How to Prepare for FIAU Compliance Visit
An FIAU compliance visit rarely turns on one dramatic failing. More often, it exposes a pattern – outdated documents, inconsistent customer files, weak transaction monitoring, or staff who know the policy exists but cannot explain how it works in practice. For subject persons in Malta, understanding how to prepare for FIAU compliance visit means treating the exercise as a test of governance, not just paperwork.
The Financial Intelligence Analysis Unit does not assess compliance in the abstract. It looks at whether your business has identified its money laundering and funding of terrorism risks, adopted proportionate controls, and applied those controls consistently. That distinction matters. A well-drafted manual will not help much if onboarding files are incomplete or your team cannot demonstrate when enhanced due diligence is triggered.
What the FIAU is really looking for
An on-site visit is typically aimed at testing whether your AML/CFT framework is appropriate for your business model and whether it is genuinely operational. The FIAU will usually examine your business risk assessment, customer risk assessment methodology, internal policies and procedures, training records, customer files, source of funds and source of wealth documentation where relevant, suspicious transaction reporting processes, and ongoing monitoring arrangements.
Just as importantly, it will look at governance. Who owns compliance internally? How often are policies reviewed? Is the MLRO sufficiently informed and independent in practice? Are senior management decisions documented? In regulated sectors and higher-risk business lines, the gap between what is written and what is implemented is where many issues arise.
How to prepare for FIAU compliance visit without creating panic
The strongest preparation starts well before any notification is received. If a visit has already been announced, the objective is not to produce perfect documents overnight. It is to identify weaknesses quickly, correct what can realistically be corrected, and present a clear and credible account of how your compliance framework operates.
Start with a focused internal review. This should cover the core AML/CFT documents, recent client files, monitoring logs, internal reporting lines, and evidence of training. Approach it as if you were the regulator. Can each control be evidenced? Can the business explain why a client was rated low, standard, or high risk? Can it show what happened after a trigger event or unusual transaction?
A rushed response can create fresh inconsistencies. If you amend policies days before the visit, but staff are still working to the previous version, that may raise more questions than it resolves. Updates should be made where needed, but they should be sensible, documented, and supported by implementation.
Review your business risk assessment first
For most firms, the business risk assessment is the foundation document. If it is too generic, too old, or disconnected from the actual services offered, the rest of the framework tends to look weak as well.
Your assessment should reflect the real risk profile of the business in Malta, including customer types, jurisdictions, delivery channels, products or services, and transaction patterns. A corporate services provider, gaming operator, financial intermediary, or crypto-facing business should not all be using interchangeable language. The FIAU will expect to see a methodology that makes sense for your sector and the way you actually operate.
If your business has expanded into new markets, onboarded higher-risk clients, or changed its service model, the risk assessment should show that. A document reviewed annually but unchanged for years is unlikely to inspire confidence unless the business itself has genuinely remained static.
Customer risk assessments must match the file
One recurring issue in compliance reviews is the mismatch between the customer risk rating and the underlying documentation. A file may be rated standard risk even though it involves a complex ownership structure, a high-risk jurisdiction, nominee arrangements, or adverse media concerns. That inconsistency is difficult to defend.
Test a sample of files across different risk levels. Check whether the rationale for the rating is recorded, whether the beneficial ownership analysis is complete, and whether enhanced due diligence was applied where required. If your methodology includes scoring or weighted criteria, make sure the outcome shown on the file can be traced back to the actual inputs.
Get customer files inspection-ready
If there is one area that deserves immediate attention, it is file quality. The regulator will not be persuaded by assurances that documents exist somewhere in the business. Files need to be complete, accessible, and internally coherent.
Review identification and verification records, beneficial ownership documentation, purpose and intended nature of the business relationship, source of funds and source of wealth where relevant, sanctions and PEP screening results, and ongoing monitoring notes. Make sure refresh dates and review cycles are visible. If documents were chased but not received promptly, the follow-up trail should be clear.
Good files also show judgement. For higher-risk clients, it should be evident why the relationship was accepted, what senior approval was obtained if required, and what additional scrutiny was applied afterwards. A file that contains documents but no reasoning can still appear weak.
Policies, procedures and controls need to be lived, not filed
Your internal manuals should be current, tailored and aligned with Maltese legal obligations. That includes customer due diligence, ongoing monitoring, reliance arrangements where applicable, record-keeping, internal reporting, suspicious transaction reporting, sanctions screening, and employee training.
Yet the policy set is only half the picture. The FIAU may ask staff how onboarding works, who escalates unusual activity, what happens when documentation is overdue, or how a suspicious matter is assessed internally. Their answers should broadly match the documented procedure. Minor variations happen in any business. Material contradictions suggest that the framework is not embedded.
This is where a short pre-visit briefing helps. It should not coach staff to recite stock answers. It should remind relevant teams of the actual process, their own responsibilities, and where supporting records are stored.
Do not overlook training, governance and board oversight
Training records often receive less attention than customer files, but they matter because they show whether the business takes AML/CFT obligations seriously at an operational level. You should be able to evidence who was trained, when, on what topics, and whether the content was relevant to their role.
Generic annual training may be enough for some lower-risk functions, but higher-risk teams often need more targeted sessions. Senior management should also be able to show awareness of the business’s exposure and of the decisions taken to address it.
Board or management meeting minutes can be particularly valuable here. If they record discussion of compliance issues, policy approvals, internal findings, staffing needs, or remediation steps, they help demonstrate active oversight. Without that evidence, governance can look passive even where management is engaged in practice.
Prepare for questions on suspicious reporting and monitoring
A common area of scrutiny is whether the business can identify and escalate unusual or suspicious activity in a timely way. The FIAU will not simply ask whether you have submitted reports. It may examine the process by which concerns are identified, assessed, escalated to the MLRO, and either reported or closed with rationale.
Your internal registers should therefore be orderly and up to date. If alerts, exceptions, or unusual patterns were reviewed and ultimately not reported, there should still be a record explaining why. That does not mean creating unnecessary paperwork for every minor issue. It means keeping an audit trail where a reasonable reviewer can understand the decision-making.
Monitoring should also be proportionate to your activity. A business with ongoing customer relationships and transactional exposure will be expected to show more than static onboarding checks. The exact depth depends on the sector, client base and service offering.
If gaps are found, handle remediation carefully
Most businesses uncover some weaknesses when they conduct a proper pre-visit review. The sensible approach is to separate issues into three groups: matters that can be fixed immediately, matters that need structured remediation, and matters that require legal or regulatory judgement before action is taken.
Do not backfill records in a way that obscures what happened historically. It is better to document a remedial review and clearly date any new note or updated assessment. Transparency is usually safer than trying to make an old file look as though it was complete from the outset.
Where issues are material, prepare a concise remediation plan with owners and timelines. If questions arise during the visit, a business is generally better placed when it can show that it has identified the issue, assessed the impact, and started corrective action.
How external legal support can help
For some firms, especially in regulated or cross-border sectors, preparation benefits from an independent legal review. External counsel can test whether your framework is aligned with Maltese AML/CFT requirements, challenge overly generic documentation, and help prepare for difficult areas such as high-risk customer acceptance, source of wealth analysis, outsourcing, or legacy file remediation.
That support is often most useful when it is practical rather than theatrical. The aim is not to stage-manage a regulator meeting. It is to reduce avoidable risk and ensure the business presents an accurate, defensible compliance position. Where appropriate, businesses may seek support from advisers such as Cuschieri Advocates through https://ca.mt.
A compliance visit is never just about the day itself. It is a measure of whether your controls can stand up to scrutiny when someone asks to see the evidence behind them. The businesses that cope best are usually not those with the thickest manuals, but those that can show a consistent link between risk, decisions and day-to-day practice.
