Rule and Statement of Guidance on Nature, Accessibility and Retention of Records for Licensees Conducting the Business of Company Management in the Cayman Islands

• New licensees must comply immediately, while existing licensees have until April 1, 2024 
  
  
• Records must adhere to strict guidelines, including personal data protection and the ability to demonstrate compliance with regulatory obligations 
  
  
• Breaching these new rules can lead to serious consequences, including license suspension or revocation from CIMA 

On 30 August 2023, following industry consultation, the Cayman Islands Monetary Authority ("CIMA") issued a new Rule and Statement of Guidance on Nature, Accessibility and Retention of Records for Licensees Conducting the Business of Company Management (the "Company Manager Rules and Guidance"), which establishes minimum requirements, and provides guidance, on the maintenance of records in a manner that promotes accessibility, retention and appropriate security.

Who do the Company Manager Rules and Guidance apply to?

The Company Manager Rules and Guidance apply to licensees under the Companies Management Act (the "CMA"), the Banks and Trusts Companies Act, the Mutual Funds Act and the Insurance Act (each as amended) if they are conducting the "business of company management" pursuant to the CMA (each a "Licensee"). 

Licensees will be required to comply with the Company Manager Rules and Guidance in addition to the pre-existing Statement of Guidance on Nature, Accessibility and Retention of Records (the most recent version of which was issued by CIMA in April 2023) (the "General SOG"), which applies to all regulated entities. The Company Manager Rules and Guidance distinguish between "rules", which establish the minimum requirements in relation to the maintenance of records (the "Rules") and "guidance", which sets out the minimum expectations of CIMA in relation to a Licensee's record keeping arrangements (the "Guidance"). We discuss further below how the requirements under the Company Manager Rules and Guidance differ to those under the General SOG.

When do the Company Manager Rules and Guidance come into effect?

For entities which have become Licensees since 30 August 2023 ("New Licensees"), the Company Manager Rules and Guidance have immediate effect. For entities which were already Licensees on 30 August 2023 ("Existing Licensees"), the Company Manager Rules and Guidance come into effect on 1 April 2024.

What are the rules?

The Rules are summarised below. 

• All records must be legible and easily accessible.
• Records must be accessible and provided by Licensees to CIMA within a reasonably short timeframe. CIMA expects that most records must be provided without delay or within the timeframe determined by CIMA regardless of whether the records are stored in the Cayman Islands or elsewhere.
• Licensees must keep, maintain, and administer records as required by relevant legislation.
• Each Licensee must keep records of books of account and other financial affairs, as well as other records related to its company management business.
• Personal data must be processed in accordance with the data protection principles set out in the Data Protection Act (as amended) and Licensees should have appropriate personal data security measures, records retention policies, personal data breach response plans and processes for data subjects to be able to exercise their rights (the "Personal Data Rule").
• Record keeping must be sufficient to enable CIMA to monitor each Licensee's compliance with regulatory and anti-money laundering/counter terrorism financing/counter proliferation financing obligations.
• Records must be maintained in a manner that ensures that they are kept up-to-date at all times as far as is reasonably practical. There should be no unjustifiably excessive delays in the adequate maintenance of records.
• Each Licensee must ensure that all due diligence information on its clients and transaction records related to its company management business are available without delay on request by CIMA.
• Licensees must maintain records for a minimum period of five years after each related transaction date or any other period as stipulated in the relevant legislation.
• Licensees must maintain adequate procedures for the availability, maintenance, security, privacy and preservation of records, working papers and documents of title belonging to the Licensee, its clients or others (regardless of whether retained electronically or by any other medium) so that they are reasonably safeguarded against loss, unauthorised access, alteration or destruction.
• CIMA expects that each Licensee has a plan in place for the treatment of records once it ceases to carry on business (whether by merger, transfer, discontinuance of activities or otherwise) and CIMA must be informed of where and how records may be accessed once a Licensee ceases to carry on business.
• Each Licensee must record information necessary to give a true and fair view of the state of its affairs and to explain any transaction carried out on its behalf and/or on its client's behalf (the "True and Fair View Rule"). This information will be required by CIMA and must be maintained in such a way so as to enable a particular transaction to be identified at any time and appropriately traced, in particular, to enable early identification of balances and of the particular items which make up those balances.
• Each Licensee must keep proper accounting records/books of account in such a manner that they are sufficient to show and explain the transactions and commitments related to its company management business (whether effected on its own behalf or on behalf of others) and in particular so that these records: (a) disclose with accuracy and completeness the financial position for a minimum of five years of operation or for a time period required under the Anti-Money Laundering Regulations (as amended); (b) demonstrate whether or not the Licensee is or was at that time complying with its financial resources' requirement (where applicable); and (c) enable the Licensee to prepare, within a time period specified by CIMA, any financial reporting required by CIMA as at the close of business for any date within the previous five years, and that the statement complies with the requirements of CIMA.
• When records are held outside of the Cayman Islands, the Licensee must ensure that CIMA has access to the records regarding the entity or its clients at all reasonable times in accordance with relevant legislation and the other Rules.
• The conversion of any paper-based record to an electronic record must not hinder the availability of such records to CIMA. The use of technology to handle records does not absolve a Licensee from any record keeping obligations under the relevant legislation.
• Each Licensee (where applicable) must assess whether record keeping practices at the group-wide level meet the objective of the Company Manager Rules and Guidance. If not, the Licensee must adopt record keeping practices which align with the Company Manager Rules and Guidance.

The Guidance sets out steps and measures which CIMA expects Licensees to take in relation to their record keeping arrangements, which if followed will assist Licensees to comply with the Rules. The Guidance is not intended to be prescriptive or exhaustive.

The Company Manager Rules and Guidance recognise that record keeping arrangements will vary according to the manner in which the business of the Licensee is structured, organised, managed, its size, complexity, nature of business, and the risk profile of its operation, but emphasise that the overriding principle is that the records and systems must be adequate to satisfy the requirements of CIMA and the relevant legislation.

What are the consequences for failing to comply with the Rules?

If a Licensee fails to comply with the Rules, CIMA's policies and procedures contained in the Enforcement Manual will apply in addition to any other powers provided for under relevant legislation.  The enforcement actions available to CIMA for breach of the Rules include licence suspension and, in very serious cases, licence revocation.

How do requirements under the Company Manager Rules and Guidance differ to those under the General SOG?

Generally speaking, the requirements under the Company Manager Rules and Guidance, and those under the General SOG are similar, and there is significant overlap.

However, the Company Manager Rules and Guidance include some additional requirements, specifically those set out in the Personal Data Rule and the True and Fair View Rule. 

The following differences in requirements are also worth noting: (i) under the Company Manager Rules and Guidance, records must be provided to CIMA without delay, whereas, under the General SOG, records should be provided to CIMA within one to three business days from the date of request (in each case, unless a different timeframe is specified by CIMA); (ii) under the Company Manager Rules and Guidance, record keeping arrangements should be reviewed at least once a year, whereas, under the General SOG, record keeping arrangements should be reviewed periodically; (iii) under the Company Manager Rules and Guidance, the record retention policy should be in accordance with all relevant regulatory acts, regulations and measures (ie not limited to those in the Cayman Islands), whereas, under the General SOG, the record retention policy should be in accordance with all regulatory acts and other legal requirements in the Cayman Islands; and (iv) under the Company Manager Rules and Guidance, relevant records should not be kept outside the Cayman Islands if access to those records is likely to be restricted or delayed by laws and/or regulations governing the relevant jurisdiction outside of the Cayman Islands, whereas, under the General SOG, relevant records should not be kept outside the Cayman Islands if access to those records is likely to be restricted or delayed by confidentiality or data protection restrictions. 

The fundamental difference between the Company Manager Rules and Guidance, and the General SOG is that the former includes rules and guidance, whereas the latter is only guidance.

Only breach of a rule will give rise to a right of enforcement. Therefore, a key point to note for Licensees is that the Company Manager Rules and Guidance convert requirements that were previously just guidance under the General SOG into rules, meaning a breach of these may result in enforcement action.  This clearly indicates the increased importance attached by CIMA to having effective procedures and processes in place for record keeping.

Next Steps

The Company Manager Rules and Guidance are already in force in respect of New Licensees and, therefore, those entities should already be complying with the Rules and following the Guidance.  For Existing Licensees, the Company Manager Rules and Guidance do not come into effect until next year so there is still time for these entities to prepare.  At this stage, Existing Licensees should review their record keeping procedures and processes, and put in place appropriate measures to ensure that they are in compliance with the Company Manager Rules and Guidance when they come into effect on 1 April 2024.

In our experience, CIMA is minded to take a more robust and challenging approach to bringing enforcement cases, and this could also apply in enforcing the Company Manager Rules and Guidance.

Walkers can assist with all aspects of compliance with the Company Manager Rules and Guidance, including the implementation of relevant policies and procedures.  Please contact a member of the Regulatory & Risk Advisory practice group, or your usual Walkers contact, if you have any questions or would like any further assistance.