Tailoring AML Policies, Controls and Procedures

It is absolutely acceptable to use a template to establish your AML Policy, Controls and Procedures (PCP) manual; however, it must be tailored to your practice.  Your PCPs should factor the risks that your practice is exposed to, as identified from your latest Firm-wide Business Risk Assessment.

When you have an AML inspection, your professional body will check that you: 

  1. Have an up-to-date and signed off AML Policies, Controls and Procedures document that is tailored to your practice; 
  2. Have factored the risks to your practice, as identified in your latest Firm-Wide Risk Assessment;
  3. Can evidence that you are doing what you say you do in your policies.

In AML HQ, we provide you with a template PCPs for you to tailor (our latest version was released in January 2025 and is available within the AML Policies library section of your account).  You should review and tailor the full document as appropriate and we draw your attention, in particular, to sections 2.4, 3.2 and 3.3 to ensure it aligns with your latest Firm-wide Risk Assessment.

Key PCP Sections

  1. When updating Section 2.4 Identified Risks, include real risk references based on what you have identified in your Firm-Wide Business Risk Assessment.  Add specific details about your client base, for example, if you have a lot of cash-intensive businesses you might add something like. “We have 10 cash-intensive businesses which are open to money laundering/tax evasion”.  You can further add some detail about how you mitigate the risk “We undertake the bookkeeping for these clients and monitor expenditure/inventory.  We are aware of similar clients in the area and there is nothing irregular about their receipts / payment transactions.  We have conducted a visual inspection of the premises, and all appears to be normal”. 
  2. When updating Section 3.2  KYC & CDD – ensure it includes what you are actually going to do within the practice when onboarding and undertaking your required ongoing monitoring obligations. 
  3. When updating Section 3.3.1 (8) Enhanced Due Diligence ensure consistency between any mitigating actions highlighted within your latest firm-wide Business Risk Assessment. Examples of EDD measures could include:
    1. MLRO/Senior Manager Sign-Off: Required for high-risk clients (prompted within AML HQ when a client is flagged as high-risk as the result of their Client Risk Assessment).
    2. Additional Scrutiny for High-Risk Clients: High-risk clients undergo further scrutiny at both onboarding and ongoing monitoring stages. This includes:
      • Collecting evidence for source of wealth / funds.
      • Further investigation of the client’s business intentions, operations, and associations.
      • Advanced identity verification and if necessary, gathering additional evidence if there is uncertainty regarding the client’s identity.
    3. Ongoing Monitoring: Consider why this client has been identified as high-risk and monitor for specific red flags as part of your ongoing monitoring.  Flag them on the system as high-risk to aid the team in what they should be looking out for . For cash-intensive businesses, consider implementing checks such as inventory vs. sales reconciliation (Z reads) and industry benchmarking.