AML Vendor Evaluation Checklist
Eight groups of questions to take into every vendor call. Use the same list for each supplier, write the answers down and keep them with your selection record.
The checklist
1. Data coverage and refresh
- Which countries, lists and entity types does the data cover, and does that match where your customers are?
- How does a change at the source reach your account, and can you see when each list was last updated?
- Is the origin of every data point documented well enough to cite to an auditor?
2. Matching and false-positive handling
- How are names in other scripts, transliterations and common variants handled?
- What controls do you have over match sensitivity, and who can change them?
- Can you suppress a known-good result without hiding a future true match?
3. Explainability
- Does each result say why it was raised, in plain language and not only a score?
- If a model is involved, does the vendor describe its inputs and limits in writing?
- Can a second reviewer reach the same conclusion from the record alone?
4. Audit trail and record retention
- Is every search, decision and edit logged with a person, a time and a reason?
- Can you set how long records are kept, and can you prove they were not altered?
- Can an examiner be given read access without sharing a staff login?
5. Security and hosting
- Where is your data stored and processed, and does that fit your own data-location commitments?
- Which independent security assurances does the vendor hold, and can you read the reports?
- How are access, encryption and subcontractors described in the contract?
6. Data export and exit terms
- Can you export searches, decisions and notes in a usable format at any time?
- What happens to your data when the contract ends, and is deletion confirmed in writing?
- Are there terms that make it hard to move, such as a long minimum term or fees to leave?
7. Support and implementation
- Who helps with onboarding, and is that a named team or a ticket queue?
- What support hours apply, and how are urgent issues handled outside them?
- Are reference customers of a similar type to yours available to talk to?
8. What the quote must contain
- Are the volumes, modules, environments and users that the quote covers all written down?
- Which items are extra, such as sandbox access, premium support or additional data sets?
- What are the renewal and change terms, stated before you sign and not after?
Using the answers
Keep the written answers, the sample cases you gave each vendor and the quotes together. If a supervisor or auditor later asks why you chose a tool, that file is the evidence. A reply that a vendor will not put in writing is itself useful information.
To place the tool in the wider picture, read the AML software landscape. For businesses with fast payment flows, the FinTech and crypto criteria and the real-time versus batch guide add integration questions. The AML audit readiness guide explains how the evidence is organised afterwards.
Product and company names belong to their owners and are used only to identify them.
Frequently Asked Questions
How many vendors should we compare?
Can a pilot replace this checklist?
Where does FRAMEWORQ come into a vendor evaluation?
Is this checklist legal advice?
Find the gaps. Close them. Prove it.
Stay audit-ready with FRAMEWORQ, our compliance readiness platform. Free 3-month trial, and a pilot if you want one.