Introduction
In July 2026, the Cayman Islands Monetary Authority (CIMA) finalised two new Rules that impact the compliance landscape in the Cayman Islands, both taking effect on 18 September 2026:
- Rule on Effective Compliance Programme for the Prevention and Detection of Money Laundering, Terrorist Financing and Proliferation Financing for Financial Services Providers (the “Compliance Rule”); and
- Rule on Compliance with Financial Sanctions and Targeted Financial Sanctions (the “Sanctions Rule”).
(Collectively, the “Rules”)
Background and Rationale
The Rules respond to the Caribbean Financial Action Task Force (CFATF) 4th Round Mutual Evaluation, which found that CIMA’s existing Guidance Notes on the Prevention and Detection of Money Laundering, Terrorist Financing and Proliferation Financing (the “Guidance”) do not meet the required enforcement standard. This is particularly significant ahead of the CFATF’s 5th Round Mutual Evaluation on-site inspection of the Cayman Islands, scheduled for 2027. To close these gaps, specific sections of the Guidance have been elevated into the new Rules to make them legally enforceable, while the Guidance continues to provide non-binding supplementary guidance.
Compliance Rule
The Compliance Rule applies to all Financial Service Providers (FSPs), being all persons conducting relevant financial business, that are regulated and supervised by CIMA under the Regulatory Acts, including branches, subsidiaries, affiliates and other members of a CIMA-regulated financial group.
The Compliance Rule establishes minimum requirements for an effective compliance programme. These include requiring the AMLCO to perform the compliance function independently and objectively; limiting internal compliance audits to two consecutive cycles before an external audit is required; requiring risk assessments to be updated ‘without delay’ following material trigger events; and requiring CIMA to be notified of any material functions of the Compliance Programme.
Sanctions Rule
The Sanctions Rule has a broader scope than the AML Compliance Rule: it applies to all “Regulated Persons”, being any person, entity or arrangement regulated by CIMA under the Regulatory Acts (including the Insurance Act), regardless of whether they conduct “Relevant Financial Business”.
The Sanctions Rule establishes sanctions compliance as a standalone enforceable requirement, to be integrated as part of a person’s overall AML/CFT/CPF programme.
Key requirements include: a prohibition on assigning a “low” geographic risk rating where the customer’s country is subject to sanctions by the UK, UN, US and/or OFAC; mandatory re-screening of all customers “Without Delay” against updated sanctions lists; detailed, enforceable asset freezing obligations; and mandatory filing of a Compliance Report Form (CRF) with the FRA upon discovering a relationship contravening a sanctions order.
Updated FAQs
CIMA has published FAQs to support industry implementation of the Rules. The FAQs are updated from time to time and are available on CIMA’s website: FAQs











