You have a code of conduct, a KYC procedure and a compliance officer. But does this framework actually work? A compliance assessment answers exactly that question: it measures the gap between what your internal policies say, what regulations require and what your teams do day to day. Since Law No. 25-10 and Instruction No. 04-2026 on unified KYC, this question is no longer theoretical in Algeria.
Too often, executives discover weaknesses during an inspection or when a foreign correspondent bank turns them down. An assessment reverses that logic: identify weaknesses before they become costly. Here is the method we use at Hodemia Consulting, shaped by our engagements in Europe, the Gulf and Algeria.
Law No. 05-01 on anti-money laundering was amended by Law No. 23-01 of 7 February 2023, then by Law No. 25-10 of 24 July 2025, which requires a national and sectoral risk assessment shared with obliged entities. Banks must also comply with Regulation No. 11-08 of 28 November 2011 on internal control, Regulation No. 24-03 of 24 July 2024 and Instruction No. 04-2026 of 30 April 2026. Law No. 25-11 on personal data protection widens the scope further.
For the organisation these obligations call for, read our guide to the compliance function in Algeria.
Algeria's removal from the FATF grey list on 19 June 2026 is excellent news. But the next mutual evaluation, expected around 2029, will focus on how effective frameworks really are. Your foreign partners, meanwhile, already expect documented answers: due diligence questionnaires from correspondent banks and investors are increasingly detailed, and a vague answer is sometimes enough to stall a relationship.
Beyond regulatory pressure, an assessment is a governance instrument. It gives the board an objective, shared picture, helps prioritise investment and avoids spreading limited resources over secondary issues. For a new chief executive or compliance officer, it is also the best way to take stock when taking up the role.
A useful assessment starts with a clear scope. A bank, an insurer, a stockbroker or an industrial group are not subject to the same texts, but the structure of the assessment remains similar. The key is to start with the areas of highest exposure.
The cross-cutting components must also be assessed: governance and reporting line of the compliance function, risk mapping, procedures, controls, training, information systems, reporting and alerts. This is often where the most significant gaps lie.
A compliance assessment engagement usually runs over two to four weeks, in four steps.
We list the applicable texts and collect internal documentation: organisation charts, policies, procedures, committee minutes, previous audit reports, inspection follow-up letters and correspondence with the supervisor. This review already reveals many findings: outdated procedures, references to repealed texts, unclear responsibilities, no formal approval by management.
Documents say what should happen; interviews show what really happens. We meet senior management, control functions and operational staff. A simple question, “what do you do if a customer refuses to provide a supporting document?”, often reveals more than a twenty-page procedure.
We then test a sample of files. In a bank: are high-risk files reviewed at least once a year, as Instruction No. 04-2026 requires? Is the CNRC beneficial ownership register consulted? Is onboarding a politically exposed person approved by senior management? In industry, we focus instead on supplier files and entertainment expenses. The sample is risk-based, centred on the highest-risk customers and transactions, then supplemented by a few random picks: the aim is not to produce statistics but to establish a trend objectively.
The gap analysis compares, requirement by requirement, the observed situation with the expected level. Each gap is rated by nature (missing, insufficient or unapplied control) and severity. Here is what two typical lines look like:
| Requirement | Finding | Nature | Severity |
|---|---|---|---|
| Annual review of high-risk customer files | 30% of tested files not reviewed for over two years | Not applied | High |
| Gifts and hospitality policy | No written rules, practices vary across departments | Missing | Medium |
This format makes findings readable for management and eases the move to an action plan.
Knowing whether you are compliant or not is not enough. A maturity assessment provides a finer reading, on a five-level scale.
The same organisation can be “managed” on KYC and “emerging” on anti-corruption. This is common: many Algerian institutions focused their efforts on AML/CFT during the FATF's increased monitoring period, sometimes at the expense of other risks. A radar chart, component by component, lets the board grasp these contrasts at a glance.
Each level awarded must rest on verifiable evidence: an approved procedure, a tested sample, a tracked indicator, committee minutes. Self-declared scoring, based only on what teams say, almost always overstates actual maturity. This is precisely what the supervisor, and later the FATF assessors, will seek to verify.
In the Gulf as in Europe, we have seen that regulators mainly expect consistency between an institution's risk profile and the maturity of its framework. A low-risk SME does not need the tooling of an international bank; a highly exposed institution cannot settle for the “defined” level.
An assessment is only as valuable as the action plan that follows.
Rank gaps by exposure (sanctions, incidents, loss of partners) and remediation effort. Tackle the “quick wins” first, serious but easy to fix: updated procedures, a formally appointed owner, targeted training.
Each action should specify:
Present the plan to senior management, then to the board or its audit committee: this gives it legitimacy and secures resources. Quarterly follow-up prevents loss of momentum, and a new maturity review twelve to eighteen months later measures progress.
A compliance assessment lets executives know, with evidence, where their organisation stands and make informed decisions. With a strengthened AML/CFT framework and the upcoming FATF mutual evaluation, it is a governance investment rather than a cost. An honest maturity assessment, a rigorous gap analysis and a prioritised action plan: that is the foundation of a framework that genuinely protects your company and its reputation. If resources are tight, start with a narrower scope: a targeted assessment that is followed through beats an exhaustive exercise left on the shelf.