Following industry consultation, on 20 July 2026 the Cayman Islands Monetary Authority (CIMA) published a new Rule on Effective Compliance Programme for the Prevention and Detection of Money Laundering, Terrorist Financing and Proliferation Financing for Financial Services Providers (AML Rule) and a new Rule on Compliance with Financial Sanctions and Targeted Financial Sanctions (Sanctions Rule).
What is the application and timing of the AML Rule and the Sanctions Rule?
The AML Rule and the Sanctions Rule apply to all CIMA registered or licensed financial service providers (CIMA Regulated FSPs), which includes all registered investment funds and all other CIMA registered or licensed entities. The AML Rule and the Sanctions Rule do not apply to financial services providers (FSPs) which are not CIMA registered or licensed. The date on which the AML Rule and the Sanctions Rule are in force is 18 September 2026.
What is the rationale for introducing the AML Rule and the Sanctions Rule?
All Cayman Islands persons are already subject to the Proceeds of Crime Act (POCA), the Terrorism Act (TA), the Proliferation Financing (Prohibition) Act (PFPA) and various sanctions legislation (Sanctions).
FSPs must, in addition, also comply with the Anti-Money Laundering Regulations (AMLRs) and CIMA's Guidance Notes on the Prevention and Detection of Money Laundering, Terrorist Financing and Proliferation Financing in the Cayman Islands (Guidance Notes). The AML Rule and the Sanctions Rule distil the key obligations from the Guidance Notes (which are 245 pages long) into a relatively few pages and make these key obligations fully enforceable (in contrast to the Guidance Notes, which are technically not enforceable although treated as binding in practice). Breaches of the AML Rule and the Sanctions Rule may lead to the imposition of a fine or regulatory action. As enforceability is an important aspect of compliance with the global standards set by the Financial Action Task Force, the AML Rule and Sanctions Rule underline the jurisdiction's ability to demonstrate the effectiveness of its framework.
What is new?
The AML Rule and Sanctions Rule largely reiterate existing requirements which should already have been implemented by all FSPs. However, the AML Rule creates certain expanded requirements which CIMA Regulated FSPs will need to implement. This advisory is not intended as an overview of the pre-existing framework but, rather, summarises key new points to note and action.
1. Governance of the Compliance Programme
The AML Rule introduces a new defined term of 'Compliance Programme' meaning 'a documented framework of policies, procedures, controls, oversight and reporting mechanisms designed to ensure ongoing compliance with the AML/CFT/CPF Regime'. This is not a new obligation in substance and FSPs should already have in place what amounts in practice to a Compliance Programme. However, Walkers can review any existing Compliance Programme for compliance.
The AML Rule introduces more emphasis on delineating and documenting the governance framework for the Compliance Programme. Again, FSPs should already have done this, with clearly documented roles and responsibilities for the Governing Body, anti-money laundering compliance officer (AMLCO), money laundering reporting officer (MLRO) and deputy money laundering reporting officer (DMLRO) and any outsourced service providers (with the FSP retaining ultimate responsibility for any outsourced compliance).
2. Effective independent audit
Regulation 5 of the AMLRs requires that FSPs maintain an 'appropriate effective risk-based independent audit function' which is expanded on in the Guidance Notes. However, the AML Rule adds new facets to this requirement. First, the AML Rule requires that the Compliance Programme audit be carried out by 'suitably qualified persons who are independent and separate from those involved in the design, implementation, or operation of the policies, procedures, systems, and controls under audit, and who are free from any conflict of interest that could impair their objective judgment'. CIMA Regulated FSPs must be ready to provide CIMA with the documentation of the independence of any person who performed the Compliance Programme audit, including the basis on which independence was determined, so this should be considered and documented now if not already done. This function does not need to be carried out by a CIMA-approved financial auditor.
Second, the AML Rule stipulates that the Compliance Programme audit report be filed with CIMA as soon as practically possible after the completion of the audit, or as otherwise prescribed by CIMA. Currently many CIMA Regulated FSPs are not required to file their audit reports with CIMA.
Third, every third audit must be conducted be an external service provider. The AML Rule expresses this by stipulating that the AML Rule provides that the Compliance Programme audit must not be undertaken internally for more than two consecutive audit cycles. If the audit is conducted internally for two consecutive audit cycles, then the next audit must be conducted by an external service provider.
The AML Rule also provides that the Compliance Programme audit must be carried out at a frequency commensurate with the CIMA Regulated FSP's size, complexity, structure, nature of business, and the risk profile, as determined by the CIMA Regulated FSP's risk assessment or as otherwise required by CIMA.
CIMA recognises that investment funds and some securities investment businesses and others with no employees of their own rely on service providers. CIMA acknowledges that while structures and outsourcing arrangements are relevant to determining the appropriate scope and frequency of audits, they do not remove the requirement for an independent audit under the AMLRs but confirms that the audits may be performed at the service provider level.
Regardless of whether the Compliance Programme audit is outsourced, the CIMA Regulated FSP remains ultimately responsible for ensuring that the Compliance Programme is adequate and operates effectively.
Walkers can assist with independent audits, including conducting an external audit as now required by the AML Rule.
3. Risk assessment
The AML Rule reiterates the existing requirement set out in the AMLRs and Guidance Notes that a FSP must conduct and document a risk assessment of its own exposure to money laundering (ML), terrorism financing (TF) and proliferation financing (PF) risks. The risk assessment must include a number of statutory data points prescribed by the AMLRs.
To the extent that any CIMA Regulated FSP has not already documented its risk assessment (which in the case of investment funds must be at fund level, not manager or advisor level), this should be addressed now. Risk assessments which have been documented in the past should be reviewed to confirm that they remain up-to-date. CIMA Regulated FSPs need to be able to provide their written risk assessments to CIMA on request.
Not only does the AML Rule make clear that having a documented risk assessment will be an area of focus for CIMA, but such risk assessment will be vital in underpinning any risk-based approach, particularly in determining the frequency of independent audits.
For example, if a CIMA Regulated FSP considers that independent audits should be carried out less frequently than annually, it will need to have documented the basis for such conclusion in its documented risk assessment. In practice, once a risk assessment has been completed, it will be relatively easy to keep up-to-date. Please click here if you would like details of our risk assessment tool.
4. AMLCOs
The AML Rule largely reiterates the suitability criteria of an AMLCO, with which FSPs should already be familiar. The AML Rule also includes a new requirement that the AMLCO must 'perform the compliance function independently and objectively from the business and operational functions subject to their oversight, and, where full separation is not practicable, ensure conflicts of interest are effectively managed'. It remains the case that the AMLCO, MLRO and DMLRO are not required to be based in the Cayman Islands (subject to any licence-specific requirements). It also remains the case that notwithstanding the designation of an AMLCO, who has overall responsibility for the proper implementation and effectiveness of the Compliance Programme, the FSP remains ultimately responsible.
The AML Rule requires the AMLCO to ensure that the Compliance Programme includes appropriate systems, controls and procedures to ensure effective maintenance of records, including in relation to declined business, politically exposed persons (including family members and close associates), competent authority requests, suspicious activity reports, transaction alerts and sanctions.
5. Policies and procedures
As is already the case, FSPs must document their compliance policies, procedures and control mechanisms. The AML Rule specifies that, at a minimum, such policies and procedures shall address:
(a) risk assessment and application of a risk-based approach;
(b) customer due diligence (CDD) and ongoing monitoring, including enhanced measures for higher-risk customers;
(c) record-keeping and retention;
(d) outsourcing of all or part of the Compliance Programme;
(e) procedures for suspicious activity detection, transaction monitoring, investigation, escalation and reporting, as well as travel rule requirements if applicable; and
(f) financial sanctions compliance, including screening against official sanctions lists.
The AML Rule requires CIMA Regulated FSPs to make their Compliance Programme's policies, procedures and control documents accessible to all relevant parties, including any parties executing relevant outsourced functions. CIMA acknowledges that investment funds and some other FSPs outsource their AML functions and rely on the policies and procedures of their AML service provider. The AML Rule reiterates that in these circumstances, the CIMA Regulated FSP retains ultimate responsibility for compliance and specifies that in these circumstances the CIMA Regulated FSP must be ready to provide on request 'timely and sufficient evidence demonstrating how it remains satisfied that such relied-upon functions comply with the requirements under the AML Rule and the AMLRs'.
Policies must be approved by the Governing Body, while related procedures and controls must be approved by either senior management or the Governing Body (or both). Further, the Governing Body must ensure that such policies and procedures are reviewed and updated in a timely manner, proportionate to the size, complexity, structure, nature of business, and risk profile of its operations, and to reflect changes in risk, business activities, or regulatory requirements.
6. Customer due diligence and screening
The AML Rule reiterates key elements relating to CDD, transaction monitoring and screening as set out in the AMLRs and Guidance Notes. Generally, the AML Rule does not introduce new requirements in this regard so assuming CIMA Regulated FSPs are already compliant, no changes should be needed. However, it is worth flagging that the AML Rule does specify that where a business relationship is established or a transaction conducted prior to completing CDD, heightened monitoring and scrutiny should be applied until such time as the required verification is completed. Also, under the AMLRs and the Guidance Notes, when verifying the identity of a person who purports to act on behalf of a customer, the AML Rule specifies that the authorisation document must be certified.
Although already permitted by the Guidance Notes, it is helpful that the AML Rule reiterates FSPs' ability to use electronic-Know Your Client (e-KYC) methods and digital ID technologies, subject to ensuring that any decision to onboard a customer remotely using such technologies is dependent on the risks presented and assessed.
CIMA confirms that even where it is possible to apply simplified due diligence to a customer, sanctions screening in accordance with the requirements of the AMLRs and Sanctions must still be conducted.
7. Record-keeping
The AML Rule reiterates the existing record-keeping requirements as set out in the AMLRs and Guidance Notes. Thus, it continues to be the case that FSPs must maintain all identification and verification data obtained through the CDD process, account files, business correspondence and transaction records for at least five years after the end of a business relationship or the completion of a one-off transaction. Such records must be retained in a manner that ensures they are available to CIMA upon request without delay.
The AML Rule also provides that CIMA Regulated FSPs must obtain, maintain and keep accurate, adequate and up-to-date beneficial ownership information for all customers that are legal persons or legal arrangements and keep such beneficial ownership information under periodic review. CIMA Regulated FSPs must retain beneficial ownership records for at least five years after the date on which the customer is dissolved or otherwise ceases to exist or ceases to be a customer of the CIMA Regulated FSP. The requirement to keep beneficial ownership information 'up-to-date' should be interpreted consistent with the Guidance Notes on ongoing monitoring, which provide that information should be kept current through proportionate, risk-based measures and is not intended to require the automatic or routine re-verification or renewal of identification documents relating to beneficial owners.
8. Outsourcing
The Guidance Notes require that FSPs conduct a risk assessment prior to entering into any outsourcing agreement. The outsourcing contract must contain prescribed content. The AML Rule reiterates these requirements but also introduces a requirement that CIMA be notified of any outsourcing agreement that relates to material functions (as defined in CIMA's Statement of Guidance on Outsourcing) of the CIMA Regulated FSP's Compliance Programme. Most CIMA Regulated FSPs are already subject to a requirement to notify CIMA of material outsourcings pursuant to CIMA's Statement of Guidance on Outsourcing (which applies to all outsourcings, not just AML).
FSPs remain ultimately responsible for compliance with the AMLRs and the AML Rule, regardless of any outsourcing. When outsourcing all or any of its Compliance Programme, the CIMA Regulated FSP must conduct and keep records of the due diligence and risk assessment conducted on the service provider prior to the outsourcing arrangement.
9. Training
The AML Rule expands on what, at a minimum, training must include and who must receive it. It also introduces a requirement for a training plan.
Training recipients: The AML Rule requires that CIMA Regulated FSPs 'establish, document, and implement an effective training programme and plan that ensures that all relevant employees, agents, and other persons authorised to act on their behalf understand and comply with the requirements of POCA, the AMLRs, the TA, the PFPA, and all applicable legislation'. CIMA has confirmed that this does not extend to third parties, such as agents and service providers authorised to act on a CIMA Regulated FSP's behalf, which train their own staff. The recipients of such training must include those who:
(a) have contact with clients, such as front-line staff or agents;
(b) are involved in client transaction activities;
(c) handle cash, funds, or virtual currency for the CIMA Regulated FSP, in any way; and
(d) are responsible for implementing or overseeing the Compliance Programme, including the AMLCO, senior management, information technology staff, members of the Governing Body and internal auditors.
Training content: Pursuant to the AML Rule, the training programme of each CIMA Regulated FSP must, at a minimum, cover the following::
(a) the requirements under POCA, AMLRs, PFPA, TA and applicable legislation;
(b) background information on ML/TF/PF, including related technical jargon, interpretations, definitions, methods, and activities;
(c) the business or professional vulnerability to ML/TF/PF risks (providing indicators and examples);
(d) recognition and treatment of transactions carried out by, or on behalf of, any person who is, or appears to be, engaged in ML/TF/PF, or whose assets are subject to financial sanctions and TFS applicable in the Cayman Islands;
(e) the policies and procedures developed to meet the requirements under the relevant acts and associated regulations for preventing and detecting ML/TF/PF risks, including the reporting, record keeping and KYC requirements; and
(f)the internal systems, roles and responsibilities for detecting and deterring ML/TF/PF activities and handling suspicious activities or transactions.
Training plan: The AML Rule imposes a new requirement for CIMA Regulated FSPs to have a documented forward looking training plan and schedule for delivering and implementing their ongoing compliance training programme. Where a CIMA Regulated FSP provides different types of training to its employees, agents, or other persons authorised to act on its behalf based on their specific roles and duties, the rationale must be explained in the CIMA Regulated FSP's training plan. The training plan must include descriptions of:
(a) training recipients;
(b) training topics and materials;
(c) training methods for delivery; and
(d) training frequency.
External providers: While a CIMA Regulated FSP may use an external service provider to manage its training programme, it must assess and determine whether the external service provider's services and training content are appropriate to the size, complexity, structure, nature of business and risk profile of its operations. The procurement of third-party AML/CFT/CPF training services does not constitute outsourcing of the Compliance Programme, provided that the CIMA Regulated FSP retains full responsibility for determining training requirements, assessing the suitability of the provider and content, and overseeing the adequacy of training delivered.
Frequency: The CIMA Regulated FSP's training programme must be delivered at regular intervals (for example, monthly, semi-annually or, at a minimum, annually), when certain events occur (for example, before a new employee deals with clients or after a procedure or regulation is changed) or by using a combination of both.
Record: A CIMA Regulated FSP's training record must include, at a minimum, when the training took place, a list of the attendees who received the training, and the topics and content that were covered. This record must be made available to CIMA upon request.
Walkers can assist with compliance, including delivering training programmes and documenting training plans and records in accordance with the AML Rule.
What are the next steps?
CIMA states that CIMA Regulated FSPs should review their Compliance Programmes to assess if they meet the requirements of the AML Rule and Sanctions Rule and make necessary changes. The AML Rule and the Sanctions Rule are valuable in preparing for inspections and responding to AML Returns. We can assist with independent audits, risk assessments, training, preparing and reviewing your Compliance Programme and any policies, procedures and controls. Please also click
here to register for our AML Rule and Sanctions Rule compliance checklist.
