Preparing your client files for an AML supervision visit

Firm wide

• Your firm wide risk assessment (regulation 18).
• Your written policies, controls and procedures (regulation 19).
• Records of staff training (regulation 24).

For each client file

• The client's identity information and the evidence you used to verify it (regulation 28).
• For business clients, the company details, directors and beneficial owners, and how you verified them.
• What you understood about the purpose and intended nature of the work.
• Your risk assessment of the client.
• Sanctions and PEP screening results, and the date they were run.
• Any enhanced due diligence, with senior management approval where required (regulation 35).
• Evidence of ongoing monitoring and updates to the file.
• If you use a digital identity check, a note that the service is on the DVS register.

Keep in mind

• Records must be kept for five years after the relationship ends (regulation 40).
• Don't place internal suspicious activity reports or MLRO decisions on the client file where the client or colleagues without a need to know could see them.