Aug 2026
On 18 September 2026, two new rules issued by the Cayman Islands Monetary Authority (“CIMA”) will take effect: the Rule on Effective Compliance Programme for the Prevention and Detection of Money Laundering, Terrorist Financing and Proliferation Financing (the “AML Compliance Rule”) and the Rule on Compliance with Financial Sanctions and Targeted Financial Sanctions (the “Sanctions Compliance Rule”).
Each Rule applies to financial service providers (“FSPs”) regulated by CIMA, meaning persons carrying on or conducting Relevant Financial Business, including mutual funds, private funds and persons registered under the Securities Investment Business Act (“SIBA”). The Rules have been established to convert specific sections of the non-binding Guidance Notes (the “Guidance Notes”) to the Anti-Money Laundering Regulations (the “AMLRs”) into binding Rules. Therefore, both Rules are enforceable and any breach may result in enforcement action. The AMLRs and the Guidance Notes remain in force and continue to apply alongside the Rules.
AML Compliance Rule
The AML Compliance Rule requires each FSP’s Compliance Programme to comprise five core components: (i) designation of an Anti-Money Laundering Compliance Officer (“AMLCO”) responsible for implementation and oversight; (ii) documented written policies and procedures; (iii) a risk management framework applying a risk-based approach to the evaluation and mitigation of ML/TF/PF risks; (iv) an ongoing compliance training programme and plan; and (v) ongoing evaluations of effectiveness through independent audit. Additionally, the Rule addresses customer due diligence, record-keeping and outsourcing obligations. Each of these elements is discussed below.
Suitability of the AMLCO
The AMLCO must perform the compliance function independently and objectively from business and operational functions and, where full separation is not practicable, must ensure conflicts of interest are effectively managed. The AMLCO must possess knowledge of AML/CFT/CPF and sanctions-evasion risks relevant to the FSP’s business sector, including emerging issues, trends and typologies. The AMLCO must report to the governing body at least annually.
Given the breadth of these requirements, entities may benefit from appointing an external AMLCO who is structurally independent of business functions and who possesses current specialist expertise in AML/CFT/CPF and sanctions-evasion risks.
An entity and potential AML Officers should also be aware of the applicable administrative fine and penalties relating to various regulatory breaches in the Cayman Islands, which can be substantial and include potential personal liability for AML officers for failure to carry out their relevant functions.
Risk-Based Approach
FSPs must identify, assess, manage and mitigate ML/TF/PF risks proportionate to their nature, size, complexity and risk profile. Risk assessments must take into account the Cayman Islands National Risk Assessment and be updated without delay upon material trigger events, including new product launches, expansion into higher-risk jurisdictions, mergers and restructuring and economic or geopolitical developments. Enhanced due diligence is mandatory for high-risk relationships; simplified due diligence is never appropriate where suspicion exists.
Importantly, the level of assessed risk also drives other core elements of the Compliance Programme. The AML Compliance Rule provides that the frequency of independent audits must be commensurate with the FSP’s size, complexity, structure, nature of business and risk profile, as determined by the FSP’s risk assessment. A robust, current risk assessment is therefore fundamental not only to proportionate due diligence but also to determining the appropriate audit cycle.
Customer Due Diligence, Record-Keeping and Outsourcing
FSPs must verify customers and beneficial owners before (or, in limited cases, shortly after) establishing a business relationship and must ensure that all customers are subject to ongoing monitoring. Where a relationship is established before CDD is complete, heightened monitoring and scrutiny must be applied until verification is finalised. FSPs must implement controls to prevent the opening or maintenance of anonymous or fictitious accounts. Transaction and CDD records must be retained for at least five years after the end of a business relationship or, for a one-off transaction, after the date of the transaction.
FSPs that outsource compliance functions must assess associated risks (including country risk), conduct due diligence on the service provider, ensure the outsourcing agreement documents the respective rights and obligations of both parties and notify CIMA of any material outsourced compliance functions. Where outsourcing risks cannot be effectively identified, managed or mitigated, the FSP must not enter into or continue the arrangement. Ultimate responsibility remains with the FSP regardless of outsourcing.
Independent Audits and CIMA Filings
An audit of the compliance programme is required at a frequency commensurate with the size, complexity, structure, nature of business and the risk profile of the relevant FSP. The audit must be carried out by suitably qualified persons who are independent and separate from those involved in the design, implementation or operation of the policies, procedures, systems and controls being audited and must be free from any conflict of interest that could impair judgment.
Internal audits are permitted for no more than two consecutive audit cycles before an external audit must be conducted. Audit reports must be filed with CIMA as soon as practically possible after completion. FSPs must be able, upon request, to provide CIMA with documentation of the auditor’s independence, including the basis on which it was determined. Effective remediation measures must address any deficiencies identified within appropriate timeframes.
CIMA has acknowledged that investment funds and other FSPs that rely on service providers may satisfy the independent audit requirement at the service provider level, provided that the scope of such audit adequately covers the compliance functions performed on behalf of the FSP. Notwithstanding such arrangements, the FSP retains ultimate responsibility for the adequacy and effectiveness of its Compliance Programme.
Training
FSPs must establish a documented training programme and forward-looking training plan. Training must be delivered at least annually, or more frequently where warranted by the FSP’s risk profile or changes in applicable legislation. The training plan must describe training recipients, topics and materials, delivery methods and frequency. Training recipients must include front-line staff, those involved in client transactions, persons handling cash, funds or virtual currency and compliance, senior management, IT and internal audit personnel.
Suspicious Activity Reporting
Suspicions of money laundering, terrorist financing or proliferation financing must be reported to the Money Laundering Reporting Officer (“MLRO”) or Deputy Money Laundering Reporting Officer (“DMLRO”) without delay, and tipping-off is strictly prohibited.
Sanctions Compliance Rule
The Sanctions Compliance Rule requires that sanctions compliance be integral to each FSP’s AML/CFT/CPF programme.
Key obligations include:
(i) Screening and re-screening – all applicants, customers, beneficial owners, service providers and connected persons must be screened at onboarding or when engaged, as applicable, and on an ongoing basis; transactions must be screened before execution. Existing customers must be re-screened without delay upon every update to sanctions lists, regardless of prior due diligence classification. The Rule states that “without delay” ideally means within a matter of hours of a designation. Simplified due diligence does not waive screening obligations. The relevant sanctions lists include the UK Sanctions List published by the UK Foreign, Commonwealth and Development Office and any other sanctions list that applies to the Cayman Islands.
(ii) Geographic risk – a customer’s geographic risk cannot be rated “low” where the jurisdiction is subject to UK, UN or US sanctions (including OFAC designations) relating to ML/TF/PF.
(iii) Asset freezing and unfreezing – where a true match is confirmed (or there is reasonable cause to suspect that a person is a Designated Person), funds and economic resources owned, held or controlled by that person must be frozen and a Compliance Reporting Form must be filed with the Financial Reporting Authority (“FRA”) without delay. Regulated persons must also maintain policies and controls for unfreezing assets when designations are lifted, as guided by the FRA.
(iv) Ongoing monitoring and record-keeping – regulated persons must maintain systems for ongoing monitoring of business relationships and one-off transactions to prevent, counter and report TF and PF. Internal records used to assess whether individuals or entities are Designated Persons must be maintained and kept up to date.
(v) False positives and training – reasonable steps must be taken to verify potential matches before treating them as confirmed. Regular training on identifying individuals and entities subject to TFS and on handling frozen funds is required.
Enforcement
Non-compliance with the Sanctions Compliance Rule or the AML Compliance Rule may result in administrative fines, directions, conditions on licences or registrations, public statements and, in serious cases, revocation of regulatory status. The Rules have the force of law and take precedence over any prior CIMA guidance notes, policy statements or interpretative materials. However, in the event of conflict with the Proceeds of Crime Act, AMLRs, Terrorism Act, Proliferation Financing (Prohibition) Act or Beneficial Ownership Transparency Act, such legislation prevails. CIMA has further confirmed that it will exercise its discretion in imposing administrative fines in a manner that precludes duplication, thereby avoiding a double jeopardy scenario where an FSP is penalised for the same breach under both the AMLRs and the Rules.
Recommended Next Steps
As soon as possible and ideally before 18 September 2026, it is advisable for FSPs, including funds and SIBA registrants, to take, among other things, the following proactive steps to ensure regulatory compliance:
(i) conduct a gap analysis of existing policies against both Rules;
(ii) enhance sanctions screening and ongoing monitoring systems;
(iii) confirm that governance structures, including the AMLCO, MLRO and DMLRO designations, meet the new requirements;
(iv) update risk assessments;
(v) ensure outsourcing arrangements are documented and CIMA notified;
(vi) prepare a documented training plan and schedule training; and
(vii) plan for independent audits, noting the filing obligation and the two-cycle internal audit cap.
Conyers regularly assists clients with gap analyses, compliance assessments, corporate governance documentation, audit preparation and the conduct of independent audits, risk assessments, training plans and delivery of AML training, among other services.
Please contact our team if you would like further information or a tailored assessment of your compliance position.