Independent AML Audit for Crypto & MSB Businesses
The Bank Secrecy Act requires covered businesses to conduct periodic independent testing of their AML programs, called an independent AML audit. At Hodder Law, we deliver attorney-led independent AML audits that satisfy FinCEN requirements, and give you a clear, documented picture of where your program stands before an examiner does.
What Is an Independent AML Audit?
An independent AML audit, referred to as “independent testing” under the BSA, is a periodic, objective review of your AML compliance program conducted by a qualified party with no role in the program’s daily operations. It is one of the five required pillars of a BSA-compliant AML program under 31 CFR §1022.210.
Independent testing verifies that your written controls are actually functioning as designed, not just that they exist on paper. FinCEN and IRS examiners expect to see documented evidence of independent testing when they review your program.
Who Needs an Independent AML Audit?
If your business is registered with FinCEN as a Money Services Business, independent testing is required. This includes:
- Cryptocurrency exchanges and trading platforms
- Bitcoin ATM operators
- Wallet providers and custodians
- Payment processors and money transmitters
- DeFi platforms serving U.S. customers
- Fintech companies with MSB obligations
Businesses holding state money transmitter licenses may face additional independent audit requirements at the state level.
What Our Independent AML Audit Covers
Our audit examines every component FinCEN and IRS examiners look for, calibrated to your business model, transaction volumes, and customer risk profile.
AML Policy & Written Procedures
We review your written compliance program for completeness, accuracy, and alignment with current BSA and FinCEN guidance. We flag gaps, outdated provisions, and ambiguous language that could create liability.
Customer Identification Program (CIP) & KYC
We assess your CIP procedures, identity verification methods, beneficial ownership collection, and Enhanced Due Diligence practices — including your handling of crypto-native customer types.
Transaction Monitoring & Red Flag Detection
We evaluate your monitoring rules, alert thresholds, and investigation workflows. For crypto businesses, this includes blockchain analytics tool usage, wallet screening, and Travel Rule compliance.
SAR Filing Practices
We review a sample of your Suspicious Activity Reports — and your decisions not to file — for quality, timeliness, narrative completeness, and consistency with FinCEN’s SAR Activity Review guidance.
Employee Training Program
We assess your AML training curriculum for adequacy and frequency, review training logs for completion, and evaluate whether your team can identify red flags relevant to your specific products and customers.
BSA Officer Role & Governance
We verify that your designated BSA/AML compliance officer has appropriate authority, resources, and operational independence — and that oversight structures are documented and functioning.
Recordkeeping & Reporting
We confirm that your Currency Transaction Reports, FinCEN registration, and recordkeeping obligations are current and accurately maintained, including your FinCEN Form 107 status.
Sanctions & OFAC Screening
We review your OFAC screening process for onboarding and ongoing transaction monitoring, including SDN list coverage, crypto address screening, and handling blocked transactions.
Why Attorney-Led Independent Testing?
Most compliance consultants are generalists. Hodder Law’s independent AML audits are conducted by attorneys who work exclusively in cryptocurrency law and BSA compliance. That distinction matters in three ways.
- Legal precision. Findings are documented against the specific regulatory provision they implicate, giving you a defensible record rather than a checklist.
- Attorney–client privilege. Work product from legal counsel may be privileged, giving you a confidential view of your vulnerabilities before you remediate.
- Crypto-specific expertise. We understand the Travel Rule, blockchain transaction monitoring, DeFi risk profiles, and how IRS examiners actually approach crypto MSBs — not just how frameworks read in the abstract.
How the Audit Works
Intake & Scoping
We gather your existing AML policies, FinCEN registration, and a summary of your products and customer base. We scope the audit to your specific risk profile.
Document & Data Review
We review your written program, training logs, SAR samples, monitoring alert data, and onboarding records under strict confidentiality.
Findings & Analysis
We identify deficiencies, rate their severity, and map each finding to the specific regulatory provision it implicates.
Written Audit Report
You receive a formal independent audit report and prioritized remediation roadmap — ready to present to examiners, banking partners, or your board.
Frequently Asked Questions
How often should an independent AML audit be conducted?
FinCEN does not specify a fixed interval, but annual independent testing is the recognized industry standard and what examiners expect to see. Higher-risk businesses should consider more frequent reviews.
What happens if the IRS finds we haven’t done independent testing?
Failure to conduct independent testing is itself a BSA program deficiency. During a Title 31 audit, also known as the Title 31 exam, that finding can result in civil money penalties, a cease-and-desist order, or a supervisory remediation agreement. A proactive audit costs a fraction of the cost of defending against a deficiency finding.
Can a lawyer conduct an independent AML audit?
Yes. Outside legal counsel qualifies as an independent tester under FinCEN guidance, provided the attorney has no role in your AML program’s operations. Attorney-led audits carry additional legal weight and potential protection from privilege.
Is this different from a Title 31 audit?
A Title 31 exam is an IRS-initiated examination of your BSA compliance. An independent AML audit is something you commission proactively to identify and fix gaps before an examiner finds them. The two are related: a strong independent audit record is one of the best defenses during a Title 31 exam.
Schedule Your Independent AML Audit
Don’t wait for a Title 31 exam to learn where your program falls short. Contact Hodder Law to discuss your independent AML audit — and get a written report your team, your bank, and your regulators can rely on. Book a Free Consultation now.