MONEYVAL is coming. The Island's regulated firms must be ready to show their workings.

On 28 September 2026, a MONEYVAL assessment team begins around two weeks of on-site interviews in the Isle of Man — with government agencies, regulators, and a selection of the Island's regulated firms. The visit is the most visible stage of a process that runs around eighteen months in total, from the jurisdiction's technical and effectiveness submissions to the adoption of a final report. For the firms in the interview room, and for the several hundred that will never enter it, the evaluation poses the same question: not whether a compliance programme exists, but whether there is evidence that it operated.

MONEYVAL — the Committee of Experts on the Evaluation of Anti-Money Laundering Measures and the Financing of Terrorism — is the Council of Europe's permanent monitoring body for money-laundering and terrorist-financing controls. It assesses jurisdictions against the FATF's international standards through mutual evaluation: a peer review in which assessors examine both the technical framework — laws, regulations, guidance — and, more consequentially, how effectively that framework works in practice.

The Isle of Man's last full evaluation, under MONEYVAL's fifth round, was adopted in December 2016. The Island was placed in enhanced follow-up and spent the following years working through the report's findings, with progress reports published up to 2022 — by which point it was rated compliant or largely compliant with 39 of the FATF's 40 Recommendations, a strong technical framework on paper. The sixth round, which now begins, is a different exercise again: its methodology places still greater weight on demonstrated effectiveness — outcomes evidenced with data — over technical compliance.

It is worth being precise about what the evaluation is and is not. MONEYVAL assesses the jurisdiction, not individual firms. The assessment team will not examine every firm's files; it will meet a sample of private-sector representatives and test the Island's framework, including how its supervisors evidence their own risk-based oversight. But that distinction offers less comfort than it appears to. The picture assessors form of the private sector is built from what firms have already produced: statistical returns, inspection findings, the records supervisors have gathered over years. Every regulated business feeds the evidence base, whether or not it meets an assessor.

That evidence base is broad. A blank search of the Financial Services Authority's register returns more than 780 regulated licences — held across banks, insurers, fiduciaries, fund businesses and designated non-financial businesses, with many firms holding several, each licence a discrete permission carrying its own obligations — alongside 54 online-gambling licence holders on the Gambling Supervision Commission's register. The Authority has encouraged all of them to prepare, publishing briefing packs and readiness material through 2026. Firms cannot volunteer for interview: the assessment team selects whom it wishes to see, and those chosen are required to attend. But whether or not a firm is selected, the practical obligation is the same — to be able to show its workings.

This is the shift the sixth round represents, and it is larger than it sounds. Under earlier methodologies, a firm with a current business risk assessment, a policy suite, and a training log could reasonably consider itself prepared. The standard now being applied asks a harder question: can you demonstrate, from records, that the programme operated? That customer risk assessments were reviewed when triggers occurred, not merely scheduled; that monitoring alerts were resolved with reasons recorded; that exceptions were tracked to closure; that decisions can be traced to the rule — and the version of the rule — in force at the time.

The distinction is between assertion and evidence. “We have a policy” is an assertion. A record showing the policy was applied to specific cases, on specific dates, by identified people, with the reasoning preserved — that is evidence, and it is the currency this evaluation trades in. Most firms hold far more of the first than the second. Not through negligence, but because their systems were built to run the programme, not to prove it ran.

The outcome matters beyond the autumn. Mutual evaluation results shape how correspondent banks, counterparties, and other jurisdictions price the risk of doing business with the Island. A strong report is a market-access asset; a weak one carries costs that arrive slowly and are difficult to reverse. The Island's public and private sectors share an interest in the result, which is why preparation has been a jurisdiction-wide effort.

For an individual firm, the practical test is quickly stated: pick a control — any control — and try to assemble the evidence that it operated over the past twelve months. If the exercise takes an afternoon, the firm is in good shape. If it takes weeks of reconstruction from inboxes and spreadsheets, that gap is the finding, whoever eventually looks.

This is the problem Quywater Partners® works on. QUYLEX, an operating system for rules, is built on the premise that evidence should be a by-product of operating a rule set, not a project undertaken after the fact — the record of what a rule required, when it changed, and how it was applied should exist because the rules ran, not because someone went looking. The evaluation beginning in September will not examine most firms directly. It will set the standard against which every firm's workings are eventually read. Worth being ready for.