Preparing for an AML inspection before you receive the letter.

Document readiness has always mattered. Inspection testing can go beyond documentary readiness and examine whether the files, processes and decisions support the framework the firm says it operates.

Depending on scope and risk, supervisory testing may include file sampling, process walkthroughs, interviews and detailed review of governance information. The purpose of each is to test whether the framework operates as its documentation implies. Preparation that treats inspection as a presentation exercise misses the point.

Perspective 004 set out three governance tests I use when thinking about whether oversight is working in practice. Inspection is where questions of that kind get asked at the file, meeting and MI level. This Perspective is about the period before an inspection, and how to use it.

Across the inspections I have observed or supported, three issues come up often enough that I look at them first.

Legacy customer due diligence

Legacy CDD is one of the issues I see recur most often in readiness and remediation work, particularly on higher-risk customers onboarded before current standards. The issue is not usually a lack of documentation. It is that the documentation on file no longer reflects the customer's current activity, ownership, geography or risk profile. Ongoing review has fallen behind, or has become a calendar exercise that confirms data without genuinely reconsidering the relationship.

Monitoring configuration

Transaction monitoring is the second recurring theme. Among the things that may be tested are whether monitoring coverage reflects the firm's actual products, customers, channels and risks, whether material thresholds or parameters are governed appropriately, and whether closure decisions are defensible against the methodology and evidence.

A common failure mode is a configuration left at vendor defaults and never properly reviewed against the firm's own population. That is a difficult control position to defend. The firm should be able to explain the basis for the current monitoring configuration, who owns material changes, what evidence supports it and how it is reviewed.

Management information

The third area is the MI reaching governance. Perspective 004 set out the properties of effective MI. A useful readiness test is whether accountable senior leaders can explain the firm's principal financial-crime risks and material weaknesses using the same MI they actually receive. If they cannot, the issue is not simply a reporting problem. It is a governance problem.

Where a firm has meaningful advance notice, this is broadly how I sequence the work. The phases below are illustrative. The order and duration should follow the risk, materiality and time actually available.

Preparation is not only about the state of the framework. It is also about the practised discipline of engagement. An inspection may concentrate a lot of judgement into a relatively small number of interviews, file discussions and observed processes. The discipline of how people answer, evidence and escalate therefore matters.

Claritas readiness work is designed around the time actually available and the weaknesses the firm needs to address. I normally think about it in three broad parts.

First, a readiness diagnostic. A focused readiness assessment tests the framework against the firm's material risk areas and known weaknesses. Legacy CDD, monitoring configuration and MI recur often in my work, but the assessment should follow the firm's own risk profile rather than a fixed Claritas template. This is diagnostic work. It is not Independent Assurance.

Second, a remediation runway. A prioritised remediation runway sequences corrective work by materiality, dependency and available capacity. Third, a readiness test. A simulation may be useful once the underlying control work is mature enough to make the exercise meaningful, focusing on live explanation, evidence retrieval and the handling of difficult issues rather than rehearsing a polished presentation.

For many smaller institutions, the direct assessment effort may be measured in weeks rather than months, spread across the wider preparation period. The exact effort should follow the scope and evidence needed.