AML/CFT Remediation (2023-12-29)

Summary

This is a CIMA Supervisory Information Circular explaining how the Authority monitors and expects financial service providers (FSPs) to remediate deficiencies identified during AML/CFT onsite examinations. It describes the tools CIMA can use when Requirements (specific corrective actions with deadlines) are issued following an inspection.

• Requiring remediation action plans and supervisory meetings
• Independent AML audits
• Supervisory Letters
• Appointment of a Special Advisor
• Placement on the High-Risk Entities list
• Referral for enforcement action

The circular sets out the mechanics of ongoing monitoring: FSPs that have received Requirements are asked to report on a monthly or quarterly basis (depending on the nature and severity of the deficiency) via a CIMA-provided 'Work Plan' template. It gives detailed guidance, including a comparison table of 'more effective' versus 'less effective' reporting practices, on how FSPs should structure communications, evidence remedial actions, identify accountable persons, meet timeframes, and demonstrate senior management oversight.

The document also explains the process for requesting extensions to remediation timeframes, factors CIMA considers when deciding whether to escalate matters to enforcement (referencing section 6.4 of CIMA's Enforcement Manual), and notes that CIMA will formally confirm when it is satisfied remediation is complete, potentially followed by a validation inspection.

The circular is primarily explanatory/guidance in nature, describing CIMA's supervisory expectations rather than creating new statutory rules, but it does impose specific reporting and documentation expectations on FSPs that are already subject to inspection Requirements.

Key obligations

• FSPs that have received AML/CFT Requirements from an inspection must report to CIMA on their remediation progress monthly or quarterly, as determined by the Authority based on the nature and severity of the deficiency.
• FSPs must complete and submit the CIMA-provided Work Plan template, providing detailed responses to each Requirement along with Board-approved supporting documents where required.
• FSPs must ensure that documents or information submitted are clearly linked to the specific related Requirement.
• FSPs must submit any request for an extension of a remediation timeframe in writing to the Authority before the deadline, rather than simply missing it.
• Where an extension is granted, the FSP may be required to provide a revised remediation action plan and more frequent progress updates to the Work Plan.
• FSPs should demonstrate senior management oversight and sign-off on remediation progress reported to the Authority.
• FSPs should seek clarification from the Authority where CIMA's comments on the Work Plan are unclear, and must address those comments.

Applies to

financial service providers (FSPs)

Deadlines

• monthly or quarterly: FSPs subject to AML/CFT Requirements must report to CIMA on remediation progress at a frequency (monthly or quarterly) set by the Authority based on the nature and gravity of the deficiency.