AML/CFT for business

Internal control rules and actual processes

Why having a file containing rules does not yet explain how work with clients and transactions is organised.

At a glance

Internal rules should connect to employees' roles, working forms and actual procedures.

Organised layers and dividers representing an internal control system.
In this article 1 min read
  1. Identify the organisation's category
  2. Describe the actual process
  3. Check forms and records
  4. Prepare an implementation plan

Identify the organisation's category

Applicable requirements depend on activities and supervision. Before drafting documents, determine the organisation's category, the transactions it conducts and how its work with clients is organised.

Describe the actual process

Who obtains client information, who checks completeness, where is the risk assessment recorded and how are questions passed to the responsible officer? The answers help connect the rules to actual actions and systems used.

Check forms and records

Compare the rules with questionnaires, logs, internal reports and other documents required by the process. Names and roles should match, and records should allow the sequence of actions to be reconstructed.

Prepare an implementation plan

For each finding, it is useful to define an action, responsible person and deadline. Consultancy support does not replace appointing the organisation's personnel or their actual performance of procedures. The scope of external support is recorded separately.

Official sources

  1. Rosfinmonitoring: development and updating of internal control rules ↗

Sources checked on 24 October 2026. Practical recommendations on preparing materials are provided by the AML Expert editorial team. The procedure for a specific case depends on the documents and the applicable basis.

Related reading