Read the findings column of your last AML audit report. If most findings say a policy is out of date, a procedure is missing or a register is incomplete, the audit tested paperwork. It told you what exists. It did not tell you whether the program stopped anything.
Compliance is the floor; effectiveness is the test
Kenyan law sets a modest bar. Regulation 43 of the Proceeds of Crime and Anti-Money Laundering Regulations 2023 requires an independent audit function “to check compliance by the institution with the Act and these Regulations”. An audit can meet that bar by confirming that required documents and processes are in place.
CBK’s draft AML/CFT/CPF guideline, issued for comment in September 2026, raises it for banks. The independent audit must assess the adequacy and effectiveness of the program, and the board must ensure controls are subject to regular independent testing and that weaknesses are remediated on time.
| Source | Requirement |
|---|---|
| POCAMLA Regulations 2023, reg 43 | An independent audit function to check compliance with the Act and the Regulations |
| Same, reg 44 | An annual compliance report to the Financial Reporting Centre by 31 January, covering compliance with the law and the institution’s internal rules |
| CBK draft AML/CFT/CPF guideline (August 2026), 5.3.1(i) | The board ensures controls are regularly and independently tested and weaknesses remediated in a timely manner |
| Same, 5.4(d) and 5.4.1.3 | The independent audit assesses compliance with law and internal policy, the adequacy and effectiveness of the program, and the reliability of internal and regulatory reporting |
This guide’s position applies to every reporting institution, not only banks: an independent AML audit re-performs the work the controls were meant to do, on a sample of real cases, and reports what the controls produced. Confirming that controls exist is preparation for the audit, not the audit.
Re-perform, don’t inspect
| Control | What an existence test checks | What an outcome test does |
|---|---|---|
| Customer due diligence and beneficial ownership | A CDD checklist is on file and signed | Re-establishes the beneficial owner of sampled legal-person customers from source documents and compares the result with the file |
| Customer risk rating | The rating model is approved | Re-rates a sample of customers from their raw data and compares with the system rating |
| Transaction monitoring | Scenarios are documented; alerts closed within the service level | Re-reviews a sample of closed alerts: was the reasoning sound, and should any have been escalated? |
| Suspicious transaction reporting | An STR register exists | Traces sampled escalations from the date suspicion arose to filing, against the two-day limit |
| Sanctions screening | The system is in place and lists are loaded | Reconciles screened populations with source systems and runs a seeded test (see Sanctions screening you can prove) |
| Training | Attendance records exist | Tests whether front-line staff in sampled branches can recognize and escalate a scenario |
| Remediation of past findings | Closure evidence is filed | Retests a sample of closed findings to confirm the weakness is gone |
The right column takes longer. It is also the only column that tells the board whether the program works.
Picking the sample
No Kenyan rule sets audit sample sizes. Three principles keep the sample honest:
- Weight to risk. Draw more items from high-risk customers, products and channels than from the rest. State the basis in the report.
- Reach the edges. Include items that controls are most likely to miss: accounts onboarded through agents, customers rated low but transacting heavily, alerts closed by the busiest reviewer, overrides of system ratings.
- Size for a conclusion. Take enough items per control to say whether it operated, not just whether one case failed. Where early results show exceptions, extend the sample before concluding.
Isolated or systemic
An exception list is not a finding. Group the exceptions by cause. If several share one cause, such as a missing data field, a reviewer workload problem or a model setting, the finding is the cause, and it is systemic. Remediating each file one by one leaves the cause in place and the next audit finds the same exceptions.
Assurance that matters
Existence is the easiest thing an AML audit can prove. My oversight of AML/CFT/CPF controls has turned repeatedly on one distinction: evidence that a procedure was followed is not assurance that the risk was managed. A completed CDD checklist has not shown that beneficial ownership was established. An alert count has not shown that suspicious activity was identified and escalated. Even closed audit findings have needed a second look to confirm that the weakness was actually fixed. The reviews that earned the name re-examined real customer files, transactions, screening outcomes and investigation decisions; tested whether corrective actions worked; and traced each exception to the weakness that let it recur. An independent audit must answer whether the controls have worked against the risks they were built for, not whether the institution can show that they exist.
Before the audit committee accepts the report
- Which controls were re-performed on real cases, and which were only inspected?
- How was each sample chosen, and how many items did it hold?
- Which findings are systemic, and what is the cause behind each?
- How many previously closed findings were retested, and did any reopen?
- Does the conclusion say whether the program is effective, not only whether it complies?
Commission the audit you need
An audit scoped as a compliance check will deliver one, and the report will look reassuring. Scope it as an effectiveness test, with re-performance written into the terms, and the report will tell you something you did not already know.
Riskill’s Independent AML Audit Pack includes an audit program, a sampling plan, a findings register, a rating methodology, a report template and a corrective action tracker: riskilled.com/toolkits. For an independent AML/CFT/CPF audit and effectiveness review, talk to the advisory desk: riskilled.com/engage.