An anti-money laundering programme is not a policy document. It is a set of controls that run every day: transaction monitoring, suspicious activity reporting, customer due diligence, sanctions screening and staff training. Each is usually owned by a different team, working in a different system. The monthly programme review is the control over those controls. Once a month the MLRO or BSA officer looks at the numbers from every part of the programme, challenges what looks wrong, records a conclusion and assigns actions. This free AML compliance checklist gives banks, payment firms, wealth managers, fintechs and other regulated firms a repeatable review. The monthly steps run in the same order every time, and a conditional annual section covers the risk assessment refresh, the independent test and the MLRO’s annual report. Every step has an owner, every conclusion is signed off and every month leaves an evidence trail that an examiner can follow.
Transaction monitoring systems, KYC platforms and screening tools do the operational work. They generate alerts, collect documents and flag names. What they cannot do is tell you whether the programme as a whole is working. A monitoring system will happily report that it closed 4,000 alerts last month. It will not tell you that 300 of them were closed with a one-word rationale, that one scenario has produced no alerts since its threshold was changed, or that the team closing them is two analysts short.
Regulators on both sides of the Atlantic expect a named senior individual to own that judgement. In the US, the Bank Secrecy Act requires a designated BSA compliance officer. In the UK, the Money Laundering Regulations 2017 and the FCA’s SYSC rules require a nominated officer and an MLRO who reports to senior management. A monthly review is how that person turns a regulatory title into a documented, repeatable act of oversight.
Examples: alert investigation, KYC onboarding, screening hit review, SAR drafting.
Cadence: daily, case by case.
Output: closed alerts, approved customers, filed reports.
Tooling: monitoring, case management and screening systems.
Examples: backlog trends, QA results, overdue reviews, training gaps, issue ageing.
Cadence: monthly, plus an annual deep review.
Output: a signed conclusion on effectiveness, escalations and an action log.
Tooling: a structured checklist with evidence, owners and sign-off.
Six monthly phases take the review from data collection to MLRO sign-off. A seventh phase switches on automatically for the annual review.
Assign this phase to a compliance analyst so the data is ready before the MLRO’s review is scheduled. The review is only as good as the MI that goes into it.
This phase is assigned to the MLRO or BSA officer by name. It cannot be completed by the analyst who prepared the pack.
Shown only when the review is marked as the annual review. Conditional logic keeps the monthly checklist short for the other eleven months.
US and UK rules describe the same core programme in different words. Most practitioners know the US version as the “pillars” of a BSA/AML programme. The table maps each element to its main source and to the part of the review that produces evidence for it. Your own obligations depend on your firm type and regulator, so treat the table as a starting point, not legal advice.
| Programme element | United States | United Kingdom | Evidenced in |
|---|---|---|---|
| Risk assessment | Expected by examiners; FinCEN’s April 2026 proposal would make it an explicit requirement | Firm-wide risk assessment, MLR 2017 reg. 18 | Phase 7 |
| Policies, controls & procedures | Internal controls, e.g. 31 CFR 1020.210 for banks | MLR 2017 reg. 19 | Phases 2–5, Phase 7 |
| Responsible officer | Designated BSA compliance officer | MLR 2017 reg. 21 and the FCA’s MLRO rules in SYSC | Phase 6 |
| Training | Ongoing employee training | MLR 2017 reg. 24 | Phases 1 and 5 |
| Independent testing | Independent testing of the programme | Independent audit function where appropriate to size and nature, reg. 21 | Phase 7 |
| Customer due diligence | CDD and beneficial ownership rule, 31 CFR 1010.230 | MLR 2017 Part 3, including EDD and PEPs | Phase 4 |
EU firms should plan for the Anti-Money Laundering Regulation (EU) 2024/1624, which applies directly across member states from 10 July 2027. The new EU Anti-Money Laundering Authority will begin directly supervising a small group of the highest-risk cross-border institutions from 2028. The review structure above carries over: only the references change.
A recurring schedule creates the review on the first working day of each month and assigns Phase 1 to the analyst who prepares the pack. Nobody has to remember to start it, and a missed month shows up as an overdue checklist rather than a gap discovered during an examination.
The MLRO sign-off phase is assigned to one person by name, and each task records who completed it and when. MI extracts, QA samples and committee papers are attached to the task they support, so the evidence for every conclusion sits in one place.
When the examiner asks for evidence of ongoing oversight, you export the last twelve completed reviews with their timestamps, attachments and actions. The annual phase shows the risk assessment refresh and the MLRO report sitting in the same trail.
CheckFlow is not a transaction monitoring or KYC platform, and it does not replace one. It runs the human review and attestation work around those systems. Our guide to financial services workflow automation explains where that line sits, and lists the other recurring compliance workflows (sanctions list checks, SOX control testing and DORA ICT risk reviews) that follow the same pattern.
Customer onboarding is where most CDD exceptions start. The Customer Due Diligence Checklist covers the onboarding side of the process, and CheckFlow’s compliance checklist software shows how recurring reviews, evidence and approvals work across your whole compliance calendar.
It is a scheduled, documented assessment of whether a firm’s anti-money laundering controls are working. The MLRO or BSA officer reviews management information from each part of the programme: transaction monitoring, suspicious activity reporting, customer due diligence, sanctions screening and training. They then challenge anything that looks wrong, record a conclusion and assign actions. Most firms run a lighter review monthly and a full review annually, alongside the risk assessment refresh.
Regulations set some fixed points and leave the rest to a risk-based judgement. In the UK, the FCA expects the MLRO to report to senior management at least annually on how the AML systems and controls operate and how effective they are. In the US, independent testing is commonly carried out every 12 to 18 months, depending on the institution’s risk profile. A monthly MI review sits between those points. It catches backlogs, overdue reviews and training gaps while they are still small, and it gives the annual report twelve documented data points to draw on.
At minimum it should cover the core programme elements: the risk assessment, policies and controls, a responsible officer, training, independent testing and customer due diligence. In practice it also needs the operational checks that show those elements are working. Those include alert backlog and QA, SAR timeliness, overdue periodic reviews, PEP and high-risk approvals, sanctions list update dates, and an issues log with owners. Most importantly it should end in a signed conclusion, because the review is only evidence of oversight if someone accountable records a judgement.
The MLRO in the UK, or the designated BSA/AML compliance officer in the US. An analyst can prepare the pack, but the conclusion and sign-off should belong to the person accountable for the programme. That keeps preparation separate from review. Where the conclusion is that the programme is not effective, or a material issue has emerged, the checklist should also record the escalation to senior management or the board.
No. Monitoring, case management, KYC and screening systems do the operational work, and CheckFlow does not replace them. This checklist runs the oversight layer on top of them: collecting their output, reviewing it, recording decisions and tracking actions to closure. The MI extracts from those systems are attached to the relevant tasks as evidence.
Yes. The template is fully editable. A small payment institution or wealth manager might merge Phases 2 and 3, drop the scenario-tuning tasks if it uses a vendor’s standard rules, and run the full review quarterly rather than monthly. The principle stays the same at any size: collect the evidence, review it, sign it off and track the actions.
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.
