On 20 July 2026, the Cayman Islands Monetary Authority (CIMA) published the AML/CFT/CPF Compliance Rule and the Financial Sanctions Rule (the Rules), both effective 18 September 2026.
The Rules convert key parts of CIMA’s non-binding Guidance Notes into enforceable requirements; breaches may result in fines or other regulatory action. They apply to all CIMA-registered or licensed financial service providers, including registered investment funds, fund administrators, managers, advisers, SIBA-registered persons and virtual asset service providers. They do not apply to entities that are not regulated by CIMA.
What is new
While the Rules largely codify existing requirements, they introduce several expanded obligations:
Independent AML audit
Audits must be conducted by suitably qualified, independent persons; internal audits are limited to two consecutive cycles before an external audit is required. The report must be filed with CIMA, and each fund must have its own audit even if its operations are fully outsourced.
Outsourcing controls
CIMA’s outsourcing requirements now extend to investment funds: funds must conduct due diligence on service providers, document arrangements, notify CIMA of material outsourcing and retain ultimate compliance responsibility.
Documented training plan
A forward-looking plan must cover all relevant staff, be delivered at least annually and have supporting records.
Risk assessment triggers
Risk assessments must be updated without delay after material trigger events, such as new products or geopolitical developments, and must consider the Cayman Islands National Risk Assessment.
Governance documentation
The roles of the governing body, the AML compliance officer (AMLCO), money laundering reporting officer and deputy money laundering reporting officer must be clearly documented. The AMLCO must operate independently from business functions.
Sanctions integration
Sanctions compliance must be embedded in the AML/CFT/CPF programme. Screening must cover all applicants, customers, beneficial owners and connected persons against all applicable lists, including the United Kingdom's Foreign, Commonwealth and Development Office list; assets of designated persons must be frozen 'without delay'; and geographic risk cannot be rated 'low' for sanctioned countries.
What you should do now
Entities within scope should take the following steps before the Rules take effect:
- Review your compliance programme against the new Rules and conduct a gap analysis.
- Confirm AML officer appointments meet the qualification and independence requirements.
- Review outsourcing arrangements and ensure they are documented and notified to CIMA.
- Update written AML/CFT/CPF policies and obtain governing body approval.
- Plan for the independent AML audit - identify an auditor and determine scope and frequency.
- Ensure risk assessments are current, documented at fund level, and reflect trigger-event requirements.
- Verify sanctions screening covers all required lists and that geographic risk ratings comply.
- Put a documented training plan in place, delivered at least annually.
For further information on the new Rules and how they may affect your CIMA-registered or licensed financial service providers, please contact our team.
