CIMA’s AML/CFT/CPF Compliance Rule does not fix a single audit interval for every entity: each FSP is required to test its compliance programme “at a frequency commensurate with its size, complexity, structure, nature of business, and the risk profile,” as set out in its own risk assessment. Whatever cycle a fund adopts, the audit “must not be undertaken internally for more than two (2) consecutive audit cycles,” so the following cycle’s audit must be carried out by an external, independent provider.
Frequency is set by risk, not a fixed calendar
A large, complex fund with multiple share classes, delegated functions and higher-risk investors will typically need a more-frequent audit cycle than a small, single-strategy fund with a stable, low-risk investor base. The Rule leaves that judgement to the FSP’s own documented risk assessment, rather than mandating one interval across the industry. That said, CIMA may itself require a different frequency if it considers one necessary.
The two-internal, one-external pattern
Whatever cycle length a fund sets, the Rule caps how long it can rely on internal testing: an audit may be conducted internally, but not for more than two consecutive cycles, after which the next audit must be conducted by an external service provider. In practice, that means most funds will need an external, independent audit within any three-cycle stretch. But a fund with a shorter cycle reaches that point sooner in calendar terms than one with a longer cycle.
Filing the report with CIMA
Once an audit, whether internal or external, is completed, you must file the report with CIMA “as soon as practically possible after the completion of the audit, or as otherwise prescribed by the Authority.” This filing obligation did not exist under the earlier Guidance Notes, and it applies regardless of whether the cycle in question was tested internally or externally.
Setting the cycle from 18 September 2026
For funds establishing a cycle for the first time, the practical starting point is documenting when the compliance programme was last tested in any form, and using that date, together with the fund’s risk assessment, to set a forward cycle from 18 September 2026. Waiting until an audit is overdue to make that decision leaves less time to select and engage a genuinely independent, suitably qualified reviewer.
Getting the cycle length and the internal-versus-external sequencing right, and documenting the reasoning behind both in the fund’s risk assessment, is what a fund needs to show CIMA if its audit approach is ever questioned.
Related questions: Who can perform an independent AML audit under CIMA’s Compliance Programme Rule, and why can’t a fund’s own AML officer do it? | What does an independent AML auditor ask for first, and how should a fund prepare for it?
wb.group helps funds set a defensible, risk-based AML audit cycle and prepare for their independent audit. Contact us for more information.
FAQs
CIMA’s AML/CFT/CPF Compliance Rule does not fix a single audit interval for every entity: each FSP is required to test its compliance programme “at a frequency commensurate with its size, complexity, structure, nature of business, and the risk profile,” as set out in its own risk assessment. Whatever cycle a fund adopts, the audit “must not be undertaken internally for more than two (2) consecutive audit cycles,” so the following cycle’s audit must be carried out by an external, independent provider.
No. CIMA’s Compliance Programme Rule ties audit frequency to each FSP’s documented risk-based cycle rather than a fixed annual requirement, though a higher-risk fund may reasonably set an annual or near-annual cycle for itself.
Rule 12.3 permits internal audits for up to two consecutive cycles, but the following cycle’s audit must be carried out by an external, independent provider. A fund cannot rely on internal testing indefinitely, regardless of how its cycle length is set.
Yes. Because the two-internal, one-external pattern applies to consecutive cycles rather than to a fixed number of years, a fund with a one-year cycle reaches its external audit roughly every three years, while a fund with a longer cycle reaches it correspondingly less often in calendar terms.
Yes. The filing requirement applies to the audit report from each completed cycle, whether tested internally or externally, and the report must be filed with CIMA as soon as practically possible once it is complete.