An investor file can pass identity checks and still leave a Bermuda fund unable to explain who controls the investor or where the subscription money came from. Customer due diligence needs evidence behind those conclusions, a risk assessment and a record of the decisions taken.
This guide focuses on Bermuda financial institutions supervised by the Bermuda Monetary Authority (BMA). Bermuda uses AML/ATF, meaning anti-money laundering and anti-terrorist financing, for the framework often described internationally as AML/CFT. The amended Regulations also expressly address CPF, countering proliferation financing. For help with the file work, see our Bermuda KYC services.
Establish which Bermuda AML rules apply
The legal framework includes the Proceeds of Crime Act 1997, the Anti-Terrorism (Financial and Other Measures) Act 2004, the Proceeds of Crime (Anti-Money Laundering and Anti-Terrorist Financing) Regulations 2008 and the AML/ATF Supervision and Enforcement Act 2008. Use the BMA’s legislation index to check the amended texts and effective provisions.
The consolidated Regulations include BR 70/2026, effective 22 June 2026. Those amendments expressly extend provisions on CDD, outsourcing, systems, reporting, independent audit and training to proliferation financing. A policy based only on older AML/ATF guidance needs checking against these amended duties. For example, Regulation 6(1)(c) now includes suspected proliferation financing as a trigger for CDD, and Regulation 17 includes it in internal reporting procedures.
Section 42A of the Proceeds of Crime Act defines AML/ATF regulated financial institutions. It covers activities including deposit-taking, investment business, fund administration, investment fund operation, trust and corporate services, and licensed digital asset business. Insurance requires particular care: the definition distinguishes specified long-term insurance business, reinsurance and intermediary activities. Do not assume every Bermuda insurer falls within the same AML/ATF category.
Read the legislation alongside the BMA’s General Guidance Notes and relevant sector annexes. The guidance explains the BMA’s supervisory expectations and how institutions should meet their obligations. It is not a replacement for the legislation. Recommendations for organising a remediation project below are AgentKYZ’s operating recommendations.
The BMA’s remit does not cover every business subject to Bermuda AML legislation. Identify the entity, regulated activity and supervisor before using this guide as a starting point for a checklist.
Build a CDD file that explains the relationship
Regulations 5 and 6 address customer due diligence measures and when they apply. The work includes identifying and verifying the customer, identifying the beneficial owner and taking adequate risk-based measures to verify that identity, and understanding the purpose and intended nature of the relationship. Regulation 7 addresses ongoing monitoring.
For a corporate investor, retain evidence connecting the legal entity to its owners, controllers and authorised representatives. Record the intended investment activity and the information needed to assess risk. A register extract proves some facts about an entity; it may not explain the person controlling it through another company or arrangement.
Regulation 9 addresses cases where required CDD cannot be completed, including restrictions on opening accounts or carrying out transactions, termination of existing relationships and consideration of a suspicious activity disclosure. Escalate a failed CDD case promptly under the firm’s procedures. An unresolved identity question should not disappear into a routine document-chasing queue.
Our recommendation is to distinguish a document received from a check completed. Each file should show what the evidence establishes, what remains unresolved and who has authority to decide the next action.
Trace beneficial ownership beyond a percentage
Regulation 3 defines beneficial ownership for different legal forms. For companies, it addresses ownership and voting rights as well as control over management. Trusts require attention to the settlor, relevant interests, beneficiaries or classes of beneficiaries, and the individuals with control under the applicable provisions.
A single 25% rule is insufficient. Regulation 3(11) substitutes 10% for specified thresholds when applied to corporate service provider business. Control also needs assessment even where an ownership threshold is not met. Check the relevant provision and the institution’s risk-based policy before setting a screening population.
For layered structures, connect each link to its supporting evidence and explain how the individuals were identified. Record a gap where the chain stops at an intermediary. A beneficial ownership register entry can inform the review, but it does not discharge the institution’s own CDD obligations.
Separate the fund’s duties from the administrator’s work
The BMA’s securities-sector guidance, Annex III, paragraph III.134, addresses due diligence by fund administrators and investment fund operators on the fund, underlying investors and other parties appointed to the fund. It also addresses ongoing monitoring of the fund’s transactions and arrangements.
Paragraph III.136 calls for a clear contractual division of responsibilities where an intermediary is involved, consistent with the rules on reliance and outsourcing. The entity cannot contract out of its AML/ATF obligations.
For a fund remediation project, we recommend identifying the responsible entity for each population before requesting documents. An investor review does not automatically cover due diligence on the administrator, manager or other appointed parties. Agree who obtains missing evidence, who approves exceptions and how the fund can retrieve the underlying records.
Apply enhanced checks where the risk requires them
Regulation 11 covers enhanced due diligence, including specified higher-risk situations and politically exposed persons (PEPs). Apply the relevant PEP category, risk assessment, approval and monitoring requirements rather than treating every screening hit as the same risk.
Keep source of funds and source of wealth distinct. Source of funds explains the origin of money used in a particular transaction or relationship. Source of wealth explains how the person accumulated their wealth. A transfer from a bank account may establish the payment route without explaining the underlying origin of the money.
Sanctions checks also need their own handling. Use the sanctions measures applicable in Bermuda and current official notices, including relevant ownership and control rules. A clean name-screening result alone does not establish that a transaction is permitted. Record the evidence and rationale for dismissing a possible match, and escalate unresolved matches before proceeding.
Keep monitoring active between file reviews
Regulation 7 requires scrutiny of transactions against the institution’s knowledge of the customer, business and risk profile, and keeping CDD documents, data and information up to date. A scheduled KYC refresh covers only part of that work.
Set review frequency under the firm’s risk-based policy and respond to material changes. New ownership, an unexpected payment route, a change in activity or adverse information can justify a review before the scheduled date. Track overdue cases and retain the evidence and decisions from each review.
Suspicious activity follows the reporting process. The Financial Intelligence Agency (FIA) receives suspicious activity reports (SARs) through goAML. Internal concerns should reach the reporting officer through the firm’s procedures, with attention to the applicable reporting duties and tipping-off restrictions. The BMA’s supervisory role and the FIA’s reporting role are different.
When commissioning file work, specify whether transaction monitoring, sanctions alerts and reporting support are included. Do not infer those services from the words “periodic KYC review”.
Outsource KYC with access and oversight intact
Regulation 14 governs reliance on third parties; Regulation 14A addresses outsourcing. Reliance has eligibility and information-access conditions. Receiving a completed KYC file from another provider does not by itself establish a valid reliance arrangement.
As amended in June 2026, Regulation 14A expressly includes AML/ATF/CPF systems, controls and procedures. The institution must retain ultimate responsibility and assess the money laundering, terrorist financing and proliferation financing risks associated with the outsourced function.
BMA General Guidance paragraphs 5.149–5.160 explain operational outsourcing. Work must follow the institution’s policies, procedures and controls, and the institution retains responsibility. It needs to assess the provider, document the outsourcing risks and oversee performance. Paragraph 5.154 warns against arrangements where confidentiality, secrecy, privacy or data-protection restrictions would impede access to data without delay.
Before transferring customer files, our recommendation is to agree:
- The entity, case population, approved AML policy and evidence requirements.
- The provider’s work, your retained decisions and the escalation route.
- Access to source records for the institution and relevant authorities.
- Hosting, confidentiality, data handling and retention arrangements.
- How the institution will monitor quality, handle service failure and recover records when the engagement ends.
AgentKYZ’s Bermuda managed KYC service performs agreed operational file work. It does not replace the firm’s compliance officer or reporting officer, and it does not constitute statutory reliance on a third party.
Retain records and test the wider AML programme
Regulation 15 and Chapter 11 of the BMA General Guidance address record keeping. Paragraphs 11.11–11.14 distinguish the retention periods and their starting points:
- Relationship CDD records: for the relationship and at least five years after it ends.
- Occasional-transaction CDD: at least five years after the transaction is completed.
- Transaction records: at least five years after completion.
- Records related to a SAR: at least five years after the SAR is made.
- Records subject to a notified law-enforcement investigation: until the relevant agency confirms the investigation is closed.
Apply any further retention obligations or holds before deleting records. Outsourcing should preserve retrieval of the evidence after the provider’s engagement ends.
Regulation 17A addresses an independent audit function and now expressly includes the AML/ATF/CPF framework. BMA General Guidance paragraph 1.81 specifies an AML/ATF audit at least once a year, with more frequent work where weaknesses or risk warrant it. Its scope extends to policies, procedures and controls, including sanctions; apply the amended CPF requirements too. Paragraph 1.80 addresses independence from the ongoing compliance processes being tested.
A file sample can identify remediation needs and support oversight, but it does not by itself cover that wider audit. Define the review’s purpose and independence before using its findings as assurance.
Turn missing evidence into a scoped remediation project
Start with the case count, risk profile and deadline. Prioritise files under the firm’s risk assessment, record each missing item and assign responsibility for obtaining it. Track reviewed files separately from those awaiting a customer response or an authorised decision.
Our Bermuda KYC onboarding, remediation and periodic review services return human-reviewed files with the supporting evidence and unresolved exceptions. Your authorised team retains customer acceptance, high-risk approvals and reporting decisions. Share the population and target date to agree scope and pricing before transferring documents.