Do we actually need an independent AML audit? And can we do it ourselves?

Eloise Butterworth · 28 September 2026 · a five-minute read

This is the quick question I get asked. Usually in a corridor, usually prefaced with “can I just grab five minutes?”, and usually from someone who suspects the answer but would quite like it to be different.

So here is the straight answer, up front. If your firm does work within scope of the Money Laundering Regulations, you almost certainly need an independent audit, and you need to record your reasoning if you decide you don’t. And yes, you can technically do it yourselves. Whether you should is a different question, and we’ll get to the haircut.

What the regulation actually says

Regulation 21 of the Money Laundering Regulations 2017 requires firms to establish an independent audit function “where appropriate to the size and nature” of the business. That qualifier does a lot of work in people’s imaginations. In practice, the SRA has made its expectation clear: all but the smallest firms doing in-scope work should have one, on a periodic cycle. If you are relying on “where appropriate” to mean “not us”, the regulator will expect to see that decision made deliberately, recorded, and revisited, not simply assumed.

The audit’s job is set out in the regulation too. It examines and evaluates whether your policies, controls and procedures are adequate and effective, makes recommendations, and monitors whether you follow them. Notice what that is not: it is not a check that your policies exist. Every firm’s policies exist. The question is whether they work, and whether what happens on files matches what the documents claim.

Independent does not mean external

Here is the part that surprises people: the regulations do not say the audit has to be done by an outsider. It has to be independent. Those are different things, and the difference is where firms come unstuck.

Your MLRO cannot do it. Your MLCO cannot do it. Your compliance manager, who wrote the policies and runs the controls, cannot do it. That is not a comment on their ability; it is the definition of the word. An audit of your AML framework carried out by the person who built the framework is homework marked by its author, and the regulator treats it accordingly. If you have someone genuinely senior, genuinely outside the AML function, with full access and the expertise to test files, interview staff and challenge what they find, an internal audit can be legitimate. Most firms, being honest, do not have that person spare.

The haircut problem

Which brings us to cutting your own fringe. You can do it. The scissors are right there, the mirror is right there, and it will save you money. And every hairdresser can spot the result from across the room.

DIY audits fail the same way. Not through laziness, but through closeness: the person auditing knows why the workaround exists, remembers the file that prompted the policy, and unconsciously tests the framework the way it was designed to be used rather than the way it is actually used. The value of independence is not scepticism for its own sake. It is that fresh eyes ask the questions nobody inside the building thinks to ask any more.

What a proper one involves

A real Regulation 21 audit reads your documents and then tests them against reality: interviews with the people doing the work, file sampling that includes the client account ledger, and findings that come back prioritised, with owners and dates, in language a board can act on. If an audit you are being offered is a desk review of your policies with no interviews and no file testing, it is a policy review wearing an audit’s name badge, and it will not do what you need it to do when the SRA asks who audited you.

The honest close

If your firm is genuinely tiny and your in-scope work is minimal, you may conclude an independent audit is disproportionate, and that can be a defensible position, provided you write the decision down, with reasons, and revisit it when the firm changes. Everyone else: the question is not whether, it is who and how deep.