AML Independent Testing and Audit: What Examiners Look For

An AML independent test, often called an AML audit, is a review of the whole programme by people who did not design or run it, checking that policies are followed, controls work and earlier findings were closed. Examiners look for evidence, not assurances: traced cases, calibration records, risk assessments, training logs and board reports that show each control working.

The 2018 AMLA implementing rules require an independent audit function as part of a covered person's written prevention programme. In the sources reviewed, they set no testing frequency or scope, so what follows is a checklist built from those rules, BSP's guidance on transaction monitoring and the FATF Recommendations, not a mandated programme.

This guide covers what an AML audit should examine and what evidence to have ready. For the separate question of what makes a reviewer independent, see our guide on who checks the auditors.

What does AML independent testing cover?

It covers every control in the programme, from governance and risk assessment to monitoring, reporting and record retention, and it tests them against evidence.

Under the 2018 implementing rules, Rule 16 requires covered persons to formulate and implement a written, risk-based money laundering and terrorism financing prevention programme, and its minimum contents include an independent audit function. Rule 4 makes the board of directors ultimately responsible for compliance. The table below turns those duties into an audit scope.

The first row matters most. A control that works but is not governed will still be reported as a gap, because the board cannot show it knew.

What do examiners look for in practice?

They look for proof that a control operated on a specific occasion, not a description of how it is meant to operate.

The most useful way to prepare is to run the same exercise yourself. Pick a closed alert and ask for the whole record: the rule that fired, the analyst's reasoning, the approver and the outcome. Pick a high-risk customer and trace the file from onboarding to the last review. Pick a rule that changed in the past year and ask who approved the change and what testing came before it. Where the answer needs an email search, the control is undocumented.

BSP's Memorandum M-2023-013, the guidance paper on an effective AML/CTPF transaction monitoring system, sets out a useful frame for the monitoring part of this review. It covers governance, system design and pre-implementation testing, risk-based and holistic monitoring, alert and case management, red flags and scenarios, suspicious transaction reporting and independent testing. BSP's basic principles for combating money laundering describe a risk management system that identifies, assesses, monitors and controls money laundering risks, which is the standard an audit is testing against.

Which gaps should an independent test be built to catch?

Seven gaps are worth building the test around, and each can be checked with a small sample.

1. 01A stale or unapproved risk assessment. Check the date, the methodology and the board approval against the two-year minimum.
2. 02Thresholds that have not changed in years. Ask for calibration records. Our guide to threshold tuning describes what a defensible one looks like.
3. 03Boilerplate closure reasons. Read a sample of dismissed alerts and check whether each reason is specific to the customer.
4. 04Unclear determination dates. An STR is due by the next working day from the determination of suspicion, so the record needs the date and the reasoning. The STR filing window is where late filings usually start.
5. 05Reports filed late or on the wrong clock. Covered transaction reports and risk event reports run on different windows. BSP Circular 1193 requires a risk event report within 24 hours from knowledge or discovery.
6. 06Overdue customer reviews. Check the refresh schedule against the customer risk rating and ongoing due diligence policy.
7. 07Findings closed without proof. A register that shows "closed" with no remediation evidence is a frequent reason a repeat finding appears.

None of these needs a specialist tool to test. They need access to the records and a reviewer with the time to read them.

How often should AML testing happen?

The sources reviewed set no fixed period, so the frequency should follow the institution's risk and be written into the audit plan.

A commonly cited practice is to test the whole framework every 12 to 18 months and to test higher-risk areas more often. Significant change should bring a review forward: a new product, a new channel, a system migration, a rise in alert volume or a change in the customer base. A practical approach is a rolling plan in which the institutional risk assessment sets the priorities and each audit cycle covers the areas where risk or change is highest.

The board question to keep asking is what has changed since the last test and whether those changes were tested.

How does the 2027 mutual evaluation change what auditors test?

It raises the weight on effectiveness, which means evidence that controls work, not only that they exist.

The FATF says the most important part of a mutual evaluation is a country's effectiveness ratings, and that it began its fifth round of evaluations under the 2022 methodology in 2024. The Philippines' next assessment is widely stated to fall in 2027, and the Philippines exited the FATF grey list on 21 February 2025, so this is preparation, not a countdown. We cover the evidence side in our guide to the 2027 mutual evaluation and in our piece on what the grey-list exit changed.

An internal audit that tests effectiveness gives the institution a head start. It produces the same traced cases, calibration records and finding registers that an assessor or examiner would ask to see.

What is a practical audit-readiness checklist?

Twelve checks, run quarterly by the compliance team, keep the evidence ready between formal audits.

1. 01Confirm the institutional risk assessment is dated, approved and within two years.
2. 02Confirm the written programme matches current procedures.
3. 03List every monitoring rule with its last change date and approver.
4. 04Confirm each rule has a calibration record from the last review cycle.
5. 05Pull five closed alerts and test the reasoning.
6. 06Pull five STRs and match each to a recorded determination date.
7. 07Check that every covered transaction and risk event report was filed in its window.
8. 08Sample high-risk customer files for overdue reviews.
9. 09Confirm list updates and match decisions in name screening are logged.
10. 10Check training records against the role matrix.
11. 11Retrieve a five-year-old record to test retention.
12. 12Review the finding register and attach proof to every closed item.

FATF Recommendation 11 sets the five-year minimum for transaction records, which is the floor for the retrieval test in item 11. For the wider supervisory context, see our BSP Circular 950 compliance guide.

How does Fyscal ARCX help with audit readiness?

Fyscal ARCX keeps the evidence an audit asks for in the system where the work happens. Transaction Monitoring records the rule and condition behind each alert. Case Management writes every action to a timestamped timeline that locks at closure, with a mandatory written reason for each disposition. Reports generated from a case are stored in a searchable filing record, and the Admin Control Center lets compliance leadership govern case workflows and AI features from the platform, with changes logged.

If you want to see how a closed case, a rule change and a filed report can be retrieved on request, book a walkthrough of Fyscal ARCX and bring your last audit finding to test it against.