Preparing for a Central Bank AML inspection

What brings a supervisor to your door

Inspections are not purely random. They follow from supervisory risk categorisation, from thematic work across a sector, from what a firm has told the supervisor in returns, and sometimes from something specific: a complaint, an STR pattern, an event at a peer firm.

Whichever route it arrives by, the notice period is rarely generous. The useful conclusion is that inspection readiness is a steady state rather than a project. Firms that treat it as a project are the ones asking, three days out, whether anyone can find the training records.

How the Central Bank rates you

The Bank keeps its own money laundering risk assessment of the firms it supervises. Each sector is rated high, medium high, medium low or low, every firm starts with its sector’s rating, and the rating then moves with what the Bank learns about the firm: the nature, scale and complexity of the business, its customer types, distribution channels and products, and the quality of its controls. The main data feed is the sector-specific Risk Evaluation Questionnaire, submitted once a year through the Central Bank Portal, which is why the questionnaire deserves the compliance officer’s own attention rather than being delegated and signed.

The rating sets the intensity of engagement. Higher-rated firms get on-site inspections. Lower-rated firms get the questionnaire, outreach and occasional spot checks. In between sit review meetings, meetings with the chief executive, the chief risk officer, internal audit and the independent directors, and attendance at board meetings. The Bank can also appoint authorised officers to enter premises, with a warrant where needed, though for most firms the engagement is a letter followed by a request list.

What they have read before they arrive

Your questionnaire answers, your previous findings and what you said you had done about them, the themes of the latest sector bulletin, and the Bank’s Financial Crime Bulletin, which since December 2025 has set out the risks it is prioritising. Read all of it yourself before the opening meeting. An inspector who has noticed a gap between the questionnaire and the documents produced will start there.

What they ask for first

The opening document request is fairly consistent, and it is worth being honest with yourself about how long each of these would take to produce today:

1. The business-wide risk assessment, with its approval and review history
2. AML policies and procedures, in the version currently in force
3. The MLRO’s reports to senior management, and the board minutes recording them
4. Training records: who, what, when, and what score
5. A sample of client files, usually chosen by the supervisor rather than by you
6. The STR log, including matters considered and not reported
7. Details of any outsourcing or reliance arrangements

The speed of the response is itself information. A firm that produces the pack in a day looks like a firm that keeps its house in order. A firm that takes a fortnight has answered a question nobody asked.

The rest of the request list

The seven items above open the engagement. The full list for a firm of any size usually also includes:

• Governance: the organisation chart, the terms of reference of the board and any risk or compliance committee, and the minutes showing AML was discussed rather than noted
• The compliance officer’s appointment letter, and the Central Bank approval for the Head of AML and CFT Compliance where that role is a pre-approval controlled function
• The customer risk methodology, and the current distribution of customers across the risk bands
• Transaction monitoring: the rules or scenarios, the alert volumes, the backlog, and how alerts are closed
• Sanctions and PEP screening: the lists used, the matching settings, the hit log and the returns filed with the Bank
• Outsourcing and reliance arrangements, with the oversight reports
• The internal audit and compliance monitoring plans, and the reports they produced
• The breach and incident log, including system failures
• Previous findings, from the Bank or from auditors, and the evidence that each was closed

Build the pack once, keep it current, and the request becomes an afternoon.

How training evidence is actually tested

Training is where the paperwork is often weakest, because attendance has historically been treated as the deliverable. It is not. The supervisor is testing whether people were instructed, and instruction implies something was learned.

Expect the questioning to go in this order:

• Show me that everyone in scope has been trained
• Show me what they were trained on, in the version they took
• Show me how you know they understood it
• Show me the people who did not complete, and what you did about them

The third question is the one that separates firms. An assessment score answers it. A signature on a sheet does not. The fourth is the one firms forget entirely: the overdue learner who was never chased is a live gap, and the absence of a chasing record makes it worse rather than better.

Versioning matters more than firms expect. If your AML content changed in March, the supervisor may want to know which version a given learner took, and when. If you cannot answer that, the training record is weaker than it looks.

The interviews

Documents are read in the morning and tested in the afternoon, in interviews. The compliance officer is first, and the questions follow the framework: where the risk is, what has changed, what the board was told. Then the chief executive and one or more board members, who are asked the same things in a different register: what the firm’s highest money laundering risks are, when they last approved the risk assessment, what the compliance officer’s last report said, whether the function has the people it needs, and what training they have had themselves. A director who has to look to the compliance officer for the answer has given one.

Front-line staff come last, and their interviews are the most revealing. What is risky about a customer in your role? What would make you escalate, and to whom? What happened the last time you did? When were you trained? Staff who have been told the policy exists answer differently from staff who have been trained on it, and the difference is audible.

Where firms lose marks

• CDD files with gaps. Not missing entirely, but missing the beneficial owner verification or the source of funds enquiry on the files where it mattered.
• Risk ratings nobody can explain. A rating with no reasoning behind it reads as a default rather than a decision.
• Ongoing monitoring in name only. Onboarding is thorough, then the relationship is never looked at again.
• An MLRO without the time or standing to do the job. Particularly where the role sits with someone already carrying a full workload.
• STR decisions that were never written down. Deciding not to report is a legitimate outcome. Deciding it without recording why is a finding.
• Policies describing a firm that no longer exists. New products, new channels, unchanged procedures.

What the published cases show

The Bank’s enforcement notices are the best guide to what it treats as serious. In November 2025 it fined Coinbase Europe €21.5 million, after a 30 per cent settlement discount, for transaction monitoring failures between April 2021 and March 2025: a configuration fault left around 30 million transactions, worth over €176 billion and about 31 per cent of the firm’s activity in the period, unmonitored for a year, and working through the backlog took almost three years and produced 2,708 late suspicious transaction reports. The lesson the Deputy Governor drew was not about the fault. It was that system failures must be reported to the Central Bank without delay.

Across the Bank’s inspection bulletins the recurring findings are less dramatic and more common: risk assessments that are missing, generic or high-level; due diligence on politically exposed persons that stops at identification; alerts reviewed late, so that reports go to FIU Ireland late; compliance officers who never presented an annual report to the board; outsourced functions nobody oversaw; and AML absent from the internal audit plan. Small firms are not exempt. Credit unions have been sanctioned for failures as basic as taking cash from people who were not members without applying due diligence.

The week before

If notice is short, spend it on the things you can still genuinely fix rather than on the ones you cannot:

1. Run the training report. Chase every incomplete, and record the chase.
2. Read the risk assessment as an outsider would. If it has not been reviewed this year, review it and minute the review.
3. Pull ten client files yourself, weighted towards the higher-risk end. Fix the administrative gaps; note the substantive ones before somebody else finds them.
4. Check the MLRO reports actually reached the board and that the minutes say so.
5. Brief the staff who will be interviewed. Not on answers, on the framework: what the firm considers risky, who they escalate to, and what happens next.

What not to do is manufacture documents with last year’s dates on them. It is detectable, it converts a control weakness into an integrity issue, and it changes the nature of the engagement entirely.

On the day

• One point of contact for every request, and a log of what was asked, when it was supplied, and by whom
• A copy of everything handed over, kept together, so the firm knows exactly what the Bank has
• Answers that are accurate rather than complete: say what you know, say what you will check, and never guess
• No volunteering of documents that were not requested, and no editing of documents that were
• A short wash-up at the end of each day: what was asked, what surprised you, what to prepare for tomorrow
• A straight answer where something does not exist. A gap admitted is a finding. A gap concealed is an enforcement case

After the findings letter

Most inspections produce findings. Findings are not a verdict on the firm, they are a list with dates attached. What matters from that point is whether the remediation plan is credible and whether it is delivered.

A remediation plan that lands well is specific about the action, names an owner, carries a date that is realistic rather than flattering, and defines how completion will be evidenced. A plan of six items delivered in full beats twenty items half-delivered, and the supervisor will remember which one you produced when they come back.

Remediation, and what sits behind it

The Bank’s stated position is that a firm found in breach will be required to remediate, and that a firm which fails to engage with remediation, or whose breaches are serious, faces the Administrative Sanctions Procedure. Since the 2023 accountability reforms that procedure reaches individuals directly, settlements for undisputed facts carry a discount of up to 30 per cent, and the resulting sanctions are confirmed by the High Court. A credible plan therefore does three things the letter did not ask for: it states the root cause rather than the symptom, it puts an interim control in place while the permanent fix is built, and it reports progress to the Bank before being asked.

Readiness as a quarterly habit

Everything above reduces to a short list, repeated. Once a quarter, with the output filed:

1. Run the training report, chase the incomplete, and record the chase
2. Check the date and approval of the business risk assessment against anything that has changed
3. Read the last quarter’s board minutes for the AML items and the discussion of them
4. Review the suspicious transaction log for timeliness and for decisions without reasons
5. Sample five customer files at the higher-risk end and fix what you find
6. Test screening with a known name, and confirm the lists updated
7. Read the latest oversight report on each outsourced function
8. Reconcile the data in the last Risk Evaluation Questionnaire to the systems it came from
9. Update the status of every open finding, internal or supervisory

A firm that has done this for a year does not prepare for an inspection. It receives one.