On 24 September 2026, the Cayman Islands Monetary Authority published updated FAQs.1 The FAQs address two new Rules that took effect on 18 September 2026. The first governs effective AML, CFT and CPF compliance programmes for financial services providers. The second governs compliance with financial sanctions and targeted financial sanctions. CIMA revised the FAQs following industry queries after the Rules came into force. The update clarifies audit timing, audit scope and reliance on service providers. Firms need not conduct a new AML audit solely because the Rules are in force. CIMA will not adopt a blanket enforcement approach from the effective date. The administrative fines framework for breaches of the Rule is not yet in effect. Regulated funds with outsourced operating models must still obtain fund specific audit evidence. CIMA links the Rules to Cayman's FATF fifth round review. They reach funds, insurers and other CIMA regulated entities.
The Two Rules And Their Legal Basis
The Rules are the Rule on Effective Compliance Programme for the Prevention and Detection of Money Laundering, Terrorist Financing and Proliferation Financing for Financial Services Providers, and the Rule on Compliance with Financial Sanctions and Targeted Financial Sanctions.2 CIMA states their objective is "to support and promote an effective, proportionate, and risk-based framework that enables regulated entities in scope to identify, assess, manage, and mitigate ML, TF, PF, and sanctions-related risks".1 The Rules also align with CIMA's strategic objective of a positive assessment on the FATF fifth round review of the Cayman Islands.1
CIMA's power to issue the compliance programme Rule derives from sections 6(3)(b) and 34(1) of the Monetary Authority Act (as amended).3 The Rule supplements the Anti-Money Laundering Regulations, and CIMA states that "if there is any inconsistency between the provisions of the Rule and the AMLRs, the AMLRs will prevail".1 The Rule applies to all financial services providers conducting Relevant Financial Business under the Proceeds of Crime Act and regulated by CIMA under the Regulatory Acts, including branches, subsidiaries and affiliates, with no sector specific exemptions.1
The Enforcement Posture On The Effective Date
CIMA states that it "does not intend to adopt a blanket enforcement approach upon the Rule's effective date. In particular, the Administrative Fines framework applicable to breaches of the Rule is not yet in effect."1 The Rule will instead form part of CIMA's risk based supervisory toolkit, assessed through onsite inspections, desk based reviews, thematic reviews and other engagement.
The position in the above is a transitional window, not a moratorium. Many provisions of the Rule restate or enhance obligations already imposed by the AMLRs, which remain enforceable on their existing terms.1 Firms should read the absence of Rule specific administrative fines as time to align programmes before that framework commences, not as relief from the underlying regulations.
Accuracy note: FAQ 3 states that "for high and medium risk entities onsite inspections are a more appropriate supervisory tool. However, for those entities rated medium or otherwise, a desk based review would be more reasonable tool".1 Medium rated entities appear in both categories. Firms carrying a medium rating should not assume which supervisory tool CIMA will apply, and may wish to seek clarification.
Amlco Accountability And Governance
CIMA states that an AMLCO "may be personally liable for an FSP's AML compliance failure where this amounts to a breach of the AMLRs and the breach is attributable to the AMLCO's conduct. However, the FSP remains ultimately responsible for AML/CFT/CPF compliance."1 The AMLCO must hold an appropriate professional qualification, relevant knowledge of the Cayman framework, sufficient experience and good repute. Independence means functional and reporting autonomy with direct escalation rights, not complete separation from business activities. The function may be outsourced, but CIMA is explicit that "[o]utsourcing does not transfer accountability away from the FSP or its Governing Body".1
Governing Body oversight must be evidenced through minutes, reports, documented decisions and remediation tracking.1 The evidential requirement in the above is where supervisory reviews will begin. A board that oversees its compliance programme without recording that oversight will be treated as not having exercised it.
The Independent Aml Audit
The audit obligation is not new; it already exists under the AMLRs, and the Rule clarifies how effectiveness should be demonstrated.1 On timing, CIMA is direct: "No. The Rule does not require FSPs to conduct or commission an AML/CFT/CPF audit solely because the Rule has become effective."1 CIMA will first consider each firm's risk assessment and resulting risk profile, which should drive the timing, frequency and scope of its audit programme. The Rule sets no universal filing date and no industry wide completion date.
No frequency is prescribed, but CIMA offers illustrations: a higher risk firm might reasonably be audited every two years, with medium and low risk firms every three and four years respectively.1 At least one external AML audit is required for every three independent audit cycles, to mitigate familiarity and self review risks. The AMLCO, MLRO and DMLRO cannot audit activities for which they are responsible, whether the functions are internal or outsourced. CIMA prescribes no audit report format, but reports must assess the effectiveness of every applicable programme component and document deficiencies. Findings do not invalidate an audit; they identify remediation and may inform supervisory assessment.1
Fund Level Audit Evidence And Outsourced Models
A regulated fund must undertake an AML audit under regulation 5(a)(ix) of the AMLRs even where all or substantially all of its operations are outsourced.3 CIMA states that "relying solely on a service-provider-level internal audit or a population-based review, without obtaining sufficient evidence regarding the individual Fund's Compliance Programme, would not provide sufficient assurance of the effectiveness of the AML Audit".1 Reliance on a service provider's audit is permitted only where that audit includes testing specific to the fund's own programme. CIMA illustrates with outsourced sanctions screening: the auditor should obtain the service provider's screening policies, its testing, and testing results relevant to the specific fund.1
The fund guidance in the above is the operative change for Cayman's funds industry. An administrator's firm wide audit, however thorough, no longer answers the question for any individual fund. Fund boards should expect audit engagements to include fund specific sampling of investor onboarding, screening and monitoring, with the cost implications that follow.
The Sanctions Rule
The sanctions Rule promotes compliance with existing domestic and international financial sanctions obligations in force in the Cayman Islands.1 Because sanctions obligations apply to all persons in the Islands, it reaches every Regulated Person supervised by CIMA under the Regulatory Acts, whether or not it conducts Relevant Financial Business. CIMA recognises the Financial Reporting Authority as the competent authority for financial sanctions, and states that the Rule reinforces compliance with the FRA's reporting guidelines rather than duplicating its mandate.1 For insurers and reinsurers conducting Relevant Financial Business, the RFB Self-Declaration is an attestation and does not replace independent audit.1
What The Rules Mean For Digital Asset Funds And Vasps
The Cayman Islands is a principal domicile for digital asset investment funds, many operating fully outsourced models through administrators and third party compliance providers. The fund level evidence standard applies to them on its terms. Virtual asset service providers supervised by CIMA fall within the compliance programme Rule where they conduct Relevant Financial Business, and within the sanctions Rule as Regulated Persons.4 CIMA's outsourced sanctions screening example applies to any outsourced screening arrangement, which for digital asset firms typically includes blockchain analytics providers. Audits of such firms should test how that screening operates for the specific entity, not merely the provider's general methodology.
A Legal And Regulatory Note
The FAQs do not replace or amend the Rules and must be read with the Rules and relevant legislation.1 Firms should monitor for commencement of the administrative fines framework applicable to breaches of the Rule, which will change the enforcement position. This article is provided for general information only and does not constitute legal advice.
Footnotes
- Cayman Islands Monetary Authority, General Industry Notice, "Updated AML & Sanctions Rules FAQs Now Available", 24 September 2026; Cayman Islands Monetary Authority, Frequently Asked Questions on the AML and Sanctions Rules, available at www.cima.ky/aml-cft-faqs.
- Cayman Islands Monetary Authority, Rule on Effective Compliance Programme for the Prevention and Detection of Money Laundering, Terrorist Financing and Proliferation Financing for Financial Services Providers; Rule on Compliance with Financial Sanctions and Targeted Financial Sanctions; both effective 18 September 2026.
- Monetary Authority Act (as amended), sections 6(3)(b) and 34(1); Anti-Money Laundering Regulations (as amended), including regulation 5(a)(ix); Proceeds of Crime Act (as amended).
- Virtual Asset (Service Providers) Act (as amended).
