Selecting an external AML auditor for a London investment firm

Under the Money Laundering Regulations 2017, a London investment firm whose Money Laundering Reporting Officer conducts their own internal audit is effectively marking their own homework. At Compliance Consultant, we see mid-sized discretionary managers and corporate finance boutiques struggle to satisfy Financial Conduct Authority (FCA) expectations for independent scrutiny while managing day-to-day transaction monitoring. Selecting an external AML auditor requires choosing practitioners who evaluate operational control effectiveness under SYSC 8 rules rather than generalists running through static questionnaires. This decision guide details the legal thresholds, evaluation criteria, and operational scope needed to procure an independent AML review that protects your regulatory permissions and gives your governing body an actionable audit trail.

The regulatory threshold for independent AML audits

Regulation 21 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLRs 2017) establishes a clear statutory requirement: where appropriate with regard to the size and nature of its business, a firm must establish an independent audit function. For London investment managers, private equity sponsors, and broker-dealers, the threshold of proportionality is routinely crossed early. If your business manages institutional capital, controls client money, interfaces with offshore fund structures, or executes transactions for high-net-worth individuals, the regulator does not view an independent audit as an optional exercise.

The fundamental compliance friction arises around the word independent. An internal compliance officer or an active MLRO who drafted the financial crime policies cannot objectively audit their execution. When supervisory teams from the FCA review anti-money laundering frameworks, they examine whether the audit function provides genuine second- or third-line challenge. As detailed in Crowe UK's analysis of MLRs 2017 Section 21 requirements, the person undertaking the audit must not have personal involvement in the design, day-to-day operation, or customer due diligence gathering of that compliance programme.

Mid-sized firms rarely possess the internal headcount to maintain a fully segregated internal audit department that has specialist financial crime training. The rules accommodate this reality. Under the FCA Senior Management Arrangements, Systems and Controls sourcebook (SYSC 8), regulated entities are permitted to outsource operational functions, including audit testing. However, the governing body remains fully accountable under regulatory rules. As outlined in Regulatory Counsel's insights on outsourced compliance audits, outsourcing compliance reviews does not transfer regulatory liability away from the regulated firm; senior managers must demonstrate rigorous vendor selection and substantive ongoing oversight.

Before engaging an external auditor, your firm should verify that the appointment addresses these specific regulatory expectations:

• Complete independence from policy drafting, day-to-day onboarding, and alert clearing
• Documented testing methodologies that evaluate operating effectiveness, not merely theoretical manual designs
• Direct reporting lines to the board or audit committee, bypassing operational heads
• Full alignment with Joint Money Laundering Steering Group (JMLSG) guidance for the investment sector
• Retention of all working papers and sampling records to evidence compliance during supervisory reviews

Evaluating sector expertise against generalist approaches

London investment firms operate in a distinct risk environment compared to retail deposit-takers or payment service providers. Your financial crime risks stem from complex beneficial ownership structures, trusts in non-equivalent jurisdictions, nominee arrangements, and transactions involving private markets. A compliance partner who primarily audits consumer credit providers or high-street mortgage brokers will not have the context required to test an alternative investment fund's investor intake. When selecting a specialist, understanding the delivery model is as significant as verifying regulatory credentials. For a broader framework on assessing regulatory advisory models, see our analysis on evaluating FCA compliance consultants: what to look for in a regulatory partner.

The danger of the junior checklist

A common complaint across mid-sized investment houses involves the deployment model used by major consultancies. A partner sells the engagement, but the actual file reviews and staff interviews are assigned to junior analysts working from generic, off-the-shelf spreadsheets. These analysts often fail to distinguish between standard retail documentation gaps and the nuanced risk mitigations required for an institutional wealth management vehicle.

This mechanical approach creates severe operational friction. Junior reviewers often issue red-rated findings for perfectly legitimate, documented commercial structures because the file does not match an inflexible checklist. Conversely, they can miss critical exposure points, such as subtle source-of-wealth inconsistencies in an overseas family office, because the tick-box for proof of address was marked complete. The resulting report generates unnecessary internal panic while failing to shield the firm from real regulatory intervention.

Supervisory perspective and commercial reality

At Compliance Consultant, our delivery model operates differently. The firm was founded by Lee Werrell, who brings more than 25 years of UK financial services regulation experience to the oversight of every client engagement (see Compliance Doctor profile). Rather than relying on junior trainees, our team of seven qualified senior associate consultants delivers reviews based on how regulatory supervisors actually evaluate risk.

Senior practitioners understand the commercial reality of operating a boutique or mid-sized investment firm in Mayfair or the City. They test controls against the regulatory standard while recognising how trading desks, prime brokerage arrangements, and investment committees work in daily practice. This level of technical depth separates genuine assurance from hollow administrative box-checking.

Evaluation Criterion	Generalist Consultancy	Commodity Template Provider	Specialist Regulatory Practice
Auditor Seniority	Junior associates supervised remotely	Unqualified automated checkers	Senior associate consultants with extensive market experience
Testing Methodology	Fixed retail banking checklists	Self-assessment web forms	Risk-based sampling of active investment files
Sector Focus	Broad consumer and commercial retail	Generic small business	Specialised: Investment managers, PE, wealth management
Deliverable Quality	80-page theoretical manuals	Unreviewed software exports	Pragmatic, RAG-rated board action plans
Accountability	Opaque delegation	No human accountability	Direct oversight by named senior practitioners

Defining the scope of the external audit

An independent AML audit must examine what actually takes place on the operational floor, not merely what is written inside your compliance manual. When scoping an engagement, the Head of Compliance and the MLRO must establish clear boundaries that encompass every stage of the financial crime lifecycle. For an overview of our firm's technical review parameters, examine our dedicated AML reviews and MLRO support services.

Business-wide risk assessment review

The foundation of your anti-money laundering framework is the Business-Wide Risk Assessment (BWRA). Under Regulation 18 of the MLRs 2017, firms must identify and assess the risks of money laundering and terrorist financing to which their business is subject. An external audit must examine whether this assessment remains an active, dynamic document or a static text created solely for authorisation.

The auditor must test whether your BWRA accounts for the full spectrum of risk factors:

• Client risk, specifically evaluating high-net-worth individuals, PEP exposure, and corporate structures with opaque ownership
• Geographic risk, testing exposures to jurisdictions identified on high-risk third country lists or subject to international sanctions
• Product and service risk, including complex derivatives, illiquid secondary assets, and co-investment vehicles
• Transaction and delivery channel risk, reviewing non-face-to-face onboarding, intermediary introductions, and reliance arrangements under Regulation 39

An effective audit identifies misalignments between the stated risk appetite in your BWRA and the actual accounts accepted onto the firm's books.

Customer due diligence and monitoring

The core of the external audit requires rigorous file sampling across your active investor base. The auditor must pull representative samples of standard Customer Due Diligence (CDD), Simplified Due Diligence (SDD), and Enhanced Due Diligence (EDD) files.

For institutional investment firms, the review must evaluate the corroboration of Source of Wealth (SoW) and Source of Funds (SoF). Auditors should not just confirm that a bank statement is on file. They must examine whether the narrative supporting an investor's accumulated wealth is plausible, documented, and properly verified against independent third-party sources.

Beyond onboarding files, the audit must evaluate ongoing monitoring and internal escalation procedures. The auditor must review your threshold alerts, manual trading reviews, and the log of internal suspicious activity reports made to the Nominated Officer. How does the MLRO handle internal escalations? Are determinations to submit or withhold a Suspicious Activity Report (SAR) to the National Crime Agency (NCA) fully reasoned and documented? The audit should verify these decision-making trails with total impartiality.

What this means in practice

When an external AML audit is concluded, the Head of Compliance should receive a clear operational asset, not an academic thesis that sits unread on a server. The deliverable must translate regulatory findings into a clear, Red-Amber-Green (RAG) action plan designed directly for the board of directors and the audit committee.

Each finding in the final report should state the exact regulatory obligation, the observed operational deficiency, the systemic risk to the firm, and a proportionate remediation step. If an auditor notes that your EDD files lack sufficient source-of-wealth verification on non-executive directors of corporate clients, the solution must specify the exact evidentiary standard required to close the gap.

+-------------------------------------------------------------------------------+
|                       SAMPLE RAG AUDIT REMEDIATION ITEM                       |
+-------------------------------------------------------------------------------+
| FINDING: EDD files for overseas corporate investors lack independent source   |
|          of wealth corroboration (MLRs 2017 Reg 33).                          |
| RISK RATING: HIGH (RED)                                                       |
| SUPERVISORY IMPACT: Risk of formal supervisory intervention or skilled person |
|                     review under FSMA Section 166.                            |
| REMEDIATION REQUIREMENT: Update the institutional CDD procedure to mandate   |
|                          certified audited accounts or verified bank letters;  |
|                          re-mediate the identified 12 high-risk accounts.     |
| TARGET COMPLETION: 30 business days.                                          |
+-------------------------------------------------------------------------------+

This structural clarity is essential for managing personal regulatory liability. Under the Senior Managers and Certification Regime (SMCR), the designated Money Laundering Reporting Officer (SMF17) and the Head of Compliance (SMF16) hold explicit personal accountability for the effectiveness of financial crime systems. Presenting an independent, professionally conducted AML audit report to your governing body proves that senior management is actively identifying vulnerabilities and allocating resources to correct them.

A robust audit also helps firms avoid severe regulatory sanctions. The FCA frequently deploys its statutory powers under Section 166 of the Financial Services and Markets Act 2000 to appoint an external skilled person when it suspects systemic compliance failures. A rigorous, independent voluntary audit helps you identify and resolve operational weaknesses before an FCA supervision team initiates enforcement inquiries. Where significant issues are identified early, firms can manage communications cleanly with the regulator; for guidance on structured regulatory reporting, review our analysis on drafting an FCA Principle 11 notification: SUP 15 submissions that prevent a Section 166.

When executing regulatory change, we apply a structured three-stage approach: engage, execute, and embed. We define engage as establishing regulatory requirements before infrastructure is built; execute as driving process and organisational change in parallel with technology development; and embed as integrating compliance into real-world operations through testing and scaling. Applying this discipline ensures that an AML audit is not treated as a disruptive annual interruption, but as an operational baseline that protects your firm's market standing.

To evaluate your firm's financial crime controls, discuss your regulatory permissions, or scope an independent AML audit with an experienced team, book a free discovery call with Compliance Consultant via our discovery booking portal or contact our team directly at 0800 689 0190.