 and 40 as transposed; Regulation (EU) 2024/1624 (AMLR), Articles 9 and 11, applying from 2027-07-10.
• EBA/GL/2024/14 on restrictive measures, applicable from 2025-12-30.
• UK Money Laundering Regulations 2017 (SI 2017/692), regulation 21.
• FATF Recommendation 18 (internal controls), name and number only.
• Related templates: Internal Audit Program (ISO 19011) (compliance/internal-audit-program), Internal Audit Engagement (compliance/iia-internal-audit-engagement), Internal Audit Charter and Plan (compliance/internal-audit-charter-and-plan), AML/CFT Programme Policy (compliance/aml-cft-programme-policy), SAR/STR Narrative (compliance/sar-str-narrative), Model Validation Report (ai-data/model-validation-report).

Standard and licence note

Based on the US bank programme and reporting rules (31 CFR Chapter X), FinCEN and FFIEC publications and Federal Reserve and OCC guidance, which are US federal works in the public domain, on EU law (Directive (EU) 2015/849, Regulation (EU) 2024/1624, EUR-Lex) and EBA guidelines (reuse with acknowledgement), and on the UK Money Laundering Regulations 2017, all described in original wording. FATF Recommendations and internal audit standards are cited by name and number only. The structure, rating scales, sample sizes and the Fernhollow Bank results are original and fictional; sample sizes are illustrative and must come from your own methodology. Check the current official texts and regulator guidance before use. This is a document format, not legal, audit or compliance advice. Template licence: MIT.