Updated AML & Sanctions Rules FAQs Now Available (2026-09-24)

Summary

CIMA has issued a notice announcing updates to its AML & Sanctions Rules FAQs, following queries from industry after the new AML & Sanctions Rules came into effect on 18 September 2026. The updated FAQs are guidance only, intended to clarify how the Authority expects entities to apply existing obligations rather than to impose new rules.

• Audit timing: Firms are not required to conduct a new AML audit merely because the Rules came into force; audit timing should remain risk-based and follow the entity's established audit programme.
• Audit expectations: Clarifies scope, independence, frequency and reporting expectations for AML audits, with examples showing audit cycles can vary by risk profile.
• Outsourcing and accountability: Even where AML functions are outsourced, the regulated entity remains responsible and cannot delegate accountability for compliance.
• Audit findings: Deficiencies identified during an AML audit do not automatically invalidate the audit; findings and remediation are treated as part of a healthy compliance process.

The full updated FAQs are available on CIMA's website alongside the new AML & Sanctions Rules themselves.

Key obligations

• Regulated entities remain accountable for AML compliance even where AML functions or the audit itself are outsourced to service providers
• AML audit timing and frequency should continue to align with the entity's risk profile and existing audit programme rather than being triggered automatically by the Rules coming into force

Applies to

entities regulated by CIMA subject to AML/CFT Rules, industry participants conducting relevant financial business

Deadlines

• 18 September 2026: Date the new AML & Sanctions Rules came into effect, prompting the FAQ updates