ICAEW Registered Auditors  ·  90+ UK-Based Experts

AML Audit

The independent AML audit the Money Laundering Regulations require — delivered by a regulated audit firm that tests your defences the way your supervisor would.

Regulation 21 of the Money Laundering Regulations 2017 requires many regulated businesses to establish an independent audit function: someone with no role in designing or operating the firm's AML controls must examine whether they are adequate and actually followed. Supervisors — HMRC, the FCA, the SRA and the professional bodies — now routinely ask for evidence of that audit, and 'we review ourselves' is not an answer that survives a visit.

Acumon provides that independent examination: we test your firm-wide risk assessment, your customer due diligence in practice rather than on paper, your monitoring and reporting arrangements, and we report findings you can hand to your supervisor with confidence.

Who Needs an Independent AML Audit

The requirement applies to businesses within the Money Laundering Regulations where the size and nature of the business make it appropriate — in practice, most firms of any substance in the regulated sector: accountancy and legal practices, estate and letting agents, high-value dealers, art market participants, trust and company service providers, and cryptoasset businesses. If your supervisor has asked whether you have an independent audit function and the honest answer is no, that is the gap this service closes.

What the Audit Examines

We test the full chain the regulations require: the firm-wide risk assessment and whether it reflects your actual client base; policies, controls and procedures and whether staff follow them; customer due diligence files — including enhanced due diligence for higher-risk clients and source-of-funds work; ongoing monitoring; suspicious activity reporting arrangements; training records; and record-keeping. The consistent finding across the sector is a gap between documented procedures and daily practice — which is exactly what independent testing exists to find.

File Testing, Not Policy Reading

An AML audit that only reads your manual is worthless. Ours samples real client files and walks each through the requirements: was the risk rating justified, was identity verified before the engagement, was EDD triggered and performed, would this file satisfy an inspector? Findings come back specific — which files, which gaps, which fixes — so remediation is a task list rather than a philosophy.

Reporting Your Supervisor Will Recognise

The output is a clear written report: scope, methodology, findings graded by severity, and practical recommendations with owners and timescales. It is written knowing a supervisor may read it — demonstrating that the audit was genuinely independent, appropriately skilled and acted upon is precisely what Regulation 21 compliance looks like from the outside. A follow-up review confirming remediation closes the loop.

Independence by Design

Because Acumon is an ICAEW-registered and FRC-regulated audit firm, independence is not a claim but a discipline we are inspected on. We take no role in operating your AML controls, which is what makes the audit valid — and if you also need help fixing what we find, we will tell you plainly where the line sits between auditing your framework and building it.

What You Get With Acumon

  • Independent AML audit satisfying Regulation 21 of the MLRs
  • Firm-wide risk assessment reviewed against your actual client base
  • Real client file sampling: CDD, EDD, source of funds and monitoring
  • SAR arrangements, training and record-keeping tested
  • Findings graded by severity with owners and timescales
  • A report written to withstand supervisor scrutiny
  • Follow-up remediation review to close the loop
  • Delivered by an ICAEW-registered, FRC-regulated audit firm

Why Acumon for AML Audit?

  • ICAEW-registered and FRC-regulated — independence is an inspected discipline, not a claim
  • Team of 70 audit professionals, more than half from leading international accounting firms
  • Acumon operates under the Money Laundering Regulations itself and is supervised for AML — the regime is home ground
  • Anti-fraud and forensic capability in-house for matters that escalate

Get a Fixed-Fee Quote

Tell us what you need and we'll come back within one business day with a clear scope and a fixed price — no hourly-rate surprises. Call 020 8567 3451 or use the form and we'll be in touch.

Common Questions

Frequently Asked Questions

Is an independent AML audit a legal requirement?
For businesses within the Money Laundering Regulations, Regulation 21 requires an independent audit function where appropriate to the size and nature of the business. Supervisors interpret 'appropriate' broadly — beyond genuinely tiny firms, they expect to see one, and firms are asked for their latest AML audit during supervisory visits. The audit can be internal if truly independent of the AML function, but most firms have no one both qualified and independent, which is why it is typically outsourced.
How often should the AML audit be done?
The regulations set no fixed frequency, but supervisory practice has converged on a cycle of roughly every one to two years, with higher-risk businesses at the shorter end and a follow-up review after significant findings. A one-off audit that is never repeated tends to look, to a supervisor, like a box ticked rather than a function established.
What do AML audits usually find?
The same families of issues across every sector: firm-wide risk assessments that were written once and never updated; client risk ratings applied by default rather than judgement; EDD triggered but not evidenced; source-of-funds notes that record what the client said but verify nothing; and training logs that stop eighteen months ago. None of these is fatal if found and fixed by your own audit — all of them are expensive if found first by your supervisor.
Can you also fix the problems you find?
We can support remediation — updating the risk assessment methodology, training, redesigning procedures — but we are careful about the boundary: the audit must remain independent of the controls it audits. In practice we agree the split up front. What we will not do is design your entire framework and then 'independently' audit our own work; a supervisor would see through that, and so would we.
Get in Touch

Ready to Sort Your AML Audit?

Tell us what you need. Within one business day, a qualified accountant will be in touch to talk it through and give you a clear, fixed-fee quote — no obligation.

Visit us1-2 Craven Road, Ealing, London, W5 2UA

Speak to a Specialist

Fill this in and we'll come back to you within one business day.

No obligation. Your details stay private.
Call Now Get in Touch