# AML Assure — Independent Regulation 21 AML Audit ## Draft Engagement Schedule **Status:** Solicitor-approved final wording applied — implementation pending checkout acceptance/order-linkage validation. **Version:** 1.4 — 28 August 2026. **Read with:** AML Assure Draft Terms of Business and Engagement Confirmation. Where there is a bespoke engagement letter, it governs matters it expressly addresses alongside those documents; otherwise this Schedule governs matters it addresses alongside those documents. > This Schedule records the agreed product scope. It is deliberately concise and should be completed for each Engagement. For the standard online product, the intended draft position is that it is incorporated at the exact Purchase Time; for a bespoke Engagement, the formation route is set out in the bespoke engagement letter. **[Solicitor to confirm before use.]** ## 1. Engagement details | Item | Agreed detail | | --- | --- | | Audit ID | `[INSERT]` | | Customer legal name | `[INSERT]` | | Customer legal entity type | `[INSERT]` | | Registration number (where applicable) | `[INSERT]` | | Trading name (if different) | `[INSERT]` | | Registered/principal office | `[INSERT]` | | Authorised Contact | `[INSERT NAME, ROLE, EMAIL]` | | Firm size | `[INSERT PARTNER COUNT / OTHER SCOPE FACTOR]` | | Review date / period | `[INSERT]` | | Purchase Time | `[INSERT — exact approved checkout purchase timestamp and time zone]` | | Cancellation Window ends | `[INSERT — exact Purchase Time plus 48 hours]` | | Standard service commencement | `[INSERT — exact Purchase Time plus 48 hours, subject to the approved Terms and statutory rights]` | | Report delivery target | `[INSERT — estimate only]` | | Provider | HS Consultants Oxford Limited, trading as AML Assure | ## 2. Service and objective 2.1 The Provider will conduct an **Independent Regulation 21 AML Audit**: a focused, proportionate, firm-level review of the agreed Evidence relating to the Customer's AML arrangements. 2.2 The objective is to provide the Customer with an independently prepared, human-reviewed Report that identifies relevant strengths, areas for attention and practical priorities from the agreed Evidence, in the context of the agreed review criteria. 2.3 The review criteria will be the provisions, guidance and good-practice sources expressly identified by the Provider for this Engagement. **[Solicitor and subject-matter reviewer to approve the final description of criteria and the appropriate “as at” date before customer use. Do not describe the Schedule as a legal opinion.]** ## 3. Independence Review before commencement 3.1 Before accepting or commencing the standard audit, the Provider will carry out and document a proportionate review of independence and conflicts in relation to the Customer and the agreed scope. 3.2 HS Consultants Oxford Limited and its **Relevant Persons** (its officers, directors, employees, contractors and other persons connected with it whose relationship or circumstances may be relevant) will assess whether the Provider can act independently for the purpose of the agreed audit, considering actual or potential conflicts and other relevant relationships or circumstances. 3.3 If the Provider determines that it cannot act independently for the purpose of the agreed audit, or identifies a potential independence issue that it does not consider can be appropriately managed, it will not proceed with the standard audit and will refund the Purchase Price and VAT paid in full within 14 days to the original payment method. 3.4 References to 'independent' describe that the review is conducted by an external party independent of the Customer. This product, including the optional Follow-up Review described below, is not, and does not by itself constitute or satisfy, the internal independent audit function that regulation 21(1)(c) of the Money Laundering Regulations 2017 requires certain firms to establish, which is an ongoing function that monitors compliance with its own recommendations as a matter of course. The Follow-up Review is a separate, customer-initiated, point-in-time re-consideration of specifically identified items, not continuous monitoring. The Customer remains responsible for determining whether, and how, this Report and any Follow-up Review are relevant to its own regulation 21 obligations. 3.5 Where a potential independence issue is manageable, the Provider will give reasonable details and proposed safeguards and may proceed only with the Customer's written agreement. If a post-commencement issue cannot be appropriately managed, the Provider may terminate the Engagement and the Terms refund provisions apply. ## 4. Standard scope 4.1 Subject to the agreed Evidence, the standard scope may include a review of the Customer's firm-level AML framework, governance, policies, procedures, controls, templates, oversight arrangements and supporting organisational evidence. 4.2 The standard service is a one-time, point-in-time review. It is limited to the agreed scope and Evidence and does not provide continuous monitoring or a guarantee that all issues have been identified. 4.3 The Provider will tailor the review to the Customer's size, nature and risk context only to the extent apparent from the agreed Evidence and onboarding information. ## 5. Included output 5.1 Subject to receipt of sufficient Evidence and the agreed scope, the Provider will deliver one management-ready Report that may include: - an executive summary; - headline findings and relevant strengths; - practical priorities and recommended next steps; and - appropriate qualifications where the Evidence is incomplete, unavailable or outside scope. 5.2 The Report is not a legal compliance opinion, certification, regulator approval, prediction of regulatory action, inspection or enforcement, or benchmark against other firms. ## 6. Excluded from the standard product Unless expressly agreed in a signed variation or bespoke engagement letter, the standard product does not include: - comprehensive live-client-file testing or review of live client identity documents; - drafting, rewriting or implementing policies, procedures, controls or remediation plans; - monitoring implementation or ongoing compliance with recommendations, unless the Customer purchases a separate Follow-up Review under clause 3.9 of the Terms, which is a point-in-time re-consideration of specific items, not ongoing monitoring; - legal advice, legal compliance opinions or representation before a regulator; - independent assurance over systems or controls outside the agreed Evidence; or - a commitment to identify every control issue, breach or regulatory concern. ## 7. Evidence and information 7.1 After onboarding, the Provider will give the Customer administrative instructions headed **Submit Audit Evidence**. The Customer is responsible for deciding what it may lawfully provide and for following those instructions. 7.2 The Customer must not provide live client identity documents, unnecessary personal data, privileged material or other client-confidential information unless specifically requested in writing. Documents should be anonymised where reasonably possible. 7.3 The Customer should organise agreed Evidence, where relevant, using the following folder structure before creating one encrypted archive: `01 – Firm-Wide Risk Assessment`; `02 – AML Policies, Controls and Procedures`; `03 – Client Due Diligence and Onboarding`; `04 – Client and Matter Risk Assessment`; `05 – Source of Funds / Source of Wealth / EDD`; `06 – Sanctions and PEPs`; `07 – Training`; `08 – Governance and MLRO / MLCO Oversight`; `09 – Supervision and Quality Assurance`; `10 – Previous Audit and Remediation`; and `11 – Other Relevant Evidence`. Not every folder will apply to every Customer, and it may be left empty where there is no relevant material. 7.4 Typical organisational material may include the firm-wide risk assessment; AML policies, controls and procedures; CDD, client/matter-risk, sanctions, PEP, source-of-funds, source-of-wealth and EDD guidance; training materials and records; governance and MLRO/MLCO reporting; escalation procedures; templates and checklists; supervision and quality-assurance arrangements; previous audit reports and remediation plans; anonymised QA findings; and a proliferation-financing risk assessment where relevant. The agreed evidence request, rather than this indicative list, controls what the Customer should provide. 7.5 The Customer will ordinarily send one encrypted archive to the Provider's notified evidence email address, with the password communicated separately through an agreed channel. This is the current version-one submission method. The stage is described as **Submit Audit Evidence** so that the Provider may adopt another approved method in the future. The Provider confirms receipt of the archive filename and hash, not its contents. 7.6 MadeThis is not the substantive evidence repository. In the normal workflow it stores commercial and administrative metadata only; it does not receive or store the Evidence, detailed substantive analysis or final Report. The Provider's business/admin and audit records are retained outside MadeThis for at least six years, subject to the Terms. 7.7 The Provider may request clarification or additional Evidence. The Customer acknowledges that Evidence gaps, restrictions or delays may limit the review and may be reflected in the Report or timetable. ## 7A. Follow-up Review 7A.1 A Follow-up Review is optional and customer-initiated. It is available only after a Report identifies specific Follow-up Items. The Customer must respond within 21 days after Report delivery and, if accepted, submit the agreed remediated material within 30 days. 7A.2 The Follow-up Fee is from £499 plus VAT. The Provider confirms the final fee after remediated material is received and before review begins. It is a separate Engagement, limited to submitted Follow-up Items, and is not a re-audit or ongoing monitoring. 7A.3 The Follow-up Review must be purchased and completed within six months after Report delivery. A material change in relevant circumstances requires an independence confirmation; after 12 months, a fresh proportionate review is required. ## 8. Method and professional judgement 8.1 The Provider may use technology to assist analysis. A human professional reviewer remains responsible for evaluating relevant Evidence, challenging unsupported points, applying materiality and proportionality, and approving the Report. 8.2 The Provider may rely on the Customer's statements and Evidence without independently verifying them unless the parties expressly agree otherwise in writing. ## 9. Fee and payment 9.1 **Standard fee:** £999 plus VAT for firms with up to 10 partners. 9.2 **Additional or larger-firm scope:** `[INSERT IF APPLICABLE]`. 9.3 **Payment status and timing:** `[INSERT]`. 9.4 For the standard online service, the Customer has a 48-hour Cancellation Window beginning at the exact Purchase Time. The standard service commences when that period ends, 48 hours after the exact Purchase Time. 9.5 Subject to section 3, once the Cancellation Window has elapsed, the £999 plus VAT standard-service fee is fully payable and non-refundable, including where the Customer does not complete onboarding or does not submit Evidence. Incomplete or late Evidence may affect the timing, scope or qualifications of the Report, but does not itself create a right to a refund. 9.6 The Engagement remains subject to the solicitor-approved cancellation, refund, service-commencement and statutory-rights provisions in the Terms, checkout and/or bespoke engagement letter. **[Solicitor to confirm the final wording for the intended customer type and contracting route, including the timing and mechanics of the full refund in section 3 and whether it covers VAT and fees exactly as paid.]** ## 10. Delivery and communications 10.1 The Provider will ordinarily provide the Report by encrypted file or archive to the Customer's agreed recipient email address, with the password communicated separately through an agreed channel, unless another method is agreed in writing. 10.2 The Report may be shared only in unaltered form with the instructed firm's professional advisers or with a regulator where necessary. No third party may rely on the Report without the Provider's prior written consent, subject to the Terms. 10.3 Completion notifications and other administrative communications may be sent through MadeThis or email. MadeThis does not host the Report. ## 11. Assumptions and special instructions | Item | Agreed detail | | --- | --- | | Agreed Evidence categories / limits | `[INSERT OR REFERENCE APPROVED EVIDENCE REQUEST]` | | Known restrictions or exclusions | `[INSERT]` | | Special assumptions | `[INSERT]` | | Approved report recipients | `[INSERT]` | | Agreed secure password channel | `[INSERT]` | | Any bespoke deliverable or variation | `[INSERT]` | ## 12. Acceptance 12.1 For the standard online product, the proposed contractual wording is: “The person placing the order confirms that they are authorised to bind the firm identified during onboarding to these Terms and the applicable Audit Engagement Schedule. HS Consultants may rely on that confirmation.” **[Solicitor to confirm the wording, formation route and evidence requirements before use.]** 12.2 This Schedule must not be used to seek a second acceptance after an approved checkout acceptance. If the approved checkout acceptance record is unavailable or incomplete, use the approved manual or bespoke engagement route. 12.3 For a bespoke Engagement only, the Customer confirms that it has read and accepts this Schedule and the Terms and that its Authorised Contact is authorised to bind the Customer. The Provider confirms that it will perform the service described above, subject to the Engagement. | For the Customer | For HS Consultants Oxford Limited | | --- | --- | | Name: `[INSERT]` | Name: `[INSERT]` | | Title: `[INSERT]` | Title: `[INSERT]` | | Signature / approved electronic acceptance: `[INSERT]` | Signature / approved electronic acceptance: `[INSERT]` | | Date: `[INSERT]` | Date: `[INSERT]` |
Engagement Schedule
Independent Regulation 21 AML Audit
Read this Schedule with the Terms and Engagement Confirmation. This page is informational and does not request acceptance.