On 20 July 2026, CIMA's new AML Rule and new Sanctions Rule were gazetted. The new AML Rule and Sanctions Rule apply to all CIMA-registered or licensed investment funds, as well as managers, advisers and any other CIMA-registered or licensed entities and come into force on 18 September 2026.
This advisory provides practical guidance for investment funds and addresses some frequently asked questions. Our advisory providing a more general overview of the new AML Rule and Sanctions Rule can be found here.
What are the main changes for investment funds?
The main changes relate to the requirement for regulated investment funds to have effective independent audits. This requirement already exists pursuant to the AMLRs and many investment funds addressed this requirement in practice by having their AMLCO conduct testing, especially of the fund’s investor procedures. However, this approach will no longer be sufficient. The AML Rule requires that the audit be carried out by 'suitably qualified persons who are independent and separate from those involved in the design, implementation, or operation of the policies, procedures, systems, and controls under audit, and who are free from any conflict of interest that could impair their objective judgment'.
Application
Do all entities that are subject to the AML Regulations have to comply with the AML Rule?
The AML Rule and the Sanctions Rule apply to all CIMA-registered or licensed investment funds, as well as managers, advisers and any other CIMA-registered or licensed entities. They do not apply to entities which are not CIMA-registered or licensed, even if such entities are subject to the AMLRs and have AML officers. Single investor funds, debt issuers and lenders are examples of entities that are subject to the AML Regulations but do not need to be CIMA registered or licensed and therefore do not have to comply with the AML Rule unless they are CIMA registered on a voluntary basis.
Scope of audit
Is the audit a review of the investor due diligence and screening procedures only?
No. It is not sufficient to audit investor due diligence and screening procedures only.
What does the audit have to cover?
The AML audit must be a documented review and testing of the investment fund’s (or other regulated entity’s) 'Compliance Programme', meaning its entire ‘framework of policies, procedures, controls, oversight and reporting mechanisms designed to ensure ongoing compliance with the AML/CFT/CPF Regime’, ensuring its adequacy, effectiveness and alignment with Cayman legislative and regulatory obligations. As the audit reviews and tests the roles of the AML officers, it cannot be conducted by the AML officers.
Does CIMA have specific expectations regarding the scope of audits of investment funds?
Yes. For audits of investment funds, there is no template but consideration needs to be given to the specific investment fund’s policies, controls and procedures, which should incorporate investor onboarding controls, ongoing due diligence, investment objective and policies, third party relationships, outsourcing, internal reporting, the training programme, record keeping, risk assessments, and the application of a risk-based approach.
Can audits be conducted on a bulk or service provider level?
No. CIMA states that it expects an audit of each individual investment fund should obtain sufficient and appropriate evidence to conclude on the design and operating effectiveness of the Compliance Programme of the individual investment fund. Accordingly, relying on a service-provider-level internal audit or a population-based review, without obtaining sufficient evidence regarding the individual investment fund’s Compliance Programme would not provide sufficient assurance. However, the audit will take account of any manager or administrator or other service provider-level audit. Naturally there will be considerable overlap where the same or similar procedures and policies are applied to multiple funds.
Frequency
How frequently does the audit have to be conducted?
There is no prescribed frequency. The audit need not necessarily be carried out annually. The audit must be carried out at a frequency commensurate with the investment fund’s size, complexity, structure, nature of business, and the risk profile, as determined by a risk assessment carried out by its governing body (being the investment fund's board of directors, general partner or trustee). Not only is a documented risk assessment mandatory, it is also crucial to support a risk-based approach to the audit, as a lower risk rating of the investment fund can support a lower intensity and frequency of audit - potentially only every two, three or even four years, if justified by the documented risk assessment. We expect that new funds will document their initial fund-level risk assessment at launch and any existing funds will ensure their fund-level risk assessments are properly documented, approved and up-to-date.
Auditor
Can the AMLCO conduct the audit?
No. CIMA has confirmed AML officers are not sufficiently independent or separate to carry out audits.
Does the audit need to be conducted by a financial auditor?
No. CIMA has confirmed that the audit does not need to be conducted by a financial auditor. The term 'audit' as used by CIMA is referring to 'assessment' or 'appraisal'.
Can the audit be conducted by the investment fund’s manager or administrator?
Potentially, if the manager or administrator has an internal audit team which is completely independent and separate from any staff involved in the fund's AML functions. As well as being independent and separate, such audit team staff would also need to be 'suitably qualified' to audit the investment fund's compliance with the Cayman AML/CFT/CPF Regime. Although a manager or administrator may have a standalone internal audit function, its purpose will typically be to audit the manager or administrator to its own U.S. or other standards rather than to audit investment funds' compliance with the Cayman AML/CFT/CPF Regime. It will be necessary to identify auditors who are independent, separate and suitably qualified with respect to the Cayman AML/CFT/CPF Regime. We anticipate that where investment managers do not have this sort of function, or whose internal function does not consider itself suitably qualified as to the Cayman AML/CFT/CPF Regime, the fund's governing body will engage an independent third party to conduct each audit.
Can the audit be conducted by Walkers?
Yes. Walkers law firm's Regulatory & Risk Advisory Group carries out independent audits and does so for investment funds, as well as other types of CIMA-registered and licensed entities. For clients with an appropriate internal audit function, we can also give advice and guidance as to the frequency, coverage and format of the internally-conducted independent audits described above.
Third audits
What is the requirement for every third audit to be conducted by an external auditor?
There is a requirement that where a regulated entity has its own independent internal audit function which conducts the first and second audits (which is unlikely to be the case for many investment funds), the third audit must be conducted by an external auditor.
Is a fund’s manager or administrator regarded as internal or external?
Managers and administrators are deemed to be internal to the investment fund for the purposes of the AML Rule. If a manager or administrator had an internal audit team which was independent, separate and suitably qualified to audit the investment fund, every third audit would need to be conducted by an external auditor (such as Walkers Regulatory & Risk Advisory Group).
Is it only the third audit that cannot be carried out by the AMLCO?
No. AMLCOs cannot conduct any audits. The above FAQs and requirements for independence and separation apply to all audits, not the third audit only.
Submissions to CIMA and fund documentation
How will CIMA assess independence and separation in practice?
Investment funds must be ready to provide CIMA with the documentation of the independence of any person who performed the audit, including the basis on which independence was determined by the investment fund, so this should be considered and documented now if not already done.
Does the audit report need to be submitted to CIMA?
Yes. The audit report needs to be submitted to CIMA by the investment fund as soon as practically possible after the completion of the audit, or as otherwise prescribed by CIMA. This is a change, as investment funds have not until now been required to file audit reports with CIMA.
How are audit reports to be submitted to CIMA?
There is no set process for submitting audit reports and a complex filing process is not anticipated. CIMA has not indicated that a fee will be charged.
Will there need to be amendments to documentation such as private placement memorandum or board meeting agendas?
We do not anticipate the new AML Rule to require any specific updates to offering memorandums or other investor-facing documentation. Boards should note the AML Rule and Sanctions Rule and outline the steps that are being taken to comply.
Roles and responsibilities
Does the audit requirement diminish the roles or responsibilities of the AMLCO or governing body?
No. On the contrary, the revised audit requirement puts more focus on the role of the AMLCO, who is now subject to an additional layer of scrutiny and whose performance will be reviewed as part of the audit report filed with CIMA. Where an AMLCO is not completely familiar with Cayman requirements, any weaknesses will come to light in an AML audit. The investment fund and its governing body remain ultimately responsible for ensuring the investment fund’s Compliance Programme is adequate and operates effectively and for selecting an independent, suitably qualified auditor.
Have the criteria for who can act as AMLCO changed?
The AML Rule largely reiterates the suitability criteria of an AMLCO, with which investment funds should already be familiar. However, it also includes a new requirement that the AMLCO must 'perform the compliance function independently and objectively from the business and operational functions subject to their oversight, and, where full separation is not practicable, ensure conflicts of interest are effectively managed'.
Are the AMLCO, MLRO and DMLRO required to have specific knowledge and understanding of the Cayman Islands’ AML/CFT/CPF/TFS requirements?
Yes. It remains the responsibility of investment funds to ensure that their AMLCO, MLRO and DMLRO have specific knowledge regarding the applicable Cayman Islands legislative, regulatory and other AML/CFT/CPF/TFS requirements.
Can the AMLCO still be located overseas?
It remains the case that the AMLCO of an investment fund does not need to be based in the Cayman Islands, as long as they have specific knowledge and understanding of the Cayman Islands AML/CFT/CPF/TFS requirements.
Does the AMLCO have to possess formal qualifications for the role?
CIMA has said in FAQs relating to the AML Rule that the AMLCO must possess an appropriate professional qualification, although this requirement does not appear in the AML Rule itself.
Is the AMLCO personally accountable for all AML compliance failures?
The AMLCO is expected to ensure that the requirements set out in the AML Rule and the AMLRs are adopted by the investment fund. An AMLCO may be personally liable for an investment fund’s AML compliance failure where this amounts to a breach of the AMLRs and the breach is attributable to the AMLCO’s conduct. However, the investment fund and its governing body remain ultimately responsible for AML/CFT/CPF/TFS compliance.
Outsourcing
Do investment funds have a new requirement under the AML Rule to notify outsourcings to CIMA?
No. Investment funds already meet this requirement by various mechanisms including but not limited to filing updated offering memorandums (where applicable) and AML-related officer change forms. Therefore, there will be no new requirement for investment funds to report this information.
Recommended actions and timing
What has to be done by the 18 September 2026, when the AML Rule comes into effect?
There is no 'grace period' other than from now until 18 September 2026 although an audit is not required to be filed by this deadline. While the AML Rule does not specify a deadline for funds to submit their first audit to CIMA, at a minimum funds should determine their appropriate frequency of audits, and anticipate submitting their first audit within that period from 18 September 2026 (so a fund that determines a two-year audit frequency would submit their first audit by 18 September 2028).
Will there be further guidance?
CIMA has already published the AML Rule and Sanctions Rule and related FAQs, and we have been closely involved in the consultation discussions and feedback, so we are not necessarily expecting anything further. Investment funds should not wait for further guidance.
What steps should investment funds take now in practice?
Investment funds should take the following steps.
- Review their audit history and determine if and when their Compliance Programme was last independently assessed (as this will drive timing of the first audit under the AML Rule). As noted above, we expect that while funds have complied with the prior requirements as to independent assessment, they are unlikely to have performed an internal or external independent audit of the sort now required.
- Identify an independent, suitably qualified auditor and document how independence and conflicts have been assessed.
- Define an appropriate intensity and frequency of audits based on the investment fund’s risk assessment. The Walkers Regulatory & Risk Advisory Group (which uses a tailored risk assessment tool) can assist with an investment fund's documented risk assessment, if this is not already in place.
- Establish processes, including governing body oversight, for reviewing findings, overseeing remediation and managing regulatory reporting requirements.
- Conduct a gap analysis of their Compliance Programmes against the expanded requirements of the AML Rule and Sanctions Rule. At a minimum, investment funds will need a training record and may need other adjustments to their training programme.
