The announcement of an audit shifts priorities. The focus is no longer on immediately seeking the ideal long-term solution, but on determining what actually works, what can be demonstrated, and what shortcomings in the system need to be corrected.
This issue particularly concerns entities supervised by the ACPR, the French Prudential Supervision and Resolution Authority, which carries out supervisory functions related to AML-CFT and asset freezing with institutions falling within its scope, particularly in the banking and insurance sectors.
For an insurer or mutual insurance company, strengthening its screening process AML-CFT ahead of an ACPR audit can lead to four types of action: consolidating and documenting existing processes, reviewing configuration settings, adding a module to address a specific gap, or considering, in the longer term, replacing the solution.
AP Solutions IO advocates a pragmatic approach in this regard: when an audit is announced, it is not the time to make unnecessary changes to an existing system. The first step is to understand the discrepancies, secure what can be secured, and maintain a clear audit trail.
Where should you start before an ACPR audit?
Before making any technical decisions, it is necessary to assess the system that is actually in use.
A simple checklist involves verifying whether the process is formalized, effectively implemented, traceable, managed, and regularly reviewed. These five dimensions make it possible to distinguish a documentation-related weakness from a more structural shortcoming.
Check the actual system, not just the procedure
A procedure may precisely describe the scope of the screening, the timing of checks, and the rules for handling alerts, even if all of these provisions are not applied consistently.
We must therefore compare the procedures with the practices actually observed in specific cases:
- Which populations are actually being monitored?
- When?
- What reconciliation rules are applied?
- How is an alert analyzed?
- Where is the decision recorded?
- Is it possible to retrieve the settings that were active at the time of the audit?
This approach is consistent with the philosophy we follow at AP Solutions IO : technology should not merely ensure theoretical compliance, but should enable teams to understand and trace what actually happened.
Our guide to the steps in a compliance process helps place this assessment within a broader framework.
Identify Priority Gaps
Several challenges may arise:
- a configuration that is insufficiently documented;
- informal whistleblowing practices;
- an incomplete audit trail;
- an actual controlled area that differs from the one described in the procedures;
- a risk classification that has not been reviewed for a long time;
- periodic inspections that are difficult to document.
Not all of these discrepancies are equally serious. The goal, therefore, is to prioritize them based on the risk they pose and the resources needed to correct them, rather than launching multiple projects simultaneously.
What does the ACPR examine with regard to “ AML-CFT ”?
The audit is not limited to the technical operation of a screening engine.The ACPR conducts a broader assessment ofthe organization andeffectiveness of the anti-money laundering and counter-terrorist financing framework, as well as the associated internal controls. The applicable framework includes, in particular, the Monetary and Financial Code, the decree of January 6, 2021, and the various sector-specific texts, guidelines, and implementation principles published by the authority.
A system tailored to the risks
The first question concerns the consistency between the identified risks and the resources deployed.
For screening purposes, this involves examining, in particular:
- the scope of controlled persons or entities;
- events that trigger an audit;
- the standards used;
- the engine's operating rules;
- handling alerts;
- governance and approvals;
- internal controls related to the system.
Our article on the role of the ACPR and its compliance oversight examines this institutional framework.
Traceability is just as important as configuration
An alert should not simply result in a “resolved” or “confirmed” status. The team must be able to retrieve the items reviewed, the rationale for the decision, and its history.
Management can also rely on metrics such as the volume of alerts, their resolution rate, their processing time, or their recurrence.
For AP Solutions IO, this ability to reproduce results is an integral part of a tool’s quality. Our Glass Box approach is specifically designed to ensure that operations remain explainable and traceable, rather than producing results that cannot be reproduced.
How can you improve your screening process before an audit?
The right choice depends on the nature of the identified gap and the time available. Not all improvements require a change in tools.
| Option | Main Objective | Relative Horizon | Point to Watch For |
| Strengthen the Existing Structure | Strengthen documentation and evidence | Short | Do not retroactively fabricate evidence that does not exist |
| Review the settings | Improving the Relevance of Alerts | Short to medium | Test and document each change |
| Add a dedicated brick | Address a specific gap | Medium | Mastering Integration and Governance |
| Replace the solution | Rethinking the Technical Infrastructure | Long | Avoiding a poorly managed transition during the audit |
Consolidate and document what already exists
This option is useful when checks have been performed but the information is scattered across multiple systems, files, or tools.
The work may include:
- centralize existing documentation;
- identify the configuration versions;
- define responsibilities;
- Check the availability of supporting documents.
One important point to keep in mind: improving documentation does not mean retroactively reconstructing an audit trail.
If evidence does not exist, the gap must be identified and documented as such, and the process must be corrected for the future.
Review the engine settings
When the system generates too manyirrelevant alerts, a review of the matching rules may be warranted.
However, simply lowering the thresholds or making the engine less sensitive is not a sufficient strategy. Each change must be tested using representative data to assess its effect on false positives without compromising detection capabilities.
This is a key issue for AP Solutions IO. With AP Scan, our engine uses more than 90 configuration criteria to refine reconciliations and reduce noise based on each organization’s specific data and rules.
AP Scan and its automated screening engine thus enable optimization to be carried out within a configurable and traceable framework.
Add a solution to address an identified need
The shortcoming may also lie elsewhere than in the screening of individuals.
For example, an organization may need to strengthen its risk assessment, operational oversight, or screening for sanctions and embargoes.
TheAP Solutions IO suite specifically allows you to tailor your approach to your needs using AP Scan, AP Scoring, AP Monitoring, and AP Filter. This architecture eliminates the need to replace an entire system when an issue is limited to a specific area.
However, the project must remain on schedule: a rushed integration can create more complexity than it resolves.
Should you switch to a different solution right before the test?
Not necessarily.
A migration introduces new considerations: data migration, testing, historical data continuity, user training, validation of new settings, and management of the coexistence period.
When the current solution remains viable, consolidating the system and then planning a structural overhaul after precisely identifying its limitations may be more appropriate than rushing to replace it.
Our analysis of changes in the ACPR’s supervisory methods also allows us to view this preparation in the context of evolving supervisory practices.
What initiatives can quickly improve traceability?
Several actions do not depend on a change in technology: documenting configuration settings, formalizing rules for handling alerts, monitoring the audit trail, and aligning procedures with actual practices.
Document the configuration
When making significant modifications to the engine, it is helpful to be able to locate:
- the relevant rule or setting;
- its effective date;
- the reason for the choice;
- the validation level applied;
- the tests conducted prior to deployment.
This log not only helps prepare for an audit but also makes it possible, several months later, to understand why an alert was or was not generated.
Formalize the rules for handling alerts
Experienced analysts can apply coherent lines of reasoning even when they have not been sufficiently formalized.
Documenting them helps clarify the information to be reviewed, the criteria for ruling out a match, the cases requiring further analysis, and the required levels of validation.
The goal is not to automate the decision-making process, but to prevent two comparable cases from being handled in completely different ways without justification.
Test the audit trail
One practical approach is to select several old files and see what can actually be reconstructed from them.
Can we locate the alert? The data used? The decision? Who made it? The applicable settings?
With AP Solutions IO, traceability and explainability are built into our design of the Glass Box Augmented Intelligence platform: the tool is meant to help teams justify their analysis, not create another area of opacity.
What are the specific requirements for “ AML-CFT ” screening by a mutual insurance company or an insurer?
The insurance sector varies greatly depending on the type of business and products offered. Therefore, one should avoid applying the same procedure to all insurance companies and mutual insurance organizations.
The ACPR also publishes sector-specific implementation guidelines for the “ AML-CFT ” in the insurance sector.
Tailor controls to the relevant products and events
Due diligence may be required at various stages of the business relationship. The scope and intensity of the controls must be determined based on the products distributed, the identified risks, and the obligations applicable to the organization.
With regard tolife insurance and capital accumulation contracts, the Monetary and Financial Code includes specific provisions concerning the identification and, in certain situations, the verification of the identity of the policy beneficiary and any beneficial owner.
It also provides for measures to determine, no later than in certain situations related to the payment of benefits or the assignment of the contract, whether the beneficiary has the status of PEP.
Manage data volume without generating unnecessary alerts
For organizations with large portfolios, the challenge also becomes a technical one.
Even a small proportion of irrelevant matches can result in a considerable number of alerts when tens or hundreds of thousands of people are screened.
AP Solutions IO addresses this challenge with an engine designed for large volumes and a strategy aimed at reducing false positives. Our goal is not to artificially reduce the number of alerts, but to enable compliance teams to devote more time to reconciliations that truly require their analysis.
Turning Audit Preparation into an Improvement Project
An audit should not result in a series of one-off corrections without a long-term perspective.
On the contrary, the gaps identified during the preparation phase make it possible to define precise requirements: What information is missing? Which alerts take the most time? What historical data is difficult to retrieve? Which system needs to be integrated?
Prepare for the program's evolution based on actual findings
AP Solutions IO is a French RegTech company founded by experts with more than fifteen years of experience in AML and AML-CFT compliance tools.
Our suite combines AP Scan for screening, AP Scoring for risk assessment, AP Monitoring for transaction monitoring, and AP Filter for screening against international sanctions and embargoes.
Our solutions are available as SaaS and via API, with data hosted in France. Our Glass Box technology places traceability, explainability, and auditability at the heart of the system.
Regulatory responsibility remains with the regulated entity. Our role is to provide compliance teams with tools that can automate controls, manage large volumes of data, and clearly illustrate how the system works.
If preparing for an audit reveals structural limitations in your screening process, discussing the actual gaps identified with our team will help you define a path forward without confusing immediate remediation with long-term transformation.
