The operating answer
Use the firm’s risk assessment to explain why a control exists, then show that the control operates and is tested. The FCA’s Financial Crime Guide provides supervisory guidance; the applicable legal and regulatory requirements still need a firm-specific assessment. [FCA Handbook] [FCA]
The workflow below is our editorial synthesis. Regulatory statements link to primary sources. Examples are hypothetical, and applicability requires a firm-specific assessment.
Connect the risk assessment to the service
Describe the products, customers, distribution channels and relevant geographic exposure. Explain the movement of money and the parties involved. A risk assessment that could describe any business is a weak basis for deciding where a control is needed.
Record the evidence behind the assessment and the events that should trigger a review. Examples include a new product, a materially different customer group or a changed delivery model. These are editorial prompts, not an exhaustive regulatory list. The FCA's guidance should be read against the firm's actual activities. [FCA Handbook]
Write a control objective that can be tested
State the risk, the intended control outcome and the owner. Separate design from operation. A screening tool may be installed while its data feed is incomplete; an escalation policy may be approved while staff do not know who receives the escalation.
For each control, record the input data, relevant systems, decision rules, escalation path and retained evidence. Keep access and change permissions clear. The control file should make it possible to investigate a failure without relying on one employee's memory.
Validate data before tuning a model
Check that the data required by the control reaches it accurately and on time. Reconcile record counts, identify missing fields and document transformations. A sophisticated rule cannot compensate for a population that never enters the system.
Use a controlled change process for tuning. Record the rationale, expected effect, validation and approval. Do not optimise solely for fewer alerts. A reduction in volume may reflect better precision or a blind spot; the test must distinguish the two.
Make alert handling observable
Define the responsibilities for triage, investigation, escalation and closure. Keep enough rationale to explain a decision, including the information available at the time. The goal is a traceable assessment, not a long narrative assembled after the event.
Monitor workload and ageing alongside quality. A queue can appear stable while difficult cases are left behind. Give decision makers a view of unresolved exposure, capacity and overdue actions. Protect confidential information and limit access to sensitive case material.
Keep suspicious-activity decisions controlled
The firm's reporting responsibilities should be assessed under the applicable law and supervisory framework. The FCA's money-laundering and terrorist-financing material is a starting point for that framework. Staff need an internal escalation route and clear responsibilities for the specialist assessment. [FCA]
Do not use a public editorial checklist as a substitute for a reporting decision. This site does not provide transaction thresholds or patterns for avoiding detection, and it does not advise a firm to disclose confidential reporting decisions to customers. Operational records should preserve the appropriate confidentiality.
Test effectiveness with quality assurance
Define a sample that can reveal meaningful weaknesses. Include different decisions and risk contexts rather than reviewing only the easiest closed cases. Record what the reviewer checked, the finding and whether the issue is isolated or systemic.
Where possible, distinguish the person operating the control from the person testing it. Describe any independence limitations honestly. Track recurring defects across periods and connect them to training, process or system changes. A rising quality score is useful only when the test remains comparable.
Read enforcement as a specific record
Public notices can help a team formulate better questions. They should not be turned into unsupported claims about the current condition of a named firm. Keep the entity, relevant period, requirement, findings and remediation separate.
The Starling and CB Payments notices included in this edition concern specific historical findings. Use the separate case pages to understand the source and then test your own control. The editorial question is whether a similar weakness could exist in your process, not whether another firm is currently safe or unsafe. [FCA] [FCA]
Close an issue only with evidence
An action is not complete merely because the policy text changed. Define the operating evidence and the test that will demonstrate the improvement. Keep the original finding, interim controls, implementation record and retest together.
Where the result remains uncertain, say so. An honest issue log supports better decisions than a green dashboard that counts activity instead of effectiveness. The downloadable checklist is a way to organise this work and should be adapted by the responsible professionals.
| Control layer | Evidence question | Typical owner |
|---|---|---|
| Risk assessment | Why is this control needed? | Financial crime leadership |
| Data | Does the complete population reach the control? | Data and operations |
| Operation | What happened to each material exception? | Investigation team |
| Quality assurance | Does testing support the conclusion? | Control testing or assurance |
| Remediation | Did the change address the original defect? | Named issue owner |
Working checklist
Progress is saved only in this browser when local storage is available. Ticks record your work; they are not a compliance score.
Method, assumptions and limits
We use official sources for regulatory facts and label our suggested workflows as editorial methods. Illustrative examples are hypothetical. The content does not establish the position of any individual firm and is not a prescribed regulator template.
Source review date: 12 November 2026. No automatic monitoring is running. Check the underlying document, applicable entity, activity and jurisdiction before using this material.
Read the full methodologyQuestions, answered.
Does fewer alerts mean a better control?
Not necessarily. A change may improve precision or remove useful detection. Validate the effect against the control objective.
Does this checklist replace an MLRO assessment?
No. It is an editorial operating aid. Specialist decisions and reporting responsibilities remain with the appropriate firm personnel.
Are enforcement cases current ratings of the firms?
No. They are historical source records. Findings, time periods and remediation should be read in the original notices.
Sources & scope
Primary sources used for this research edition. Document dates and commencement dates are different fields. Recheck the issuing authority before acting.
- FCA Handbook: FCG 2: financial crime systems and controlsHandbook guidance · source reviewed 12 November 2026
- FCA: Money laundering and terrorist financingGuidance · source reviewed 12 November 2026
- FCA: Starling Bank Limited: final noticeFinal notice · source reviewed 12 November 2026
- FCA: CB Payments Limited: final noticeFinal notice · source reviewed 12 November 2026