Independent of the MLCO
We do not test a programme we drafted, and we will not act as your MLCO and independent reviewer at the same time. Conflict checks come first, consistent with ICPAU ethics.
SERVICES
Money Laundering Audit
Independent reviews and testing of anti-money laundering programmes so boards, money-laundering control officers, and supervisors can see whether policies, customer due diligence, and reporting actually operate — not only whether they exist on paper.
Independent testing of the AML programmes supervisors in Uganda expect to see working.
An AML audit is a test of whether an accountable person’s anti-money laundering programme does what the Anti-Money Laundering Act and the Financial Intelligence Authority expect — customer due diligence, a money-laundering control officer, training, monitoring, and reporting — and whether daily practice matches the policy. It is not a year-end audit of the financial statements, and it does not produce an ISA opinion. Kisaka & Company scopes that work against the Act, the AML Regulations, and FIA guidance, using procedures agreed in writing, typically in the form ICPAU recommends for accounting firms.
We accept the independent review only where we did not write the policies under test and where the money-laundering control officer is not on our team. Findings go to those charged with governance, with a remedial plan the board can track, and with a file that can be shown to FIA if the Authority asks for the Regulation 43 report. If you need policies drafted, an MLCO coached, or staff trained, that is a separate advisory mandate — we will not sell both sides of the line to the same programme.
At a glance
What you can expect when Kisaka & Company is appointed to test an AML programme independently.
Not a statutory audit
This is a test of design and operating effectiveness against the Anti-Money Laundering Act, the Regulations, and FIA guidance. ICPAU treats a typical external review as agreed-upon procedures (ISRS 4400): factual findings, not an ISA opinion.
A file FIA can request
You receive a written report, a findings log, and a remedial plan for the board. Regulation 43 requires a copy of the independent-audit report to be available to FIA on request.
AML review and testing services
Illustrative scope for FIA-registered accountable persons — financial institutions and DNFBPs alike. We confirm procedures, period, and intended users in an engagement letter before work begins.
Independent AML programme test
The periodic independent audit Regulation 43 requires: whether the programme is designed, implemented, and operating — policies and controls, a designated compliance function, training, and an independent-audit trail. Not a financial-statement audit and not FIA accreditation.
Discuss scopeCDD / reporting sample testing
Sample testing of KYC and customer due diligence files, beneficial owners, PEPs, high-risk countries, and record-keeping. We also test suspicious-transaction and large-cash processes, including Form A / Form B and goAML where the entity reports electronically.
Discuss scopeMLCO & governance
Appointment and FIA notification of the money-laundering control officer, seniority and reporting line, access to information, board reporting, and whether the MLCO function is independent of the first line. Useful ahead of the 31 January Regulation 45 pack.
Discuss scopeAdvisory (sold separately from the independent test)
Gap assessments, policy and manual drafting, MLCO coaching, or staff training under a separate letter. The team that drafts cannot later be the independent reviewer. We will not act as your MLCO and as your independent AML auditor at the same time.
Discuss scopeHow we run the engagement
Timing is often set so the Regulation 43 report exists before the 31 January FIA annual pack — we confirm the calendar at proposal stage.
01
Scoping & independence
We meet the MLCO and those charged with governance, run conflict checks, and agree procedures — typically ISRS 4400 agreed-upon procedures. If we are your external auditor, we say in writing which AML services we can and cannot accept.
02
Programme & file review
On-site and desktop review of policies, interviews, and sample files. Systems testing of monitoring or screening tools is included only if it is in the letter. We do not rewrite the manual in the same engagement.
03
Draft findings
We discuss exceptions with management, protect tipping-off and unnecessary personal-data exposure in sample summaries, and give process owners a chance to comment before the report is final.
04
Report & board close
We issue the independent AML review report and a findings-and-actions log with owners and dates, then a short close with the board or audit committee. Working papers are retained if FIA later asks for the report.
Let’s connect
Discuss an independent AML programme test, sample testing, or a separate advisory letter — we will confirm scope and independence first.