Regulatory Procedure - Appointing Controllers and Advisors and Auditors for AML Audits and Assessing Costs (2018)

Summary

This is a CIMA internal procedure (February 2018) explaining how the Authority appoints Controllers, Advisors, and Auditors (for anti-money laundering audits) as either enforcement or supervisory/regulatory actions, and how it assesses and approves the costs and fees of those appointees. It is primarily a guide to CIMA's own process, but it also creates approval and reporting obligations for the regulated entities and appointed persons involved.

• Selection and conflicts: Before appointing a Controller or Advisor, CIMA gathers information on the licensee/registrant and screens candidates for actual or potential conflicts of interest.
• Enforcement appointments: Where CIMA requires a regulated entity to appoint an Advisor or Auditor for an AML Audit as an enforcement action, the entity must obtain CIMA's approval before finalising the appointment, and CIMA must approve the scope of the role and any remedial timelines.
• Supervisory appointments: The same pre-approval requirement applies where an AML Audit appointment is made as a supervisory or regulatory action.
• Reporting lines: Controllers, Advisors and Auditors must route interim, final and follow-up reports to CIMA's Compliance Division, the relevant Supervisory Division, and the Legal Division, in some cases simultaneously with delivery to the regulated entity.
• Implementation control: Licensees or registrants may not act on an Advisor's or Auditor's report or recommendations until CIMA has had the opportunity to review, approve, and set or adjust timelines for implementation, including any restructuring proposals.
• Cost assessment: Appointed persons must submit itemised bills of costs (fees and disbursements, time recorded to the nearest 1/10th hour, staff identified, hourly rates stated) with a signed declaration of accuracy, which CIMA reviews and approves; disputed costs may go to an agreed independent expert.

The procedure also sets default rules such as travel time being billed at half rate, a fixed CI$/US$ exchange ratio of 0.82 for bills submitted in a different currency, and the statutory requirement that a Controller furnish a report within 90 days of appointment unless CIMA sets a different timeframe.

Key obligations

• A Controller must provide a report within 90 days of the date of appointment, or within such other time as the Authority may require.
• A regulated entity required to appoint an Advisor or Auditor for an AML Audit must obtain the Authority's approval before finalising that appointment.
• A regulated entity must seek the Authority's prior approval before undertaking any remedial action that would materially change its governance structure or operations.
• Advisors appointed by a regulated entity, and auditors conducting AML Audits, must send their reports to the Compliance Division, Supervisory Division and Legal Division at the same time the report is issued to the regulated entity.
• Licensees or registrants must not take steps to implement an Advisor's or Auditor's report until the Authority has reviewed and approved it and provided feedback.
• Appointed Controllers, Advisors or Auditors must submit bills of costs itemising fees and disbursements, with time recorded to a minimum of 1/10th of an hour, and containing a signed declaration that the bill is accurate, complete, and does not exceed incurred costs.

Applies to

licensees, registered persons/registrants, regulated entities, Controllers, Advisors, Auditors conducting AML Audits

Deadlines

• within 90 days of the date of appointment: Statutory deadline for a Controller to provide a report to the Authority, unless a different time is required by the Authority.
• 1/10th of an hour: Minimum increment at which appointed persons must record time in bills of costs.