Sample size arguments can consume a kickoff call. A clearer approach is to agree populations first, then draw methodically.
Define populations
Separate new onboarding, periodic refresh, and enhanced diligence. Mixing them into one sample hides whether refresh controls actually operate. For wallet issuers, also separate personally acquired customers from agent-introduced ones when the risks differ.
Trace the full path
A useful sample is not a PDF of an ID. It is the path from application to screening hit (or clean result) to approval and, where relevant, to monitoring alerts. Missing links in that path are the findings that matter in audits for fintech AML programmes.
Protect the team’s time
Send the sample list 48 hours before testing day. MLROs who receive lists at 9:00 for an 10:00 session will struggle, and exception rates climb for the wrong reasons.