A regulatory examination is not an emergency. It is a predictable event with a predictable structure, and the businesses that handle it well are the ones that prepared long before the examiner’s email arrived. This guide is written for compliance officers and Money Laundering Reporting Officers (MLROs) who want a practical playbook: what regulators are actually looking for, how to conduct yourself during an inspection, and the specific dos and don’ts that separate a clean exam from a remediation order.

Regulators, whether FINTRAC, FinCEN, a state banking department, a provincial securities commission, or a central bank, are not trying to catch you doing something wrong on the spot. They are testing whether your compliance program, as written and as practiced, actually manages the risks your business carries. An inspection generally tests three things:

1. Design: Do you have policies and procedures that address the risks relevant to your business?

2. Implementation: Are those policies actually followed, day to day, by the people doing the work?

3. Effectiveness: Does the program catch what it’s supposed to catch, in practice, not just on paper?

Most findings come not from the absence of a policy, but from a gap between what the policy says and what actually happens. That gap is where compliance officers lose credibility, and it’s the single most common root cause of enforcement action.

Part 2: Before the Inspection — The Work That Actually Matters

By the time the regulator shows up, your outcome is largely already determined. Preparation is 80% of the result.

Keep a “living” compliance file, not a reactive one

Your risk assessment, policies, training records, independent review reports, and board or senior management reporting should be current at all times, not assembled when an exam is announced. Examiners can tell the difference between a program that’s been maintained and one that’s been reconstructed in the two weeks before they arrive.

Run your own mock exams

Periodically, have someone outside the day-to-day compliance function, internal audit, outside counsel, or a consultant, pull a sample of files the way a regulator would and ask: would this withstand scrutiny? Treat every gap found this way as a gift.

Know your numbers

Before any exam, you should be able to answer, without looking it up: how many SARs/STRs did we file last year, how many alerts did our monitoring system generate, what’s our current alert-to-SAR conversion rate, how many customers are high-risk, and when was our last independent review and what did it find. If you have to go find these numbers during the exam, that’s itself a finding.

Close known gaps before they’re found for you

If your own risk assessment, QA testing, or internal audit has already identified a weakness, remediate it or have a documented, board-approved remediation plan with dates and owners. A gap you identified and are actively fixing looks very different to an examiner than the same gap found cold.

Prepare your team, not just your documents

Front-line staff, whoever handles onboarding, transaction monitoring, or customer service, may be interviewed. Make sure they know their actual job, not a scripted version of it. Examiners are good at spotting rehearsed answers that don’t match real practice.

Designate roles before day one

Decide in advance who is the single point of contact with the examiners, who pulls documents, who can speak to which topic, and who escalates to senior management or the board. Confusion about who answers what, in real time, creates inconsistency that examiners notice.

Part 3: During the Inspection — How to Conduct Yourself

Do: Be the calm, organized point of contact

As the MLRO or compliance officer, you set the tone for the entire exam. A composed, organized counterpart makes examiners more efficient and, frankly, more favorably disposed toward your program. Greet document requests with “let me get that for you” rather than friction.

Do: Answer exactly what’s asked, honestly and completely

If asked a direct question, give a direct, accurate answer. If you don’t know, say “I don’t know, let me confirm and get back to you” rather than guessing. Follow through on that promise quickly.

Do: Let the right person answer the right question

If a question is better answered by someone else on your team, say so and bring them in, rather than answering outside your own knowledge.

Do: Document every interaction

Keep a log of every request received, every document produced, and every question asked, with dates. This protects you if there’s ever a dispute about what was or wasn’t provided or said, and it gives you a clean record for your after-action report.

Do: Ask clarifying questions when a request is ambiguous

“When you say transaction records, do you mean the full ledger or a sample for a specific period?” This isn’t evasive, it prevents you from producing the wrong thing or over-producing sensitive material unnecessarily.

Do: Escalate internally in real time

Keep senior management and, where appropriate, the board informed as the exam progresses, especially if examiners flag a potential issue. Nobody should be surprised by findings at the exit meeting.

Don’t: Volunteer information beyond the question asked

This is one of the most common and costly mistakes. Answer what’s asked. Don’t pad answers with speculation, opinions about what might be wrong elsewhere, or unprompted context about unrelated issues. Over-talking creates new lines of inquiry you weren’t prepared for.

Don’t: Guess, speculate, or improvise policy on the spot

If you’re not sure of a number, a date, or a process detail, do not estimate out loud and present it as fact. Take it as a follow-up item. An incorrect answer given under the guise of confidence is worse than a delayed, accurate one.

Don’t: Argue with the examiner in the room

If you disagree with a preliminary observation, it’s fine to ask for the underlying basis or point to specific evidence that contradicts it. It is not productive to get defensive, dismissive, or combative. Save substantive disagreement for the written response process, where you can make your case calmly and with full documentation.

Don’t: Alter, backdate, or create documents during the exam

This should go without saying, but it’s worth stating plainly: never create or modify a record to make it look like it existed before the exam. This isn’t just an ethical failure, it’s often a separate, more serious violation than whatever the original gap was, and it is one of the fastest ways to convert a finding into a referral.

Don’t: Let unprepared or untrained staff speak for the program

If someone outside compliance is asked a question about AML policy and doesn’t actually know the answer, don’t let them guess in front of the examiner. Redirect to the right person.

Don’t: Treat the exam as adversarial

Examiners are not the enemy, and treating them as one, through stonewalling, slow-walking document production, or visible frustration, tends to extend the exam and invites closer scrutiny, not less.

Don’t: Go silent after a difficult question

If you need time, say so: “I want to make sure I give you an accurate answer, can I follow up on that by end of day?” Silence or visible hesitation reads worse than a short, honest delay.

Part 4: The Exit Meeting and Preliminary Findings

• Do take detailed notes on every preliminary finding, including the specific evidence the examiner cites.

• Do ask for clarification on scope and severity if findings are vague. “Is this characterized as a technical deficiency or a systemic weakness?” matters for how you respond.

• Do thank the examiners and ask about timing for the written report and response deadlines.

• Don’t commit to specific remediation timelines or actions verbally in the room without consulting senior management first. “We’ll take this back and come back to you with a remediation plan” is a safe, standard response.

• Don’t treat the exit meeting as final. Preliminary findings can and do change once the full written response and supporting evidence are submitted.

Part 5: After the Inspection — Responding and Remediating

4. Respond on time, in writing, with evidence. Address every finding individually. Where you agree, say so and provide a remediation plan with named owners and dates. Where you disagree, provide the specific documentation that supports your position rather than a general objection.

5. Get the remediation plan approved at the right level. Senior management and, for significant findings, the board should formally approve and track remediation, not just the compliance function alone.

6. Close the loop with evidence, not assertions. When you tell the regulator an item is remediated, be ready to show the policy update, the training record, the system change, or the testing results that prove it.

7. Run a post-mortem internally. What did the exam reveal that your own testing missed? Feed that back into your risk assessment and QA process so the same gap doesn’t reappear next cycle.

8. Track remediation like a project, not a memo. Missed internal deadlines on your own remediation plan are a very common source of the next exam’s findings.

Part 6: The Core Principles, Distilled

Final Thoughts

A regulatory inspection tests the honesty and maturity of your compliance program as much as its technical design. Examiners have seen every form of over-talking, defensiveness, and after-the-fact paperwork before, and they know what it looks like. The compliance officers and MLROs who come through inspections cleanly are the ones who’ve built a program that doesn’t need performing in the moment, because it’s been real all along, and who handle the exam itself with calm, precise, honest communication rather than either silence or over-disclosure.

Preparation, composure, and documentation are not separate skills. They are the same discipline, applied before, during, and after the exam.

This article is for general informational purposes and does not constitute legal advice. Specific regulatory expectations vary by regulator and jurisdiction; consult qualified counsel or your regulator’s examination manual for authoritative guidance.