BlueSky AML

FINRA Rule 3310 Independent Testing

Independent AML Testing for Broker-Dealers

$5,000 flat fee. Final report in 15 business days.

We work with clients who want a fair and thorough test, a clear report and a process that respects their time. Fully remote, with every request, follow-up and deliverable in one secure portal.

Start your review See how it works
  • No hourly billing
  • Engagement e-signed on day 1
  • AML testing is all we do

An illustration of the process.

  • Meets Rule 3310(c)An independent test of your AML program by a qualified, independent tester.
  • Built for broker-dealersScoped to introducing and private placement business models.
  • Exam-ready reportScope, samples, findings and recommendations, documented.

Why BlueSky

The right review, without the wait.

Independent by design

AML testing is our only service. We don't write AML procedures, serve as anyone's CCO or sell surveillance software, so we're never grading our own work.

Fifteen business days

From signed engagement to final report. Your portal shows where the review stands every day, so nobody has to chase anyone.

One flat fee

50% due upon engagement, the remainder due upon completion. No hourly billing, no change orders, no surprise invoices.

Reg S-P due diligence, done

Everything your firm needs to vet us as a service provider, ready on day one. See what's included

Regulation S-P · Vendor Due Diligence

Your Vendor Due Diligence, Done Before You Ask.

Your AML tester sees customer files, which makes us a service provider under Reg S-P. Your firm needs to oversee providers like us through due diligence and ongoing monitoring.

We hand you the answers on day one, so your vendor file is complete before testing starts.

  • 72-hour incident notice, written into our engagement letter
  • Customer data never sent by email, only through our encrypted portal
  • Minimum data, deleted within 30 days of the final report; redacted copies welcome

For your BlueSky due diligence file:

Our Focus

AML Reviews. Without the Runaround.

Your firm faces different operational realities than large, vertically integrated financial institutions, so we evaluate how your AML program is designed, documented and operating in practice against the requirements that apply to YOUR business, not a bank's.

We work exclusively with:

Introducing broker-dealers

Your clearing firm handles much of the infrastructure, but relying on it doesn't transfer your obligations. We focus on the seams between the two firms.

  • Who does what. We compare your AML procedures with the allocation of functions in your clearing agreement and confirm you're performing your side.
  • CIP reliance. If you rely on your clearing firm for customer identification, we check that the reliance meets the CIP rule's conditions.
  • Surveillance. We identify which exception reports come from the clearing firm, who at your firm reviews them, and whether that review is documented.
  • Escalation. We trace how red flags your representatives see reach your AMLCO and the clearing firm.

Private placement firms

Firms engaged in private offerings see deal-based relationships, large single transactions and investors that are often legal entities. The risks sit in onboarding and in how funds move.

  • Who your customer is. We confirm your procedures identify which investors are customers for CIP purposes, and that you treat them that way.
  • Beneficial ownership. We test identification and verification of the people who own or control legal entity investors.
  • Source and flow of funds. We look at your procedures on how escrow and subscription payments are monitored.
  • Sanctions and issuer red flags. We test your OFAC screening and how red flags are escalated.

The goal isn't simply to identify deficiencies. It's to help you understand where your program stands and what to do next.

Our Approach

Our Approach to AML Testing

An AML review should answer one question: would your program detect and report suspicious activity, given how your firm actually does business? Everything we test works back from that question.

What FINRA Rule 3310 requires

Every FINRA member must maintain a written AML program, approved in writing by senior management, that at a minimum:

  • 3310(a)

    Has policies and procedures reasonably expected to detect and cause the reporting of suspicious transactions.

  • 3310(b)

    Has policies, procedures and internal controls reasonably designed to comply with the Bank Secrecy Act, including the Customer Identification Program rule.

  • 3310(c)

    Provides for independent testing, annually on a calendar-year basis for most firms.

  • 3310(d)

    Designates an AML compliance person and keeps that person's contact information current with FINRA.

  • 3310(e)

    Provides ongoing training for appropriate personnel.

  • 3310(f)

    Includes risk-based customer due diligence: understanding the nature and purpose of each relationship, ongoing monitoring, and current customer and beneficial ownership information.

A risk-based approach

We start from your risk assessment and business model: who your customers are, what they buy, where they are, and how money moves in and out. Then we test the controls that matter for those risks. Do your surveillance reports surface the red flags your business presents? Are alerts reviewed, documented and escalated? Do your SAR decisions hold up?

Our Process

Our AML Testing Process

Fifteen business days from signed engagement to final report, managed in one secure portal.

  1. 1Day 1

    Start

    Complete the 2-minute form and e-sign the engagement letter. Your portal opens with a request list tailored to your firm.

  2. 2Days 1–2

    Upload

    Upload documents to the portal and check items off as you go. Each item shows as received the moment it arrives.

  3. 3Days 1–14

    Review and test

    We discuss the specifics of your business with your CCO/AMLCO and start reviewing your program and testing samples. Follow-up questions come through the portal.

  4. 4Day 15

    Final report

    Delivered in your portal and kept there, ready for your records and for FINRA examiners.

The 15-day timeline assumes requested documents and subsequent requests for information are uploaded and responded to promptly.

What we'll ask for

Your request list is tailored to your firm. A typical list includes:

  • AML program, written procedures and senior management approval
  • AML risk assessment and your most recent independent test
  • New account lists for sample selection, then the selected CIP and due diligence files
  • Surveillance and exception reports with evidence of review
  • Suspicious activity investigation log and SAR decision records
  • OFAC screening and 314(a) search records
  • Training materials and attendance
  • Clearing agreement (introducing firms) or offering, escrow and subscription records (private placement firms)

What you receive

  • Scope and methodology: the period covered, the areas tested and how samples were selected
  • Findings by priority, each tied to the rule or procedure it relates to
  • Practical recommendations sized to your firm, not to a bank
  • A statement of the tester's independence and qualifications
  • Room for management's response, so your remediation is documented alongside the findings

Pricing

$5,000 flat fee

  • Tailored request list and secure portal
  • Program review, sample testing and AML officer interview
  • Final report
Start your review

How the secure portal works

  • Private access. Each firm sees only its own requests and files.
  • One checklist for every document we need, with a status on each item.
  • Encrypted in transit and at rest.
  • Questions in one place, not scattered across email threads.
Screenshot of a BlueSky AML portal request list: Preliminary document request, 3 of 6 items received. AML Program section with current AML WSPs, AML risk assessment and previous AML audit report checked off and AML training records outstanding; Clearing Firm section with clearing agreements and sample exception reports outstanding.
A real request list: you see what's done and what's left at a glance.

FAQ

Questions CCOs and AMLCOs Ask

Does this satisfy the independent testing requirement in FINRA Rule 3310(c)?

Yes. The test is performed by a qualified tester who is independent of your AML function, and the report documents the scope, the testing performed and the results, which is what examiners look for.

Is an AML independent test the same as an AML audit or AML review?

In practice, yes. Firms and vendors use "AML test," "AML audit" and "AML review" interchangeably. Rule 3310(c) calls it independent testing. What matters is that the tester is qualified and independent, and that the scope, testing and results are documented.

How often does our firm need an independent AML test?

Every calendar year for most firms. Only firms that don't execute transactions for customers, hold customer accounts or act as an introducing broker for customer accounts may test every two years. Introducing firms test annually.

What makes a test independent? Can our CCO or AML officer do it?

Rule 3310 requires a tester who knows the Bank Secrecy Act requirements and isn't your AML compliance person, anyone who performs the functions being tested, or anyone who reports to them. That often rules out an in-house CCO or AML officer. Because AML testing is all we do, we never test our own work.

What does the $5,000 fee include?

The full engagement: request list, secure portal, discussions with CCO/AMLCO, program review, sample testing, and the final report. There is no hourly billing.

What happens if you find problems?

Each finding in the final report comes with a practical recommendation, and the report includes room for management's response, so your remediation is documented alongside the findings.

Is the review done remotely?

Yes. Documents go through the secure portal and our discussions are by phone or video call - whichever you prefer.

When during the year should we schedule our test?

Any time in the calendar year. Scheduling well before year-end leaves time to act on any findings before your next test.

About

Jack Walsh

Principal

Jack Walsh, Principal of BlueSky AML
jack@blueskyaml.com (678) 235-5444

"BlueSky AML was founded to do one thing really well. I look forward to the opportunity to work with you."

Jack has been in the investment industry since 1998, focusing on compliance since 2002. Prior to founding BlueSky, he spent twelve years as a CCO in the asset management space. He has also worked as a compliance consultant to broker-dealers and investment advisers, assisting clients with all areas of compliance. He first began working with AML programs and conducting annual reviews in 2004. Jack received his undergraduate degree from the University of Rochester, where he was captain of the men's swim team. He's a 2-time IRONMAN triathlon finisher, and a proud husband and father of two daughters.

Jack has always taken a practical and constructive approach to compliance, which has been appreciated by his colleagues and clients.

Contact

Let's Take a Closer Look at Your AML Program.

Start your review in about two minutes. No obligation until you sign the engagement letter.

  1. Send the form. We confirm your firm is a fit.
  2. E-sign the engagement letter we email you the same business day.
  3. Your portal opens with your request list, and the 15-day clock starts.
Prefer to talk first? Call or text: (678) 235-5444 Email: jack@blueskyaml.com

We use this only to prepare your engagement. $5,000 flat fee - 50% engagement deposit and 50% due upon completion.

How we handle your information: Privacy Policy (PDF)