Refreshing Client Due Diligence: Why It Matters for TCSPs

For TCSPs and other licenceholders operating in or from the Isle of Man, refreshing client due diligence (CDD) is mandatory. It isn’t housekeeping; it’s a statutory expectation under the AML/CFT framework and a cornerstone of sound fiduciary practice.

1) The legal foundation: what the Isle of Man regime requires

First, the Anti-Money Laundering and Countering the Financing of Terrorism Code 2019 (the “Code”) requires ongoing, effective monitoring of business relationships and occasional transactions. In practice, confirm that CDD/ECDD stays current, accurate, and appropriate against the customer’s risk profile and source of funds, and that sanctions monitoring is active. Additionally, the AML/CFT Handbook explains how ongoing monitoring should work day-to-day.

2) What “refreshing CDD” means (and doesn’t)

Refreshing CDD means reassessing—and, where needed, updating—the documents, data, and understanding you hold about the client and relevant parties so they reflect current reality and risk. Crucially, this review must keep CDD up to date, accurate, appropriate, and demonstrably risk-based. It goes beyond paperwork to include adverse media and sanctions screening, plus scrutiny of activity against the expected profile. However, the Handbook also notes that refreshing CDD does not automatically require replacing expired identity documents; use a risk-based approach and document your rationale.

3) When to refresh: periodicity and trigger events

Next, set the extent and frequency of monitoring (and thus CDD refresh) using materiality and your BRA/CRA/TRA, with heightened attention for higher-risk customers. In addition, trigger an out-of-cycle refresh when you see:

Unusual or inconsistent activity, a change in transaction patterns, or potential suspicion—often requiring ECDD.
Changes in beneficial ownership/control, controllers, authorised signatories, or trustees/protectors; or the addition of beneficiaries.
A change in PEP status (domestic or foreign), which demands enhanced monitoring and reasonable measures to establish source of wealth.
New hits or changes on sanctions or adverse media screening.
Material geographic or product/service changes that alter the risk profile.

4) Who you must keep current (TCSP specifics)

For legal persons and arrangements, identify beneficial owners and persons with ultimate effective control, and understand the ownership/control structure. For express trusts, identify trustees/controlling parties, (classes of) beneficiaries, any protector/enforcer, and the settlor. Furthermore, before payments or loans to beneficiaries/beneficial owners, verify identities and record the purpose. The TCSP sector guidance also highlights risks around complex structures, pooled client accounts, and role conflicts, and points back to Code paragraph 13 on ongoing monitoring.

5) Consequences of getting it wrong

Breaching the Code is a criminal offence and can lead to custody and fines. Alternatively, the Authority can impose civil penalties up to 5% of the relevant person’s income—or 8% where aggravating factors apply. Notably, enforcement themes frequently cite weak ongoing monitoring and stale CDD.

6) Practical checklist for TCSP CDD refreshes (Isle of Man aligned)

Re-screen customers, beneficial owners, beneficiaries, controllers, and authorised persons for sanctions; run adverse media checks; record results.
Re-validate the purpose and nature of the relationship; map activity to the expected profile and sources of funds; investigate deviations.
Update ownership/control diagrams; confirm trust beneficiary classes; capture any trustee/protector/enforcer/settlor changes.
Assess whether ECDD is warranted (e.g., PEPs, higher-risk jurisdictions, unusual activity). For PEPs, apply enhanced monitoring and SoW measures.
Address legacy gaps (SoF/SoW) with reasonable, risk-based efforts, prioritising higher-risk cases; note outcomes and constraints.
Record the review date, scope, findings, decisions, and the next scheduled review; ensure quick retrievability.
Escalate promptly if requirements cannot be met; consider ceasing activity, termination, and internal disclosure per Code triggers.

7) Why it matters—beyond compliance

Finally, refreshed and accurate CDD:

Protects the integrity of structures under administration.
Reduces exposure to sanctions and reputational risk.
Demonstrates effective governance to the Authority.
Supports Beneficial Ownership regime accuracy and nominated officer duties, where applicable.

Bottom line for TCSPs: Build a structured, risk-based refresh programme. Integrate sanctions and adverse media screening, focus on SoF/SoW where it matters, capture ownership/control changes quickly, and maintain a clear audit trail. As a result, you meet the letter and spirit of the Isle of Man Code and materially reduce the risk that your structures or services are misused.

Company News