“Regulatory readiness” is a phrase compliance consultants use to describe something that actually has a precise definition: can your firm demonstrate, to an examiner’s satisfaction, that your AML and sanctions program meets the minimum requirements for a firm of your size, in your industry, at this moment in time?
That definition does not require an enterprise compliance stack. It requires documentation, process, and evidence. Small firms confuse the two. They assume that because they cannot afford the same tools as a large bank, they cannot meet the same standard. That is not how examiners think.
What the baseline actually looks like
- A written BSA/AML policy reviewed and approved within the last 12 months.
- Evidence of sanctions screening at onboarding for every new relationship.
- Evidence of periodic re-screening — frequency proportionate to documented risk.
- An adjudication record for every alert, with a clear or confirm decision and a named reviewer.
- Annual training completion records for all relevant staff.
Where small firms actually get cited
OFAC civil penalty cases against small firms almost never cite inadequate screening technology. They cite gaps in documentation: no evidence that a screen was run, no record of who cleared an alert, no re-screening after a relationship became higher-risk. These are process failures, not tool failures.
The right investment for a small firm is a tool that produces the documentation automatically — not one that maximizes screening volume. Records are what examiners audit. Build the record first.