On 20 July 2026, Cayman Islands Monetary Authority's (CIMA) new Rule on Effective Compliance Programme for the Prevention and Detection of Money Laundering, Terrorist Financing and Proliferation Financing for Financial Services Providers (AML Rule) and a new Rule on Compliance with Financial Sanctions and Targeted Financial Sanctions (Sanctions Rule) were gazetted. Both Rules came into force on 18 September 2026. This advisory provides practical guidance and addresses frequently asked questions for the insurance sector. Our advisory providing a more general overview of the new Rules can be found here and the Walkers practical guidance of the new Rules for investment funds here.
Application
Do the new Rules apply to all licensed (re)insurers?
Not necessarily. The AML Rule applies only where an insurer or reinsurer is conducting "relevant financial business" as defined under the Cayman Islands Proceeds of Crime Act (POCA). The Sanctions Rule applies to all (re)insurers regulated by CIMA whether or not they conduct relevant financial business.
What is ‘relevant financial business’?
POCA defines ‘relevant financial business’ to include certain types of long term insurance, including life and annuity business, but excludes any 'reinsurance business' as defined in the Insurance Act. Not all activities conducted by a licensed insurer or reinsurer will necessarily constitute relevant financial business.
Does an insurer or reinsurer that does not conduct relevant financial business have any AML/CFT obligations?
While the AML Rule does not apply to an insurer or reinsurer that does not conduct relevant financial business, the Sanctions Rule still applies to all regulated persons supervised by CIMA, including insurers and reinsurers, irrespective of whether they write related business, third party business, or a combination of both. Additionally, obligations under Cayman Islands sanctions, the POCA, the Terrorism Act and the Proliferation Financing (Prohibition) Act apply to all persons in the Cayman Islands, whether they conduct relevant financial business or not and whether they are regulated or not.
These include specific reporting obligations to the Cayman Islands Financial Reporting Authority (FRA) such as (a) whether the insurer or reinsurer is required to file a sanctions report under applicable sanctions or a suspicious activity report (SAR), or (b) whether prior consent of the FRA must be obtained before engaging in any action or conduct that would otherwise amount to a specified money laundering offence under the POCA by filing a Defence Against Money Laundering SAR or "DAML SAR".
CIMA nevertheless expects insurers and reinsurers not conducting relevant financial business to have policies and procedures in place to prevent money laundering (ML), terrorist financing (TF) and proliferation financing (PF) from a sound risk management and internal controls perspective and to ensure compliance with sanctions and the broader financial crime obligations as noted above. The application of controls and measures, particularly around client due diligence (CDD), may be proportionate to a licensee's risk profile, where for example class B(i) captive insurers would typically be of lower risk given the insureds are affiliates within the same group and are generally well known to the insurer.
What about licensed insurance managers, insurance brokers and insurance agents?
The AML Rule applies to CIMA licensed insurance managers, insurance brokers and insurance agents only in relation to relevant financial business, and the Sanctions Rule applies regardless of whether they conduct relevant financial business. The other broader sanctions and financial crime obligations and CIMA's expectations for risk-based policies and procedures to prevent ML/TF/PF noted above will also apply.
The AML Rule
Where the AML Rule applies, what are the main changes for the insurance sector?
For persons licensed by CIMA under the Insurance Act (insurance licensees) within scope, the AML Rule elevates previously non-binding requirements from CIMA’s AML/CFT Guidance Notes to enforceable regulatory rules. Non-compliance may result in regulatory action including administrative fines (once the fines framework is in effect), noting CIMA has stated it does not intend to adopt a blanket enforcement approach upon the new Rule's effective date.
In the AML Rule, CIMA has clarified its expectations around effective independent audits, emphasised the importance of documented AML risk assessments in determining audit frequency and the CDD measures for long-term insurance business.
What is an effective independent audit?
The requirement for effective independent audits already exists under the Anti-Money Laundering Regulations (AMLRs). The AML Rule requires that the audit be carried out by 'suitably qualified persons who are independent and separate from those involved in the design, implementation, or operation of the policies, procedures, systems, and controls under audit, and who are free from any conflict of interest that could impair their objective judgment'.
This means the audit can be conducted by the insurance licensee's own independent internal audit function or an external auditor (such as Walkers Regulatory & Risk Advisory Group). Where the licensee's own independent internal audit function has conducted the first and second audits, the third audit must be conducted by an external auditor. CIMA has confirmed that AML Officers cannot carry out audits due to lack of separation and independence, and that audits do not need to be conducted by a financial auditor.
There is no prescribed audit frequency. The audit must be carried out at a frequency commensurate with the insurance licensee’s size, complexity, structure, nature of business, and the risk profile, as determined by a risk assessment carried out by its Board. As indicative examples, CIMA suggests the audit should be every 2 years for higher-risk entities, every 3 years for medium risk, and every 4 years for lower risk.
For insurance licensees with their own independent internal audit function, this may not be a heavy lift but should nevertheless review their arrangements to ensure compliance. This includes checking and documenting the independence of the auditor and reviewing the internal audit plan to ensure frequency of AML audits reflects the risk profile of the insurance licensee in line with its documented AML risk assessment and every third audit is conducted by an external auditor.
Why is the AML risk assessment important and what should it cover?
Not only is a documented AML risk assessment mandatory, but it is also crucial to support a risk-based approach to the audit, as a lower risk rating of the insurance licensee can support a lower intensity and frequency of audit if justified by the documented risk assessment. The risk assessment should address risks relating to customers, country in which customers reside, products and services and delivery channels including use of intermediaries. In particular, the assessment should include risks specific to the nature of insurance products being underwritten or sold, amounts involved, including single-premium policies, policies with investment features, policies permitting assignment or change of beneficiary, and products with cash-in or surrender values. CIMA requires insurance licensees to ensure their risk assessments are properly documented, approved and up-to-date.
How does CDD apply for long term insurance business?
The AML Rule reinforces, in line with the AMLRs, that in addition to CDD conducted on policyholders and beneficial owners at policy inception, CDD measures must be applied to beneficiaries as soon as they are identified or designated and, at the latest, at the time of payout.
The Sanctions Rule
What are the key requirements for insurance licensees?
The Sanctions Rule consolidates sanctions obligations including screening, asset-freezing, and reporting to the FRA and has introduced a "Without Delay" standard for implementing controls and procedures to ensure compliance with these obligations.
The Sanctions Rule states that it supports existing requirements set out in the CIMA's Rule on Risk Management for Insurers, which requires all CIMA regulated insurers and reinsurers to have a risk management framework that addresses all material risks including ML, TF and fraud risk. This reinforces CIMA's expectation for all insurance licensees to have policies and procedures to mitigate ML/TF/PF and sanctions risks even if they are not conducting relevant financial business.
At what points must sanctions screening be conducted?
The Sanctions Rule does not specify when sanctions screening needs to be conducted but states that applicants, customers, beneficial owners, transactions, services provided and other relevant parties including connected persons must be screened. This means all relevant parties to the (re)insurance policy or contract must be screened such as policyholders, named insureds, beneficiaries, cedants, and claims payees, and this screening must occur prior to any (re)insurance related transactions such as at policy/contract inception, renewal, endorsement, assignment, change of beneficiary, claims payment, and premium refund.
How quickly must customers and connected persons be re-screened upon list updates?
The Sanctions Rule requires that insurance licensees must have systems in place to re-screen their existing customers and connected persons "Without Delay" which means ideally within a matter of hours of a designation or of a list update being published.
Desk-based reviews
How will CIMA supervise and monitor compliance with the new Rules?
As mentioned above, CIMA has stated it does not intend to adopt a blanket enforcement approach upon the effective date of the new Rules. However, CIMA will conduct desk-based reviews in which it will request a copy of a regulated entity's documented risk assessment and methodology, along with a copy of its business plan.
Recommended actions and timing
When do the new Rules take effect?
The new Rules were gazetted on 20 July 2026 and came into force on 18 September 2026.
Is there a transitional period?
No. Existing licensees do not have a transitional period. New applicants must demonstrate compliance from licensing.
What steps should the insurance sector take now in practice?
- Assess the applicability of the new Rules and whether you are conducting relevant financial business.
- Conduct a gap analysis of current AML/CFT and sanctions frameworks against the new Rules.
- Update policies and procedures, including CDD, sanctions screening, SAR reporting, and record-keeping and use this opportunity to review and refresh against applicable sanctions and broader financial crime obligations.
- Review and enhance sanctions screening systems to cover all required touchpoints and enable re-screening within required timeframes.
- Review and update the AML risk assessment to ensure relevancy, accuracy and incorporate proliferation financing risk if not already included.
- Review internal auditor or audit function, audit plan and audit frequency.
- Provide training to underwriting, claims, and compliance staff on the new Rules where applicable, and refresh training on sanctions and broader financial crime obligations.
- Ensure appropriate governance, including Board-level oversight over AML and sanctions compliance and designation of AML compliance officer roles.
We can assist with independent audits, risk assessments, training, preparing and reviewing your Compliance Programme and any policies, procedures and controls. Please also click here to register for our AML Rule and Sanctions Rule compliance checklist.
Disclaimer
This advisory provides general information only and is not legal or regulatory advice. It should not be relied on as a substitute for advice on a specific matter. Please obtain independent professional advice before acting on it.
For further information, please contact your usual contact at Walkers or any member of our Insurance and Regulatory team listed below:
