Key Highlights

• Your STRIX statistical return is a structured, regulator-designed dataset — not just an annual filing.
• It pulls together your inherent risk, your controls and your outcomes in one place.
• The Isle of Man FSA uses the same data to spot sector-wide trends and firm-level outliers — so your BRA should reconcile back to it.
• Extract and retain the data and the return becomes ongoing management information, not a yearly panic.

Each year, regulated firms invest significant time completing the AML/CFT Annual Statistical Return through STRIX. Once it is submitted, the temptation is to move on and treat it as "job done".

But the Isle of Man Financial Services Authority has been clear — both through its statistical return guidance and its supervisory reviews — that the data collected through STRIX is not intended to sit in isolation. It is a central input into how the Authority assesses risk across the sector, and it should play the same role within firms themselves.

In short, your statistical return is not just a regulatory requirement. It is a structured, regulator-designed dataset that should feed directly into your Business Risk Assessment (BRA) and broader AML/CFT governance.

What the FSA is really using the data for

The STRIX return collects information across three broad areas:

• Inherent risk — your customer base, geographies, products and services, distribution channels and concentrations;
• Controls — how you manage those risks in practice, including screening, monitoring, resourcing and governance; and
• Outcomes — disclosures, sanctions hits, declined relationships and other indicators of exposure.

The FSA uses this information to build a picture of:

• sector-wide trends,
• firm-level outliers,
• changes in risk exposure over time, and
• whether controls appear proportionate to the scale and nature of the business.

This same framing should exist internally. A statistical return that is prepared carefully but never analysed again is a missed opportunity.

The link between STRIX, CRAs and your BRA

One of the most consistent supervisory themes in the Isle of Man has been the expectation that BRAs demonstrate a real understanding of the firm's own business, supported by evidence.

Customer Risk Assessments (CRAs) produce individual risk outcomes. STRIX requires you to aggregate those outcomes — for example:

• numbers of higher-risk customers,
• exposure to PEPs and commercially exposed persons,
• jurisdictional breakdowns of customers and beneficial owners,
• concentration of income, and
• reliance on introducers or concessions.

That aggregation exercise is exactly what many firms struggle to articulate in their BRA. Used properly, your STRIX data solves that problem: it provides an objective, consistent snapshot of your customer and risk profile at year-end, using categories and definitions that align with regulatory expectations.

Strengthening your BRA using statistical return data

A strong BRA does more than describe policies and processes. It explains what your data shows and why your controls are appropriate.

In practice, that means:

• explaining how your customer risk distribution compares with your stated risk appetite;
• demonstrating how exposure to higher-risk jurisdictions, PEPs or CEPs is identified and mitigated;
• showing how changes in client mix or activity over the year have been assessed; and
• evidencing that board and senior management oversight is informed by real trends, not assumptions.

The STRIX return already captures this information in a structured format. Folding it into the BRA narrative improves consistency and reduces the risk of producing a generic or disconnected assessment. If your BRA still reads as too generic, our companion piece on why your statistical return is the evidence behind your BRA walks through how to fix that.

A living dataset, not an annual panic

The FSA guidance makes clear that the statistical return reflects the position as at 31 December, but many of the questions are inherently trend-based — risk ratings, volumes, new relationships, disclosures and changes over time.

Firms that extract and retain their STRIX data (for example, via the Excel export facility) are better placed to:

• monitor movements during the year,
• identify early changes in risk profile,
• support interim BRA updates where required, and
• evidence ongoing oversight if challenged by supervisors.

This is particularly relevant given the Authority's increasing focus on how firms use information, not just whether they can produce it.

Final thought

The AML/CFT Annual Statistical Return is designed to answer a simple question: what does risk look like inside your business, in practice?

If your BRA cannot be reconciled back to the data you submit through STRIX, that disconnect is likely to be visible — sooner or later — to your supervisor.

Used properly, the return is not just a compliance obligation. It is one of the clearest, regulator-aligned evidence bases you have for demonstrating that your AML/CFT framework is informed, proportionate and properly understood.

Frequently Asked Questions

Where does the AML/CFT statistical return fit into my BRA?

The return is an aggregated, year-end snapshot of your customer and risk profile — inherent risk, controls and outcomes. That is exactly the evidence a BRA needs, so the data should feed directly into your BRA narrative and remain reconcilable back to what you submit through STRIX.

We already complete STRIX carefully — why analyse it again?

Because the FSA's focus is increasingly on how firms use information, not just whether they can produce it. A return that is filed and never revisited is a missed opportunity; the same data, analysed internally, evidences that your controls are proportionate to your real client base.

How often should the return inform our BRA?

Treat it as a living dataset. The position is reported as at 31 December, but risk ratings, volumes and disclosures move through the year. Extracting and retaining the data lets you monitor movements, support interim BRA updates and evidence ongoing oversight between annual refreshes.