Two services, one purpose: identify gaps before your regulator does, and build programmes that hold up under scrutiny. Our team conducts independent AML audits and designs or rebuilds AML programmes for EMIs, payment institutions, fintechs and CASPs across the EU.
An independent review of your AML programme's effectiveness, conducted against AMLD6 requirements, EBA guidelines and your NCA's specific supervisory expectations. The output is a structured written report: a finding-by-finding breakdown, severity rating, root cause analysis for material issues, and a prioritised remediation plan your board can act on and your NCA can inspect.
We conduct AML audits at four specific moments: pre-NCA examination health checks, as part of annual governance cycles, following regulatory changes that have altered your obligations, and where there is a specific concern about a control area, sanctions screening match rates, PEP identification coverage, or transaction monitoring alert quality.
Our auditors have operated inside the regulated entities they audit, not just reviewed them from the outside. This means findings are practical and actionable, not just technically accurate.
Commissioned by CLOs, MLROs and Heads of Compliance at EMIs, payment institutions, fintechs and CASPs. Also used by legal and risk teams preparing board submissions or investor due diligence packs where AML programme quality is a disclosure item.
Sample audit report cover. All engagements produce a structured written report with severity-rated findings, root cause analysis and a prioritised remediation plan.
What the audit covers
Gap assessment, policy documentation and full AML programme design for regulated entities building their programme from scratch, inheriting a stale or undocumented framework, or expanding into a new jurisdiction or regulatory regime such as MiCA. This is the structured work that turns a compliance obligation into an operable, documented programme a regulator can inspect.
We start from your current state, however incomplete, and produce a documented, defensible AML programme. That means a BWRA populated for your actual customer base, a policy suite that reflects your specific products and risk appetite, and a governance framework with clear escalation paths and accountability. Not generic templates downloaded from the EBA website.
Engagements are scoped in writing before work starts. Deliverables are agreed upfront. The implementation roadmap assigns owners and timelines so there is a clear path from the documentation to a live, functioning programme. Where we identify critical gaps during the assessment phase, we flag them immediately rather than waiting for the final report.
Typically commissioned at three moments: before a licence application where the NCA needs to see a complete AML programme, after acquiring or inheriting an entity with a deficient or undocumented framework, and by CASPs preparing for MiCA pre-registration review. Also used by firms that have received an NCA finding requiring remediation of the overall programme rather than a single control.
What programme advisory covers:
High growth strains AML frameworks built for smaller volumes. A current-state audit identifies where the programme has not kept pace with the business and what needs to change before the NCA notices it first.
MiCA requires demonstrable AML substance. An audit against MiCA Title VI and EBA CASP guidelines shows where the gap is. A programme build closes it in a form the NCA can inspect.
An upcoming examination is the most common trigger. A pre-examination health check identifies and allows remediation of findings before examiners arrive, not after they write them up.
Many fintechs inherit AML frameworks from previous management or original founders. Where the programme has not been reviewed against current AMLD6 requirements, it is likely materially deficient.
The NCA wants to see a documented, coherent AML programme before granting a licence. We build that programme in a form that satisfies the NCA's pre-authorisation review requirements.
After a significant compliance event, an independent audit of the programme that produced it, and a redesign of the controls that failed, is both prudent and often required by the NCA as a condition of continued authorisation.
AML audit findings and programme design must reflect what specific NCAs look for in examination, not just what the EBA guidelines say. The DNB in the Netherlands has different examination priorities from the Bank of Lithuania or the Central Bank of Ireland. Our experience across 10+ NCAs means our findings are calibrated to your regulator.
All engagements are fixed-scope and fixed-fee. We scope and agree before we start. The scope does not expand mid-engagement without a written variation.
We understand your regulatory framework, NCA, current programme state and what is driving the engagement. Within two business days we provide a written proposal: fixed scope, fixed fee, clear deliverables. No engagement begins without a signed proposal.
We review your AML policies, risk assessments, training records, anonymised case samples, governance documentation and any prior NCA correspondence. Secure document sharing is arranged at kick-off. Where documents are missing or incomplete, that is itself a finding, we do not ask you to prepare materials that should already exist.
For an audit: we test controls against documented standards, regulatory requirements and NCA supervisory guidance, not just EBA guidelines in the abstract. For programme design: we map current state against AMLD6 and EBA requirements, identify gaps by severity, and draft the programme structure before the final report is produced.
The report is issued in draft for factual accuracy review, then delivered as final. All findings are evidence-referenced. For programme design engagements, the full policy suite and implementation roadmap are delivered alongside the gap assessment report. Board presentation available. Remediation follow-up advisory is available separately.
Can't find your answer? Contact us directly. We respond within one business day.
A senior advisor will assess your situation and come back with an honest view of scope, fee and timeline. No obligation, no generic proposals.
EU-based KYC and ODD analyst teams. Operational in two weeks. Fixed monthly rate. Addresses capacity gaps that an AML audit often surfaces.
View service →Interim, fractional and licence-stage compliance officer provision. Gap cover after departure, licence applications, Deputy compliance officer resilience.
View service →AML programme build and KYC teams for crypto CASPs under MiCA. Travel Rule implementation, AMLCO support and NCA pre-registration preparation.
View service →Risk classification, conformity assessment and cross-regulatory advisory for regulated institutions using AI in credit, insurance or HR decisions.
View service →