What is AML Audit Readiness for Fintechs?

Prepare for an AML audit or CBN examination: the evidence for customer due diligence, PEPs, sanctions, transaction monitoring, STR and threshold reporting, records and independent testing.

What is AML audit readiness?

Being able to show, on request, that your anti-money-laundering programme ran as designed: customer checks done, alerts reviewed, reports filed on time and records kept. It is judged on evidence, not on policy documents, so readiness means that evidence already exists and can be found quickly.

How quickly must a suspicious transaction report be made in Nigeria?

The Money Laundering (Prevention and Prohibition) Act 2022 says the report must be drawn up within 24 hours after the transaction. Threshold reports, for single transactions above N5,000,000 for individuals or N10,000,000 for companies, are due in writing within seven days.

Is StackWeaver's assessment an AML audit?

No. The evidence readiness assessment is a readiness review, not an audit. In five working days we review the evidence you hold for these seven areas and give you a gap list and plan. Independent testing of your programme should come from your internal audit unit or an independent reviewer.

AML Audit Readiness for Fintechs

AML audit readiness · customer due diligence evidence · audit readiness · Updated 2026-10-12

An AML audit, or a CBN examination, tests whether your anti-money-laundering programme actually ran: who was checked, what was flagged, what was reported and when. This page sets out the seven areas a reviewer tests, what Nigerian law says about each, and the evidence that shows it.

Last reviewed: 12 October 2026 · Next review: 10 January 2027 · By the StackWeaver compliance research team

1. Customer due diligence (SWC-30 Customer due diligence and risk rating)

Evidence a reviewer will ask for: your CDD procedure and risk-rating method; a sample of customer files showing the documents and the verification result; beneficial ownership records for business customers; and the log of periodic reviews, with higher-risk customers reviewed more often.

2. Enhanced due diligence and PEPs (SWC-31 Enhanced due diligence and PEPs)

Evidence: the PEP screening configuration and the list sources it uses; the record of each PEP match and how it was resolved; senior management approvals with dates that come before the account was opened; and the enhanced checks applied to high-risk customers.

3. Sanctions screening (SWC-32 Sanctions and watchlist screening)

Evidence: which lists you screen against and how often they update; match thresholds and the reason for them; every potential match with its disposition and who cleared it; and a test showing that a known listed name is caught.

4. Transaction monitoring (SWC-33 Transaction monitoring)

Evidence: the monitoring rules or scenarios and why they fit your products; how thresholds were tuned; alert volumes and the time each took to close; a sample of closed alerts with the analyst's reasoning; and the record of changes to rules.

5. Suspicious and threshold reporting (SWC-34 Suspicious and threshold transaction reporting)

Evidence: the reporting procedure; a register of reports filed with submission dates and references; the timing from alert to report; the threshold report extracts and their completeness checks; and how you make sure the customer is not told.

6. Record keeping (SWC-35 Record keeping)

Evidence: the retention schedule; a reconstruction test of a few transactions picked at random; and proof that old records can still be found and read. Our guide to audit-ready payment logs covers the fields to capture and how to keep them tamper-evident.

7. Independent testing (SWC-36 Independent testing of the compliance programme)

Evidence: the latest internal audit or independent test of the AML programme, its scope and findings; the remediation tracker with owners and dates; the compliance officer's appointment; and training records showing who completed what.

Customer due diligence software is not the whole answer

The control names above come from the StackWeaver control library. Draft mapping, pending named reviewer sign-off.

Find your gaps in five working days

Our evidence readiness assessment takes five working days. It is a readiness review, not an audit: we look at the evidence you can show today across these seven areas, list the gaps against each control, and give you a plan with owners. For how we engineer the controls themselves, see CBN AML/CFT compliance; for readiness beyond AML, see audit readiness for fintechs.

This page is general information, not legal advice. The official text is the authority. Local legal interpretation should come from qualified counsel in Nigeria. AI tools helped research and draft this page; every legal statement is recorded in our public source ledger and checked automatically against the official text. Labels follow our editorial policy.