Certified AML & Financial Crime Auditor
A professional assurance qualification covering AML and financial-crime audit planning, control testing, evidence, sampling, regulatory alignment, findings, root-cause analysis and independent reporting.
What This Certification Covers
The Certified AML & Financial Crime Auditor certification equips professionals with the specialised knowledge and skills needed to plan and perform audits and independent testing of anti-money laundering, counter-terrorist financing and financial crime programmes, and to assess their adequacy and effectiveness within financial institutions, fintech companies and regulated entities.
The certification develops participants' ability to apply risk-based audit methodologies, test control design and operating effectiveness, evaluate customer due diligence, transaction monitoring and sanctions screening systems, and draft findings and recommendations and follow up on their implementation. It emphasises practical application and case studies, and aligns audit work with international internal auditing standards, supervisory requirements and the FATF Recommendations.
Like every ACS credential, the CAFA is awarded only after a formal assessment of defined qualification outcomes — evaluating understanding, application and professional judgement, not attendance alone.
What You Will Be Able to Do
- Understand the regulatory framework and international standards governing AML/CTF programmes and independent testing requirements
- Plan financial crime audit engagements using a risk-based approach and define their scope and priorities
- Test control design and operating effectiveness using sampling techniques, and gather and document evidence
- Assess the adequacy of customer due diligence, transaction monitoring, sanctions screening and reporting systems
- Draft audit findings, rate their severity and prepare professional reports for senior management and the board
- Leverage data analytics and modern audit tools to expand test coverage and improve quality
The CAFA Programme in 8 Modules
01Regulatory Framework and International Standards for Financial Crime Prevention5 topics
- Defining money laundering, terrorist financing and predicate offences
- FATF Recommendations and the mutual evaluation methodology
- Supervisory requirements for independent testing of AML/CTF programmes
- Elements of an effective AML programme and the three lines of defence
- Enforcement trends, regulatory penalties and lessons learned
02Audit Fundamentals and Professional Standards6 topics
- Global Internal Audit Standards (IIA) and professional ethics
- Auditor independence, objectivity and avoiding conflicts of interest
- Internal audit versus independent testing and compliance reviews
- Types of audit: compliance, operational and system-based audits
- The role of audit in governance and reporting to the audit committee
- Competency requirements and continuing professional development for financial crime auditors
03Risk-Based Audit Planning6 topics
- Understanding the institution's business model, products, channels and geographies
- Reviewing and relying on the enterprise-wide money laundering risk assessment (EWRA)
- Preparing the annual audit plan and setting engagement frequency
- Defining engagement scope, objectives and evaluation criteria
- Preparing the work programme and the risk and control matrix (RCM)
- Determining required resources and skills and engaging subject-matter experts
04Auditing Customer Due Diligence and Customer Risk Management5 topics
- Testing customer onboarding and identity verification (KYC) procedures
- Assessing the customer risk rating methodology and its accurate application
- Testing enhanced due diligence (EDD) and politically exposed persons (PEPs)
- Verifying beneficial ownership identification and customer data updates
- Auditing correspondent banking and third-party relationships
05Auditing Transaction Monitoring, Sanctions and Reporting6 topics
- Assessing the coverage of monitoring scenarios against the institution's risks
- Testing threshold calibration and the quality of data feeding the systems
- Reviewing the quality and timeliness of alert handling, closure and escalation
- Auditing sanctions screening systems and match management
- Testing the suspicious transaction reporting (STR/SAR) process and report quality
- Reviewing record keeping and responses to requests from competent authorities
06Performing Tests and Gathering Evidence6 topics
- Testing control design and operating effectiveness
- Statistical and judgmental sampling methodologies
- Evidence-gathering techniques: interviews, observation, inspection and re-performance
- Preparing working papers and documenting evidence in line with professional standards
- Assessing compliance culture, training and senior management responsibilities
- Handling indicators of fraud or misconduct identified during the audit
07Analytics and Modern Technologies in Financial Crime Auditing6 topics
- Data-driven auditing and full-population testing
- Using data analytics tools to identify gaps and exceptions
- Auditing regulatory technology (RegTech) systems and artificial intelligence models
- Reviewing model governance and independent model validation
- Auditing virtual asset and digital payment risks
- Continuous auditing and continuous control monitoring
08Reporting and Following Up on Findings6 topics
- Drafting audit findings: criteria, condition, cause, effect and recommendation
- Rating finding severity and forming an overall opinion on programme effectiveness
- Preparing audit reports for senior management, the audit committee and the board
- Following up on corrective action plans and verifying closure of findings
- Communicating with regulators on independent testing results
- Audit quality assurance and continuous improvement
Built for These Roles
- Internal auditors and heads of internal audit
- Anti-money laundering and counter-terrorist financing (AML/CTF) specialists
- Compliance officers and Money Laundering Reporting Officers (MLROs)
- External auditors
- Quality assurance and compliance testing teams
- Risk and internal control managers
- Professionals in banks, fintech companies, insurance and exchange companies
- Inspectors and supervisors at central banks and regulatory bodies
- Consultants and experts in compliance, governance and audit
How the CAFA Is Assessed
- 01
The exam is administered through an accredited testing centre
- 02
The computer-based exam consists of 100 multiple-choice questions
- 03
Passing score: 70%
- 04
Exam duration: 3 hours
Unless otherwise stated, candidates must achieve a minimum assessment score of 70%. Full entry requirements and the certification process are listed on the Certifications.
Start the CAFA Certification
Registration opens on a rolling basis through ACS or an authorised ACS centre. Reach out and our team will walk you through eligibility, registration and assessment windows.
Get Registration Details