A consistent theme emerged from both sessions: CIMA’s focus is increasingly on effectiveness. It is no longer enough for regulated entities to have policies and procedures in place. They must be able to demonstrate that they are operating effectively in practice.
One of the more immediate takeaways was CIMA’s confirmation that desk-based reviews will commence across regulated sectors from mid-October 2026.
Business risk assessments are expected to be an early area of focus. Entities selected for review should expect short turnaround times, with approximately five business days to provide requested documentation. CIMA expects key compliance documents to be current and readily available. CIMA also indicated that repeat findings are likely to attract increased scrutiny.
There is no universal deadline for a first audit and no prescribed annual audit cycle. The timing and frequency of audits should be determined with reference to an entity’s risk profile and be documented by the governing body. One notable change is the requirement to submit audit reports to CIMA “as soon as practicable” following completion.
While at least every third audit must be external, entities should give careful consideration to the independence of the person conducting the audit. Relevant factors may include reporting lines, conflicts of interest and the extent of any involvement in the activities under review.
For investment funds, the audit should assess not only delegated AML functions, but also the fund’s oversight of those arrangements. An audit of a service provider’s controls alone will not automatically satisfy the fund’s own audit obligations.
CIMA also outlined broader organisational changes designed to support its supervisory agenda.
These include the creation of a new Authorisations Division to centralise licensing and registration applications, the appointment of a second Chief Supervision Officer and a move toward sector-specific AML supervision teams within CIMA’s AML Division. Updated AML/CFT Guidance Notes are expected by year-end.
Regulated entities should ensure that business risk assessments and key AML documentation are up to date, revisit their independent audit arrangements and confirm that sanctions screening and re-screening processes are operating effectively. With desk-based reviews expected shortly, now is a good time to address any gaps.
Maples Group is available to assist with compliance programme reviews, independent AML audits and regulatory readiness assessments.
