The question, and what this framework will not decide
The most dangerous control is not the one everyone knows is broken. It is the one recorded as effective because a policy exists, a system is enabled or a sample contained no failures.
Control testing is the work of replacing that comfort with evidence. The conclusion is not whether a document looks sensible. It is whether the control could work, reaches the population it claims to cover and actually operated during the period being tested.
This framework separates those three questions. A control has to pass three different proofs, and if the evidence cannot answer them the honest conclusion is Not evidenced, not Effective. It is written for first-line control owners, second-line monitoring, MLRO oversight and internal audit, and it teaches a shared way of reaching and recording a conclusion. Who owns which test inside a particular firm is a structural decision this guide leaves to the firm. It is a practitioner framework, not an audit programme, not an assurance opinion and not legal advice.
It will not give you a sample size, a pass rate or a test frequency. No source read for this guide sets one across financial crime controls, and a guide that supplied a number would be inventing a standard and presenting it as one. What it gives you is a way to say, for one control, one scope and one period, what the evidence supports and what it does not.
A conclusion is only as wide as its evidence: one control, one scope, one period.
The analytical spine
- Question
- What evidence is sufficient to conclude that a financial crime control is designed appropriately, deployed across its intended scope and operating effectively?
- Evidence state
- Established: the Money Laundering Regulations 2017 and applicable FCA SYSC rules on effective controls, review and, where regulation 21 applies, independent audit. Guidance: the Financial Crime Guide and the FCA's published findings, which are examples and observations. Public-sector practice: the GOV.UK fraud control testing methods and ratings, written for public bodies. FinCrimeRadar assessment: the Control Proof Chain, the three proofs and the Not evidenced conclusion.
- Decision object
- One bounded conclusion about a named control, scope and period, and the action that follows. It is not a rating of a firm's whole financial crime framework.
- Uncertainty
- No source read sets one sample size, failure tolerance, test frequency or rating scale across financial crime controls. Whether a given rule, provision or example applies depends on the firm, the control and its regulatory perimeter.
- What would change this
- New legal or FCA testing requirements. A source that prescribes a cross-control method. Evidence that this model produces misleading conclusions. A material change to the MLR or SYSC provisions relied on.
- Practitioner outcome
- After this guide you should be able to scope a control test, choose evidence that addresses design, deployment and operation, avoid false assurance, state a supportable conclusion and specify remediation and retest.
How evidence is labelled
- Established A statute, an in-force regulation or an FCA rule, read from the text.
- Guidance Handbook guidance and FCA findings. Examples and observations, not rules.
- Public-sector practice Recommended practice for public bodies. Not an FCA rule or an MLR requirement.
- FinCrimeRadar assessment Our analysis. It rests on the sources but is not their wording.
- Unknown No source read settles it.
Out of scope: a universal audit programme or sample-size table, certification or assurance opinions, a control library for every AML, fraud or sanctions process, scoring a firm's whole financial crime framework, and detailed transaction monitoring model validation. This guide gives no instructions for bypassing live controls. Any pressure or scenario testing has to be synthetic, authorised, lawful, reversible and isolated from live customer harm. For the governance of a customer risk scoring method, see Customer Risk Scores: What the Number Cannot Decide.
What the authority establishes, and where it stops
The legal text requires effective controls and, in stated circumstances, an independent look at them. It does not say how much evidence makes a control effective.
Source
Established Regulation 19(1) requires a relevant person to establish and maintain policies, controls and procedures to mitigate and manage effectively the money laundering and terrorist financing risks identified in its regulation 18(1) risk assessment, to review and update them regularly, and to keep written records of them, of changes made on review and of the steps taken to communicate them. They must be proportionate to the size and nature of the business and approved by senior management (regulation 19(2)), and must include risk management practices, internal controls, customer due diligence, reliance and record keeping, and the monitoring and management of compliance with them and their internal communication (regulation 19(3)). [1]
Established Regulation 21(1) applies "where appropriate with regard to the size and nature of its business". Under regulation 21(1)(c) the relevant person must establish an independent audit function with responsibility to examine and evaluate the adequacy and effectiveness of the policies, controls and procedures it has adopted to comply with the Regulations, to make recommendations on them, and to monitor compliance with those recommendations. Regulation 21(6) disapplies paragraphs (1) and (3) where the relevant person is an individual who neither employs nor acts in association with any other person. In deciding what is appropriate, regulation 21(10) requires the firm to take account of its regulation 18(1) and 18A(1) risk assessments and allows it to take account of qualifying guidance. [2]
Established A firm within SYSC 3.2.6 must take reasonable care to establish and maintain effective financial crime systems and controls. Its money laundering systems and controls must identify, assess, monitor and manage risk and be comprehensive and proportionate, and the firm must carry out regular assessments of their adequacy. Whether these rules apply, and in what form, depends on the firm. [3]
Application
FinCrimeRadar assessment These provisions establish the need for effective controls, regular review and, in the circumstances regulation 21 specifies, independent audit. They do not provide a sample size, pass rate, test frequency or test script for any control. As read, regulations 19 and 21 prescribe no universal test frequency, sample size, pass threshold, rating scale or evidence taxonomy. That is a statement about those two regulations, not about every legal or professional standard that might apply to a particular firm. [1] [2]
The words "regular" and "effective" are therefore doing the work, and the firm has to decide, and be able to defend, what evidence shows a control is effective. This framework is one way of making that decision. It is our design and not the regulator's.
Action
Define the control objective and the testing scope before choosing documents or samples. A test method selected first will often prove only what is easiest to inspect. This is a FinCrimeRadar recommendation.
What the guidance, the findings and the public-sector framework add
Guidance The Financial Crime Guide is general guidance under section 139B of the Financial Services and Markets Act 2000. It is not binding, it is not a standalone statement of all requirements, and firms can comply in other ways. [4] Within it, FCG 2.2.5 treats internal audit or another independent party monitoring the effectiveness of policies, procedures, systems and controls as good practice, and failing to check that policies and procedures are applied consistently and effectively as poor practice. FCG 2.2.7 treats internal audit and compliance routinely testing defences against financial crime as good practice, and asks how a firm ensures that its review of control effectiveness is comprehensive and how remediation has progressed. [5]
Guidance The FCA's recent good and poor practice reports on risk assessment, customer due diligence and sanctions are findings from multi-firm reviews. They are examples of what the FCA saw. The FCA says good practice often goes beyond the minimum regulatory requirements. [6] [7] [8] This guide uses them as evidence of what a supervisory conversation is likely to probe, and never as a testing specification. Where an example from one domain is applied to another, the text says that it is an application.
Public-sector practice The GOV.UK Fraud Control Testing Framework (FCTF-01) is recommended practice for public bodies, issued by the International Public Sector Fraud Forum. [9]
It is not an FCA rule, a Money Laundering Regulations requirement or a private-sector AML testing standard, and it does not govern FCA-regulated firms. This guide borrows its idea of rating a control as Effective, Partially effective or Ineffective, with each rating linked to action, because the private-sector sources read offer no equivalent. Where this guide departs from it, the page says so.
Guidance The FCA has also recorded firms concluding that their controls were effective or mature without appropriate evidence to support the conclusion. [6] That is a finding about those firms' conclusions. It does not say what evidence would have been enough.
1. Policy Mirage
- Risk
- A documented control is mistaken for an effective one.
- Signal
- Test evidence is limited to policy review and interviews.
- Response
- Separate design, deployment and operation before concluding.
The Control Proof Chain
Every control test, however it is run, walks the same seven links. A conclusion is only as strong as the weakest link the evidence reaches.
Figure 1. From risk to retest
Risk
State the failure or abuse the control is intended to reduce.
Control objective
State what must happen, for which population, at what point and with what escalation.
Design
Decide whether the specified control could achieve the objective if performed as written.
Design proofDeployment
Verify that the control reaches the intended systems, records, staff, vendors, products and jurisdictions.
Deployment proofOperation
Verify performance over the selected period, including exceptions and hand-offs.
Operating proofExceptions
Determine their nature, extent, root cause and whether they undermine the objective.
Tests all three proofsRemediation and retest
Assign action, interim protection, owner and date, then test the corrected control before closure.
Re-proves the failed proof
FinCrimeRadar assessment The first two links are where most weak testing is decided before any evidence is collected. If the risk is vague and the objective cannot be tested, no later link can repair it. The FCA says a business-wide risk assessment should feed into controls testing and the firm's wider risk-based approach, which is the same dependency seen from the supervisor's side. [6] Guidance
The three proofs
The central judgement is three separate questions with three separate kinds of evidence. A strong answer to one does not stand in for the others. The labels design, deployment and operation are FinCrimeRadar's synthesis, and no source read imposes this exact three-part taxonomy. FinCrimeRadar assessment
Figure 2. What each proof asks, accepts and must reject
Design proof
- Core question
- Could this control achieve the stated objective if performed as specified?
- Evidence examples
- Risk statement, objective, process map, policy, rule logic, data requirements, ownership, escalation and failure-mode analysis.
- False assurance to reject
- A detailed policy proves the control works.
Deployment proof
- Core question
- Is the control embedded across the full intended scope?
- Evidence examples
- Population reconciliation, system and data lineage, configuration, access, training, vendor mapping, change records and walkthroughs.
- False assurance to reject
- The system is switched on, so every item is covered.
Operating proof
- Core question
- Did it perform consistently during the test period and handle exceptions?
- Evidence examples
- Logs, case files, re-performance, data analysis, samples, alerts, decisions, quality assurance, incidents, misses and remediation evidence.
- False assurance to reject
- No incident or clean sample proves effectiveness.
Proof 1: design
Design asks whether the control, if performed as specified, could address the stated risk. Start with the risk and the objective, not the policy title.
A useful control objective names the population, the action, the timing and the escalation. "Customers are reviewed" is not testable. A testable version reads: every customer in the high-risk population receives a documented review at least at the firm's defined interval, and overdue cases are escalated to the named owner. The interval in that sentence is the firm's own design choice unless a specific rule or source establishes it, and nothing here suggests what it should be.
Design testing should challenge the happy path. Ask what happens when data is missing, a vendor feed is late, an analyst is absent, a record moves between systems, an alert is returned or a customer changes segment. A control that works only when every dependency behaves perfectly has a design weakness before anyone selects a sample. FinCrimeRadar assessment
Not every control deserves the same depth. The GOV.UK framework recommends focusing testing on high-risk areas and critical controls instead of attempting shallow testing of every control. [9] Public-sector practice The principle is sensible in a firm too, but the framework is written for public bodies and gives no private-sector depth rule, so how a firm ranks its controls is its own risk-based decision.
Manual, automated and outsourced controls
The same three proofs apply whoever or whatever performs the control, but the evidence changes. FinCrimeRadar assessment
- Manual. The evidence is people and records. Design asks whether the steps are clear enough to be performed the same way twice. Operation asks whether they were.
- Automated. The evidence is logic, data and configuration. Design and deployment carry more weight because a flaw in either applies to every item. Change records matter because the control can alter without anyone deciding to alter it.
- Outsourced. The evidence has to include the firm's own side: what it sends, how it configures the service, what comes back and who oversees it. Design must cover the hand-offs, and a supplier's description of its own service does not cover them.
The FCA's 2025 risk assessment findings record limited or no testing and review of risk assessment processes when firms made enhancements, upgrades or introduced automation. [6] Guidance That finding concerns risk assessment processes. Applying the same discipline to other automated controls is our application.
Proof 2: deployment
Deployment asks whether the designed control reaches the real population. This is where policy and system existence most often create false assurance.
Reconcile the population independently. Identify the products, legal entities, customer segments, jurisdictions, systems, manual queues and outsourced steps that should be covered, using a source that does not come from the control itself. Trace a small number of records from source to control and back. Confirm that configuration, data fields, access, training and escalation routes match the approved design. FinCrimeRadar assessment
The FCA's sanctions findings show why this proof matters. They record errors, omissions and delays in list data and in transfers between systems, firms with limited understanding of how lists were ingested into their screening systems, and a legacy integration failure that left a set of transactions unscreened over an extended period. The firm did not find it through routine monitoring. [8] Guidance A control can be well designed and running somewhere while still missing the population that matters.
The same review tested how screening systems ingest, transform and interpret names from the UK Sanctions List, and found, among other things, one-word names or names containing digits excluded by default and long names that exceeded system character limits and failed without generating an alert. [8] Guidance Those findings are specific to sanctions screening. The percentages the FCA published describe its own testing programme and are not pass thresholds for any firm.
2. Population Blind Spot
- Risk
- Records outside the test source are never examined.
- Signal
- The sample denominator comes from the control output rather than an independent population.
- Response
- Reconcile the intended population before sampling.
Change and growth are deployment questions
The FCA saw rapid expansion without firms first considering and ensuring that their controls remained appropriate and effective. [6] Guidance The item is not a change control specification, but it points at a practical habit. Every new product, entity, jurisdiction, data source or migration is a new deployment question, and the answer from last year's test does not carry across.
Vendors and group functions
The FCA's sanctions findings record limited challenge or validation of vendor configuration, logic and updates, insufficient internal testing, and historic vendor settings used without reassessment or oversight. [8] Guidance A supplier's assurance report speaks to the supplier's service under the supplier's conditions. It does not show how this firm's data, configuration and use interact with that service, and the firm remains the party that has to understand and test its own implementation. FinCrimeRadar assessment
3. Vendor Assurance Substitution
- Risk
- Third-party assurance is treated as proof of the firm's configuration and data.
- Signal
- No internal lineage, configuration or scenario testing exists.
- Response
- Test the firm's implementation and challenge vendor dependencies.
Proof 3: operation
Operation asks what happened over a defined period, and that takes evidence beyond asking people.
Walkthroughs show how staff say the control works. Samples, re-performance, logs, data analysis, exception records and outcome review show how it did work. The GOV.UK framework lists desktop review, interviews, walkthroughs, sample analysis, data analysis, technical testing and controlled scenario-based testing as different methods, to be chosen for the objective and used within a lawful, authorised scope. It also says testing must go beyond confirming that controls exist and processes are followed, particularly where an adversary may find a way around a control. [9] Public-sector practice
The FCA's customer due diligence review used a questionnaire, policy and procedure review, customer file review and staff interviews, and observed some firms using sample-based compliance monitoring with proportionate review cycles. It gives no sample size and no universal cycle. [7] Guidance Those describe how the FCA worked and what it saw, which is useful to borrow from and no more than that.
Sampling follows the objective
Define the population and the period before selecting any item. Include the strata that matter to the objective: the higher-risk items, the items that changed, and the items that raised exceptions. State how items were selected, because a judgemental sample and a random one support different conclusions. A clean judgemental sample cannot be extrapolated to a population that has not been reconciled, and no source read for this guide supplies a universal number that cures that weakness. Record the sampling limitation in the conclusion itself instead of leaving it in a working paper. FinCrimeRadar assessment
4. Clean Sample Comfort
- Risk
- A small passing sample creates a broad conclusion.
- Signal
- Selection excludes changes, exceptions, high-risk strata or failed items.
- Response
- Match selection to the objective and state sampling limits.
Silence is not a test result
The FCA's sanctions review recorded many firms reporting no true sanctions matches, and it also recorded weaknesses in screening configuration, data and assurance testing. [8] The FCA does not say that absence of matches proves nothing. That inference is ours: FinCrimeRadar assessment the absence of incidents, matches, breaches or complaints does not by itself demonstrate that a control is effective, because a control that is not seeing the population cannot report what it never sees.
Independence of the tester
The FCA's customer due diligence review saw stronger firms operating independent third-line testing across onboarding and due diligence, documenting findings and acting on them. It said that the same staff onboarding customers and conducting assurance raised questions about impartiality and effectiveness. Its poor practice examples included no independent review of CDD or EDD, insufficient detail on quality control, and no version control capable of demonstrating the audit trail of review and change. [7] Guidance These are observations about the arrangements the FCA reviewed. They do not say that every test must be performed by the third line, and the boundary between second-line monitoring and independent audit depends on firm structure and purpose.
From finding to conclusion
Rate the control only for the stated objective, scope and period. Everything outside those three is not covered by the conclusion.
Figure 3. The conclusion ladder, and the state that sits off it
- Effective
All three proofs are supported and no material weakness undermines the objective.
- Partially effective
The control reduces risk, but a bounded weakness or coverage gap remains.
- Ineffective
A weakness defeats or materially undermines the objective.
Not evidenced
The work cannot support a conclusion, because the population, period, evidence or method is insufficient.
This is a limit on the assurance work, not a rung of control performance. It is not a weak pass, not a fail and not a maturity level. The next action is more or better testing, with interim protection alongside if the uncertainty concerns a critical control.
Public-sector practice The GOV.UK framework rates controls Effective, Partially Effective or Ineffective, links each rating to a recommended action, and says tolerance can depend on a control's purpose and criticality, so a control may be acceptable with some gaps in coverage where another would not be. [9] This guide adapts those three ratings. In that framework the middle and bottom ratings turn partly on whether the factors that could undermine the objectives are possible, or likely or existing. It is a public-sector device, not an FCA or MLR test, and it gives no number.
FinCrimeRadar assessment Not evidenced is our addition. It stops missing evidence being treated as either a pass or a failure without analysis. The distinction from Partially effective matters. Partially effective is a conclusion about the control: it works in part, and the part that does not is known. Not evidenced is a conclusion about the assurance work: it did not establish what is true. A known coverage failure is evidence. Test gaps are not.
The conclusion record
Every conclusion should state the nine items below, so that a reader who was not there can see what was claimed and on what basis. The fields are FinCrimeRadar's design. FinCrimeRadar assessment
- Control and objective.
- Population and period.
- Test methods and evidence used.
- Findings for each of the three proofs.
- Limitations and sampling risk.
- The conclusion state.
- Immediate risk response.
- Remediation owner and target date.
- Retest condition.
What a conclusion does not establish
FinCrimeRadar assessment An Ineffective conclusion is a finding about a control against its objective. By itself it does not establish a regulatory breach, a suspicion, a loss or customer harm. Those depend on the specific obligation, the facts and the period, and they are separate judgements. Nor does a control rating alone establish residual risk. The GOV.UK framework treats control effectiveness and residual risk as separate and uses test results as an input to the residual risk assessment. [9]
Exceptions, remediation and closure
A finding is not closed because an owner says the action is complete.
Exceptions are findings about the control
An exception is a fact about the control as well as about the item. Establish its nature, its extent and its root cause, and decide whether it undermines the objective. The FCA records stronger firms using root cause analysis after screening mismatches, and independent testing whose findings were documented and acted on. [8] [7] Guidance A log of exceptions that never changes the control is a record of a problem the firm has chosen to keep.
5. Exception Graveyard
- Risk
- Findings are logged but do not change the control.
- Signal
- Repeated issues, extensions or accepted risks have no root-cause action.
- Response
- Link exceptions to owners, interim protection, remediation and governance.
Closure needs evidence of the right kind
Closure needs evidence that the correction was implemented and that the affected proof now holds. A design rewrite needs deployment confirmation. A configuration fix needs data-flow and scenario testing. A training response needs evidence that the underlying process weakness was addressed, and attendance records do not show that. FinCrimeRadar assessment FCG 2.2.7 asks how remediation has progressed, which is the supervisor's version of the same question. [5]
Retest the corrected control over a period capable of showing operation. If that period has not elapsed, record the action as implemented but not yet validated. Do not collapse implementation and effectiveness into one closure status. Interim protection stays in place until validation. FinCrimeRadar assessment
6. Closure Without Retest
- Risk
- An action is closed when implementation is reported.
- Signal
- No evidence shows the corrected control operated after the change.
- Response
- Separate implementation from validation and retest before effectiveness closure.
The clean CDD sample
Every file the team looked at was fine. The question is which files it looked at.
Composite scenario for teaching. All names, organisations, counts and dates are fictional. It does not describe a real firm and the figures are not thresholds.
- Control objective: every customer in the firm's high-risk population receives a review at the firm's defined interval, and overdue cases are escalated.
- The policy and workflow design are clear.
- Management information reports 96 percent completion.
- Compliance samples 20 completed reviews from the workflow queue and finds no errors.
- Population reconciliation then finds that 312 customers migrated from a legacy system never entered the queue.
- Eleven of those customers are high risk and overdue under the firm's policy.
How each option grades
Unsupported on the facts Effective, because every sampled review passed, reported completion is 96 percent and the policy and workflow design are clear.
Source
Regulation 19(1) requires policies, controls and procedures that mitigate and manage the identified risks effectively, and neither regulation 19 nor regulation 21, as read, says how much evidence makes a control effective. [1] [2] The FCA has recorded firms concluding that controls were effective without appropriate evidence to support it. [6]
Application
The sample tested files inside the queue. It says nothing about customers that never reached the queue, and the 96 percent is a share of the queue's own output, not of the intended population. Design proof holds. Deployment proof fails, because 312 customers sit outside the control and 11 of them are high risk and overdue. Operating proof is supported only for items that were in the queue. This analysis is our assessment.
Action
Do not record the control as effective for this population. A clean in-queue sample is a result about the queue. This is a FinCrimeRadar recommendation.
Incomplete Not evidenced, because the conclusion should wait until every migrated customer has been reviewed and the whole population can be tested.
Source
FCG 2.2.7 asks how a firm ensures that its review of control effectiveness is comprehensive. [5] The FCA has recorded firms concluding that controls were effective without appropriate evidence to support the conclusion. [6]
Application
Not evidenced is the right label when the work cannot support a conclusion. Here the work has produced a finding: a whole migrated cohort sits outside the control and 11 high-risk customers are overdue. More file review is needed to measure exposure, but exposure is a separate question from whether the control met its objective. Waiting would leave the control recorded as unassessed while a known failure stays open.
Action
Conclude now on what the evidence shows and state what remains unmeasured. Keep Not evidenced for questions the work genuinely cannot answer, such as the state of the same control elsewhere in the firm. This is a FinCrimeRadar recommendation.
Best supported on the facts Ineffective for this population and period: protect the missed customers, fix the feed, quantify the impact and retest.
Source
Regulation 19(1) requires policies, controls and procedures to mitigate and manage the identified risks effectively, to be regularly reviewed and updated, and to be recorded. [1] The FCA's CDD review saw stronger firms documenting and acting on findings from independent testing, and FCG 2.2.7 asks how remediation has progressed. [7] [5] The GOV.UK framework separates a middle rating from the lowest by whether the factors that could undermine the objectives are possible, or likely or existing. [9]
Application
The objective covers every high-risk customer. A known population exclusion defeats it for the excluded customers whatever the quality of the design or of the files that were reviewed. Design proof holds. Deployment proof fails. Operating proof is supported inside the queue and untested outside it. The conclusion is stated for this objective, population and period, and it does not say the firm's whole CDD framework is ineffective. The response follows the finding: the 11 are high risk and overdue now, the feed must be fixed so the rest of the cohort enters the control, the impact must be sized, and the corrected control needs a retest over a period capable of showing operation. This reasoning is our assessment.
Action
Record Ineffective for this population and period, with the response and retest condition in the conclusion record. Review the 11 first, then the rest of the migrated cohort by risk. This is a FinCrimeRadar recommendation.
Unsupported on the facts Partially effective, because most customers were covered, the sampled reviews were clean and the shortfall looks small.
Source
The GOV.UK framework describes a partially effective control as one that somewhat functions to its purpose and/or has possible factors that could undermine its objectives, and an ineffective one as having likely or existing factors that could do so. [9] That is public-sector practice, not an FCA or MLR test.
Application
Partially effective needs a bounded weakness, and a weakness is bounded only when its edges are known. They are not known here. The control's own output was used as the denominator, so most customers being covered is an inference from the queue. The missed segment includes overdue high-risk customers, and the control did not detect the exclusion: reconciliation did. The rating would turn an unknown into a percentage judgement. The factor that could undermine the objective is not merely possible. It has been found.
Action
Revisit Partially effective only if reconciliation establishes the full population and shows a limited gap that the control detected and closed. See the counterfactual. This is a FinCrimeRadar recommendation.
Counterfactual: change one fact
Suppose reconciliation had proved the population complete and found only three isolated late reviews, which the control itself detected and escalated. Partially effective could then become supportable, subject to materiality and the stated tolerance. The facts that moved the decision were the completeness of the population and whether the control caught its own misses.
Decision Record
- Facts
- Clear design. 96 percent reported completion. 20 of 20 sampled queue reviews clean. 312 migrated customers never entered the queue. 11 of them high risk and overdue.
- Assumptions
- The reconciliation is correct for the legacy cohort. The ratings of the other migrated customers are not yet confirmed. The firm's policy interval is the intended standard.
- Proofs
- Design: supported. Deployment: not supported, because a migrated cohort never entered the control. Operation: supported for reviews inside the queue, not tested outside it.
- Limitations
- The sample of 20 is a judgemental sample from the queue and says nothing about the excluded cohort. The size of the exposure is not yet measured.
- Conclusion
- Ineffective against the stated objective, for the high-risk population, for the period tested.
- Response
- Complete the overdue reviews for the 11, review the rest of the migrated cohort by risk, correct the migration feed and size the impact. Record an owner and a target date. Retest once the corrected control has run over a period capable of showing operation, starting from an independent population reconciliation.
- Rationale
- The objective names every customer in the population. The control reached only the part that entered the queue, and its own reporting could not show the difference.
The vendor screening assurance
The vendor has a report, the service is on and nothing has matched. Whether that adds up to a working control depends on what happens to the data on its way in.
Composite scenario for teaching. All names, organisations, counts and dates are fictional. It does not describe a real firm or vendor.
- Control objective: screen the intended customer and payment population against current sanctions data, including relevant name variants, and escalate potential matches before release.
- The vendor supplies an annual assurance report and the service is enabled.
- Internal testing uses exact names only.
- A data-lineage review finds that one-word names are excluded and long names are truncated before matching.
- No exclusion was approved and no compensating control exists.
- The firm has reported no true matches or suspected breaches during the period.
How each option grades
Incomplete Replace the vendor immediately, because its assurance did not prevent the exclusions and a new supplier will remove the defect.
Source
The FCA's sanctions findings record errors and omissions in list data arising from poor quality data and from transfers between systems, and limited challenge or validation of vendor configuration, logic and updates. [8]
Application
The fault may sit in the firm's own transformation or configuration, in the vendor's service or in both, and the facts do not say which. Replacing the vendor before the root cause is known can reproduce the defect in a new service. It also does nothing about exposure in the period already run, where names have gone unscreened.
Action
Establish the root cause first. Replacement may follow as a decision on vendor performance, but it is not the response to this finding. This is a FinCrimeRadar recommendation.
Best supported on the facts Ineffective for the stated objective: protect now, test the full data path, look back on a risk basis and govern any exclusion.
Source
The FCA says screening systems and processes should be proportionate to risk, appropriately calibrated and regularly tested and reviewed. [8] It lists periodic calibration and quality assurance, retesting after list or matching-logic changes, root cause analysis after mismatches and proactive thematic lookbacks as effective practice, and lists excluding categories of sanctioned names without rationale or evidence as poor practice. [8] These are findings in sanctions screening, not rules.
Application
The objective is to screen the intended population against current data, variants included. Known unapproved exclusions of one-word and long names mean part of that objective cannot be met, and no compensating control picks up what the data path removes. Design proof is unsupported for these inputs. Deployment proof fails on the data path. Operating proof cannot be shown for names that are never screened. The response addresses present risk through interim protection, impact through a risk-based lookback over the period, since silence is not evidence, and cause through full data-path and variant testing before closure. This reasoning is our assessment.
Action
Record Ineffective and escalate through governance, then follow the response. Any exclusion that remains afterwards needs a recorded rationale, an approver and a tested compensating control. This is a FinCrimeRadar recommendation.
Unsupported on the facts Effective, because the vendor is independently assured, the service is enabled and the firm has reported no true matches or breaches in the period.
Source
The FCA recorded limited challenge or validation of vendor configuration, logic and updates, and listed historic vendor settings used without reassessment or oversight as poor practice. [8] It also recorded many firms reporting no true matches, and separately recorded configuration, data and assurance weaknesses. [8]
Application
Vendor assurance describes the vendor's service. It does not test this firm's data, configuration or coverage, and the lineage review has shown that the firm's path excludes names. The FCA does not say that silence proves nothing. That inference is ours, and here it is concrete, because a control that never sees a name cannot report a match on it. Deployment proof fails and operating proof cannot be shown for the excluded names.
Action
Do not rely on assurance and silence. Record a conclusion based on the firm's own test evidence. This is a FinCrimeRadar recommendation.
Incomplete Not evidenced, because internal testing used exact names only and the variant testing that would settle the question is not yet done.
Source
The FCA lists formal governance for approving and reviewing screening exclusions, and mitigating controls where data is excluded from automated screening, as good practice. It lists excluding categories of sanctioned names without appropriate rationale or evidence as poor practice. [8]
Application
Incomplete variant testing leaves a question open, but the lineage review has already answered a different one: names the objective covers are excluded, with no approval and no compensating control. That is affirmative evidence of a coverage failure. Not evidenced would record the work as unable to conclude when it can. The label remains right for what the work has not shown, such as how variants perform across the intended list.
Action
Conclude Ineffective on the established exclusion, and carry the untested variant behaviour as an explicit limitation in the record. This is a FinCrimeRadar recommendation.
Counterfactual: change one fact
Suppose the exclusions had been documented, risk-assessed, approved and covered by a tested manual control. The conclusion could then move to Partially effective or Effective, depending on evidence that the compensating control operated over the period. The facts that moved the decision were the governance of the exclusion and proof that something else caught what it left out.
Decision Record
- Facts
- Vendor assurance report held. Service enabled. Internal testing used exact names only. One-word names excluded and long names truncated before matching. No approved exclusion and no compensating control. No true matches or suspected breaches reported.
- Assumptions
- The lineage review reflects production configuration for the whole period. The exclusions have existed throughout the period, until the lookback shows otherwise.
- Proofs
- Design: unsupported for these inputs and incomplete for variants. Deployment: not supported on the data path. Operation: cannot be shown for names that are never screened.
- Limitations
- Variant behaviour across the intended list is untested. Exposure in the period is unknown until the lookback is done. The vendor report was not evidence about this firm's data.
- Conclusion
- Ineffective against the stated screening objective, for the period tested.
- Response
- Interim protection for the excluded name categories with its limits stated, full data-path and variant testing, a risk-based lookback over the period, root cause across the firm's transformation and the vendor configuration, and governed exclusion decisions. Record an owner and a target date. Retest over a period capable of showing operation.
- Rationale
- The objective includes the names the data path removes. Assurance and silence cannot show coverage that the lineage evidence shows to be absent.
One Screen Operational Summary
- ObjectiveState the risk, then the objective: population, action, timing and escalation.
- DesignChallenge the happy path. Ask what happens when data is missing, late or moved.
- DeploymentReconcile the intended population independently, then trace records from source to control and back.
- OperationFix the population and period first. Use samples, re-performance and data analysis, not inquiry alone.
- ExceptionsEstablish nature, extent and root cause. Link each to an owner and interim protection.
- ConclusionOne control, one scope, one period. Effective, Partially effective, Ineffective or Not evidenced.
- RemediationRecord implemented and validated as different statuses.
- RetestTest the corrected control over a period capable of showing operation before closing effectiveness.
Red Team Questions
- Could we show the population this conclusion covers without using the control's own output?
- Which proof does each piece of our evidence address, and which proof has no evidence at all?
- What would a failure in the part of the population we did not test look like, and would we see it?
- Are we relying on a vendor, a group function or a report for something we have not tested ourselves?
- Does the sample include the changed, higher-risk and failed items, or only the easy ones?
- Are we treating silence (no incidents, no matches, no complaints) as a test result?
- If we cannot conclude, have we said so, with what we need to find out and what protects us meanwhile?
- Is any finding marked closed on the owner's word alone, with no retest?
A control is defended by its evidence, not by its documentation.
Knowledge check
Choose one answer for each question. The score is an aid to review, not a credential or a case decision.
Answer notes
Question 1. Source: No source read uses the term deployment proof. Application: Reconciling the intended population against an independent source tests whether the control reaches what it is meant to cover, which is the deployment question in this framework. Action: Reconcile before you sample.
Question 2. Source: Regulation 21(1) applies where appropriate with regard to the size and nature of the business, and regulation 21(6) disapplies paragraphs (1) and (3) for an individual who neither employs nor acts in association with any other person. [2] Application: The duty to establish an independent audit function is conditional, so a statement that every firm must have one overstates the text. Action: Decide and record whether the function is appropriate for the firm, having regard to its regulation 18 and 18A risk assessments.
Question 3. Source: No authority is cited for this point. It follows from how sampling works. Application: A sample taken from the queue is a result about the files in the queue. If the queue was not reconciled to the intended population, the sample cannot speak for the customers that never entered it. Action: Take the denominator from a source independent of the control.
Question 4. Source: Not evidenced is a FinCrimeRadar conclusion state, not a term used by the regulations or the FCA. Application: It describes the limit of the assurance work. A known coverage gap is evidence and points to Partially effective or Ineffective. Action: Use Not evidenced for what the work has not shown, and say what more is needed.
Question 5. Source: FCG 2.2.7 asks how a firm ensures review of control effectiveness is comprehensive and how remediation has progressed, and it is guidance, not a rule. [5] Application: Implementation shows that something was done. Retest shows whether the proof now holds. Action: Record implemented and validated as separate statuses.
Risk, Signal, Response
1. Policy Mirage
- Risk
- A documented control is mistaken for an effective one.
- Signal
- Test evidence is limited to policy review and interviews.
- Response
- Separate design, deployment and operation before concluding.
2. Population Blind Spot
- Risk
- Records outside the test source are never examined.
- Signal
- The sample denominator comes from the control output rather than an independent population.
- Response
- Reconcile the intended population before sampling.
3. Vendor Assurance Substitution
- Risk
- Third-party assurance is treated as proof of the firm's configuration and data.
- Signal
- No internal lineage, configuration or scenario testing exists.
- Response
- Test the firm's implementation and challenge vendor dependencies.
4. Clean Sample Comfort
- Risk
- A small passing sample creates a broad conclusion.
- Signal
- Selection excludes changes, exceptions, high-risk strata or failed items.
- Response
- Match selection to the objective and state sampling limits.
5. Exception Graveyard
- Risk
- Findings are logged but do not change the control.
- Signal
- Repeated issues, extensions or accepted risks have no root-cause action.
- Response
- Link exceptions to owners, interim protection, remediation and governance.
6. Closure Without Retest
- Risk
- An action is closed when implementation is reported.
- Signal
- No evidence shows the corrected control operated after the change.
- Response
- Separate implementation from validation and retest before effectiveness closure.
FAQ
How large should the sample be?
No source read sets a size. Regulations 19 and 21 prescribe no sample size, pass rate or test frequency, and the FCA's CDD findings describe sample-based monitoring without giving a number. [1] [2] [7] Size follows the objective, the population, the risk and the conclusion the firm needs to be able to defend, and the firm's own audit or statistical method may set one. Whatever is chosen, record how items were selected, what the sample can and cannot support and the sampling limitation in the conclusion.
Can the first line test its own controls?
The sources read do not prohibit it, and where the line falls between second-line monitoring and independent audit depends on firm structure, regulatory scope and the purpose of the work. The FCA's CDD review saw stronger firms using independent third-line testing, and raised questions about impartiality and effectiveness where the same staff onboarded customers and conducted assurance. [7] Those are findings about the arrangements reviewed. Regulation 21(1)(c) is conditional, as set out above. [2] FinCrimeRadar assessment First-line testing is useful for early detection, but a conclusion about effectiveness carries more weight when the tester is not the operator, so record who tested and how independent they were.
Does no incident mean a control is effective?
FinCrimeRadar assessment Not by itself. The FCA recorded many firms reporting no true sanctions matches, and it also recorded weaknesses in screening configuration, data and assurance testing. [8] The FCA does not state the inference in these words, and the inference is ours. A control that is not seeing the population cannot report what it never sees.
Is vendor assurance enough?
No source read says it replaces the firm's own testing, and the FCA recorded limited vendor challenge and insufficient internal testing as findings. [8] Vendor assurance can be one input. The firm still needs evidence about its own data, configuration and use of the service. FinCrimeRadar assessment
What is the difference between Partially effective and Not evidenced?
FinCrimeRadar assessment Partially effective is a conclusion about the control: it reduces risk, and a bounded weakness is known. Not evidenced is a conclusion about the assurance work: the population, period, evidence or method could not support a conclusion. A known coverage gap is evidence and points away from Not evidenced. Neither state is a sign of good or bad control performance on its own.
Does an ineffective control prove a regulatory breach?
FinCrimeRadar assessment No. An Ineffective conclusion is a finding about a control against its objective. Whether an obligation was breached depends on the specific obligation, the facts and the period, which is a legal judgement this guide does not make. It does not by itself establish suspicion, loss or customer harm either.
How often should a control be tested?
No source read sets one frequency across controls. Regulation 19(1)(b) requires policies, controls and procedures to be regularly reviewed and updated, and SYSC 3.2.6C R requires regular assessment of adequacy where it applies, but neither fixes an interval. [1] [3] The GOV.UK framework recommends focusing on high-risk areas and critical controls. [9] FinCrimeRadar assessment Set the frequency from risk, criticality, the rate of change and past results, record the reasoning, and retest after material change. In sanctions screening the FCA lists retesting after list or matching-logic changes as effective practice. [8]
Sources and methodology
Scope: UK financial crime control testing under regulations 19 and 21 of the Money Laundering Regulations 2017, applicable FCA SYSC rules, the Financial Crime Guide, three FCA good and poor practice reports and one GOV.UK public-sector framework. It does not cover other jurisdictions, JMLSG guidance, transaction monitoring model validation or the testing obligations of any particular firm. This is decision support for practitioners, not legal advice and not an assurance opinion.
Method: The sources listed below were read on 1 November 2026. For each, the proposition the guide relies on was recorded with its scope and limits before drafting. Regulations 19 and 21 were read from the current revised text on legislation.gov.uk. The FCA Handbook provisions were checked on the Handbook, and the FCA findings and the GOV.UK framework were read on their publishers' pages. FCG examples are labelled as guidance throughout and FCA findings as observations.
Evidence separation: Source blocks state what an authority establishes. Application blocks are FinCrimeRadar analysis. Action blocks and the recommendations in scenario analyses are operational judgements and are labelled as ours. The Control Proof Chain, the three proofs, the four conclusion states and the conclusion record are FinCrimeRadar designs, not a regulator's. Not evidenced is our addition to the three public-sector ratings.
Limits: No source read sets a universal sample methodology, an acceptable failure rate or a test frequency for UK financial crime controls. The boundary between second-line monitoring and independent audit depends on firm structure and scope. The GOV.UK framework is written for public bodies and the FCA findings are multi-firm observations. This guide teaches test design and conclusion discipline and cannot certify a firm's control environment or replace professional audit judgement. Scenario figures are fictional.
- Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, regulation 19, Policies, controls and procedures, as revised, read 1 November 2026.
- The same Regulations, regulation 21, Internal controls, as revised, read 1 November 2026.
- FCA Handbook, SYSC 3.2.6, Financial crime, checked 1 November 2026.
- FCA Handbook, Financial Crime Guide, FCG 1.1, What is the FCG? (paragraphs 1.1.7, 1.1.8 and 1.1.11), last updated 3 June 2025.
- FCA Handbook, Financial Crime Guide, FCG 2.2, Financial crime systems and controls (paragraphs 2.2.5 and 2.2.7), provisions dated 13 December 2018.
- Financial Conduct Authority, Risk assessment processes and controls in firms: our findings, published and last updated 11 November 2025.
- Financial Conduct Authority, Firms' customer due diligence processes and controls: our findings, published and last updated 8 April 2026.
- Financial Conduct Authority, Sanctions systems and controls in our firms: our findings, published and last updated 28 May 2026.
- GOV.UK, International Public Sector Fraud Forum, Fraud Control Testing Framework FCTF-01 (HTML), updated 15 June 2026. Recommended practice for public bodies.
Last reviewed: 1 November 2026. Recheck when the FCA or the Government publishes testing expectations for financial crime controls, when regulation 19 or 21 is amended, when FCG 2.2 or the cited FCA findings are revised, and if any authority prescribes a cross-control test method or rating scale.