Plain-English guide

Independent testing for jewelers

Updated October 2026 · Based on 31 CFR 1027.210(b)(4) and FinCEN guidance

Writing an AML program is one thing. Knowing it actually works at your counter is another. That's the job of independent testing, the fourth required part of a covered dealer's program. Many small jewelers assume they must hire an outside auditor. They don't have to. This guide explains who can do the test, what to check, how to write it up, and how often to do it.

1. What the rule says

A covered dealer's AML program must provide for independent testing. The scope and frequency of the testing must be commensurate with the dealer's risk assessment (31 CFR 1027.210(b)(4)). In other words, a busier, riskier business should expect a deeper and more frequent test.

2. Who can do the test

The rule lets an officer or employee of the dealer do the testing, as long as that person isn't the compliance officer and isn't involved in operating the program (31 CFR 1027.210(b)(4)).

FinCEN guidance adds two helpful points:

A co-owner may do the testing, as long as they aren't the compliance officer and aren't involved in running the program (FinCEN preamble, 2005 interim final rule).
An outside party isn't required, but you may use one, such as an accountant or consultant (FinCEN dealer FAQ 4(a)(4)).

Here's how that can look in a small business:

Owner is the compliance officer, and there's a co-owner: the co-owner can test, if they stay out of running the program.
A manager or bookkeeper who doesn't train staff, handle Form 8300 filings or approve buy-counter decisions may be able to test.
Everyone is involved in the program: use an outside party.

If you hand testing or any other function to a third party, your business remains responsible for compliance (FinCEN preamble, 2005 interim final rule).

FineVault AML doesn't perform independent tests. It plans to provide a testing checklist for the person you choose.

3. What to check

The rule doesn't give a checklist. A practical test walks through each required part of the program and looks at real records. The checklist below is recommended practice. The citations show the requirement each item checks.

The written program

Is the program written, approved by senior management, and ready to provide to FinCEN on request? (31 CFR 1027.210(a)(1))
For a retailer covered through public purchases, does the program address those purchases? (31 CFR 1027.210(a)(2))

The risk assessment and controls

Does the risk assessment reflect the business as it is today: products, customers, suppliers, channels, locations, non-established dealings and high-risk jurisdictions? (31 CFR 1027.210(b)(1)(i)(A)–(C))
Do written procedures address the red flags, reasonable inquiries, and refusing or ending a transaction? (31 CFR 1027.210(b)(1)(ii))
Pick a sample of recent buy tickets and large sales. Were red flags noticed, questioned, documented and escalated as the procedures say? (recommended practice)

The compliance officer

Is a compliance officer named in writing? Are they making sure the program is carried out, updated, and that staff are trained? (31 CFR 1027.210(b)(2))

Training

Have the right staff been trained on their responsibilities, with records showing who and when? (31 CFR 1027.210(b)(3))
Ask two or three staff members what they would do if a seller refused to give contact details. Do the answers match the procedures? (recommended practice)

Form 8300 and records

For cash sales over $10,000, was Form 8300 filed within 15 days? (31 CFR 1010.330(b)(1))
Was the customer's identity verified? (31 CFR 1010.330(e)(2))
Were January 31 statements sent? (26 CFR 1.6050I-1(f)(1), (f)(3))
If the business is a required e-filer, was Form 8300 e-filed? (26 CFR 301.6011-2(b)(3))
Are Form 8300 copies kept for five years? (31 CFR 1010.330(e)(3))
Are required records kept for five years? (31 CFR 1010.430(d))

Follow-up

Were findings from the last test fixed? (recommended practice)
Has the business re-checked whether it still meets the dealer definition this year? (FinCEN dealer FAQ 5(b)–(c))

Our Form 8300 guide and risk assessment guide explain those items in more detail.

4. Put the results in writing

FinCEN guidance says independent testing results should be put into writing, including any recommendations for improvement (FinCEN dealer FAQ 4(a)(4)). A short report usually covers (recommended practice):

the test date and the period covered;
the tester's role, and a note that they aren't the compliance officer or involved in running the program;
what was reviewed and how many records were sampled;
findings, each rated by importance;
recommendations, an owner for each fix, and a due date; and
senior management's sign-off.

Keep the report with your program records. Keeping it for five years, to match FinCEN's general retention period for required records (31 CFR 1010.430(d)), is recommended practice for test reports. FinCEN guidance also notes that the IRS has delegated authority to examine dealers for compliance (FinCEN dealer FAQ 4(b)), so a clear written record helps.

5. How often to test

The rule doesn't set a fixed schedule. Testing frequency must be commensurate with your risk assessment (31 CFR 1027.210(b)(4)).

As recommended practice, a small dealer can plan to test every 12 to 18 months. Test sooner after a big change, such as opening a buy counter, adding a location, starting online sales, or replacing the compliance officer. A higher-risk business should test more often and more deeply than a lower-risk one.

6. After the test

The compliance officer is responsible for making sure the program is carried out well and updated as needed (31 CFR 1027.210(b)(2)(i)–(ii)). Use the findings to:

update the risk assessment, policies or procedures;
refresh staff training where answers didn't match the procedures;
fix record gaps, such as missing Form 8300 copies; and
show senior management what changed (recommended practice).

Not sure you need a program at all? Start with Do jewelers need an AML program? and our guide to buying gold from the public.

Also check: state and local rules. Check with your state and local authorities for any rules that apply to your business.

Coming soon: a testing checklist your tester can follow

FineVault AML will include an independent-testing checklist, with a testing workbook and findings log planned for the Pro plan. Your tester does the review and your business owns the results. Planned pricing from $49/month, training included.

Join the waitlist

More guides

Sources

This guide summarizes federal rules as of the date above. State law and your own facts may add requirements. It isn't legal advice, so talk to a qualified attorney about your situation.