Advanced Audit and Assurance (International) · Money laundering

Anti-Money Laundering Regulations and Firm Procedures in ACCA AAA

Updated 11 October 2026 · Fact-checked

Anti-money laundering (AML) procedures are the rules and controls a firm uses to stop clients using it to launder criminal money. They cover risk assessment, customer due diligence, record keeping, training, internal reporting to the MLRO and external reporting. In AAA, you identify the gap in the scenario and recommend the fix.

Understand Anti-Money Laundering Regulations and Firm Procedures

Money laundering is the process of making money from crime look legitimate. Auditors and accountants can be used without knowing it, so AML laws put duties on professional firms. Those duties apply to the firm, not only to the individual who spots a problem.

The framework has two layers. The first is law: each country has its own AML legislation, usually based on the standards of the Financial Action Task Force (FATF). The second is professional guidance: the IESBA Code and your own firm's policies. Your exam answer should say that the exact legal rules depend on the jurisdiction, and then focus on the principles that are common to all.

Most AML regimes require a risk-based approach. The firm assesses the money laundering risk of its clients, services, countries and delivery channels. It then applies more checks where risk is higher and fewer where risk is lower. A standard checklist for every client is not enough.

Customer due diligence (CDD) is the core control. The firm identifies the client and verifies identity using reliable independent documents. It identifies the beneficial owners, meaning the people who ultimately own or control the client. It understands the purpose and nature of the relationship. It monitors the relationship on an ongoing basis. Enhanced due diligence (EDD) applies to higher-risk situations such as politically exposed persons (PEPs), high-risk countries, complex ownership structures or unusual transactions. Simplified due diligence may be allowed for low-risk cases.

The firm must also keep records, train staff and appoint a money laundering reporting officer (MLRO). The MLRO receives internal reports of suspicion from staff, decides whether they must go to the national authority, and makes the external report. Staff report to the MLRO, not directly to the client or colleagues. Staff must never tip off the client that a report has been or may be made. This is an offence in most regimes.

Key rules to remember

Risk-based approach: Assess risk (client, service, country, channel) → apply CDD or EDD in proportion → monitor; Higher risk means deeper checks. Low risk may allow simplified checks, but never no checks.
Core CDD elements: Identify + Verify + Beneficial owner + Purpose of relationship + Ongoing monitoring; Use this list to structure any CDD answer.
Firm AML controls: Risk assessment + Policies + CDD + Records + Training + MLRO + Reporting + Review; A gap in any one of these is a weakness to report in a scenario.
Internal reporting chain: Staff member → MLRO → national authority (if suspicion is justified); Report suspicion promptly. Do not tip off the client.
When EDD applies: PEP, high-risk country, complex structure, unusual transactions, no face-to-face contact; Typical triggers. Under EDD, add senior approval and source of funds and wealth checks.
Record keeping: Keep CDD evidence and transaction records for the period the local law requires; Do not quote a number of years unless the question gives one. Say 'the statutory period'.

How to solve Anti-Money Laundering Regulations and Firm Procedures questions

Use this method for any AML question on firm procedures, whether it asks you to evaluate, explain or recommend.

1Read the requirement. Note the verb: evaluate, explain, recommend or discuss. Note who you are writing to, such as a partner or the MLRO.
2Scan the scenario for risk indicators: new client, offshore or complex ownership, cash, PEP, reluctant client, odd fee payments, rushed timetable.
3Identify the firm's weaknesses: missing CDD, no risk assessment, untrained staff, no MLRO, poor records.
4For each issue, state the relevant principle, such as CDD, EDD or the duty to report to the MLRO.
5Apply it to the facts. Name the client, the figures and the specific action.
6Recommend a practical action: obtain documents, verify beneficial owners, get partner approval, report to the MLRO, avoid tipping off.
7Show professional scepticism and judgement. Say what you would want to know next and what the firm should not do.
8Finish with a clear conclusion, such as whether to accept, continue or report.

Quickest way: Issue, rule, action

When to use it: Use this when time is short, for example a 10-mark Section B part or a short AML point inside the Section A case.

List the red flags from the scenario in one line each.
Link each flag to a control: CDD, EDD, MLRO report, training or records.
Write one action per flag, with a short reason.
Add one line on tipping off and one on the MLRO decision.
Keep every point tied to the named client.

Common mistakes in Anti-Money Laundering Regulations and Firm Procedures

Listing AML steps with no link to the scenario.
Students memorise a list and write it out.
Fix: Tie every point to a fact in the case. Name the client, the owner or the transaction.
Telling the client about the suspicion or the report.
Students treat it as ordinary client communication.
Fix: State that tipping off is an offence in most regimes. Take advice from the MLRO before saying anything.
Reporting a suspicion directly to the authorities, bypassing the MLRO.
Students assume the individual makes the external report.
Fix: Within a firm, staff report to the MLRO. The MLRO decides on the external report.
Applying the same CDD to every client.
Students ignore the risk-based approach.
Fix: Distinguish simplified, standard and enhanced due diligence and justify the level from risk factors.
Confusing AML duties with the duty of confidentiality, or assuming confidentiality prevents reporting.
Both topics involve client information.
Fix: Say that legal reporting duties override the confidentiality duty, and that disclosure made in good faith under the law is protected.
Stating a specific law, section or retention period from memory for the wrong country.
Students mix national regimes.
Fix: Refer to 'the local AML legislation' unless the question names the jurisdiction. Focus on the principles.

Worked examples

Example 1

Your firm is considering a new audit client, Zentra Holdings. It is owned by a trust registered offshore, and the individuals behind the trust are unknown. The finance director is a former government minister and asks that the engagement start quickly. Explain the AML procedures the firm should perform before accepting the client. (8 marks)

Show the solution

Risk assessment: the offshore trust, hidden ownership, a PEP link and pressure to rush are all high-risk indicators. The firm should treat Zentra as high risk.
Customer due diligence: identify Zentra and verify its identity from reliable independent documents. Establish its purpose and the nature of the relationship.
Beneficial ownership: the individuals who ultimately own or control the trust must be identified and verified. Without this, CDD cannot be completed.
Enhanced due diligence: because of the PEP connection and the structure, the firm should obtain senior or partner approval, establish the source of wealth and source of funds, and apply stronger ongoing monitoring.
Reluctance and urgency: the push to start quickly is itself a warning sign. The firm should not begin work until CDD is complete.
Reporting: if the owners cannot be identified, or the answers raise suspicion, the firm should decline the engagement. Staff should report concerns to the MLRO, who decides on an external report. The firm must not tip off the client.
Records: keep all CDD evidence and the risk assessment on file.

Answer: Treat Zentra as high risk, complete CDD and beneficial ownership checks and apply EDD with partner approval before accepting. If ownership cannot be established, decline and consult the MLRO about reporting, without tipping off the client.

Example 2

During the audit of Kavo Ltd, an audit senior finds that several large receipts from an unknown overseas company were immediately paid out to another overseas party, with no business reason. The senior mentions it to the audit manager, who says to ask the finance director about it and 'sort it out quickly'. Evaluate the senior's and manager's handling and recommend what should happen next. (7 marks)

Show the solution

The pattern of rapid in-and-out payments with no commercial purpose is a typical sign of possible laundering. Suspicion is reasonable and should be acted on.
The senior was right to raise it. But the manager's response is weak. Asking the finance director risks tipping off if the director is involved, and it may also compromise any later report.
The matter should go to the firm's MLRO promptly. Staff must make an internal report when they know or suspect money laundering. The manager should not decide this alone.
The MLRO will assess the facts and decide whether an external report to the national authority is needed. Under the law, a good-faith report is protected from breach of confidentiality claims.
Until the MLRO advises, the team should avoid discussing the suspicion with the client and should avoid steps that alert the client. Any further audit work should be agreed with the MLRO.
The team should record the facts, the transactions and the actions taken, but keep this record secure. The firm should consider whether the issue affects audit risk, fraud risk and continuance of the client.
Training point: the manager's response suggests training is inadequate. The firm should reinforce its AML training and internal reporting procedures.

Answer: The senior acted correctly, but the manager's approach risks tipping off and bypasses the MLRO. The matter should be reported to the MLRO at once, the client should not be told, and the MLRO decides on external reporting. The firm should also review AML training.

Exam tips

Always link AML points to the facts. Generic lists earn few marks.
Use the word 'MLRO' in the right place: staff report to the MLRO, and the MLRO reports externally.
Mention tipping off whenever a suspicion arises in a scenario.
For new clients, structure your answer as risk assessment, CDD, EDD if needed, then decision.
Add professional skills: show scepticism, give a clear recommendation, and write in a style suitable for the partner.

Practice questions from Money laundering

Anti-Money Laundering Regulations and Firm Procedures in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Anti-Money Laundering Regulations and Firm Procedures: frequently asked questions

What is customer due diligence in an audit firm?

It is the set of checks a firm performs on a client before and during the relationship. You identify and verify the client, identify beneficial owners, understand the purpose of the relationship and monitor it. The depth depends on the risk.

What does the MLRO do in an audit firm?

The MLRO is the senior person who receives internal reports of suspected money laundering. They assess the facts, decide whether to make an external report to the national authority, and keep records of the decision. They also help the firm with AML policies and training.

What is tipping off?

Tipping off means telling a person that a report has been made or that an investigation may follow, in a way that could prejudice it. In most jurisdictions it is an offence. In an exam, say you will take advice from the MLRO before communicating with the client.

How should I answer a money laundering question in AAA?

Find the red flags in the scenario, link each to a control such as CDD, EDD or an MLRO report, and recommend a specific action. Keep answers practical and tied to the client. Include a clear conclusion.