What goes in an AML/KYC manual for a small financial services firm?

The business-wide risk assessment is the first section of an AML/KYC manual. It states how the firm assesses its own exposure to money laundering and terrorist financing. It sets out:

• the risk factors the firm considers, usually its customers, the countries it deals with, its products and services and its delivery channels
• the method for scoring them: inherent risk, the controls in place, and the residual risk that remains
• who approved the assessment, when it is refreshed and what triggers an early refresh

FATF Recommendation 1 asks firms to identify, assess and understand their risks and to apply resources in proportion to them. Article 8(2) of Directive (EU) 2015/849 asks for the assessment to be documented, kept up to date and made available to the supervisor [2].

The record this section produces is the assessment itself, dated, scored and signed, with the previous version kept.

The governance section says who is accountable for the programme. It names the compliance officer or money laundering reporting officer, the level at which they sit, who they report to and what they report. It states that senior management approved the policy and when.

The interpretive note to FATF Recommendation 18 asks for internal programmes that include compliance management arrangements and the appointment of a compliance officer at management level [1]. Article 8(4)(a) of the directive asks for a compliance officer at management level where the size and nature of the business make it appropriate. Article 8(5) asks for the policies, controls and procedures to be approved by senior management.

The records are the appointment letter or board minute, the approval of the policy, and the compliance officer's periodic report to management.

The beneficial ownership section says how the firm looks through a legal entity to the natural persons behind it. It states the ownership threshold the regulator uses, what counts as control where nobody meets the threshold, which documents the firm accepts as evidence, and what it does when the chain cannot be traced.

Article 13(1)(b) of the directive asks for the beneficial owner to be identified, for reasonable measures to be taken to verify identity and for the ownership and control structure to be understood. The national registers set up under Article 30 are a source the section can name.

In the US, the customer due diligence rule at 31 CFR 1010.230(d) defines the beneficial owners of a legal entity customer as each individual who owns 25 per cent or more of its equity interests and a single individual with significant responsibility to control, manage or direct it [5].

Paragraph (b) of 31 CFR 1010.230 lets a covered financial institution collect the beneficial owners through the certification in appendix A to the section, given by the person opening the account, and then requires it to verify each one's identity [5]. The record is the beneficial ownership record or certification on file, dated, with the evidence behind it.

The ongoing monitoring section says what the firm watches after onboarding. It describes:

• the scenarios or rules that raise an alert, and the thresholds behind them
• who reviews an alert and by when
• how an alert is closed or escalated
• how often each customer's information and risk rating are reviewed
• which trigger events bring a review forward

FATF Recommendation 10 and Article 13(1)(d) of the directive both make ongoing monitoring part of due diligence rather than a separate duty, so the section links back to the tiers. Higher-risk customers are reviewed more often, and their alerts are reviewed by a more senior person. The records are the alert log with its decisions and the periodic review log.

The training section says who is trained, on what, how often and how it is tested. New staff are trained before they handle customers. All relevant staff are refreshed at the interval the regulator expects, usually annually. The compliance officer and senior management receive training suited to their roles.

FATF Recommendation 18 includes an ongoing employee training programme among the internal controls. Article 46(1) of the directive asks for staff to be made aware of the law and to take part in ongoing training programmes. For a US money services business, 31 CFR 1022.210(d)(3) asks for training that includes detecting suspicious transactions. The record is the training log with dates, attendees, content and any test result.

The independent review section says how the firm checks that the manual is followed. It names who carries out the review, how independent they are of the compliance function, how often the review happens, what it covers and how findings are tracked to closure.

FATF Recommendation 18 includes an independent audit function to test the system. Article 8(4)(b) of the directive asks for one where the size and nature of the business make it appropriate. In the US, independent testing is one of the pillars of the programme rule for each sector in 31 CFR Chapter X. For a money services business, 31 CFR 1022.210(d)(4) asks for an independent review whose scope and frequency match the risk of the services provided [8].

A small firm without an internal audit function names an external reviewer or a senior person outside day-to-day compliance. The record is the review report and the action tracker showing each finding, its owner and its closing date.

The three frameworks agree on the sections and disagree on the details, and the firm's own regulator decides the details. Each of these comes from the rulebook the firm is supervised under:

• the occasional transaction threshold
• the deadline for an escalation decision
• the form and time limit for a report
• the ownership percentage
• the retention period
• the training interval

That rulebook may be a state money transmitter regulator, FinCEN, a European national supervisor or a licensing authority elsewhere. A manual that quotes the FATF text and stops there reads as generic to an examiner, who wants to see their own rule's number next to each step. That is why the intake asks which regulator supervises you, and why the manual is drafted against that rulebook with the FATF, EU and US sources behind it.

We draft the manual from a structured intake, in the order above: risk assessment first, then the policy that states the commitments, then the procedures that carry them out. Each procedure names the person, the deadline and the record. Each procedure can be written to the firm's SOP library template so the AML steps read the same way as every other process.

Our legal team reviews the draft before it reaches you, and the review is recorded in the revision block. The manual is quoted in the bespoke manual band, $3,000 to $5,000, fixed before we start.

Firms in financial services often meet this document when a licensing authority or a banking partner asks for it. The sections above are what that reader is looking for, in the order they will look.