Your startup’s first AML review: a founder’s guide

Be clear about the review you are buying

A readiness discussion, an internal assessment and an independent review serve different purposes. Founders should understand who needs the review and what decision it supports. FinCEN guidance for money services businesses addresses independent reviews; it should not be treated as a rule for every technology startup. FinCEN guidance on independent reviews for money services businesses.

Expect questions about the real operation

A reviewer may need to understand how the business operates, rather than simply whether policies exist. If your team is struggling to explain who makes important decisions, that is a useful readiness signal. Missing information should be addressed honestly, not covered by a polished presentation.

Think beyond receiving a report

The value of a review depends partly on what leadership does with its findings. Consider the management capacity and resources needed to respond. Where an adviser has built or operated the work being reviewed, independence needs separate consideration. Preparation should support an accurate assessment, not conceal weaknesses.

Buy the review that answers the actual question

A readiness assessment helps management understand gaps and prepare for a future milestone. An independent review evaluates the program within an agreed scope. These are not interchangeable labels. Ask what work will be performed, what the report will conclude, who expects to use it and what it will not cover.

Independence matters particularly when the same adviser has designed or operated the work under review. A separate letterhead or a different engagement name does not automatically resolve that issue. Discuss the reviewer’s relationship to the program and the applicable expectations before agreeing the engagement.

In a hypothetical first review, the policy says one team owns escalations, but employees describe a different process. The useful response is to explain the difference and establish which process is actually used. Rewriting documents to hide a gap makes the review less useful. Management needs an accurate picture to decide what to fix.

Plan for the period after the report arrives. A finding should lead to a management decision about responsibility, resources and follow-up. Distinguish an immediate correction from a lasting change: clearing a backlog once is different from addressing the reasons it formed. An article cannot determine the appropriate review scope or schedule for a particular business.

Questions for founders

• What decision is this review intended to support?
• Is the scope and reviewer independence appropriate?
• Who will own the response to the findings?

Related perspectives