Isle of Man AML/CFT Handbook December 2025 Update: What Changed

The Isle of Man is a major offshore finance centre, and its regulator, the Financial Services Authority (IOMFSA), keeps its anti-money laundering and countering the financing of terrorism (AML/CFT) Handbook up to date. This guide summarises the December 2025 update and related changes, using a summary from the compliance firm Comsure and press coverage of earlier updates. The IOMFSA website blocked direct access when we checked, so treat this as a secondary summary and read the Handbook and the AML/CFT Code 2019 before you rely on any detail.

The December 2025 update

According to Comsure, the IOMFSA published the updated Handbook on 3 December 2025. It provides guidance on complying with the Anti-Money Laundering and Countering the Financing of Terrorism Code 2019 (the Code). The summary does not give an effective date or transition period, so check with the IOMFSA. A clean version and a tracked-changes version were published.

What changed

• Commercially exposed persons. Guidance on commercially exposed persons (CEPs), previously a standalone document from June 2025, is now part of the Handbook. Comsure describes CEPs as similar to politically exposed persons but focused on the risk of commercial influence.
• Risk assessments. A business risk assessment and a technology risk assessment can be recorded in one document if they meet the Code's requirements. The update also emphasises documenting methodology and review cycles.
• Introducers. Obligations when relying on introducers were clarified, in line with the Code's provisions on introduced business.
• National risk assessment. Dates and references throughout the Handbook now reflect the latest national risk assessment findings.
• Links. Hyperlinks, including to the Customs and Immigration Division, were refreshed.

Sector-specific guidance

Comsure says sector-specific guidance was published alongside the Handbook, with examples including accountants, estate agents and virtual asset service providers, and advises firms to check the guidance for their own business. Earlier press coverage, from International Adviser in February 2025, reported revised sector-specific guidance for accountancy and tax advisers, moneylenders, and firms providing safe custody or administering or managing money for another person. That coverage also reported ongoing monitoring updates for source of funds and source of wealth, and said a full review of sector guidance would follow the publication of the national risk assessment.

Compliance points flagged by the summary

1. Keep a documented business risk assessment and technology risk assessment, review them regularly and align them with the national risk assessment. They should cover money laundering, terrorist financing and proliferation financing risks. See our guide to the firm-wide AML risk assessment.
2. Apply enhanced measures for CEPs and PEPs, and verify beneficial ownership and control under Part 4 of the Code. Our guide to politically exposed persons explains the PEP side.
3. Check introducers. Confirm they meet the Code's eligibility criteria, such as regulated status and written agreements. For the general risks of relying on someone else's checks, see our guide to reliance on third parties.
4. Document risk assessments, decisions and reviews.
5. Understand the consequences. Non-compliance with the Code can lead to civil penalties in addition to criminal sanctions, according to the summary.

Supervisory programme

The IOMFSA also published a year-one update in August 2026 on its 2025 to 2027 AML, CFT and counter-proliferation financing supervisory programme, according to a KYC360 roundup. It reviews the work done in 2025/26 and sets priorities for 2026/27. The coverage we reviewed does not state specific expectations or deadlines, so read the IOMFSA report if you are supervised there.

Why the commercially exposed person concept matters

Many firms are used to screening for politically exposed persons, but commercial influence can create a similar risk of bribery or misuse of funds even where no public office is held. Adding CEP guidance to the Handbook is a reminder to ask not only who a person is politically, but what influence they have commercially. The detail of how the Handbook defines and treats CEPs is in the primary document.

A practical review plan

The steps below are our suggestions for a small firm, not requirements taken from the Handbook.

1. Download the current documents. Save the Handbook, the Code and the sector guidance for your business, and note the date you downloaded them.
2. Compare your risk assessments. Check that your business risk assessment states its methodology and review date, and decide whether recording the technology risk assessment in the same document would suit you.
3. Add a commercial influence question. At onboarding and review, ask whether the customer or a connected person has significant commercial influence that could raise bribery or misuse-of-funds risk.
4. Audit your introducers. List every introducer you rely on, confirm their regulated status and keep the written agreement on file.
5. Brief the team. Hold a short session on what changed, and record who attended.

Questions to ask at your next review

Can you show when each risk assessment was last reviewed and who approved it? Can you explain why each introducer is acceptable? Do your files show how you considered commercial influence for higher-risk customers? If the answer to any of these is no, that is where to start.

Frequently asked questions

When was the updated Handbook published?

3 December 2025, according to Comsure.

What is a commercially exposed person?

Comsure describes it as similar to a politically exposed person but focused on commercial influence risk. Check the Handbook for the formal definition.

Does the update apply to accountants?

Sector-specific guidance exists for accountants and tax advisers. Check the current guidance for your category.

Next steps

Download the current Handbook and sector guidance, and update your risk assessments and introducer procedures accordingly. This article is general information, not legal advice. For wider training, explore Learnsignal's CPD courses.