Since 1998
Licensed provider of company formation and corporate services
An independent test of your AML/CFT policies, procedures and controls, as EU and national AML rules expect from obliged entities.Findings ranked by risk, a remediation plan and a re-test you can show your regulator.
Overview
EU AML rules expect obliged entities to have their AML policies, controls and procedures tested by an independent audit function, and from 10 July 2027 the AMLR lets an external expert carry out that test. MAXCORP audits EMIs, PIs, CASPs and Canadian MSBs, testing both the design and the day-to-day effectiveness of your controls.
Risk-based sample testing of CDD and EDD files, alerts, cases and STR decisions
Your business-wide risk assessment, policies and procedures checked against current law
Findings rated by severity, each with evidence references and a named owner
A remediation plan with owners and dates, plus a summary for your management body
An optional re-test that confirms remediation worked before the next inspection
Gaps against the AMLR rules that apply from 10 July 2027 flagged for your roadmap
Most clients commission an AML audit at a clear moment: before a licence application, around a supervisory inspection, after an incident, or as the periodic independent test their AML rules expect. We scope the audit to that moment, test a risk-based sample and report findings ranked by severity, with owners and deadlines for your management. You get evidence your regulator can review, and a clear plan to close the gaps.
Scope
We test both the framework (how your AML programme is designed and governed) and the controls in operation (whether it works on real files, alerts and reports).
Governance
Management body oversight, the Compliance Officer or MLRO role, independence and reporting lines.
Risk assessment
The business-wide risk assessment and customer risk scoring.
Policies and procedures
Completeness against current law, and readiness for the AMLR.
Training and records
Training coverage and record-keeping against retention rules.
Outsourcing and agents
Oversight of outsourced tasks, agents and distributors.
Customer due diligence
CDD, EDD and ongoing monitoring: PEPs, beneficial owners, high-risk countries, tested on file samples.
Sanctions screening
Lists, thresholds and tuning, and how hits are handled.
Transaction monitoring
Rules and scenarios, alert handling, case quality and backlog.
FIU reporting
STR decisions and their timeliness against national deadlines.
FIU requests
How requests for information from the FIU are answered.
Models
Choose the format that fits your stage. Each audit is priced on a fixed scope, quoted after a short scoping call.
Before licensing
Fixed scopeBefore you apply or launch
A check of your AML framework and documents before the licence application or go‑live.
Recurring
Fixed scopeOne-off or recurring
The full independent test of design and effectiveness, repeated on your required cycle.
Targeted
Fixed scopeOne area, in depth
A focused review of one area, for example after a finding, an incident or a supervisory request.
* Pricing is indicative and subject to final confirmation. Prices exclude VAT. Prices depend on your size, business model and the number of samples, and are quoted after scoping. Audits usually start within 1 to 2 weeks once the scope is agreed.
Use cases
Most AML audits are triggered by a specific moment in the life of a regulated company. These are the typical situations; each one sets a different scope and depth, which we agree with you at scoping.
EU AML rules expect an independent audit function to test your AML policies, controls and procedures. From 10 July 2027 the AMLR lets an external expert carry out that test.
Supervisors review the AML framework in every EMI, PI or CASP application. A readiness audit finds the gaps before you submit, when they are quickest to fix.
Before an inspection, we test whether your files and records hold up. Afterwards, we check that the findings are remediated and the evidence is ready for the follow‑up.
A missed STR, a sanctions hit or a critical bank review calls for a targeted deep dive: what went wrong, why, and which controls need to change.
Crypto services, new payment corridors, agents or fast growth change your risk exposure. An audit checks that the risk assessment and controls kept pace.
Partner banks, payment schemes, acquirers and investors may ask for independent evidence that your AML programme works. Our audit report gives them that evidence.
Process
A risk-based audit using interviews, walkthroughs and sample testing, following ISO 19011 principles. The timeline depends on your size and how quickly documents and access are provided.
Indicative timeline
4 to 8 weeks
Week 1
Scope, document request and a sampling plan agreed.
Weeks 1 to 3
Policies, risk assessment and controls walked through.
Weeks 2 to 5
Interviews and sample testing of files, alerts and STRs.
Weeks 4 to 8
Draft report, management responses and the final report.
After remediation
Optional re-test, typically 3 to 6 months later.
Durations are indicative and not legal deadlines. Large or complex businesses may need longer.
FAQ
Under AMLD Art 8(4)(b) it is required where appropriate to your size and the nature of your business. From 10 July 2027, AMLR Art 9(2)(b) makes an independent audit function part of the required internal controls. In Canada, PCMLTFR s.156(3) requires an effectiveness review of the compliance programme at least every two years.
Yes. Many national laws already allow an external auditor today, and from 10 July 2027 the AMLR expressly allows an external expert to carry out the test where there is no independent audit function. Some countries require an external audit for certain licences. We confirm what applies to you during scoping.
From 10 July 2027 for most obliged entities, including EMIs, PIs and CASPs.
Typically as the periodic independent test your AML rules expect, before a licence application, around a supervisory inspection, after an incident or a finding, or when new products, markets or volumes change your risk exposure.
Your AML policies and procedures, the business-wide risk assessment, recent management reports, access to your screening and case-management tools, and a contact person for interviews. We send a document request list at scoping.
Findings ranked by risk with evidence references, a remediation plan with owners and dates, a summary for management, and the option of a re‑test.
Yes. We test sanctions lists, thresholds and tuning, and how hits are handled, as part of the controls in operation.
Yes. As part of the FIU reporting tests, we check STR decisions and their timeliness against the national deadline that applies to you.
Indicatively 4 to 8 weeks from scoping to the final report, depending on your size and how quickly documents and access are provided. This is practice, not a legal deadline.
To keep the audit independent, MAXCORP reports to the board or audit committee and keep delivery separate from assurance. If our team runs your AML operations, we tell you and recommend another auditor where independence could be questioned.
Contact
After a discovery meeting we send a tailored audit plan with the scope, the samples needed and an indicative timeline.
With your consent, we use cookies for analytics and to measure our ads. Cookie Policy
English
Polski
中文
Eesti
Suomi
Latvia
Lithuania
Sweden
Norway
Czech Republic
Switzerland
Malta
Cyprus
Canada