CIMA AML and Sanctions Rules gap analysis
A clause-by-clause review of your AML/CFT/CPF and sanctions policies, procedures and governance documents against CIMA's 2026 AML Rule and Sanctions Rule, with a prioritised remediation plan your board can approve.
Why a gap analysis now
Both Rules came into force on 18 September 2026. CIMA says many provisions strengthen existing AML Regulation obligations rather than create new ones (FAQ 4). Even so, the Rules set specific, testable expectations: management-level AML officers, annual AMLCO reporting to the board, documented training plans and records, re-screening all customers on every list update, and more. A gap analysis shows where your documents and practices fall short before an audit or inspection does.
What we review
- AML/CFT/CPF manual, sanctions policy and operating procedures
- Enterprise-wide and customer risk assessment methodology
- AML officer appointments, board minutes and AMLCO reports
- Training plan, content and records
- Outsourcing agreements and oversight arrangements
- Record-keeping and registers required by AML Rule 8.5
What you receive
- A requirement-by-requirement matrix mapping each obligation in both Rules to your documents, rated as met, partially met or not met
- A prioritised remediation plan that separates legal minimums from good practice
- A short board summary to support governing body oversight (CIMA FAQ 7)
Independence matters. If we help design, draft or rewrite your compliance programme, we cannot later audit that programme. Rule 12.2(b) requires the auditor to be separate from the design of the controls under audit, and CIMA's FAQ 41 says an auditor must not be responsible for the programme's design. A gap analysis that only identifies gaps, with your team making the changes, is a different matter. We will explain the options at the scoping stage so you can plan your next audit.
Frequently asked questions
How is a gap analysis different from an audit?
A gap analysis compares your written policies and procedures with the requirements of the Rules and recommends changes. An audit independently tests whether the programme is adequate and works in practice (AML Rule 12.1).
If you do our gap analysis, can you also audit us?
Not for the same programme. If we help design or rewrite your programme, we are no longer independent of it (AML Rule 12.2(b); CIMA FAQ 41), and another independent party must audit it.
What do we receive?
A requirement-by-requirement mapping of both Rules to your documents, with each item rated, plus a prioritised remediation plan your board can approve and track.
Find the gaps before anyone else does
Tell us what you have in place and we will propose a scope and quote for a gap analysis.