Compliance audit is an independent, evidence-based review of whether an organization meets the laws, regulatory rules, licence conditions and industry standards that apply to it, ending in a written report of findings and required fixes. It tests whether staff and systems follow policy in practice. The auditor sets scope, reviews policies, risk assessments and board minutes, then sample-tests customer files; if 7 of 60 AML files lack source-of-funds evidence, a look-back across the whole book usually follows. PCI DSS, EU AML rules and DORA make such audits mandatory for many firms. In an acquisition, buyers request two to three years of audit reports, and an open high-severity finding typically becomes a price adjustment, indemnity or closing condition.
What is a compliance audit
It differs from two neighbours. Compliance monitoring is the second line's ongoing checking during the year. Internal audit, the third line, reviews both the business and the compliance function itself. A compliance audit can be performed by internal audit or by an external firm, and its output is a set of findings graded by severity, each with an owner and a remediation deadline.
How does a compliance audit work
Scope comes first: which rules, entities and period. The auditor then requests policies, the business-wide risk assessment, board minutes and outsourcing registers, and runs walkthroughs with the people who operate each control. The core is sample testing. An AML audit might pull 60 customer files opened over the last 12 months and check identity evidence, sanctions screening, risk scoring and enhanced due diligence for politically exposed persons. If 7 of those 60 files lack source-of-funds evidence, the failure rate is 11.7%, and the finding will usually require a look-back across the whole customer book rather than fixing the 7 files. Management responds in writing, and a follow-up review confirms closure.
Payment compliance audit requirements
Several regimes make audits mandatory rather than optional. PCI DSS requires an annual Report on Compliance by a Qualified Security Assessor for Level 1 merchants, those processing over six million Visa transactions a year, and for Level 1 service providers; lower PCI compliance levels can self-assess. EU anti-money laundering rules require obliged entities, including EMIs, PIs and CASPs, to have an independent audit function testing their AML controls where proportionate to size. DORA, applicable since 17 January 2025, requires EU financial entities to have their ICT risk framework audited, alongside regular penetration testing. In the UK, the FCA's safeguarding rules require EMIs and PIs above a minimum level of client funds to obtain an annual safeguarding audit.
Findings that recur in EMIs and PIs
Across payment firms, the same weak points appear: a business-wide risk assessment not updated after new products or corridors, transaction monitoring alerts left in backlog for months, safeguarding reconciliations performed weekly instead of daily, incomplete outsourcing registers, and poor oversight of agents and distributors onboarding customers on the firm's behalf.
Why audit reports matter in an M&A deal
Buyers of a licensed payment business ask for two to three years of audit reports, regulator correspondence and the current remediation tracker. An open high-severity finding typically becomes a price adjustment, a specific indemnity or a condition to closing, and the regulator reviewing the change of control will read the same reports. A clean audit history is among the few proofs that a licence is worth more than its paperwork.