What Is an AML Independent Review and Does Your Money Services Business Need One?

If you run a money services business (MSB) and you’ve heard the term “independent review” thrown around, you might be wondering: what exactly is it, who needs one, and what does it actually look at?

With the crypto regulatory landscape shifting fast, independent reviews are quickly becoming the proof point regulators expect to see — and understanding what they cover is the first step to being prepared.

The Short Answer

An AML independent review is a third-party check-up on your anti-money laundering program. An outside reviewer is someone who isn’t part of your day-to-day compliance operations and evaluates whether your compliance program is actually doing what it’s supposed to do.

Think of it like a financial audit, but instead of checking your books, they’re checking whether your business is set up to detect and prevent money laundering.

This matters more than ever, since regulators have been issuing new guidance on what compliance looks like in crypto, and reviewers will measure your program against that evolving bar.

Why Does This Matter?

If your business exchanges fiat currency for virtual currency, exchanges one virtual currency for another, or otherwise accepts and transmits funds or value on behalf of customers, you are likely subject to Bank Secrecy Act obligations and may be required to register as a money services business.

However, maintaining a written AML program is only part of the requirement. Regulators expect companies to demonstrate that the program is operating effectively in practice. Independent testing serves that purpose. Under 31 C.F.R. § 1022.210, money services businesses must implement a risk-based AML program that includes periodic independent review to assess the adequacy and effectiveness of the program’s controls, procedures, and compliance efforts.

Keep in mind that reporting obligations extend beyond just internal flagging. What you report (or don’t) can carry consequences well beyond your AML file.

What Does the Review Actually Look At?

A thorough independent review covers five main areas:

1. Is your compliance program actually working?

The reviewer looks at whether your AML program is well-designed and functioning in practice. It’s not just about having policies; it’s about whether those policies are being applied consistently and whether they actually reduce risk. The reviewer evaluates whether the program is appropriately designed for the company’s products, customers, transaction activity, and risk profile.

2. Are you following your own policies and filing the right reports?

This section digs into your day-to-day operations. It looks at how you monitor transactions, how you verify your customers (KYC, or Know Your Customer), and how thorough your CDD (Customer Due Diligence) process is. It also checks whether you’re filing SARs (Suspicious Activity Reports) and CTRs (Currency Transaction Reports) correctly and on time. These reports are legally required when certain transactions hit specific thresholds or raise red flags, and getting them wrong can be a serious compliance problem.

3. How do you handle law enforcement requests?

If law enforcement reaches out, whether that’s FinCEN, the IRS, or another agency, how do you respond? The review looks at whether you have a clear process and whether your past responses have been timely and appropriate.

This isn’t theoretical: law enforcement can move quickly when they identify suspicious activity, and an MSB without a clear response protocol can find itself badly exposed.

4. Is your Compliance Officer actually in charge?

Every MSB must designate a compliance officer who oversees the AML program. The review evaluates whether that person has the authority, resources, and knowledge to do the job, and whether they’re adapting controls as risks evolve.

5. Are your employees properly trained?

Your staff is your first line of defence. The review assesses whether your training program prepares employees to spot red flags, understand their obligations, and know what to do when something looks suspicious. It also checks whether training is updated regularly to reflect new regulations and emerging threats.

What Documents Will You Need to Provide?

If your business is undergoing an independent review, expect to pull together a substantial set of materials, including:

• Governing documents and corporate structure
• MSB registration records and renewals
• Your written AML policies and procedures
• OFAC compliance policies (OFAC is the U.S. Treasury office that enforces economic sanctions)
• KYC and Customer Due Diligence documentation
• Enhanced Due Diligence (EDD) policies for higher-risk customers
• Transaction monitoring procedures
• SAR and CTR logs
• Employee training records
• Correspondence with IRS/FinCEN from the last two years
• Records of law enforcement interactions
• Declined or refused transaction records

It sounds like a lot, and it is. But if your compliance program is well-organized, most of this should already exist in some form. The review process also helps you find the gaps before regulators do.

How Often Should an MSB Conduct an Independent Review?

Federal regulations require periodic independent testing, but they do not prescribe a specific frequency. Most MSBs conduct an independent review annually, while lower-risk businesses may perform reviews less frequently based on their risk profile. State regulators, banking partners, and licensing authorities often expect annual reviews regardless of minimum federal requirements.

What Happens After the Review?

The reviewer produces a report documenting their findings. If there are gaps or weaknesses, you’ll receive recommendations for how to address them. That’s actually the point: it gives you a roadmap to strengthen your compliance before a regulatory exam or enforcement action puts you on the spot.

The goal isn’t just to check a box. A well-run independent review helps your business build a stronger compliance foundation and demonstrates to regulators that you take your obligations seriously.

Hodder Law Firm assists cryptocurrency businesses, money transmitters, and other money services businesses with AML compliance matters, including independent reviews and regulatory preparedness. 

Contact us now to register your money service business or start your AML program.

Disclaimer: This post is for informational purposes only and does not constitute legal advice. Readers should not act or refrain from acting on the basis of any information in this post without seeking advice from qualified counsel. Transmission or receipt of this information does not create an attorney-client relationship between the reader and Hodder Law.