The independent test your examiner, bank partner and board will ask for.

The BSA rules require a money services business's AML program to provide for an independent review, and they tie its scope and frequency to the risk of the services the business provides. They do not set a fixed calendar interval.

In practice, many state regulators and bank partners expect a review at least annually, and some put that expectation in writing, for example in a program agreement. A higher-risk profile, such as cross-border transfers, cash-intensive agents or rapid growth, can justify more frequent or deeper testing of specific areas.

We recommend an interval based on your risk and on what your regulators and bank partner require. Our guide to which U.S. rules require an independent BSA/AML review sets out where the requirement comes from. Ethixera Advisory is not a law firm and does not provide legal advice, so the legal reading of what your license requires stays with your counsel.

Not if the test is meant to be independent. A reviewer who designed the policies, built the procedures or tuned the monitoring is testing their own work, and examiners and bank partners are likely to discount that. We decline to test programs we designed, and we will not review a program where Ethixera holds the BSA/AML officer or compliance seat.

For money services businesses, the BSA rule does allow the review to be done internally, by an officer or employee other than the designated compliance officer. Examiners still generally expect the reviewer to be independent of the work tested and qualified to test it. If Ethixera built your program, plan for a different reviewer. If another firm or your own team built it, we can test it.

Six things. A scope and test plan agreed before testing starts. Risk-based test scripts for each area in scope. Workpapers documenting every test, sample and conclusion, with the evidence behind it. A findings report with severity, root cause, recommendation, management response, owner and target date. A summary for your board or committee, and for your bank partner where your program agreement calls for one. And, once remediation is done, closure evidence and follow-up testing for each finding.

The report is a compliance testing report, not a legal opinion.

Yes. Both are core to the review. For transaction monitoring, we test whether the scenarios and thresholds cover the risks in your risk assessment, whether the data feeding the system is complete and accurate from source to alert, whether alerts are worked on time and to a documented standard, and whether investigations reach sound, timely SAR decisions.

For sanctions screening, we test which lists you screen against and whether that matches your program, how matching is configured, whether customers and transactions are screened and rescreened when lists change, and how alerts are dispositioned and documented.

We test inside the systems you already run. If we tuned your monitoring or screening, that area goes to a different reviewer. Tuning is a separate service in our bank and fintech compliance practice.

The bank decides that, not the reviewer, so we start from what the bank asks for. Program agreements can specify the scope of the independent review, how often it happens, who may perform it, what qualifications the reviewer needs and how the report is delivered.

We ask for those terms, and for any prior bank findings, before we scope, and we build the review to meet them. Where the bank's requirements go beyond the BSA minimum, the review follows the bank's requirements. The report and workpapers are organized so the bank's own reviewers can follow each conclusion back to the evidence. For the rest of the file a bank will ask for, see sponsor bank readiness.