Introduction
An AML programme can look complete on paper and still fail in daily operation. Policies exist, a screening tool is live, and training is logged. Then a regulator samples the files.
The FCA fined Starling Bank £28,959,426 in October 2024. Its sanctions screening checked only a fraction of the full list from 2017, and over 54,000 accounts were opened for 49,000 high-risk customers despite an onboarding restriction.
Testing finds these problems before a supervisor does. This guide covers what AML testing is, how to run it step by step, and how a growing UK firm can use it well.
Key Takeaways
- AML testing checks whether controls are well designed, implemented and effective in practice.
- Scope should be risk-based, independent and evidence-led.
- A useful test ends in graded findings, owned actions and retesting.
- Regulation 21 sets no fixed audit interval, so frequency follows risk.
What Is AML Testing and Why Is It Critical?
AML testing is an objective review of whether a firm's AML framework is designed properly, implemented in the business and operating effectively. It is not transaction monitoring, and it is not a review of financial statements.
Regulation 21(1)(c) of the Money Laundering Regulations 2017 is the core legal requirement. Where appropriate to the size and nature of the business, firms must maintain an independent audit function that examines the adequacy and effectiveness of AML policies, controls and procedures, makes recommendations and monitors compliance with them.
Regulation 19 separately requires firms to maintain and regularly review their controls.
What Does AML Testing Cover?
Scope typically spans:
- The business-wide risk assessment, policies and procedures
- Onboarding, beneficial ownership, CDD and EDD
- Sanctions and PEP screening
- Transaction monitoring and suspicious activity reporting
- Training, governance, management information and record keeping
- Third-party and outsourced arrangements
Testing must examine documents and proof of execution, including customer files, screening results, alert histories, investigation notes, system configurations, training logs and evidence of management oversight.
Why Is AML Testing Important?
Testing exposes control gaps, inconsistent procedures, weak escalation, poor data quality and heavy reliance on manual workarounds. Growth and new products often create these weaknesses.
Starling grew from roughly 43,000 customers in 2017 to 3.6 million in 2023, and its controls did not keep pace. Independent testing gives senior management and the MLRO a documented view of what works and what needs to change before gaps become regulatory findings.
AML Testing Compared With Related Activities
- Risk assessment (Regulation 18): identifies firm-wide money laundering and terrorist financing risks. It is a written, current document, not a test of controls.
- Independent audit (Regulation 21): evaluates control adequacy and effectiveness, with recommendations and follow-up. It needs independence where appropriate.
- Ongoing monitoring (Regulation 28): scrutinises customer transactions and keeps CDD current.
- Compliance monitoring and QA: routine checks with timely follow-up. JMLSG guidance lists them separately from internal audit, and relevant outcomes feed the MLRO's annual report.
UK Regulatory and Risk-Based Considerations
Firms should track the current position under the MLRs, FCA rules, JMLSG guidance, UK sanctions obligations and SAR requirements. Recent changes matter: the 2026 amendments, effective 30 June 2026, narrow the country-based EDD trigger to FATF high-risk jurisdictions subject to a call for action.
Frequency is a judgement. SYSC 6.3.3R requires a "regular assessment" of systems and controls, and no provision prescribes a universal annual audit. Annual MLRO reporting is a separate duty. Factors that raise scope and frequency include:
- Customer types, products and delivery channels
- Jurisdictions and transaction volumes
- Crypto or cash exposure
- Outsourcing and technology changes
- Previous findings and regulatory developments
How AML Testing Works: Step by Step
The process runs from scope to evidence, testing, reporting, remediation and validation. A policy-only review is a box-ticking exercise and will miss what the FCA finds in practice.
Step 1: Define the Scope and Testing Objectives
Identify the business units, products, customer groups, jurisdictions, systems, review period and controls in scope. Use the risk assessment and previous findings to prioritise higher-risk areas.
Set clear criteria covering:
- Control coverage and consistency of execution
- Alert handling and data completeness
- Governance oversight and remediation progress
Step 2: Confirm Independence, Competence and Methodology
The tester should be free from conflicts and experienced in your sector. JMLSG 4.71 allows internal audit, external auditors or specialist consultants who are not involved in implementing or operating the AML programme. The Global Internal Audit Standards presume impaired objectivity over areas an auditor ran in the previous 12 months.
Document the methodology covering:
- Sample selection and interview protocols
- Testing scripts and evidence standards
- Issue grading and reporting lines
- Escalation of serious concerns
Step 3: Gather and Map the Evidence
Typical evidence includes:
- Risk assessments, policies and board or committee papers
- Customer files, screening logs and alert histories
- SAR decisions and case files
- Training records, vendor oversight and system change logs
- Prior remediation plans
Map each control to its policy requirement, regulatory expectation, owner, evidence source and test method. The final report can then show how each conclusion was reached.
Step 4: Test Design, Implementation and Operating Effectiveness
Use three lenses:
- Is the control designed well?
- Is it implemented in the business?
- Does it work consistently?
Practical tests include:
- Reperforming CDD checks and reviewing risk-rating decisions
- Examining sanctions and PEP screening outcomes
- Tracing alerts through investigation and escalation
- Checking that reporting decisions were documented
Sampling should be risk-based and representative. Record the population, selection rationale, exceptions, limitations and any automated testing. No universal sample size exists, so justify yours.
Step 5: Analyse Findings and Report Them Clearly
Each finding should state:
- The control expectation and evidence reviewed
- The weakness and its root cause
- The risk, severity and affected population
- The recommended corrective action
Separate isolated errors from systemic weaknesses. Escalate urgent concerns to the MLRO, senior management or board in line with your governance arrangements.
Step 6: Remediate, Retest and Maintain the Cycle
Every finding needs an owner, target date, action plan, evidence requirement and a way to track overdue actions. The OPBAS 2024/25 report criticised long or unfollowed remediation deadlines among professional-body supervisors, a lesson any firm can apply.
Retesting should confirm the fix addresses the root cause. A revised policy or a training session is not proof the risk is resolved.
AML Testing: Example Case Walkthrough
This hypothetical is illustrative only. It is not a Fraxtional client case and does not describe real findings.
A growing UK payments firm has doubled its customers, added a new payment flow and outsourced name screening to a vendor.
Scenario, Scope and Evidence
The tester reviews the risk assessment, new product details, prior issues and governance records. Scope then focuses on:
- Onboarding and risk ratings
- Sanctions screening
- Transaction monitoring
- Third-party oversight
Evidence requested includes:
- Customer files and screening records
- Alert histories and system settings
- MI and training logs
- Vendor assurance documents
Testing and Findings
A risk-based sample might reveal, for illustration:
- Thin rationale for higher-risk onboarding decisions
- Inconsistent alert escalation
- Procedures that predate the new payment flow
- Little evidence of management review
- Weak oversight of the screening vendor
The FCA's 2023 payments letter found third-party name-screening tools inadequately calibrated to firms' business, so the last point is realistic.
Each issue is recorded with evidence, root cause, risk, severity, owner and corrective action. "Improve AML compliance" is not a finding.
Remediation and Retesting
The firm updates its procedures, screening configuration, training and vendor oversight, and keeps evidence of completion.
Targeted retesting then checks the amended controls on fresh samples. Those results feed the next risk assessment and testing plan.
How Fraxtional Can Help
Fraxtional is a director-led, fractional compliance leadership firm serving fintech, banking, crypto, money transmission and embedded finance companies. It helps strengthen AML governance without the cost or commitment of a full-time executive hire.
AML Testing and Remediation Support
Fraxtional can support:
- Testing plan design and evidence preparation
- Review of AML controls, including transaction-monitoring effectiveness
- Interpretation of findings and remediation planning
- Board-ready reporting with prioritised recommendations
- Ongoing validation through fractional MLRO or wider compliance leadership
Independence matters. Under JMLSG 4.71, a tester should not be involved in operating the programme, and the FCA expects firms to retain responsibility when outsourcing. Engagements are scoped accordingly, separating independent audit work from operational MLRO support.
Why This Model Suits Growing Financial Firms
Scaling firms face investor scrutiny, banking-partner due diligence and new markets. Fraxtional offers:
- Daily access to experienced compliance leadership
- Responsive startup support
- Flexible engagement models
- A sustainable path to meet compliance obligations
For cross-border needs, its team spans the UK, European Union, United States and Canada.
Conclusion
AML testing shows whether controls are designed properly, implemented consistently and effective in practice. Having policies is not enough.
Keep testing risk-based and continuous. Turn findings into owned actions, validate the fixes, and update the programme as your business, technology and the threat landscape change.
Frequently Asked Questions
What is AML testing?
A structured review of whether a firm's AML controls are well designed, implemented and operating effectively. It goes beyond checking that policies exist.
What does an AML test cover?
Typically the risk assessment, CDD and EDD, sanctions and PEP screening, transaction monitoring, reporting, training, governance, records and outsourced controls.
Who should conduct independent AML testing?
Qualified, objective people not involved in running the AML programme, such as internal audit or external specialists. The right arrangement depends on your size, risk and obligations.
How often should AML testing be performed in the UK?
Frequency is risk-based. Regulation 21 sets no fixed interval and SYSC requires "regular" assessment. Business changes and prior findings should shorten the cycle. Verify sector-specific obligations.
What is the difference between AML testing and an AML audit?
The terms overlap. Both evaluate AML control effectiveness, unlike a financial statement audit. Scope, independence and reporting should be agreed up front.
How can a fintech prepare for an AML test?
Update your risk assessment, organise policies and evidence, keep customer and alert files accessible, assign control owners and maintain an open remediation register.
