How to Prepare for an AML Compliance Audit — A Guide for Professionals
Supervisory authorities (ELTE, Ministry of Finance, AMLCU) are intensifying inspections of accountants, lawyers and consultants. Learn what they check, which records they request, and how to be audit-ready at all times.
Why AML Audits Are Intensifying in 2026
In recent years, Greek supervisory authorities have significantly stepped up AML compliance inspections: ELTE (for accountants/auditors) conducts annual inspections that now include AML. The Ministry of Finance and the Anti-Money Laundering Authority (AMLCU) are increasing on-site inspections. The EU's AMLA (launching in 2026) will further reinforce supervision. The practical implication: it is not a question of "if" but "when" you will be audited. And penalties for inadequate compliance are substantial.
What Supervisory Authorities Check
During an AML audit, supervisory authorities typically request: 1. Written AML Policy: Do you have a written internal compliance policy? Does it include CDD, EDD and STR procedures? 2. Client Register with CDD: A file for every active client containing: identification data, UBO details, risk score, date of last update. 3. 5-Year Archives: Documentation for clients whose relationship has ended — legally required to be kept for 5 years. 4. STR Records: A log of suspicious transaction reports filed (or documented evidence that none were required). 5. Training Evidence: Certificates showing the professional has received AML training (certificates, seminars). 6. Office Risk Assessment: An annual risk assessment of your own practice.
The 6-Step Preparation Process
Step 1 — List all active clients: Create a complete list with name, tax number, risk category and date of last CDD. Step 2 — Identify incomplete files: For each client: are identification documents present? Has the UBO been checked? Has risk scoring been carried out? Step 3 — Update expired documents: National IDs, articles of association, and company registry extracts have expiry dates. Request updated versions from high-risk clients. Step 4 — Document your risk-scoring methodology: Risk classification must not exist only "in your head" — it must be written down with the factors taken into account. Step 5 — Write or update your AML policy: A simple 5–10 page document describing your procedures is sufficient. Step 6 — Run an internal mock audit: Before the official audit, select 5 random files and check whether they are complete.
The Most Common Findings in AML Audits
Based on supervisory reports, the most common findings in professional AML audits are: Incomplete UBO identification: Many know the legal representative but have not checked who is behind holding structures. Outdated documents: National IDs or articles of association that have expired or been amended without updating the file. Undocumented risk score: The score exists but there is no explanation of how it was calculated. Failure to retain files for former clients: Files of departed clients must be kept for 5 years — many firms delete them. No written AML policy document: There is no written text describing the firm's procedures.
Digital Tools vs Excel: What Do Supervisory Authorities Accept?
Supervisory authorities do not require specific software — but Excel has significant drawbacks in an audit: No audit trail: Who changed what and when? In Excel there is no record. Easy manipulation: Excel can be edited at any time without trace. Lost files: Excel files get lost, deleted or corrupted. A system like Complylty produces immutable audit logs, timestamped risk assessments and PDF reports that are accepted in every supervisory audit.
Audit-Ready Checklist for Accountants
Use this checklist to assess your readiness: ☐ Written AML policy updated (last 12 months) ☐ Complete CDD file for every active client ☐ UBO identified for legal entities ☐ Risk score documented for each client ☐ Identification documents in date (national ID, company registry) ☐ Files of former clients retained for the last 5 years ☐ STR log (or written record of non-filing) ☐ AML training evidence ☐ Internal review of 5 random files