What should be done during the review?

The Independent Review must provide a fair and impartial evaluation of each of the required elements of the agency's Anti-Money Laundering Program, including related policies, procedures, internal controls, registration and reporting functions, and training. with the Bank Secrecy Act (BSA). The review should include tests of internal controls and transactional systems and procedures to identify problems and weaknesses and, if necessary, recommend appropriate corrective actions to management. For example, if the program requires a particular employee or category of employee to be trained once every six months, then independent testing should determine whether the training was conducted and whether the training was adequate.

The Independent Review must also cover all defined Anti-Money Laundering Program actions as part of the responsibility of the Designated Compliance Officer. These actions include, for example, determination of the level of money laundering risks faced by the agency, the frequency of training against money laundering of the Bank Secrecy Act (BSA) for employees and the adoption of procedures for the implementation and supervision of controls related to the program and transactional systems.

Should the review be documented in any way and reported to agency management?

The person or persons responsible for conducting the Independent Review must document the scope of the review, the transaction analysis worked, the review findings, and the recommendations to management for corrective actions, if applicable. After review, the reviewer or Designated Compliance Officer must track deficiencies and weaknesses discovered during the review and document corrective actions taken by the money services business. All documentation should, as appropriate, be made accessible to Government examiners and law enforcement personnel who have authority to examine such documents.

Source: https://fincen.gov/resources/statutes-regulations/guidance/

---