AML Testing Graphic
Menu

Anti-Money Laundering Independent Testing

Independent AML testing under FINRA Rule 3310 for broker-dealers that need a current, risk-based review of how their AML program works in practice. Engagements are led by Mitchell Atkins, CRCP, a former FINRA Regional Director who oversaw the creation of FINRA’s National AML Investigative Unit.

FirstMark Regulatory Solutions conducts independent AML testing under FINRA Rule 3310(c) for broker-dealers across a range of business models, with particular focus on firms where AML risk, supervisory structure, affiliate relationships, cross-border activity, or prior regulatory findings require more than a checklist review.

Engagement Length

~60 days

From receipt of documents to delivery of final report.

Pricing

Fixed Fee

Scoped to business mix, complexity, and risk profile.

Deliverable

Report & Exhibits

Comprehensive report with supporting exhibits and findings spreadsheet.

Format

Remote & Onsite

Primarily remote with onsite reviews where appropriate.

What FINRA Rule 3310 Requires

FINRA Rule 3310(c) requires every member firm to conduct independent testing of its AML compliance program at least annually, on a calendar-year basis. Firms that engage solely in proprietary trading or that do business only with other broker-dealers may test every other year. The supplementary material to the rule is clear that more frequent testing should be performed if circumstances warrant.

The test must be conducted by a person with a working knowledge of the Bank Secrecy Act and its implementing regulations. If conducted internally, the tester may not perform any of the functions being tested, may not serve as the AMLCO, and may not report to the AMLCO or to anyone performing the functions being tested. If conducted externally, the consultant must be free of conflicts that compromise independence.

Firms with experienced and independent internal personnel may satisfy the rule with internal testing. Firms looking for an outside perspective, working through prior regulatory findings, or operating in higher-risk business areas frequently engage external testers.

Why the Test Matters Now

The framework that surrounds Rule 3310 has expanded considerably since the rule was first adopted. The FinCEN Customer Due Diligence Rule has been in effect since 2018, formalizing the so-called “fifth pillar” of AML compliance and adding ongoing customer due diligence and beneficial ownership identification as core program requirements. The Anti-Money Laundering Act of 2020 reshaped the underlying statutory framework and set the stage for AML coverage of investment advisers. The National AML/CFT Priorities, first issued by FinCEN in 2021, must now be reflected in firm risk assessments. The proposed FinCEN AML/CFT Program Rule, issued in April 2026, would formalize a risk assessment requirement and shift supervisory focus toward program effectiveness rather than technical process compliance.

Recent enforcement reflects this shift. In March 2026, FinCEN imposed an $80 million civil money penalty on a broker-dealer — the largest AML penalty ever assessed against a member firm — citing a years-long failure to maintain an effective AML program despite repeated regulator warnings. The thread running through many recent cases is consistent: programs that existed on paper but were not meaningfully tested for whether they actually worked.

A test that does not reflect this evolution is not a current test.

The FirstMark Approach

FirstMark engagements are tailored to the firm. The work is not template-driven. The scope is built around the firm’s actual business, customer base, surveillance environment, prior findings, and current risk assessment. Each engagement begins with a review of the firm’s current risk assessment, business activities, customer base, and prior examination findings, and the testing scope is built from there.

Most engagements are full-program tests. Where the firm needs deeper review of a specific element — surveillance system implementation, alert filter design, the firm’s incorporation of FINRA priorities and SEC priorities into its program, or a particular business line that warrants focused attention — we scope the engagement accordingly.

The report is written for both senior management and personnel responsible for AML execution. It includes scope, methodology, sample sizes, findings, severity ratings, and recommended remediation, with a findings spreadsheet for tracking.

What Gets Tested

A FirstMark AML independent test typically covers the following elements, with depth and sample size scaled to the firm’s risk profile:


  • AML Written Supervisory Procedures

    Review of the firm’s AML WSPs against current regulatory requirements, the firm’s actual business activities, and any prior examination findings or AWC obligations. Generic, off-the-shelf procedures are flagged where they do not reflect the firm’s specific business.

  • Risk Assessment & National Priorities

    Evaluation of the firm’s current AML risk assessment, including how the firm has incorporated the FinCEN National AML/CFT Priorities and any FINRA or SEC priorities relevant to the business.

  • Customer Identification & Beneficial Ownership

    Sample testing of CIP records, beneficial ownership identification for legal entity customers under the FinCEN CDD Rule, and the firm’s process for refreshing and updating customer information on a risk basis.

  • Surveillance & Monitoring

    Review of the firm’s automated surveillance system, alert filter design, alert review process, and if needed, the completeness of the data feeding the system. Suspense accounts, omnibus structures, foreign affiliate flows, and journal entries are common sources of blind spots.

  • SAR Decisioning & Filings

    Sample review of SAR decisioning, threshold application, timeliness of filings, quality of SAR narratives, and the firm’s process for identifying when a SAR is required.

  • OFAC Screening & 314(a) Compliance

    Validation of the OFAC screening process, exception handling, and the firm’s response to 314(a) information requests within the required timeframe.

  • Wire & ACH Activity

    Sample testing of wire and ACH activity, including outbound wires to high-risk jurisdictions, inbound wires from third parties, and the firm’s investigation of rejected wires.

  • Training & Recordkeeping

    Review of the firm’s training program for appropriate personnel, frequency and content of training, and AML recordkeeping under the BSA and SEC Rule 17a-4.

Leadership

FirstMark engagements are led by Mitchell Atkins, CRCP, founder and Principal of FirstMark Regulatory Solutions. Mitch is a former FINRA Senior Vice President & Regional Director who oversaw the creation of FINRA’s National AML Investigative Unit in 2012 which led numerous high-profile AML investigations.

His perspective is informed both by what FINRA expects to see and by what FINRA tends to find when expectations are not met. Remaining current in the AML space requires vigilance and ongoing engagement with the regulatory community. Mitch maintains active networking relationships in the AML compliance field and participates in industry forums where evolving regulatory expectations are discussed firsthand.

Who We Work With

FirstMark primarily works with small and mid-sized broker-dealers across business models — including introducing firms, carrying firms, M&A advisory firms, private placement firms, proprietary trading firms, and micro broker-dealers. We also work extensively with broker-dealers with cross-border affiliates and with broker-dealers serving non-U.S. clients.

Many engagements involve firms seeking a former regulator’s perspective on whether their AML program is likely to withstand current examination and enforcement expectations.

Expert Insights

FINRA Anti-Money Laundering Independent Testing in 2026

Read our discussion of AML independent testing covering Rule 3310 mechanics, the regulatory framework surrounding the rule, recent enforcement (including the 2026 Canaccord Genuity matter), common testing pitfalls, and a practical approach for scoping a 2026 test.

Discussing an Engagement

For firms seeking an independent AML review, initial discussions are handled confidentially and are generally used to determine whether the engagement is appropriate for the firm’s business model, risk profile, and timing. FirstMark accepts a limited number of AML testing engagements so that each review receives senior-level attention from scoping through final report.

Mitchell Atkins, CRCP  ·  Founder and Principal
FirstMark Regulatory Solutions
(561) 948-6511  ·  Contact Form