Independent review of your AML/CFT framework
Does your anti-money laundering framework actually work, or does it only read well? We assess design, implementation and operating effectiveness, and deliver a report with findings, root causes and a remediation plan in which every point has an owner and a deadline.
What is an independent review?
An independent review is an assessment, by a party outside the first and second line, of whether your anti-money laundering and sanctions framework is adequate in design, implementation and operating effectiveness. Design: is it properly described. Implementation: is it actually in place. Effectiveness: does it do in practice what it promises. That third question is where most frameworks come apart, and where supervisors look first.
The Dutch AML Act expects institutions — to the extent appropriate to their nature and size — to have an independent audit function that tests policies and procedures. For a large bank that is internal audit; for a payment institution or trust office with fifteen staff it is an external engagement.
What we assess
| Component | The question we ask |
|---|---|
| Risk assessment | Are the risks recognisable as yours, or is this a template? And do the outcomes actually drive the policy? |
| Client acceptance policy | Do the acceptance criteria follow the identified risks, and are exceptions recorded and reviewed? |
| Customer due diligence | Does practice follow policy? We test that with a file sample, not an interview. |
| Transaction monitoring | Do the scenarios cover the risks from the risk assessment, and are the thresholds substantiated? |
| Sanctions screening | Does list coverage match your sanctions risk assessment, and has the match logic been tested? |
| Reporting process | Are unusual transactions reported promptly and completely, and is the assessment recorded — including where nothing was reported? |
| Training | Is training demonstrably role-specific, and is there assurance that people apply it? |
| Governance | Does the board receive information it can steer on, and is it visible what it did with that information? |
When institutions use this
At the supervisor's request
DNB or the AFM asks for an independent review. Then the terms of reference matter more than the execution — we help set them before the work starts.
For a licence application
An application where an external party has already tested the framework attracts markedly fewer questions.
As your own annual cycle
Smaller institutions without internal audit place the annual review externally. Predictable, and the board gets something it can act on.
After an incident or acquisition
Something has gone wrong, or you have taken on a book and want to know what you are acquiring before it becomes your problem.
Our limit
We do not review our own work. Whoever assesses the framework cannot also remediate that same component — otherwise the report is worthless, however well written. If we already have an engagement on a component, we say so in advance and limit the scope, or refer you elsewhere. It occasionally costs us work; it is the reason the report stays usable.
What it costs
- Full framework review: from € 5,500 excluding VAT, three weeks, including the report and a debrief with the board or supervisory board.
- Single-theme review (for example only the reporting process or only the risk assessment): from € 2,950 excluding VAT, ten working days.
- Multiple locations or jurisdictions: quoted in advance.
If the review shows file work is needed, KYC remediation is the next step; if the system is the issue, the monitoring and screening effectiveness review. Where capacity to carry the remediation is missing, interim support is the route.
Frequently asked questions
What is an independent review of an AML/CFT framework?
An independent review is an assessment, by a party outside the first and second line, of whether your anti-money laundering framework is adequate in design, implementation and operating effectiveness. It covers the risk assessment, client acceptance policy, execution of customer due diligence, transaction monitoring, sanctions screening, the reporting process to FIU-the-Netherlands, training and board reporting. The output is a report with findings, risk ratings and recommendations.
Is such a review mandatory?
The Dutch AML Act requires institutions, to the extent appropriate to their nature and size, to have an independent audit function that tests policies and procedures. How that function is filled depends on your size: large institutions have internal audit, smaller ones place the review externally. Supervisors routinely ask during examinations for the most recent independent review and for what was done with the findings.
How is this different from internal audit?
Substantively very little; organisationally a great deal. An internal audit function knows your organisation better but sits closer to the people it assesses. An external review brings comparison from other institutions and can report more independently, but needs time to get up to speed. Many institutions combine the two: internal audit runs the annual cycle, external is used for a specific theme or after a finding.
The supervisor has asked for an independent review. What now?
Then the terms of reference matter more than the execution. Ask the supervisor what scope is expected and what deadline applies, and record that scope in writing before the work starts. We help draft that scope and then run the review in a reporting format that matches what supervisors want to see: finding, root cause, risk, and a remediation plan with an owner and a deadline.
How long does it take?
A full framework review for a small or mid-sized institution takes three weeks: one week of document analysis, one week of interviews and file sampling, one week of reporting and debrief. A single-theme review — the reporting process, say, or just the risk assessment — takes ten working days.
Can you also carry out the remediation afterwards?
Not on the same component. Whoever reviews cannot assess their own work; that would destroy the value of the report. We can support a remediation plan executed by another party, or the reverse: we remediate and a third party reviews. What we will not do is review and remediate at once and call it independent.
What does an independent review cost?
A full framework review starts at € 5,500 excluding VAT with a three-week turnaround, including the report and a debrief with the board or supervisory board. A single-theme review starts at € 2,950 excluding VAT. For institutions with multiple locations or jurisdictions we quote in advance.
Sources
- Dutch Anti-Money Laundering and Anti-Terrorist Financing Act (Wwft) — wetten.overheid.nl
- Sanctions Act 1977 — wetten.overheid.nl
- De Nederlandsche Bank (DNB)
- Autoriteit Financiële Markten (AFM)
- Bureau Financieel Toezicht (BFT)
- Financial Action Task Force (FATF)
Related
No concrete trigger yet? A review still makes sense — precisely because you then pick the moment rather than a supervisor. Thirty minutes tells us both whether it is worth doing now. Book a call.