AMSF tells Monaco banks and managers to fix AML gaps found in 2025 controls

Monaco financial institutions face a detailed supervisory checklist after the Autorité Monégasque de Sécurité Financière (AMSF) published its 2025 control findings for the sector. The presentation, dated 7 October 2026Amsf, summarises 15 on-site missionsAmsf — including one ad hoc and four follow-up missions — covering nine banks and financial establishments, seven asset managers and five insurance brokers and agents, plus desk-based reviews of 30 sets of internal procedures. A further publication of the 2025 findings is announced for the last quarter of 2026Amsf, with a webinar for financial institutions on feedback from the 2025 Strix campaign announced for 29 September 2026Amsf.

The starting point is the entity-wide risk assessment. The AMSF found the exercise is often implemented lateAmsf, uses a methodology too thin to judge the reliability and scope of the resultsAmsf, leaves out sources the texts requireAmsf, and produces a document in which the firm's own business is not always recognisable. Firms must define and maintain risk-identification and assessment arrangementsLegimonaco, build a classification by product, transaction term, distribution channel, client characteristic and geographyAmsf, and document the assessment so its basis can be demonstratedLegimonaco.

On internal organisation, the AMSF flags headcounts for compliance tasks as insufficientAmsf and the compliance function's place in the organigram as not always correctly understood, against a duty to set up an organisation and procedures proportionate to nature and size, approved at a high hierarchical level with a designated senior officer and internal control measuresLegimonaco. Procedures are solid where they exist, but some obligations have no formal description — notably internal control, transaction monitoring, suspicious-transaction reports and the list of countries at riskAmsf — and legal references are sometimes obsolete. Front-office training is judged insufficientAmsf, while training delivered at least annually is welcomed.

Client knowledge draws sharp findings. Identifying the beneficial owners of certain entity types causes difficulty, and some files for legal-person clients are kept loosely, including high-risk onesAmsf. Evidence corroborating the origin of wealth and funds is insufficient, particularly for high-risk clientsAmsf — against the reinforced-vigilance duty to establish the origin of assets and funds and exercise continuous reinforced controlLegimonaco. Risk categorisation errors were foundAmsf even though the indicators used are judged relevantAmsf. The specific-examination duty for higher-risk clients is insufficiently graspedAmsf, as is the particular examination tied to high-risk countries. Detection arrangements for politically exposed persons are sometimes missing entirely, so that a PEP goes unidentified; PEP identification and handling are otherwise generally satisfactory.

Client-file reviews do not respect the firm's own timetable, including for high-risk clientsAmsf. Transaction monitoring systems lack rules or scenarios for cash operationsAmsf, alerts take too long to process and justifications need improvement — though monitoring generally rests on an adequate risk-based approachAmsf. On targeted financial sanctions, the AMSF records that the monitoring arrangement does not cover all transactionsAmsf and that no arrangement identifies a freeze measure without delay; screening is otherwise dailyAmsf. Suspicious-transaction reports are often qualitative and filed quickly, but fact descriptions do not always detail the date of the fact generating the doubtAmsf, and reporting failures were found. The supervisor encourages every subject entity to use the findings to identify weaknesses in its own arrangements and remedy themAmsf.

The duties tested are those of Loi n° 1.362 du 3 août 2009 — Article 3 defines all the obligations relating to the entity-wide risk assessmentAmsf, applied through guidance including the AMSF's Lignes Directrices Génériques: risk assessment and classification (Article 3), customer vigilance (Articles 4, 13, 14, 17, 17-2), internal organisation and training (Articles 27, 30, 34) and suspicious-transaction reporting (Article 36).