For Isle of Man firms

Compliance software for Isle of Man licenceholders, built on the Authority’s own rules.

Book a demo

Amoreg · for Isle of Man firms3 capabilities

The Authority watched for youIts news and consultations pages read by the Monitor, each publication logged once with its stage and dates.
Policies read against the CodeInspector checks your library against the Isle of Man rules you switch on and raises findings with drafted fixes.
The record kept as you goEvery finding and approval carries a named person and a date, ready for the Authority.

Today

The Rule Book, the AML/CFT Code and the Handbook change, and most compliance tools are written for the UK or the EU.
When the Authority visits, the answer to “what did you do about it” is spread across inboxes and folders.

With Amoreg

The Authority watched for you. Its news and consultations pages read by the Monitor, each publication logged once with its stage and dates.
Policies read against the Code. Inspector checks your library against the Isle of Man rules you switch on and raises findings with drafted fixes.
The record kept as you go. Every finding and approval carries a named person and a date, ready for the Authority.

Follow one through. A GFSC letter, from posted to decided.

Switch on the regimes you are held to. Amoreg watches their sources and keeps every publication until someone decides.

Regulatory monitoring · one caseStep 5 of 5

Three ways to do it. One that keeps the file.

Compare Amoreg

Without AmoregDrives, inboxes and spreadsheetsCopilotAnd other general AI assistantsAmoregBuilt for regulated firms

Watching regulatorsChecking each regulator’s news page by handAnswers when asked; does not watch regulatorsWatched regulator pages read on every run

Library reviewA periodic read-through of every policy by handReviews a policy only when askedEvery document swept weekly, each point citing its rule

Tracking gapsImpact notes scattered across email and spreadsheetsA reply to copy into your documentsOne queue of open, resolved and dismissed findings

VersionsPolicies on shared drives, versions named by dateNo register of document versionsOne library with a version history and real titles

General descriptions of each approach. Some assistants add connectors, citations and enterprise controls; we are happy to compare Amoreg with the tools you use today.

For Isle of Man firms: what it is and what regulators expect.

Who regulates financial services in the Isle of Man

The Isle of Man is a self-governing Crown Dependency. It makes its own financial services law through Tynwald, and it is not part of the United Kingdom or the European Union. The UK’s Financial Conduct Authority has no remit on the island, so a compliance tool built around FCA or EU rules does not describe what applies to an Isle of Man firm.

One regulator covers almost the whole sector. The Isle of Man Financial Services Authority was formed on 1 November 2015, when the Financial Supervision Commission and the Insurance and Pensions Authority merged. It licenses banks, investment businesses, trust and corporate service providers and fund services under the Financial Services Act 2008, authorises insurers under the Insurance Act 2008, and registers pension schemes under the Retirement Benefits Schemes Act 2000. Gambling answers to the Gambling Supervision Commission instead.

Which rules a licenceholder follows

Three sets of rules do most of the work. The first is the Financial Services Rule Book 2016, which licenceholders follow on governance, conduct, client assets and reporting to the Authority. Insurers and pension schemes also follow the rules of their own sector.

The second is the Anti-Money Laundering and Countering the Financing of Terrorism Code 2019, in operation since 1 June 2019. It covers risk assessment, customer due diligence, ongoing monitoring, record keeping, staff training and reporting, and it is read with the Authority’s AML/CFT Handbook. The Code also binds designated businesses, such as accountants, estate agents and law firms, which the Authority registers and oversees for AML/CFT under the Designated Businesses (Registration and Oversight) Act 2015.

The third is data protection, which the Information Commissioner oversees under the Data Protection Act 2018 and the GDPR and LED Implementing Regulations 2018. Suspicious activity reports go to the Financial Intelligence Unit through its Themis online system, not to the Authority.

What changes, and what is coming

A consultation from the Authority is the earliest sign of a change to the Rule Book, the Handbook or a sector’s guidance, and the stage at which a firm can respond. A firm that reads those pages only when someone mentions them finds out late.

MONEYVAL, the Council of Europe’s evaluation body, opened its sixth-round mutual evaluation of the Isle of Man in January 2026, with the on-site visit scheduled for autumn 2026 and the report due before the MONEYVAL plenary in 2027. The previous evaluation was in 2016. Firms are likely to be asked how their controls work in practice, so evidence matters more than policy wording. Our article on the 2026 national risk assessment sets out what it means for boards.

What compliance software has to do for an Isle of Man licenceholder

In practice the software has five jobs. Watch the Authority and the other bodies the firm answers to, and record what they publish. Hold the Isle of Man rules as the standard, with the UK and the EU only where the firm also operates there. Check the firm’s own policies against the Code, the Handbook and the Rule Book. Run reviews and tests on a schedule, with a named person at each gate. Keep the record, so that the answer to “what did you do about it” is on file.

The record is the part a supervisor asks for. A general AI assistant can explain a rule, but it does not watch the Authority, remember what was decided last quarter or show who approved a change. A policy library that nobody reads against the rules gives the same result: the document exists, and no one can show it is current.

Is there a free Isle of Man business risk assessment template?

Yes, and it needs no sign-up. Paragraph 5 of the AML/CFT Code 2019 requires a relevant person to carry out an assessment that estimates the risk of money laundering and terrorist financing posed by its business and customers. That is the business risk assessment. The Code has separate paragraphs for the customer risk assessment and the technology risk assessment. This template is for the first.

The Code says the assessment must be undertaken as soon as reasonably practicable after the firm commences business, recorded so that its basis can be demonstrated, and regularly reviewed, with the details of each review recorded, and amended where appropriate to keep it up to date. It sets no fixed interval. The Authority’s AML/CFT Handbook (August 2026) covers the assessment in section 2.2.8 and describes it as a living document. It also says a firm may not be able to rely on a group-wide assessment alone.

The Code lists the risk factors the assessment must have regard to: the nature, scale and complexity of the firm’s activities; relevant findings of the Island’s most recent National Risk Assessment; the products and services provided; how they are provided, including whether the firm meets its customers; the involvement of third parties in customer due diligence, including reliance on them; the firm’s customer risk assessments; and any technology risk assessment. The table below starts with those factors and adds others a firm usually needs. Read the Code and the Handbook on the Authority’s site before relying on this summary.

Copy the table into a spreadsheet. Work down the rows, answer them for your own firm, and add or remove rows to fit your licence. The example rows show the level of detail to aim for. They are prompts, not findings, and a real assessment names your actual products, your actual customers and the countries you deal with.

Then add what the table does not hold: the date of the assessment, the date of the next review, the person who prepared it and the person or body that approved it. Refresh it when the business changes, when the national risk picture changes, and when the Authority changes its guidance. Keep the old versions, so you can show what you knew and when.

Business risk assessment template for an Isle of Man firm, with example rows
Risk factor	Question to answer	Example for a trust company	Inherent risk	Controls in place	Residual risk
Nature, scale and complexity	How large and how complex is the business, and what does it actually do?	A licensed fiduciary administering structures for clients in several countries	Medium	Risk appetite set by the board; compliance resource matched to the book	Low
National Risk Assessment	Which findings of the Island’s most recent National Risk Assessment bear on your business?	The findings the assessment gives for your sector and your services	High	Findings mapped to the firm’s own risk factors at each review	Medium
Customer types	Who are your customers, and which types carry more risk?	Trusts and companies with layered ownership; politically exposed persons	High	Enhanced due diligence; senior sign-off on onboarding	Medium
Customer geography	Where do customers and their owners live, and where does their money come from?	Clients with owners in countries the firm rates as higher risk	Medium	Country risk list reviewed every year; source of funds checks	Low
Products and services	Which of your services could be used to hide the origin of funds?	Holding companies; acting as a nominee; handling client money	High	Written rules on nominee roles; client money reconciled monthly	Medium
Delivery channels	How do you meet and verify customers?	Non-face-to-face onboarding through an introducer	Medium	Introducer terms; identity documents checked against the original	Low
Transactions and activity	What activity would look unusual for your customers?	Large or round-sum payments with no clear purpose	Medium	Transaction monitoring rules; escalation to the MLRO	Low
Sanctions and financing of terrorism	How could a customer or payment involve a sanctioned person or a terrorist financing risk?	Payments to or from parties on a sanctions list	High	Screening at onboarding and on every list update	Low
Reliance on others	Which duties do third parties perform for you?	Verification carried out by an introducer or a group company	Medium	Written agreement; sample checks of their files	Low
People and training	Do staff know the risks and what to report?	New staff without AML training	Medium	Training on joining and each year; test results on file	Low
Technology	Which systems do you depend on, and what does your technology risk assessment say about them?	Remote onboarding tools and screening software	Medium	Technology risk assessment reviewed alongside this one	Low

How Amoreg runs it

The Monitor reads the Authority’s news and consultations pages directly. Each publication is recorded once with its source address, stage and date, then assessed against the policies it touches. Whether a publication applies to your firm is a person’s decision, recorded with their name.

The library carries the Isle of Man AML/CFT Code and the Financial Services Rule Book as regimes, each with its headline controls. Inspector reads your policy library every week against the regimes you switch on. It stays quiet about documents that are fine and raises a finding, with a drafted fix, where one falls short. A person approves or dismisses each finding, and the file keeps who decided and when.

Amoreg supports the compliance function; it does not replace the money laundering reporting officer or the compliance officer, and it does not decide for them. Trust and corporate service providers should also read the page for those firms, which covers Jersey and Guernsey alongside the Isle of Man.

Amoreg Limited is a Guernsey company, so it is registered in a Crown Dependency itself, and its library holds the Isle of Man’s rules beside those of Guernsey and Jersey. The page on compliance software for the Channel Islands, linked below, covers those two islands.

Sources

Questions Isle of Man firms ask.

Who regulates financial services in the Isle of Man?

The Isle of Man Financial Services Authority. It licenses and supervises banks, investment businesses, trust and corporate service providers, fund services, insurers and pension schemes, and oversees designated businesses such as accountants and law firms for AML/CFT. Gambling is regulated separately by the Gambling Supervision Commission.

What is Isle of Man compliance software?

Software that helps an Isle of Man licenceholder meet its own regulatory duties: watching the Authority, checking policies against the Rule Book and the AML/CFT Code, running reviews and approvals, and keeping the record. It is distinct from client screening tools.

Which AML rules apply to Isle of Man firms?

The Anti-Money Laundering and Countering the Financing of Terrorism Code 2019, which has applied since 1 June 2019, read with the Authority’s AML/CFT Handbook. Read both on the Authority’s own site for the exact wording.

Is there a free Isle of Man business risk assessment template?

Yes. This page carries one you can copy without signing up: risk factor, the question to answer, an example, inherent risk, controls and residual risk. Fill it in for your own firm. Paragraph 5 of the AML/CFT Code 2019 requires the assessment to be recorded and regularly reviewed, and the Authority’s Handbook covers it in section 2.2.8.

Does the FCA regulate Isle of Man firms?

No. The Isle of Man is a Crown Dependency outside the United Kingdom. A firm that does business in both places must meet each regulator’s rules.

Where are suspicious activity reports made?

To the Isle of Man Financial Intelligence Unit, through its Themis online reporting system.

Does Amoreg replace the compliance officer or MLRO?

No. Amoreg watches the Authority, reads your policies against the rules and keeps the record, but a named person decides every finding and approval.