As AML/CFT frameworks continue to evolve, including through the development of the EU’s new AML/CFT package and the establishment of the Anti-Money Laundering Authority (AMLA), financial services firms are expected to demonstrate that their compliance arrangements are appropriately designed, risk-based and effective in practice.
This raises an important governance question: are firms measuring the effectiveness of their AML/CFT frameworks, or primarily measuring the volume of compliance activity?
Operational metrics remain an important part of AML/CFT oversight. Examples may include the number of transaction monitoring alerts reviewed, customer onboarding files assessed, accounts suspended or restricted, suspicious activity reports submitted, training sessions completed and policies updated. These indicators can help management understand workload, resourcing, and process discipline.
However, on their own, they may not provide a complete view of whether financial crime risks are being identified, assessed, mitigated, and reported appropriately. A high volume of alert reviews, for example, does not necessarily indicate that monitoring scenarios remain aligned with the firm’s current risk profile or relevant typologies. Equally, policies and procedures may be up to date but still require testing to confirm whether they are being applied consistently in practice.
The Right Questions to Ask When Assessing Controls
EU AML/CFT supervision continues to emphasise risk-based and proportionate approaches. Under the developing EU framework, AMLA is expected to support greater supervisory convergence, including through technical standards, guidelines, recommendations, and coordinated oversight.
For firms, this reinforces the importance of being able to evidence not only that controls exist, but that they are calibrated to their risk exposure and subject to appropriate governance, monitoring and review. Useful questions may include:
Is the business-wide risk assessment current, sufficiently granular, and reflected in day-to-day decision-making?
Are customer due diligence, ongoing monitoring, and transaction monitoring controls proportionate to identified ML/TF risks?
Does management information give senior management and the board a clear view of material risks, control performance, remediation activity, and emerging issues?
A more effective approach to AML/CFT compliance is likely to combine activity-based reporting with qualitative assessment and outcome-focused indicators. This may include reviewing the quality of alerts, the rationale for escalations and closures, the timeliness and completeness of suspicious activity reporting, the effectiveness of remediation plans, and the extent to which lessons learned are incorporated into policies, procedures, training, and systems. The objective is not to replace operational metrics, but to ensure they are interpreted in the context of the firm’s risk profile, control environment, and regulatory obligations.
As the EU AML/CFT framework becomes more harmonised, firms may wish to consider whether their existing governance and reporting arrangements provide sufficient evidence of a risk-based approach. This may involve reassessing the design and operation of key controls, strengthening documentation, and ensuring that board and senior management reporting supports appropriate oversight. In practice, the effectiveness of an AML/CFT framework is demonstrated not by the number of processes in place, but by whether those processes help the firm identify, manage, and report relevant financial crime risks in a timely and proportionate manner.
How We Can Help
We support financial services firms with independent reviews of AML/CFT frameworks, taking into account applicable regulatory expectations, the firm’s business model, and its specific risk profile. This can include reviewing governance arrangements, business-wide risk assessments, policies and procedures, customer due diligence and ongoing monitoring processes, control testing, management information, and regulatory reporting arrangements. Our reviews are intended to help firms identify potential gaps, demonstrate a risk-based approach, and consider practical enhancements to their financial crime compliance framework.