FSMA checks on AMLCOs: areas examined and how to prepare
Publication · September 18, 2025
The Act of 18 September 2017 on the prevention of money laundering and terrorist financing requires numerous financial entities and regulated professions to appoint an officer responsible for compliance with these obligations, commonly referred to as the AMLCO (Anti-Money Laundering Compliance Officer). The FSMA, as the supervisory authority for the sectors within its competence, oversees the effectiveness of this function within the regulated entities it supervises.
The supervision exercised by the FSMA follows a risk-based approach, as provided for under the Act of 18 September 2017, meaning that the intensity and content of the checks vary according to each entity's risk profile, its activity, its customer base and its geographic exposure. There is no single, fixed official audit grid applicable to all entities; each check is tailored to the specific characteristics of the entity concerned.
Generally, checks seek to verify that the AMLCO actually has the authority, resources and access to information necessary to perform their function, in line with statutory requirements regarding this officer's hierarchical position and independence within the organisation. Particular attention is paid to the formal appointment of the AMLCO, as well as of the senior manager responsible for compliance at the level of effective management.
Supervisory authorities also examine the existence and updating of an entity-wide risk assessment of money laundering and terrorist financing risks, a document that must underpin all internal policies and procedures, in line with the risk-based approach enshrined in the Act of 18 September 2017. This assessment must be periodically reviewed to reflect developments in the entity's activity and the regulatory environment.
Attention is also paid to customer due diligence procedures, including the identification and verification of clients and their beneficial owners, as well as to mechanisms for detecting and analysing atypical transactions that may require a report to the Financial Intelligence Processing Unit, in accordance with statutory obligations.
Staff training and ongoing awareness of due diligence obligations constitute another recurring area of examination, as the law requires regulated entities to provide training tailored to employees exposed to money laundering risks, according to their role and exposure to the relevant business relationships.
To prepare usefully for a check, regulated entities are well advised to rigorously document their risk assessment, internal procedures and decisions taken by the AMLCO, rather than seeking compliance with a checklist that may not necessarily reflect the FSMA's concrete expectations, since the FSMA assesses each situation in light of the supervised entity's own risk profile.
Preparation should include a sample-based review of customer files, not only a reading of policy documents. The entity should be able to reconstruct who checked beneficial ownership, why a risk classification was chosen and how an unusual transaction was escalated. Identified weaknesses should be assigned an owner and a realistic remediation date, with evidence of follow-up retained for the relevant supervisor.
As the legal framework and prudential expectations regarding anti-money laundering are liable to evolve, notably under the influence of European law, regulated entities are advised to regularly monitor the FSMA's official communications and to seek specialised advice in order to adapt their internal arrangements to the current state of the regulation.