No, and not yet. The Isle of Man Financial Services Authority cannot impose a civil penalty on an individual today. What exists is an enabling power in a Bill, not a regime in force. The revised Financial Services (Miscellaneous Provisions) Bill was introduced into the branches of Tynwald on 31 March 2026 and, in the Authority's own words, "includes a broad enabling power to implement a civil penalty regime for individuals". The Authority is equally plain about what must follow: "Secondary legislation detailing how the regime would operate in practice will be required before any new powers can be enforced. We are committed to holding a further consultation later in 2026." That secondary legislation has not been made and that consultation has not been held. The power is being built; the machinery to operate it does not exist; and a further consultation comes first.
Where the Bill has actually got to
The Authority reported this in its AML Focus newsletter for May 2026 and set it out in its Feedback Statement on the Bill, published through the Isle of Man Government consultation portal, where results and feedback were updated on 14 April 2026.
| Stage | What happened | What it means |
|---|---|---|
| Consultation and Feedback Statement | Consultation held; Feedback Statement published, results and feedback updated 14 April 2026 | Done. The responses are on the record, and they changed the Bill |
| Revised Bill introduced to Tynwald | Introduced into the branches of Tynwald on 31 March 2026 with a broad enabling power to implement a civil penalty regime for individuals | Done. An enabling power is a power to make a regime later, not a regime |
| Secondary legislation | Not made | Required, the Authority states, before any new powers can be enforced |
| Further consultation | Committed for later in 2026 | Not yet held. Scope and operation remain open to influence |
The Bill is far wider than civil penalties. It amends, among others, the Financial Services Act 2008, the Collective Investment Schemes Act 2008, the Insurance Act 2008 and the Designated Businesses (Registration and Oversight) Act 2015, each shown as amended in the Statement's appendices. The Authority describes the legislation as "intended to update the Isle of Man's regulatory and oversight frameworks, reflect updated international standards, and safeguard the Island's reputation as a well-regulated jurisdiction for financial services"; our note on the Island's MONEYVAL mutual evaluation gives that standards backdrop.
If a board is asking what the Island position is, we can give you the record as it stands.
What was consulted on, and what respondents said
The consultation was not narrow. It covered "a package of amendments to modernise and strengthen the Isle of Man's financial services legislation", spanning enforcement and civil penalties, warning notices, appeal rights, inspection and investigation powers, guidance provisions, fees, public statements, and broader alignment across regulatory Acts. Civil penalties for individuals was one item in that package, which is part of why it has been read out of context.
The published summary of what came back is candid. Respondents "broadly supported the aim of modernising the regulatory framework and aligning with international standards", but "many raised concerns about scope, proportionality, clarity and safeguards", asking for "clearer limits and stronger protections where new or enhanced powers were proposed" and "greater transparency in primary legislation". Practical impacts on businesses, individuals and the Island's competitiveness were also highlighted. The objection was not to accountability, but to a power whose limits sat somewhere other than the face of the Act.
What the Authority changed, and what it removed
The Authority says it has "proposed several changes to the Bill, including removing or deferring certain measures and narrowing the scope of others". Two lines of the published feedback matter most: "key powers, including civil penalty provisions, have been restructured to include clearer scope and safeguards in primary legislation", and "appeal rights and procedural protections have been retained or strengthened where appropriate".
Three things came out: the proposed extension of warning notice powers, removed or deferred for future consideration; proposed changes to guidance provisions; and appeal rights to the Financial Services Tribunal for some directions, removed in response to stakeholder feedback. On individuals, refined provisions "are being taken forward to address consultation feedback regarding scope, proportionality and potential impacts on the Island's competitiveness".
Chief Executive Officer Bettina Roth put it this way: "The changes to the civil penalties for individuals reflect our commitment to addressing the concerns raised by respondents while still progressing a regime that meets updated international requirements."
A consultation that removes things is a consultation that was read, which is a useful signal for the round still to come.
Where individual accountability already sits
What gets lost is that Isle of Man law has named individuals since 2019, in two places in the Anti-Money Laundering and Countering the Financing of Terrorism Code 2019.
Paragraph 23 provides for the Money Laundering Reporting Officer and permits a Deputy MLRO; our piece on the MLRO's appointment and statutory functions sets out what that role carries.
Paragraph 30(3) requires that "there is a suitable person at management level that is responsible for the functions specified in this paragraph" — the monitoring and testing of compliance. Paragraph 30(4) then sets conditions for that person: sufficiently senior or with sufficient experience and authority, a right of direct access to the officers of the relevant person, and sufficient time and resources to properly discharge the responsibilities of the position. Our post on the compliance monitoring and testing obligation covers that duty in practice.
Para 30(4) is less a duty on the individual than a set of conditions the firm must create around them. A firm that has made the appointment but withheld seniority, direct access or time has an accountability problem today, whatever the Bill eventually does.
At firm level a civil penalties regime already exists, in the AML/CFT (Civil Penalties) Regulations 2019, with the Authority's Revised Civil Penalty Provisions Q&A of 27 June 2025 alongside it — both worth reading properly rather than in summary. That framework is also being extended: the AML/CFT (Civil Penalties) (Travel Rule) (Amendment) Regulations 2026 brought the Travel Rule Code within its scope.
If you are unsure who holds your Code roles, or whether the para 30(4) conditions are met, check now.
What to do while nothing is in force
Very little that is new. There is nothing to prepare for in a regime whose scope has not been written. There is work already owed, though. Know who holds the para 23 MLRO role and who is the para 30(3) suitable person, and confirm each para 30(4) condition is genuinely satisfied for the latter rather than asserted in a policy.
Then check that the report required at least annually under para 30(2) reaches senior management, is read there, and produces a decision; a monitoring report that is filed rather than acted on is the weakest point we see in otherwise sound frameworks. Beyond that, watch for the consultation committed for later in 2026 and respond to it, because the published feedback shows responses changed the Bill.
Common mistakes we see
The first is treating the enabling power as though it were the regime, restructuring roles against a scope not yet defined. The second is the mirror image: concluding that because nothing is in force, nothing is owed, when para 30(4) sets conditions that bite today and para 23 has named an accountable individual since 2019. The third is treating consultation as a formality, when the Feedback Statement records proposals refined, narrowed or withdrawn because respondents objected. The fourth is assuming a commencement date; the Authority has given none, and we will not guess one.
Where a board wants a defensible read of its current position rather than speculation about a future one, we can do that with you.
Frequently asked questions
Can the Authority fine me personally today?
No. There is no civil penalty regime for individuals in operation. The Bill introduced into the branches of Tynwald on 31 March 2026 contains a broad enabling power to implement one, and the Authority has stated that secondary legislation is required before any new powers can be enforced. It has not been made.
When will the individual regime come into force?
No date has been given, and we will not estimate one. The Authority has committed publicly to a further consultation later in 2026, and to secondary legislation before any power can be enforced. Both sit ahead of commencement.
What conduct would attract an individual penalty?
That is precisely what has not been settled. It is the subject of the refined provisions being taken forward on scope, proportionality and competitiveness, and of the secondary legislation still to be made. Anyone telling you what will be caught is telling you something the published material does not say.
Does this change the MLRO's position?
Not at present. The MLRO's appointment and functions continue to sit under Code para 23, unchanged by a Bill that has not yet produced an operable regime.
Should we be doing anything now?
Yes, but not because of the Bill. Confirm who holds the para 23 and para 30(3) roles, that the para 30(4) conditions are met, and that the para 30(2) report reaches and moves senior management. Then respond to the further consultation when it opens.
Until the secondary legislation exists, the only individual accountability that can be measured against you is the accountability the Code has imposed since 2019 — which is where the work is.
