Building an AML/CFT Source File for Your Sector

Record the licence or activity, supervising authority and applicable law, Rules, sector directives and FIU guidance. Check later amendments and notices. Keep sector-specific instruments separate from general reporting guidance so a reviewer can see which requirement supports each control.

The FIU website retains newer and historical editions of reporting guidance. Preserve the edition used for the relevant period and verify that operating procedures reflect later changes. A saved PDF should carry its original title and version, not a vague filename such as “latest AML”.

Map customer identification, beneficial ownership, risk assessment, monitoring, escalation, reporting and record retention to the responsible people. Explain what staff should do when information is incomplete or inconsistent. A policy is more useful when it describes the evidence retained and the next action, rather than simply listing legal titles.

Consider a customer with a complex ownership chain and a payment pattern inconsistent with the stated business. The file should show the information obtained, questions raised, risk assessment and escalation. A low transaction amount alone should not end the review of unusual activity.

Distinguish threshold-based reporting from suspicious-activity reporting and use the applicable official instructions for each. Do not assume that one report substitutes for the other. Record the internal decision and relevant facts through the authorised confidential process.

Access to review records and reporting information should be limited to appropriate personnel. Ordinary customer communications should not disclose a confidential report or reporting decision.

When a new directive appears, identify the affected policy, forms, training and system settings. Assign an owner and retain evidence of the change. Periodic review should examine whether controls work in practice, including incomplete files and overdue follow-up. The source tracker helps keep the programme current, but it is not a substitute for an entity-specific compliance assessment.

ICAN’s STR Guidance Note issued in December 2025 and effective from 1 January 2026 distinguishes statutory audit from the specified non-audit activities performed by professional accountants. A generic bank-style customer-control policy should not be imposed on every audit engagement without considering that distinction.

For a statutory auditor, the guidance addresses suspicious transactions identified while conducting the audit. It does not require a separate money-laundering investigation or the same additional CDD, enterprise-risk assessment and AML-control review expected of every other reporting activity. The auditor still needs to recognise and report relevant suspicion in accordance with the guidance.

An accountant providing a specified transaction service should establish the applicable reporting role for that service and use the corresponding customer, beneficial-ownership, record and reporting requirements. A firm offering both audit and other services should document which role is involved rather than use one undifferentiated checklist for every client.

Escalation and reporting records must remain confidential. The absence of a threshold transaction report does not remove the need to consider a suspicious-transaction report. Staff communications should avoid revealing a report or planned report to the customer. Retain the evidence and professional rationale under the relevant record requirements, and preserve a restricted file of changes to the firm’s procedure.