Fintech customer bases grow faster than review calendars. When every new wallet or lending account enters the population, teams either freeze or sample blindly. Neither helps an audit for fintech controls.
Stratify before you count
Split by risk rating, product, and onboarding channel. A flat random draw across a million low-risk prepaid wallets can miss the thin slice of high-risk remittance customers where failures cluster. Stratification forces attention onto the journeys that matter for AML and conduct risk.
Agree the question the sample answers
“Is the procedure followed?” differs from “Do we catch high-risk customers before activation?” The first needs procedure checkpoints; the second needs outcome checks such as whether enhanced due diligence completed before the first transfer. Write the question on the sampling memo so reviewers and management argue about findings, not about intent.
Document exclusions
Files missing from the room — archived, litigation-held, or vendor-held — must appear as limitations. Silent exclusions make a clean sample look healthier than the programme is.
Re-sample after remittance
Closing a finding without a fresh sample of post-fix files is theatre. Build a modest follow-up sample into the remittance plan so the next board pack can show more than a green status label.
Volume intimidates; structure restores judgement. A smaller, stratified sample with a clear question usually teaches more than a sprawling extract nobody reads.