Shufti and AML Certification Centre logosWebinarThe FRAML Convergence: Unifying Fraud and AML MonitoringExplore Now WebinarThe FRAML Convergence: Unifying Fraud and AML MonitoringExplore Now The FRAML Convergence — Unifying Fraud and AML MonitoringExplore Shufti and ICA 25 Years logosWebinarFinancial inclusion and AML/CFT: Managing access and risk in practiceRegister Now WebinarFinancial inclusion and AML/CFT: Managing access and risk in practiceRegister Now Financial inclusion and AML/CFT — Managing access and riskRegister Shufti and Finance Magnates logosWebinarTransaction Monitoring & KYC: Cutting False Positives Without Missing Real FraudRegister Now WebinarTransaction Monitoring & KYC: Cutting False Positives Without Missing Real FraudRegister Now Transaction Monitoring & KYC — Cutting False PositivesRegister WebinarPix Fraud 2026: Are Your Fraud Controls Ready for the Next Generation of Instant Payment Scams?Explore Now WebinarPix Fraud 2026: Are Your Fraud Controls Ready for the Next Generation of Instant Payment Scams?Explore Now Pix Fraud 2026 — Are Your Fraud Controls Ready?Explore Gavel on AMLR rule bookAMLR applies 10 July 2027. See your stack against every obligationBook a Demo AMLR applies 10 July 2027. See your stack against every obligationBook A Demo AMLR applies 10 July 2027 — see your stackBook Demo Globe with pKYC, Onboarding, Screening and Transactions labelsShufti’s Glocal PlatformGlobal Coverage. Local Depth. Full Compliance Lifecycle.Explore More Global Coverage. Local Depth. Full Compliance Lifecycle.Explore More Glocal Platform — Global Coverage. Local Depth.Explore INNOVATION DROPSUMMER
EDITION
20
26
Qualified Electronic Signature
WATCH NOW
INNOVATION DROP - Qualified Electronic SignatureWatch Now Innovation Drop — Qualified Electronic SignatureWatch
INNOVATION DROPSUMMER
EDITION
20
26
Transaction Trust Monitoring
WATCH NOW
INNOVATION DROP - Transaction Trust MonitoringWatch Now Innovation Drop — Transaction Trust MonitoringWatch
INNOVATION DROPSUMMER
EDITION
20
26
Travel Rule Compliance
WATCH NOW
INNOVATION DROP - Travel Rule ComplianceWatch Now Innovation Drop — Travel Rule ComplianceWatch
Datos Insights 2026 Impact Awards badgeDatos Insights 2026 Impact AwardsShufti Named Best KYC/KYB Innovation SolutionExplore The Win Shufti Named Best KYC/KYB Innovation SolutionExplore The Win Shufti Named Best KYC/KYB Innovation SolutionExplore Liminal 2026 KYC IndexShufti: A top vendor for product executionRead The PR Shufti: A top vendor for product executionRead The PR Liminal 2026 KYC Index — Shufti: A top vendor for product executionRead PR Gavel on AMLR rule bookAMLR Applies 10 July 2027. Don't Wait for the Deadline to Find the GapsBook Consultation AMLR Applies 10 July 2027. Don't Wait for the Deadline to Find the GapsBook Consultation AMLR Applies 10 July 2027 — Find the GapsConsult Bank card and cashBank Account Verification: Get Secure Payouts with Confirmed OwnershipSee How It Works Bank Account Verification: Get Secure Payouts with Confirmed OwnershipSee How It Works Bank Account Verification — Secure PayoutsSee How Geo Compliance Ties Verified Location to a Verified IdentityBook A Demo Geo Compliance Ties Verified Location to a Verified IdentityBook A Demo Geo Compliance — Verified Location, Verified IdentityBook Demo Journey Builder dot gridConfigure Verification Flows as Per Your Needs with Journey BuilderSee How It Works Configure Verification Flows as Per Your Needs with Journey BuilderSee How It Works Journey Builder — Configure Verification FlowsSee How Shufti MCP toggle with ChatGPT and ClaudeShufti MCP: Verification Tools, Ready to Use Inside Claude or ChatGPTExplore Agent Shufti MCP: Verification Tools, Ready to Use Inside Claude or ChatGPTExplore Agent Shufti MCP — Verification Tools Inside Claude or ChatGPTExplore
4
Book a Demo

Scale Identity Verification and KYC Operations in the Isle of Man

Verify residents and international clients through Isle of Man passport NFC, driving licences and 10,000+ foreign ID document types, run KYB on registered entities and their beneficial owners, and monitor transactions and sanctions lists. One platform runs compliance and fraud prevention across the full customer lifecycle for IOMFSA- and GSC-supervised firms.

Banner Image for the Isle of Man
Trusted by 2000+ businesses that make identity decisions at scale
cashew gemone HERO Gaming Bitget IronFX PENN National Rakuten Witzeal Noteris banxy

Operational Performance for Isle of Man KYC

Our Numbers Speak Volumes

100%

Pass
Rates

Under 5 secs

IDV
Verification

100%

Omni-format
Document Recognition

THE ISLE OF MAN VERIFICATION GAP

Isle of Man IDV/KYC Challenges

Most Customers Arrive With Documents the Island Never Issued

Most Customers Arrive With Documents the Island Never Issued

The 2021 Census found just over half of residents were born off the Island, and trust, fund and gambling firms serve clients worldwide. A KYC solution for Isle of Man firms must read foreign documents first, and Shufti's zero-shot document intelligence verifies even unseen formats.

Keeping Customer Risk Current Requires Continuous Monitoring

Keeping Customer Risk Current Requires Continuous Monitoring

Paragraph 13 of the AML/CFT Code 2019 requires firms to keep due diligence records up to date and scrutinise transactions against each customer's profile. Shufti checks transactions against profiles, refreshes sanctions and PEP data every 15 minutes and flags registry, director and ownership changes.

Licence Holders, Gambling Operators and VASPs Follow Different Codes

Licence Holders, Gambling Operators and VASPs Follow Different Codes

Licence holders follow the AML/CFT Code 2019, gambling operators the Gambling Code with its 3,000 euro thresholds, and VASPs add the Travel Rule Code 2024. Shufti's AI Journey Builder configures checks by licence, product and risk tier, so each business meets its own code.

Thin Case Files Weaken Themis Reports

Thin Case Files Weaken Themis Reports

Suspicious activity reports reach the Financial Intelligence Unit through Themis, and a disclosure pieced together from screenshots and emails gives investigators little to act on. Shufti's case management keeps every check, alert and analyst decision together as a report-ready bundle for Themis.

Documents and Languages

Individual Documents Shufti Verifies in the Isle of Man

Shufti verifies Isle of Man passports, driving licences, proof of age cards and work permits, plus passports and ID cards from other countries. The cards below cover the core documents Isle of Man onboarding relies on, with the full list on the supported documents page.

View All Supported Documents

Isle of Man Passport

The Treasury's Passport Office has issued chipped Isle of Man variant British passports since 2006. Shufti reads the chip through NFC and runs nine forensic detection layers, from MRZ checksum validation to hologram analysis, so a cloned or altered passport fails before onboarding.

Isle of Man Passport

Isle of Man Proof of Age Card

The Island has no national identity card, so the government sells a voluntary 18+ Proof of Age card valid for five years. Shufti checks the card's photo, dates and security features and matches the holder through biometric liveness, which suits age-gated gambling and retail sign-ups.

Isle of Man Proof of Age Card

Work Permits and Immigration Status

Anyone who is not an Isle of Man worker needs a work permit under the Control of Employment Act 2014, and new entry clearance has been a digital status since 1 July 2026. Shufti verifies the permit with the passport and matches names and dates across both.

Work Permits and Immigration Status

Foreign Passports and National ID Cards

Shufti actively processes 10,000+ ID document types from 240+ countries and territories, and its zero-shot AI learns new document formats in minutes. Residents born off the Island, expatriate staff in e-gaming and finance, and non-resident clients of trust, fund and insurance firms onboard with these documents.

Foreign Passports and National ID Cards

Isle of Man Driving Licence

The Department of Infrastructure's Licensing Office issues a single-part photocard licence that does not show the holder's address. Shufti checks its authenticity, expiry and photo against a live selfie, then runs a proof of address check in the same flow to fill that gap.

Isle of Man Driving Licence

Proof of Address

Manx residents usually prove their address with Manx Utilities electricity and water bills, rates bills from the Treasury or their local authority, or Income Tax notices of coding. Shufti verifies the address document and the ID in one step and flags mismatched names or addresses.

Proof of Address
Isle of Man Passport Isle of Man Proof of Age Card Work Permits and Immigration Status Foreign Passports and National ID Cards Isle of Man Driving Licence Proof of Address Isle of Man Passport
Certificate of Incorporation Certificate of Good Standing or Certificate of Fact Business Names Registration Memorandum and Articles of Association Business Address Proof Certificate of Incorporation

Entity Identity

Certificate of Incorporation

The Companies Registry, part of the Department for Enterprise, issues certificates of incorporation for 1931 Act and 2006 Act companies and certificates of establishment for foundations. Shufti checks the certificate against live registry data, confirming the company number, type and incorporation date.

Certificate of Incorporation

Certificate of Good Standing or Certificate of Fact

The Registry issues certificates of good standing for 2006 Act companies and certificates of fact for other entities. Shufti reads either certificate and compares its details with the live registry record at every check, so a struck-off company cannot pass on an old certificate.

Certificate of Good Standing or Certificate of Fact

Business Names Registration

Sole traders and partnerships trading under a business name register it under the Registration of Business Names Act 1918. Shufti matches the registered name and its owners to the verified individuals behind it.

Business Names Registration

Memorandum and Articles of Association

Shufti's AI-OCR reads ownership, share capital and signing authority from the memorandum and articles, and flags GAN-generated or edited pages before they reach the case file.

Memorandum and Articles of Association

Business Address Proof

Many Isle of Man companies keep their registered office with a registered agent and trade from somewhere else. Shufti cross-checks the registered office against leases and utility bills for the trading address, so the difference is clear in the file.

Business Address Proof

Tax Identity

Income Tax Reference Number

The Income Tax Division issues tax reference numbers that begin with C for companies, H for individuals and X for trusts and partnerships. Shufti extracts the number from tax documents and cross-checks the name against the registry and identity record.

Income Tax Reference Number

VAT Registration Certificate

The Treasury's Customs and Excise Division registers businesses for VAT and issues a registration certificate and VAT number. Shufti reads the certificate and matches the registered name and address to the company record.

VAT Registration Certificate

Foreign Tax Registrations and FATCA/CRS Self-Certification

Shufti captures FATCA and CRS self-certifications from corporate and individual clients, extracts foreign tax numbers and flags a declared tax residence that conflicts with the identity documents or the ownership chart.

Foreign Tax Registrations and FATCA/CRS Self-Certification
Income Tax Reference Number VAT Registration Certificate Foreign Tax Registrations and FATCA/CRS Self-Certification Income Tax Reference Number
Beneficial Ownership Database Shareholder Register and Ownership Chart Directors, Managers and Authorised Signatories Beneficial Ownership Database

Ownership and Control

Beneficial Ownership Database

Under the Beneficial Ownership Act 2017, as amended in 2026, each entity's nominated officer files everyone who owns or controls 25% or more, or a senior managing official when nobody qualifies. Shufti extracts these owners, verifies and screens them, and compares the result with the database entry.

Beneficial Ownership Database

Shareholder Register and Ownership Chart

Shufti maps ownership through intermediate companies, trusts and foundations to the natural persons at the top, and screens each of them against sanctions, PEP and adverse media lists.

Shareholder Register and Ownership Chart

Directors, Managers and Authorised Signatories

Shufti verifies the identity of each director and signatory, screens them against the IOMFSA's disqualified directors list and global watchlists, and sends an alert when the board or signing authority changes.

Directors, Managers and Authorised Signatories

Languages We Cover

English and Expat Document Parsing

Isle of Man documents are in English, while residents born elsewhere and international clients bring documents in many scripts. Shufti's OCR reads 150+ languages and scripts at 99.7% accuracy and averages 93% against Google Vision's 78.4% across the languages in its published benchmark. Its zero-shot document intelligence reads layouts it has never seen on first sight, without waiting for a template.

English and Expat Document Parsing

Name Variant Matching

Mc and Mac prefixes, apostrophes, hyphens and double surnames are written several ways across documents and lists. Shufti's phonetic and transliteration rules match these variations in sanctions and PEP screening, cutting false hits on common names.

Name Variant Matching

Cross-Document Consistency Checks

Shufti reconciles names, dates of birth and identifiers across the passport, driving licence, National Insurance number, tax reference and beneficial ownership database, so a mismatch surfaces before approval.

Cross-Document Consistency Checks
English and Expat Document Parsing Name Variant Matching Cross-Document Consistency Checks English and Expat Document Parsing

Independent Validation

Shufti's Recognition Across Independent Evaluations

Liminal

Ranked Exceptional in the Liminal Index 2026 for age estimation

View Reportarrow-icon
Gartner

Differentiated by Gartner on document diversity and country coverage

Read morearrow-icon
iBeta

Certified at iBeta Level 3 PAD with 0% APCER

Read Blogarrow-icon
KuppingerCole

Broadest global reach in the 2025 KuppingerCole Extended IDV report

Download Reportarrow-icon
Homeland Security

Ranked Top 5 in the DHS RIVR 2025 for identity validation

Read Blogarrow-icon
Liminal

Top Vendor for Product Execution in the Liminal Index for KYC 2026

View Reportarrow-icon
Liminal

Ranked Exceptional for age verification by Liminal Index 2026

View Reportarrow-icon
G2

Recognised as a Leader in G2 Fall 2026 reports

Read Morearrow-icon

Regulatory Update

Every Verification Route Isle of Man Regulators Recognize, in One Platform

Section 3.3.4.5 of the IOMFSA's AML/CFT Handbook keeps verification technology neutral and lists independent electronic data sources, selfie biometrics, liveness video and registry-linked checks among its controls. Shufti supports the biometric, video and registry-linked routes, plus chip and foreign eID options, so identity verification for IoM firms matches the customer's risk.

Fraud Prevention Across the Isle of Man Customer Journey

Reduce fraud losses and protect customer trust across onboarding, account access, and payments. Shufti connects identity, behavioral, device, network, and transaction intelligence to help Isle of Man businesses act on risk while keeping legitimate customers moving.

  • 01

    Account Takeover and Recovery Abuse

    Player wallets, e-money balances and investment portals are worth stealing, and attackers go after password resets and recovery steps that most firms leave light. Shufti's account takeover prevention reads device, location and behavior signals at login and recovery, and asks for a face check when a session looks wrong.

  • 02

    Social Engineering and Manipulated Payments

    Scammers impersonating banks and regulators talk victims into sending money themselves, leaving no stolen password to detect. Shufti's behavioral biometrics spot hesitation and coached typing, active-call detection flags a live call during payment set-up, and transaction monitoring stops authorised push payment scams at new payees and unusual amounts.

  • 03

    Device Spoofing and Automated Attacks

    Bonus hunters and bot farms open dozens of e-gaming and trading accounts from emulators and spoofed devices. Shufti's device fingerprinting links accounts that share hardware, detects emulators, virtual machines and location spoofing, and blocks scripted sign-ups before a promotion or referral reward is paid out.

  • 04

    Connected Fraud Rings and Repeat Offenders

    A fraud ring rarely targets a single operator or bank. Shufti's fraud network detection links identities, devices, documents and payment details across sign-ups, and cross-company fraud intelligence surfaces people already rejected elsewhere, so a repeat offender using a fresh email address is caught at the first attempt.

  • 05

    Synthetic Identities and Fabricated Documents

    Synthetic identities blend real and invented details and can pass weak checks for months before they cash out or default. Shufti tests each identity with email and phone enrichment, and its zero-shot document checks catch fabricated and template-built IDs, even in formats it has not seen before.

  • 06

    Deepfakes and Camera Injection

    Face-swap apps and virtual cameras now beat basic selfie checks, and remote gambling, crypto and investment sign-ups are frequent targets. Shufti's deepfake detection inspects the video stream for injection, replay and manipulated faces, so a synthetic face fed into an onboarding session is rejected before an account opens.

  • 07

    Money Mules and Rapid Fund Movement

    Mule accounts receive funds and pass them on within hours, often through newly opened e-money, payment and player accounts. Shufti's money mule detection watches for pass-through patterns, shared devices and sudden changes in account use, and flags the account before the money moves on.

  • 08

    Fraudulent Businesses and Concealed Ownership

    Nominee directors and layered holding structures can hide who really profits from a merchant, fund or trust account. Shufti's business verification checks the company against the live registry, maps ownership to the people behind it and screens them, so a front company cannot pass as a legitimate customer.

Governance & Controls

Audit-Ready Decisions, Lower Operational Drag

Fewer Avoidable Re-submissions

Capture guidance for passports, driving licences and proof of age cards catches glare, cropped edges and wrong-side uploads before they turn into rejections.

Fewer Avoidable Re-submissions

Cleaner Audit Trails

Shufti's case management records sources, results, timestamps, evidence, analyst notes, and decision history, packaged as report-ready bundles for disclosures through Themis.

Cleaner Audit Trails

One Workflow, One Back Office

Unify KYC, KYB, AML screening and transaction monitoring in one case file. Perpetual KYC/KYB tracks ownership, director and transaction changes across the compliance lifecycle.

One Workflow, One Back Office

Passport Chip-First Flow Design

Holders of Isle of Man and other biometric passports verify through the chip first, while others move to document and selfie checks in one flow.

Passport Chip-First Flow Design

Shufti's IDV/KYC Solutions for the Isle of Man

KYC Solutions

KYC for Isle of Man firms has to serve Manx residents without identity cards, workers on permits, and private clients and players worldwide. One Shufti flow routes each by risk, so nobody faces checks they don't need.

Explore More
Face Verification

Face Verification

Remote gambling, crypto and private client sign-ups attract impersonation, from borrowed passports to face-swap videos. Shufti matches a live selfie to the ID photo with iBeta Level 3 certified liveness, blocking masks, replays and injected video before the account opens.

.
Age Verification

Age Verification

Isle of Man online gambling regulations bar registering any player under 18. Shufti estimates age from a selfie in under 5 seconds and falls back to a document check when the estimate sits near the threshold, so adults pass quickly and minors stay out.

.
Bank Account Verification

Bank Account Verification

Payouts and withdrawals sent to the wrong account cost money and trigger complaints. Shufti validates the IBAN and its checksum and matches the account holder's name to the verified customer before the first withdrawal or disbursement.

.
Address Verification

Address Verification

The Manx driving licence carries no address, so address proof usually comes from utility, rates or tax documents. Shufti's layout-aware extraction reads each one, fuzzy-matches the name and address to the ID, and confirms the address without an analyst retyping it.

.
Document Verification

Document Verification

An edited passport page or a forged foreign ID is the first thing a fraudster tries. Shufti's document verification checks security features, data consistency and signs of digital editing within seconds, on Isle of Man and foreign documents alike.

.
Identity Verification

Identity Verification

Most files need more than one check per customer. Shufti runs document, biometric, NFC, address and foreign eID checks in one API session, so an Isle of Man onboarding produces one decision and one evidence trail instead of five vendor reports.

.

KYB Solutions

Isle of Man corporate clients often sit behind holding companies, trusts and foundations. Shufti calls the Companies Registry record live, maps ownership through each layer and checks the result against the beneficial ownership database, which obliged entities may consult for due diligence since 1 January 2025.

Explore More
Business Verification

Business Verification

Onboarding an Isle of Man company means confirming its incorporation, registered agent, signatories and everyone who owns or controls 25% or more. Shufti's live registry call pulls that picture together in one check, putting corporate onboarding under two minutes.

.
Enhanced Due Diligence

Enhanced Due Diligence

PEPs, complex structures and higher-risk clients need the enhanced measures in paragraphs 14 and 15 of the AML/CFT Code 2019. Shufti's branching questionnaires collect source of funds and wealth evidence, score the answers and send UBO verification links.

.

AML Screening

A customer who is clean at onboarding can land on a list next week. Shufti's AML solution for Isle of Man firms rescreens every customer against 4,000+ watchlists, including the designations the Customs and Immigration Division gives effect to, with a 15-minute refresh and every alert in one case file.

Explore More
Business AML Screening

Business AML Screening

An owner or director can be designated long after a company is onboarded. Shufti screens every owner and director, rescreens the whole portfolio through perpetual KYB and alerts you when a controller appears on a list the Sanctions Act 2024 gives effect to.

.
Transaction Monitoring

Transaction Monitoring

Suspicious patterns hide inside normal payment volumes. Shufti's library of 500+ pre-built rules covering structuring, smurfing, and mule activity cuts false positives by 60% and turns confirmed alerts into report-ready case bundles for Themis.

.
Travel Rule

Travel Rule

Since 28 October 2024, the Travel Rule Code 2024 requires Isle of Man VASPs to send originator and beneficiary data with virtual asset transfers. Shufti exchanges that data in IVMS101 format through one integration and verifies who controls an unhosted wallet.

.
AI Compliance Co-Pilot

AI Compliance Co-Pilot

One common name can return 140+ screening hits. Shufti's AI Compliance Co-Pilot reviews every hit and gives each a confidence score and a written reason, so analysts clear obvious false matches quickly while the MLRO keeps the final call.

.
REGULATORY ALIGNMENT

Built To Fit the Isle of Man's Compliance Landscape

KYC requirements in the Isle of Man start with the AML/CFT Code 2019 and the Sanctions Act 2024, while the IOMFSA and the Gambling Supervision Commission each supervise their own sectors with their own guidance. Shufti maps its KYC, KYB, AML screening and transaction monitoring controls to every regime below, so one platform covers each licence your group holds.

AML/CFT Code 2019

AML/CFT Code 2019

Made under the Proceeds of Crime Act 2008 and in force since 1 June 2019, the Code sets due diligence duties for regulated and designated businesses. Paragraph 3 treats 25% ownership as beneficial ownership, paragraph 13 requires ongoing monitoring and paragraph 34 keeps records for five years.

Isle of Man Financial Services Authority (IOMFSA)

Isle of Man Financial Services Authority (IOMFSA)

The IOMFSA licenses and supervises banks, insurers, investment and fund businesses, trust and corporate service providers and pension schemes, and oversees designated businesses. Its AML/CFT Handbook, updated in August 2026, explains how firms verify customers in person and remotely.

Financial Intelligence Unit (FIU)

Financial Intelligence Unit (FIU)

Established under the Financial Intelligence Unit Act 2016, the FIU receives suspicious activity reports through Themis, its single reporting channel. Themis also carries voluntary disclosures under section 24 of the Act, sanctions breach reports and the FIU's advisory notices to reporting firms.

Gambling Supervision Commission (GSC)

Gambling Supervision Commission (GSC)

The GSC licenses operators under the Online Gambling Regulation Act 2001 and supervises their financial crime controls under the Gambling (AML/CFT) Act 2018. Its Gambling Code 2019 triggers due diligence on transactions above 3,000 euros, or 3,000 euros within 30 days.

Designated Businesses (Registration and Oversight) Act 2015

Designated Businesses (Registration and Oversight) Act 2015

Designated businesses register with the IOMFSA under this Act. The list, updated in 2024, covers legal professionals, accountants, tax advisers, estate agents, lenders, virtual asset service providers and dealers accepting cash of 15,000 euros or more, all bound by the AML/CFT Code.

Travel Rule (Transfer of Virtual Assets) Code 2024

Travel Rule (Transfer of Virtual Assets) Code 2024

In operation since 28 October 2024, the Code requires VASPs to send and check originator and beneficiary information with every virtual asset transfer. Transfers below 1,000 euros carry lighter data rules, and an amendment in 2026 made unhosted wallet checks risk-based.

Beneficial Ownership Act 2017

Beneficial Ownership Act 2017

Nominated officers file registrable beneficial owners to a database kept by the Companies Registry within 21 days of receiving the details. A 2026 amendment set the threshold at 25% or more and added senior managing officials, and the IOMFSA oversees compliance.

Isle of Man Companies Registry

Isle of Man Companies Registry

Run by the Department for Enterprise, the Registry keeps registers of 1931 Act and 2006 Act companies, limited liability companies, foundations, limited partnerships and business names. Its online company search and certificates give the details that corporate due diligence depends on.

Isle of Man Passport Office

Isle of Man Passport Office

The Passport Office, part of the Treasury, issues British passports in the Isle of Man variant and has issued chipped e-passports since 2006. The Island does not require citizens to carry identity cards, so the passport is the main government photo ID for residents.

Sanctions Act 2024

Sanctions Act 2024

The Sanctions Act 2024 gives effect to UK sanctions in the Island, and the Terrorism and Other Crime (Financial Restrictions) Act 2014 implements UN targeted financial sanctions. The Customs and Immigration Division is the competent authority, and suspected breaches are reported to the FIU.

National Risk Assessment and MONEYVAL

National Risk Assessment and MONEYVAL

The Island's latest Money Laundering National Risk Assessment rates overall risk Medium High, unchanged since 2020. FATF compliance in the Isle of Man is assessed by MONEYVAL, which carries out its sixth-round onsite evaluation of the Island in October 2026.

Isle of Man Data Residency and Deployment

Isle of Man law sets no data localisation rule, and since 1 February 2020 Island firms have been able to transfer personal data to the UK without extra safeguards. Shufti offers UK hosting or on-premises deployment, with hosting locations and transfer terms fixed in the agreement.

Data Protection Act 2018 and the Applied GDPR

The Information Commissioner enforces both. Biometric data used to identify a person is special category data under Article 9, and breaches go to the Commissioner within 72 hours under Article 33. Shufti applies encryption, role-based access and configurable retention to identity and biometric data.

IOMFSA Outsourcing Consent

Rule 8.16 of the Financial Services Rule Book requires licence holders to obtain IOMFSA consent before outsourcing material functions, keep ID evidence held off-Island readily available and tell clients where their data is held. Shufti supports this with documented hosting locations, audit rights and full data export.

Retention Controls

Paragraph 34 of the AML/CFT Code 2019 keeps CDD and transaction records for five years after the relationship or transaction ends, and longer while a disclosure or enquiry is open. Shufti's retention is configurable by client and licence, with legal holds when needed.

Encryption and Security

Shufti encrypts data in transit and at rest, applies role-based access and audit logging, and holds ISO 27001:2022 certification and SOC 2 Type 2 reports, the evidence licence holders ask for when they review a technology supplier.

Automated Decisions and Biometric Data

Article 22 of the Applied GDPR gives customers the right not to be subject to decisions based solely on automated processing. Shufti returns verification results and supporting details through the API and back office, so support teams can explain outcomes and escalate disputed results.

Scope of Our Role

Shufti processes personal data on the firm's instructions as a processor under Article 28 of the Applied GDPR, and paragraph 4(3) of the AML/CFT Code keeps compliance responsibility with the firm. Shufti's privacy notice identifies the limited activities where it acts as an independent controller.

Data Residency and Privacy Controls in the Isle of Man

BUILT FOR COMPLIANCE TEAMS

Isle of Man AML Sources That Strengthen Decisions

Turn Isle of Man Verification Requirements into a Smoother Customer Journey

Share your customer types, risk rules and current onboarding process. A Shufti specialist will show you how to connect identity verification, KYB and ongoing monitoring, reducing operational hand-offs while keeping decision evidence organised for compliance review.

INDEPENDENTLY AUDITED. GLOBALLY CERTIFIED.

Certified to Global Standards

PROVEN WORKFLOWS

Identity Verification Built Around Your Industry in the Isle of Man

Remote Account Opening With Full Due Diligence

IOMFSA-⁠licensed banks must identify customers and beneficial owners, assess the risk of customers they never meet and monitor every relationship. Shufti brings passport and document checks, KYB, sanctions screening and transaction monitoring into one case file, so account opening runs without a separate vendor for each step.

Frequently Asked Questions

Does the Isle of Man have a national digital ID, and how do customers verify without one?

No. The Island has no national digital ID or identity card, and the IOMFSA's KYC guidance is technology neutral. Shufti verifies residents through the passport chip or a document and selfie check, and offers video and foreign eID routes for everyone else.

What counts as proof of identity in the Isle of Man when there is no national ID card?

Residents usually prove identity with an Isle of Man passport or driving licence, with the government's 18+ Proof of Age card for age checks. Shufti reads the passport chip, checks each document forensically and matches the holder's face with certified liveness.

Can Shufti verify foreign documents or identity formats it has not encountered before?

Yes. Shufti's zero-shot document AI learns a new format in minutes, on top of the thousands of ID types it already processes. Residents born elsewhere, permit holders and non-resident clients can therefore onboard with the passports and ID cards they already hold.

How does Shufti OCR compare with Google OCR for documents Isle of Man firms receive?

Isle of Man documents are in English, so accuracy matters most on documents international clients bring. Across the languages in Shufti's published benchmark, its OCR averages 93% accuracy to Google Vision's 78.4%, and it reads 150+ languages and scripts without manual retyping.

How does Shufti verify ownership when an Isle of Man company has several corporate layers?

Shufti pulls the Companies Registry record live, maps each holding company, trust and foundation to the natural persons at the top, and flags anyone owning or controlling 25% or more. It then compares the result with the beneficial ownership database and screens every person.

Does Shufti's ongoing monitoring cover more than sanctions screening?

Yes. Paragraph 13 of the AML/CFT Code 2019 requires transaction scrutiny and up-to-date customer records. Shufti monitors transactions against each customer's profile, keeps screening data current and alerts you to registry, director and ownership changes at your corporate customers.

How does Shufti keep screening current and handle name variations?

Sanctions, PEP and adverse media data refresh every 15 minutes, covering the designations the Island gives effect to under the Sanctions Act 2024. Phonetic and transliteration rules match Mc and Mac prefixes, apostrophes and double surnames, so name variants do not slip through.

Can we choose where our data is hosted or run verification inside our own infrastructure?

Yes. Isle of Man firms can choose UK hosting or deploy Shufti on-premises, including air-gapped environments where identity data never leaves your network. Hosting locations are written into the agreement, which helps you tell clients where their data is held.

What controls help us protect identity and biometric data?

Shufti encrypts data in transit and at rest, limits access by role, logs every action and holds ISO 27001:2022 certification and SOC 2 Type 2 reports. Retention is configurable, which supports your duties under the Applied GDPR for biometric data used to identify customers.

Can we configure different retention periods for different Isle of Man licences?

Yes. Retention is set per client and per licence, so a bank, a fund administrator and a gambling operator in one group each follow their own schedule, with the five-year minimum under paragraph 34 of the AML/CFT Code 2019 and legal holds preserved.

What does Shufti provide when our compliance team needs to prepare a Themis report?

Shufti assembles the customer's verification results, screening alerts, transactions, analyst notes and decision history into a report-ready bundle. Your MLRO reviews it and files the disclosure with the FIU through Themis without rebuilding the case from separate systems or screenshots.

Can we add verification checks without rebuilding our onboarding journey?

Yes. Shufti's AI Journey Builder adds or removes checks such as NFC, age estimation, bank account verification or video identification through configuration, not code. You can switch a route on for one licence, product or risk tier and leave the rest of the journey unchanged.

How does Shufti make verification queries easier for our customer support team?

Every result in the back office shows which check passed or failed and why, with the captured images and data alongside. Support staff can explain a decline in plain terms, ask the customer for the right document and escalate disputed results to a reviewer.

Let’s Build Trust Into Your Business

1B+Verifications Processed

240+Regions Actively Processed

99.7%Accuracy Rate

Samer Al Tamimi

CEO of Safwa Bank

Samer Al Tamimi

“We take our client’s privacy very seriously and always look for new innovative solutions to ensure a safe banking experience. Working with Shufti feels like a breath of fresh air, as their 100% in-house tech keeps our customer’s data free from vulnerabilities and fully safe and protected.”

Trusted. Compliant. Certified

cetificate-logos cetificate-logos cetificate-logos cetificate-logos

Explore Shufti For Your Business

Get a personalised demo from our experts.

    Which products would you like to check out?

    VideoIdent

    Address Verification

    eIDV (Docless)

    KYB

    AML Screening

    Fraud Prevention

    AMLR

    Face and ID Verification

    Age Verification

    Others

    What is your expected yearly verification volume?

    1 to 1,000

    1,001 to 5,000

    5,001 to 20,000

    20,001 to 50,000

    50,001 to 100,000

    100,001 to 1,000,000

    1,000,000+

    Valid Invalid number

    By clicking Submit, you accept our Privacy Policy and consent to marketing communications.

    PROVEN PLAYBOOKS

    Explore Practical KYC & AML Resources

    Read More
    Cover of eIDV Global Capability Matrix

    5 January, 2026

    eIDV Global Capability Matrix

    Shufti's eIDV coverage across 87 jurisdictions, showing which passive, active and biometric database checks, plus address and age checks, are available in each.

    Coverage Sheet

    Read More
    Read More
    Cover of iGaming Fraud Report 2026

    8 September, 2026

    iGaming Fraud Report 2026

    Shufti's H1 2026 data ties 13.77% of iGaming cases to potential bonus abuse and 38.07% of fraud to multi-account activity. Where the risk sits for operators.

    Report

    Read More
    Read More
    Cover of State of Global AML Compliance 2025 FATF Data Insight

    18 December, 2025

    State of Global AML Compliance 2025 FATF Data Insight

    AML laws read strongly on paper while enforcement lags behind. A data-led analysis of FATF findings, the gap between rules and results, and where RegTech closes it.

    Report

    Read More