Preparing for an independent financial-crime review

Agree the question before assembling the evidence

A useful review starts with an agreed scope: the legal entities, business lines, relevant period, regulatory concerns, controls and intended audience. Identify the applicable rules and guidance for that business. FCA authorisation does not by itself mean every provision of the Money Laundering Regulations applies to every activity; applicability needs to be established.

Agree whether the work assesses control design, historical operation, current implementation, sustained effectiveness or a combination. Set out the reviewer’s access, sampling method, deliverables, limitations and process for management responses. Where the reviewer has helped implement controls, assess independence and conflicts explicitly; a different reviewer or independent challenge may be needed.

Prepare the programme and the population

Collect current and relevant historic versions of the business-wide risk assessment, customer-risk methodology, policies, procedures and governance records. Include approval and effective dates. Supply organisation charts, accountable roles, training arrangements, management information, audit work and the remediation tracker. A Board pack shows what information was presented; minutes and action records help explain the decisions and follow-through.

For file testing, reconcile the population first. Identify the source, extraction date, products, risk bands and key exclusions. Preserve duplicates and relationships as explicit mappings rather than quietly removing inconvenient records. A risk-based sample can examine higher-risk situations and control changes, but its findings should not be projected across the book as a statistical error rate unless the sampling design supports that.

1. Confirm scope, applicable standards and review independence.
2. Index policies, governance and system evidence by date.
3. Reconcile the population before selecting files.
4. Agree how later evidence and management responses will be assessed.

Provide operating records, not just a demonstration

A walkthrough is valuable for understanding a process, but it does not establish that the process operated for a particular customer at an earlier date. Pair demonstrations with attributable audit trails, verification results, screening decisions, risk assessments, transaction records and review histories. Keep a screenshot where it answers the point; supply the underlying document when its contents are the evidence.

Testing should be proportionate to the risk and relevant obligations. Do not assume every customer needs a full wealth pack or that every high-risk relationship has the identical statutory approval requirement. Separate enhanced measures under regulation 33, the specific PEP provisions and any stricter internal policy. General four-eyes onboarding approval may be a firm control rather than a universal legal rule.

Make challenge constructive and closure traceable

The reviewer should credit new evidence and clear management explanations, including evidence that disproves an initial concern. Use a point-by-point response process: what was said, what was supplied, what it proves, what remains and why. Avoid repeatedly asking for an item already present in a workbook, archive or earlier pack.

MEMA’s recommended output distinguishes historic gaps, current controls and residual work. A historic gap may remain a fact even when today’s control has improved; equally, it must not automatically be presented as an ongoing failure. Before reporting, reconcile the findings, responses, actions and summary. Ask the reviewer to state the proof boundary clearly: what was tested, what was not and what requires later effectiveness testing.