New CIMA Rules on AML/CFT/CPF Compliance and Financial Sanctions Issued in the Cayman Islands

Background

All FSP conducting relevant financial business in the Cayman Islands are subject to the Proceeds of Crime Act (Revised) (POCA), the Anti-Money Laundering Regulations (Revised) (AMLR) made thereunder, and the associated Guidance Notes on the Prevention and Detection of Money Laundering, Terrorist Financing and Proliferation Financing in the Cayman Islands as issued by CIMA pursuant to the Monetary Authority Act (Revised) (Guidance).

The AML Rule essentially incorporates obligations that are already outlined in the AMLR and Guidance into a shorter, directly enforceable, Rule. The stated objective of the Rules, is to support and promote an effective, proportionate and risk-based framework that enables FSP to identify, assess, manage and mitigate money laundering (ML), terrorist financing (TF), proliferation financing (PF) and sanctions related risks.

Notably, the Rules create binding obligations, a breach of which may result in the imposition of fines or other regulatory enforcement action by CIMA; and align with CIMA’s strategic objective to provide support for improving effectiveness in combatting financial crime and a positive assessment on the FATF 5th Round Review of the Cayman Islands.

The AML Rule supplements the AMLR and sets out certain minimum requirements applicable to FSP, including the following.

Governance and AML Officers

The Governing Body of an FSP is required to establish and maintain a clear governance framework for a Compliance Programme in respect of detecting, preventing and reporting on ML/TF/PF and compliance with targeted financial sanctions (TFS). At a minimum an FSP’s Compliance Programme should include:

• designation of an AML compliance officer (AMLCO) who is responsible for implementation and oversight of the FSP’s Compliance Programme independently and objectively from the business and operational functions subject to their oversight;
• documentation of detailed written policies and procedures;
• development, documentation and implementation of a risk management framework to evaluate risks presented by customers, services, transactions, locations and delivery channels;
• delivery of compliance training for all staff, and the Governing Body; and
• ongoing evaluation of the effectiveness of the Compliance Programme.

Supporting ‘Frequently Asked Questions’ issued by CIMA on 31 July 2026 (FAQ) have been published to assist FSP in understanding the Rules and confirm among other things that, whilst an AMLCO may be personally liable for an FSP’s AML compliance failure where this amounts to a breach of the AMLR (and the breach is attributable to the AMLCO’s conduct), FSP remain ultimately responsible for their AML/CFT/CPF Compliance Programme.

Development and Documentation of a Risk-Based Approach

FSP must establish, implement and apply a risk-based approach (RBA) to identify, assess, manage and mitigate ML/TF/PF risks. Such RBA must be proportionate to the nature, size, complexity, structure and risk profile of the FSP’s operations and should be fully documented – including such policies, procedures, and reviews as may be required in order for an FSP to be able to demonstrate the effectiveness of its Compliance Programme to CIMA.

Detailed Policies, Procedures and Controls

Compliance Programme policies and procedures must be established, documented and maintained – and must address:

• assessment of risk and application of an RBA;
• customer due diligence and ongoing monitoring;
• record-keeping and retention of records;
• outsourcing arrangements;
• notification to CIMA of material outsourced compliance functions;
• procedures for suspicious activity detection, transaction monitoring, investigation, escalation and reporting;
• financial sanctions compliance including screening against official sanctions lists (including the UK Sanctions List).

To the extent reliance is placed on a third party or member of an FSP’s group to perform any AML/CFT/CPF functions, the FSP must, notwithstanding such reliance, satisfy itself that such functions comply with the requirements of the AML Rule and the AMLR.

Customer Due Diligence (CDD)

FSP must conduct CDD when:

• establishing a business relationship;
• carrying out a one-off transaction valued in excess of KYD 10,000 (or equivalent), whether by a single transaction or several smaller linked transactions;
• carrying out one-off transactions that are wire transfers;
• there is a suspicion of ML/TF/PF; or
• there are doubts as the veracity or adequacy of customer identification information.

The AML Rule, consistent with the Guidance, confirms that customers may be onboarded remotely using electronic ‘know your client’ methods and digital ID technologies (e-KYC); but reiterates that FSP must ensure that any decision to onboard a customer remotely, using e-KYC, is dependent on an assessment of any risks this presents.

The AML Rule also provides that where a business relationship is established or a transaction is conducted prior to completing CDD, heightened monitoring and scrutiny should be applied until such time as the required verification is completed.

Record Keeping

All transaction records including associated CDD documentation must be kept for at least five years after the end of a business relationship or the completion of a one-off transaction; and should be readily available for production to CIMA upon request without delay.

Beneficial ownerships records should also be kept for at least five years after the date on which the relevant customer / legal entity is dissolved or otherwise ceases to exist, or the customer ceases to be a customer of the FSP.

Outsourcing

The AML Rule provides that, when entering into any outsourcing arrangements, FSP (including investment funds) must undertake a risk assessment and conduct appropriate due diligence on the proposed service provider to assess its fitness and propriety, competence and capability to perform the relevant outsourced activity.

It should be noted that the AML Rule also requires FSP to notify CIMA of any outsourcing agreement that relates to material functions of its Compliance Programme.

Ongoing Training and Employee Screening

FSP are required to establish, document and implement an effective training programme and plan that ensures all relevant employees, agents and other persons authorised to act for the FSP understand and comply with all applicable AML/CFT/CPF laws and regulations, and TFS, applicable in the Cayman Islands.

Such compliance training programmes should be delivered at least annually and recipients should include all those who:

• have contact with clients such as front line staff or agents;
• are involved in client transaction activities;
• handle cash, funds or virtual currency for the FSP; and
• are responsible for implementing or overseeing the Compliance Programme, including AML officers, senior management, information technology staff, members of the Governing Body and internal auditors.

Demonstrating Effectiveness

FSP are required to establish and maintain independent audit procedures to review and test their Compliance Programme.

AML audits should be carried out by suitably qualified persons who are independent and separate from the design, implementation and/or operation of the policies, procedures, systems and controls that they audit; and such persons should be free from any conflict of interest that could impair their objective judgment.

The AML Rule does not prescribe the precise frequency with which such AML audits should be conducted; this should be determined by FSP using a risk-based approach. In this respect, the FAQ suggest that if an FSP is rated ‘higher risk’ it might be reasonable to conduct an AML audit every two years; and for ‘medium’ and ‘low’ risk FSP, the frequency of AML audits could be lower i.e. every three or four years, respectively.

The AML Rule expressly provides that AML audit reports must be filed with CIMA as soon as practically possible following completion of the relevant audit; and, if an FSP wishes to conduct internal AML audits, every third audit must be conducted by an external service provider (i.e. if the audit is conducted internally for two consecutive audit cycles, then the next audit must be conducted by an external service provider).

Sanctions Rule

The Sanctions Rule essentially directs FSP to integrate sanctions compliance into their Compliance Programmes; and should be considered and implemented alongside the requirements of the AML Rule, in particular in respect of client due diligence / screening processes and staff training requirements in order to ensure: (i) TFS identification; (ii) the filing of compliance reporting forms with the Cayman Islands Financial Reporting Authority where appropriate; and (iii) the freezing of funds and economic resources where required, without delay.

Recommended Actions

All FSP should:

• review their existing AML/CTF/CPF and sanctions Compliance Programmes against the Rules and schedule a Governing Body level review and approval of any required updates to the same; and
• review and update their AML audit plans so as to ensure that they reflect all AML Rule requirements,

ahead of 18 September 2026.

How We Can Help

Appleby’s Regulatory Team routinely advises FSP across a broad range of CIMA-regulated activities. Whether an FSP requires a compliance review, assistance in responding to CIMA enquiries, guidance on its AML/CFT/CPF Compliance Programme, or broader advice with respect its regulatory position, Appleby is well-placed to assist.

Should you have any questions arising from this advisory, or on the Rules more generally, please do not hesitate to reach out to a member of the Appleby Team.