AML compliance audit for domiciliation centers: methodology, scope, deliverable

In brief

The annual AML audit is a legal obligation under the Act of 18 September 2017 for all Belgian domiciliation centers. It covers 8 mandatory domains, relies on a representative file sample, and must produce a documented report with a tracked action plan. It is the governance mechanism that demonstrates management actively supervises its AML framework.

Why audit your AML framework

The annual audit of the AML framework is required by the Act of 18 September 2017 (Article 16). It is:

• Internal for structures up to 10 staff

• External beyond (or on SPF Economie demand)

• Annual at minimum, or immediately after a major change (new obligation, sanction)

The audit is not optional: it is a governance mechanism demonstrating management has verified the framework's effectiveness. See also our 2026 checklist.

Mandatory scope (8 domains)

A compliant AML audit covers 8 domains:

1. Governance

• AMLCO appointed, trained, direct management access

• AML policy written, dated, signed, current

• Up-to-date risk assessment

• Coherent written procedures

2. Risk assessment

• Methodology in place on the 4 dimensions

• Risk grade per file

• Consistency of grades with real profile

• See assessment methodology

3. Initial KYC

• File sample: completeness (6 sections)

• Comparison with SPF Economie requirements

• See mandatory KYC file content

4. UBO

• UBO cascade documented over 3 levels

• Comparison with Belgian register

• See UBO article

5. Sanctions and PEPs

• Screening done, dated, archived

• Continuous or annual re-screening

• See PEP verification

6. Ongoing monitoring

• Rules and scenarios in place

• Alerts generated and analyzed

• See transaction monitoring

7. CTIF reporting

• Written procedure

• Log of reports and non-reports

• See CTIF guide

8. Training and retention

• Training program applied

• See AML/KYC training

• 10-year timestamped archiving

• See data retention

Test plan template

Pre-audit (1-2 days)

• Document collection (policy, risk assessment, file sample)

• Interview with AMLCO

• Process mapping

File tests (3-5 days for 5-20 files)

• Sampling: minimum 10 files, of which at least 50 % high risk

• Completeness check: each file passes the 6-section checklist

• Cross-check with external sources (BCE, UBO register)

• Decision test: is the assigned risk grade coherent?

• Alert test: if generated, correctly handled?

Procedure tests (1-2 days)

• Verify written procedures match practice

• Interview 2-3 staff to test knowledge

• Verification of reasoned non-reports (often deficient)

Synthesis and restitution (1-2 days)

• Report drafting

• Management presentation

• Action plan

Deliverable template

A compliant AML audit report comprises:

Executive summary (1-2 pages): overall grade, top 3 strengths, top 3 weaknesses

Scope and methodology (1 page): domains covered, sample

Detailed findings per domain (5-15 pages)

Action plan: prioritized recommendations (P1 urgent / P2 important / P3 improvement)

Annexes: list of audited files, anomalies, photos/extracts

File sampling

The sample must be representative:

• 60 % active files

• 20 % recently refused files

• 10 % older files (renewed)

• 10 % high-risk files (intentional over-representation)

For a practice with 200 active files: annual audit on 15-20 files is sufficient.

Grading criteria

A template grid:

Overall score: ≥ 90 % compliant, 70-89 % partial, < 70 % non-compliant.

Frequent audit mistakes

Audit by AMLCO themselves: conflict of interest, not an audit

No sampling: only "good" files examined

Report without action plan: observe, do not correct

No follow-up on recommendations: audit n+1 finds the same anomalies

Audit done but untraced: no signed written report

Scope too narrow: KYC audited but not monitoring or retention

External auditor not AML-specialized: generalist auditor can miss specificities

No presentation to management: audit stays a paper

Risk assessment not updated after audit

No audit after major change (new obligation, e.g. RD 22/04/2024)

How Company Belgium facilitates audit

Company Belgium's audit module provides:

• AMLCO dashboard with real-time compliance indicators

• KYC file export in one click for the auditor

• Statistics: completeness rate, risk files, alerts generated/reported

• Audit report templates compliant with SPF Economie format

• Integrated action plan with remediation tracking

• Audit history with scores and trends

• Monthly automated pre-audit flagging risk files

See our RegTech landscape and the dedicated Company Belgium support module.

Bottom line

The annual AML audit is not another inspection — it is the internal governance mechanism proving management supervises its framework. Mandatory 8-domain scope, representative sampling, documented report, tracked action plan.

The right reflex: schedule the audit annually at a fixed date (ideally Q4 to prepare next year), with a structured deliverable and monthly remediation tracking. It is also the best preparation for an SPF Economie inspection.