You already know what is wrong: the supervisor, the external expert or your own audit has told you. What is missing is the deliverable that proves you have fixed it: finding by finding, with an owner, a date and proof of closure.
Have a list of findings and don’t know where to start?
Send us the report or the inspection report setting out the reservations, and we’ll send you back a proposed prioritized plan.
A remediation plan is not a statement of intent: it is a living table of actions, one owner for each, and an evidence folder that backs up every “closed.”
We turn the list of findings into a plan with a severity rating, an internal owner, a committed date and the expected evidence for each action. And if your team is stretched too thin, we carry out the parts that can be outsourced—file reviews, procedures, training—without responsibility ever leaving your entity.
A finding is not closed because someone says so: it is closed when there is documentary proof and someone independent has reviewed it. We prepare the follow-up report that summarizes the status of the plan, which you can hand over without having to explain anything over the phone.
If you don’t have the list of findings yet, start here: a full review of the system with actionable conclusions.
Almost every finding ends up touching the manual. We rewrite it so that it describes what you will actually do.
Prioritization comes from risk, not from the order in which the findings appeared. We update the entity’s self-assessment.
The plan is approved, reviewed and closed in minutes. Without that trail, as far as anyone can tell, the remediation never happened.
These calls no longer come from someone who is scared: they come from someone with a list, a date committed to the supervisor and a need to show progress.
“I have the report with the reservations and a two-person team. I need to know what to tackle first, what I can delegate externally and how to keep a record of everything we close.”
“I’m going to have to state in writing that we have fixed it. I won’t sign it without seeing the evidence for each point: what was changed, when and who reviewed it.”
“We scaled onboarding very fast and now we have thousands of legacy users with weak documentation. We’ve been told we have to remediate the customer base, and we don’t even know where to start slicing it.”
“We bought a portfolio with its customers and their files. Ours are fine; the ones that came with the deal are not. And now they fall under our system.”
Almost every entity we review already had an action plan. The problem is not the lack of a plan: it is that not a single closure can be proven.
The plan with no owner: actions written in the passive voice—“files will be reviewed,” “controls will be strengthened”—with no name and no date. Nobody misses a deadline because nobody has been assigned anything, and when someone asks, everything is exactly as it was on day one.
The closure that only exists in the spreadsheet: ticking the “closed” box without attaching anything. Closed means there is a dated document that anyone can open and understand without you explaining it.
Fixing new onboarding and forgetting the existing customer base: onboarding becomes flawless while long-standing customers still have files from years ago. The supervisor does not only look at how a new customer comes in: it looks at the active customer base, which is where the real risk lies.
| Finding severity | What closure requires | Evidence you show |
|---|---|---|
| Critical — affects a core obligation of the system | Immediate correction, an express decision by the management body and, where appropriate, suspension of the questioned practice while it is corrected. | Minutes recording the resolution, a new procedure in force and a sample of redone files with their actual review date. |
| High — the control is designed but not applied | Control redesign, training for the affected team and proof that it now works in day-to-day operations, not just on review day. | Versioned procedure, training record and follow-up sampling showing that the control is applied consistently over time. |
| Medium — documentary or formal gap | Correction of the document and adjustment of the manual, without having to redo operations or review the entire customer base. | Updated version of the manual, internal communication and a distribution record for the staff concerned. |
We rank your findings by severity, give each one an owner and a date, tackle the legacy customer base in risk-based batches and build the evidence folder that backs up every closure. At the end you have a follow-up report you can hand over as it is.
From three places, and often all three at once: the inspection report from a SEPBLAC review, the external expert report that examines your system, and your own internal review or AML audit. They also arise indirectly, when a correspondent bank or a partner sends you a questionnaire and spots gaps.
The first thing we do is consolidate them into a single list, because they tend to come in different language and with duplicates: what the expert calls a reservation and the inspector describes as a breach is sometimes the same gap described twice.
An audit looks and diagnoses; remediation fixes and proves it. They are different pieces of work, and it is best not to mix them or hand both to the same person out of inertia without thinking it through.
In fact, the logical sequence is: diagnosis (audit or expert report) → prioritized remediation plan → execution with evidence → independent verification of closure. If you are missing the first step, we start there; if you already have the list of findings, we go straight to the second, and we don’t charge you to rediscover what you already know.
A dated document that allows an outsider to verify, without your help, that the action was taken. Real examples: the minutes of the internal control body approving the new procedure, the version of the manual with its effective date, the training attendance list, a system screenshot showing the control switched on, the completed customer file with its review date, or the email used to communicate the change to the team.
What is not evidence: a “done” in a spreadsheet, an internal email saying it will be done, or an approved policy that nobody has distributed.
Not all at once, and not in alphabetical order. Customer base remediation is tackled in risk-based batches: first the highest-risk customers according to your self-assessment—opaque corporate structures, sensitive jurisdictions, politically exposed persons, cash activity or unusual volumes—then the rest, in planned waves.
That approach has two advantages: it reduces real risk before formal risk, and it produces evidence from the very first batch reviewed. It also lets you explain a rationale to the supervisor, which is exactly what is expected of an obliged entity that acts on risk rather than out of inertia.
The plan is proposed by compliance but approved at the top: by the management body and the internal control body, with minutes. That approval is not red tape: it is what turns a list of good intentions into a commitment by the entity, with resources assigned and someone accountable for each action.
After that, follow-up goes back to the same place: each periodic review of the plan’s status is taken to that body, what has been closed is documented and a decision is made on what to do about anything that has slipped. That cycle, recorded in minutes, is half of the plan’s credibility.
Yes, and it is advisable. What you must never do, under any circumstances, is touch past documentation to make it look as if it was fine. Remediation is done going forward, with the real date of each action, and documented as a subsequent correction.
Done that way, it is one of the few things that work in your favor while the proceedings are ongoing. Done the other way, it ruins the entire defense. We explain this in detail in defense in sanction proceedings.
It depends on two variables, and neither is the number of findings: the size of the legacy customer base that has to be reviewed and the real capacity of the team that will do the work. A plan with many documentary findings can be closed quickly; one with few findings that nonetheless requires redoing thousands of customer files is a long-haul project.
That is why the plan is designed in waves with verifiable interim milestones: you want to be able to show sustained progress from the start, rather than arriving with everything closed the day before someone asks.
We can carry out the parts that can be outsourced—reviewing and completing customer files, rewriting procedures, training, preparing evidence, tracking the plan—and work side by side with your team on the rest. That is what we do in AML outsourcing.
That said, the rule is the same as always: responsibility cannot be outsourced. Your entity remains the obliged entity, your management body still approves and your SEPBLAC representative is still accountable. We provide hands, judgment and method; ownership of the system stays in-house.
It gets documented, which is very different from hiding it. Some actions depend on IT development, a vendor or a business decision and are not resolved within the planned time frame. In that case, you record the reason, the compensating measure you apply in the meantime and the new committed date, approved by the relevant body.
A plan with a delay that is explained and mitigated is perfectly defensible. A plan with a false closure is not: that is exactly the kind of finding that turns a routine review into a serious problem.
The method is always the same, whatever the sector or the source of the findings: consolidate, prioritize, assign, execute, evidence and verify.
A single list with all the findings, whether they come from the inspection report, the external expert or the internal audit. Duplicates are removed, findings are translated into operational language and ranked by severity using your risk self-assessment, not intuition.
Each action has an owner, a date and expected evidence defined in advance. You change what needs changing—procedures, systems, training, files—and keep the proof at the time, not at the end, when it can no longer be reconstructed.
Independent sampling of closures, a status update to the internal control body and a follow-up report showing actual progress. That is the document you show when the supervisor asks again.
If the list of findings does not exist yet, start with the AML audit or the external expert report. If you are coming out of a supervisory inspection, first read SEPBLAC inspection.
The 10 elements of an AML/CFT system you can defend before SEPBLAC, with the documentary evidence you must be able to show for each one. Use it as a self-assessment before an inspection arrives.
No spam. Your email is only used to send you this checklist and, occasionally, relevant regulatory updates.
The checklist is downloading now. If it does not start automatically, click here.
Need help implementing any of the steps after reading it? Write to us directly:
These are words you will use in every follow-up meeting. Using them with the same meaning as your supervisor and your external expert avoids costly misunderstandings.
A breach or weakness identified in a review: an inspection report, an external expert report, an internal audit or a third-party questionnaire.
A reservation the external expert records in the report when the system does not comply on a given point or compliance cannot be demonstrated.
Classification of the finding by impact and risk. It determines what is corrected immediately and what can be scheduled in later waves.
A living document with one row per finding: action, owner, committed date, expected evidence and current status.
A specific person, with a name and a role, who is accountable for the action being carried out and for the evidence existing by the committed date.
A dated document that allows a third party to verify independently that the action was carried out: minutes, a version of the manual, a record, a screenshot or a reviewed file.
The set of active customers whose due diligence documentation is incomplete or out of date compared with your current procedures.
An independent check, usually by sampling, that the action was carried out and that the evidence supports what it claims.
A document summarizing the status of the plan: closed actions with their evidence, actions in progress, delays with their reasons and compensating measures.
Active customer files complete and updated in line with the current procedure, starting with the highest-risk segments.
Batch review report with selection criteria, completed files with their review date, and a list of escalated or closed cases.
Identification and reasonable verification of the beneficial owner in corporate structures, with whatever enhanced measures apply.
Updated declarations, dated registry searches and extracts, and ownership charts kept on each file.
Risk map revised after the findings and manual rewritten to describe actual operations, not ideal ones.
A dated and approved self-assessment, a versioned manual with change control, and a record of distribution to staff.
Adjusted detection rules, alerts analyzed with no pending backlog, and reports to SEPBLAC that go out when they should.
An up-to-date alert queue with a closing rationale for each alert, reports submitted with their acknowledgment of receipt, and documented decisions to refrain.
An internal control body that meets and makes decisions, an operational SEPBLAC representative and staff trained according to their role.
Minutes with resolutions and plan follow-up, current appointments notified, and a training record with content and attendees.
Any one of these five turns a seemingly sound plan into a document that won’t withstand a review.
A remediation plan does not stand alone: it starts with a diagnosis, is carried out within a control model and ends up being reviewed from outside. These pages cover each part of the cycle, from the review that detects the problem to the proceedings it can end up in if it is not closed.
The review that produces the list of findings the plan is built on. If you don’t have a report, start here.
What the supervisor reviews and how to prepare to face it. Many remediation plans start right here.
Who executes, who controls and who verifies. Without that clear division, nobody can sign off a closure on sound grounds.
When the correction comes too late and proceedings are open: strategy, written submissions and proof of the program.
To carry out the plan we usually rely on the AML manual, the risk map and the internal control body, with the option to outsource the parts your team cannot take on. And if you are building the system from scratch to apply for a license, see AML in the authorization application.
Tell us where the findings come from—an inspection, an external expert report or an internal audit—and how many customer files you hold. We will propose the order of attack and the final deliverable.
Last updated: August 4, 2026
An anti-money laundering remediation plan is the document an obliged entity uses to turn a list of findings into specific actions, each with an owner, a date and proof of closure. It usually follows a SEPBLAC review, the annual examination by an external expert or an internal review, and it has a dual purpose: to reduce the entity’s real risk and to leave a record that the correction took place. Law 10/2010 and its implementing regulation, Royal Decree 304/2014, do not prescribe a format for the plan, but they do require a system that works and can be demonstrated: remediation is how you get from one to the other.
The first mistake in almost every plan is to tackle the findings in the order they appear in the report. That order reflects the structure of the review work, not your risk. Proper prioritization starts from the entity’s risk self-assessment and asks two questions about each finding: which core obligation it affects—identification, beneficial ownership, analysis of activity, reporting, record keeping—and what real exposure it creates in your specific business. That produces three severity levels that drive the timetable: critical items are corrected immediately and, if necessary, the questioned practice is suspended in the meantime; high items are redesigned and backed by training so that the control moves from paper to practice; medium items are corrected on paper and built into the next version of the manual. Explaining that rationale in writing is worth almost as much as carrying it out: it shows that the entity decides on the basis of risk, not convenience.
The difference between a plan that gets closed and one that drags on for years lies in three columns. The first is the owner: a person with a name and a role, never a department or an impersonal formula, because an action that belongs to everyone belongs to no one. The second is the committed date, realistic and different for each action; when every action falls due on exactly the same day, the plan was written to reassure someone, not to be carried out. The third is the expected evidence, defined before you start: which specific document will exist once the action is done. Defining the evidence in advance changes the way you work, because it forces you to think about the proof while you execute and not long afterwards, when nobody remembers who did what. The plan is approved by the internal control body and reviewed there periodically, with minutes recorded for each follow-up.
Almost every entity fixes onboarding first, because it is visible, contained and creates an immediate sense of order. The problem is that the risk does not lie with the customer who joins tomorrow, but with those already on the books with a profile from years ago, expired documents or no verification of the beneficial owner. That customer base remediation is the most expensive part of the plan and the one most often postponed. It is tackled in risk-based batches: the customer base is segmented according to the self-assessment (customer type, product, channel, jurisdiction and activity), you start with the high-risk segments and move forward in planned waves, documenting the selection criteria for each one. It is wise to decide in advance what to do with a customer who does not respond to the request for documentation, because that case always comes up, and the decision—restricting activity, an enhanced review or ending the relationship—must be written into the procedure before it is needed, not improvised by whichever salesperson happens to be on duty.
A finding is not closed because the owner says the work is done. It is closed when there is dated evidence and someone who did not carry out the action has reviewed it, usually by sampling. That division of roles is exactly what the three lines of defense model describes: the business executes, compliance controls, and internal audit or an independent third party verifies. On that basis you draft the follow-up report, which is the document the supervisor ends up seeing: closed actions with their evidence, actions in progress, delays with their reasons and compensating measures in the meantime. A plan with explained and mitigated delays is defensible; a plan with unsupported closures is not: as soon as someone opens two or three pieces of evidence at random and finds nothing behind them, the credibility of the whole document collapses at once, including the closures that were genuine. When the external review is carried out by the same professional who issues the external expert report, the closure is also aligned with the document your entity will have to submit in the next cycle.
This content is for general information purposes only and does not constitute legal advice. The legislation cited may have been amended after the update date shown: always check the version in force or contact us to analyze your specific case.
Key legislation, linked to the official text:
Legislation and links reviewed in .