AML Audit

We need to complete an AML audit and are looking for someone with experience doing these to assist.

The exact audit is TBC but I have copied below a sample scope below:

Sample Scope
This matrix is a high-level list and approach to required annual independent Audits for AML program elements. Each program is unique and may require additional topics to be covered; and the Bank may direct additional audits or additional frequency reviews as needed.

The independent audit report must include a description of the testing conducted, what was confirmed, and whether any observations were identified. If observations were identified, Column will need to understand the analysis as to whether those observations are material to the program’s AML Program.

Column requires specific confirmation that testing covers the following requirements, as well as the testing outcomes and any observations identified regarding the execution of the AML Program, including:

1. Program execution: Assessing the Company’s execution of the AML Program in place
    1. Confirming that the program has oversight of any centralized resources used for onboarding and suspicious activity reviews.
    2. Review the Company’s overall compliance with local AML regulatory requirements, where the Company is licensed / registered.
    3. Testing the effectiveness of the Company’s AML compliance program and determining whether the program mitigates any existing or potential risks related to the Company’s customer base, products and services, and geographies.
    4. Reviewing the Company’s AML risk assessment to ensure it aligns with their risk profile (products, services, customers, and geographic locations) if present.
    5. Reviewing the Company’s policies, procedures, and processes to ensure they align with the Company’s risk profile and that the Company adheres to them.
2. Designated a Responsible Person: Confirm the Company has a designated person responsible for the execution of the Company’s AML Program
3. CIP and CDD Processes: Assessing whether the Company has collected and verified customer identification and collected Customer Due Diligence data by reviewing sample accounts.
    1. Including verification of legal entities and their beneficial ownership.
4. Suspicious Activity Monitoring Processes: Assessing whether the Company’s overall process for identifying and reporting suspicious activity is adequate.
    1. The assessment included evaluating filed or prepared UARs or SARs to determine their accuracy, timeliness, completeness, and conformance to the Company’s policies, procedures, and processes.
5. OFAC Processes: Assessing whether the Company’s overall process for identifying and assessing potential OFAC matches is adequate.
    1. Confirming that the program has controls in place to screen customers for OFAC.
    2. Confirming that the program has controls in place to screen transactions for OFAC.
6. Assessing whether the Company has recordkeeping and reporting requirements covering customer identification, customer due diligence (CDD), beneficial ownership, suspicious activity reviews.
7. Assessing whether training is provided for appropriate personnel, tailored to specific functions and positions, and includes supporting documentation.
    1. Reviewing training records and comparing them with the standards outlined in the Company’s training policy to ensure they were in line with internal requirements.
8. Assessing whether previous independent review findings have been reported to the Board of Directors, or to a designated board committee, by reviewing the board or committee minutes.
    1. Assessing whether management took appropriate and timely action to address any violations and other deficiencies noted in previous independent reviews and regulatory examinations, including progress in addressing outstanding supervisory enforcement actions, if applicable.
9. Confirming that the program collects and maintains
    1. For Payments
        1. Name and address of the sender
        2. Amount of the transmittal order
        3. Date of the transmittal order
        4. Any payment instructions from the sender
        5. Identity of the recipient’s institution
        6. Name and address of the recipient
        7. Account number of the recipient
        8. Any other specific identifier of the recipient
    2. For Customers of the program (legal entities)
        1. Full Legal Name and dba if applicable
        2. Physical Address (e.g., principal place of business; cannot be a PO box)
        3. EIN or Registration Number
        4. Location and year of incorporation
        5. Any additional customer due diligence information
    3. For Control Person and any Beneficial Owners of legal entity customers
        1. Full Legal Name
        2. Physical Address (e.g., residential address; cannot be a PO box)
        3. Date of Birth
        4. Country of citizenship
        5. SSN or other ID collection aligned to the citizenship type
        6. Title (for Control Person)
        7. Ownership percentage (for all individuals with 25% or more ownership)