What does internal audit do for AML compliance?

The compliance officer designs the firm's AML procedures and monitors how they are applied, so the officer cannot also be the independent check on them. An independent audit fills that gap. It tests the policies, controls and procedures against the law and against what actually happens in the business, and tells the Board where they fall short. It is one of the four building blocks of a sound AML programme.

Article 58B of the Law requires an independent audit function to test the firm's internal AML policies, controls and procedures where this is appropriate given the size and nature of the firm's business, and the supervisor keeps the right to impose one. Those carrying out the audit should be independent of the areas they review, and the EBA guidelines that CySEC applies say the audit should not be combined with the AML/CFT compliance function. They should also be qualified enough for their findings and conclusions to be relied on.

CySEC's AML Directive requires the internal audit department of a CySEC-supervised firm to assess, at least once a year, whether the firm's AML/CFT policy, practices, measures, procedures and controls are appropriate, effective and adequate. The same applies to every type of CySEC-supervised firm, including crypto-asset service providers. A review only on request, or a single review when the firm starts, is not enough.

The internal auditor puts the findings and observations in a written report to the Board. The Board decides what must be done to correct the weaknesses and deficiencies found. The minutes of that Board decision, together with the internal auditor's report, are then submitted to CySEC within 20 days of the Board meeting and no later than four months after the end of the calendar year, which means by the end of April at the latest.

CySEC assesses these reports, together with the compliance officers' Annual Reports, every year on a risk basis, and from time to time publishes the common weaknesses it finds, most recently in 2024. For internal audit, these have included reports and Board minutes sent late, reports that left out branches and subsidiaries outside the EEA, and Board minutes that did not set specific corrective measures for every weakness, or a timetable for them.