CIMA Issues New AML Rule and New Sanctions Rule: Key Obligations for Cayman Islands Regulated Financial Service Providers

On 20 July 2026, the Cayman Islands Monetary Authority (“CIMA”) gazetted a new Rule on Effective Compliance Programme for the Prevention and Detection of Money Laundering, Terrorist Financing and Proliferation Financing for Financial Services Providers (the “AML Rule”), together with a companion Rule on Compliance with Financial Sanctions and Targeted Financial Sanctions (the “Sanctions Rule”, and together with the AML Rule, the “Rules”). The Rules will come into force on 18 September 2026, being sixty days after being gazetted.

The AML Rule is issued pursuant to sections 6(1)(b) and 34(1) of the Monetary Authority Act and, by its own terms, “shall have the force of law.”  It supplements, and is expressed to be subordinate to, the Anti-Money Laundering Regulations (the “AMLRs”), which prevail in the event of any inconsistency.² In substance, the AML Rule consolidates and distils obligations that have previously appeared in CIMA’s Guidance Notes on the Prevention and Detection of Money Laundering and Terrorist Financing in the Cayman Islands (the “Guidance Notes”) into a shorter, directly enforceable instrument. It also introduces several new or expanded obligations, most significantly in relation to (i) independent audit, (ii) outsourcing notification and (iii) compliance training, discussed in Section 5 below.

This Legal Update summarises the scope, key requirements and practical implications of the AML Rule for CIMA-regulated financial service providers (“FSPs”), and identifies the key areas requiring action ahead of the 18 September 2026 effective date.

FSPs conducting relevant financial business in or from the Cayman Islands are subject to an existing AML/CFT/CPF framework comprising the Proceeds of Crime Act (“POCA”), the AMLRs, the Terrorism Act (“TA”), the Proliferation Financing (Prohibition) Act (“PFPA”), the Beneficial Ownership Transparency Act, and the Guidance Notes. The Guidance Notes have not historically been formally binding, although non-compliance with them may be taken into account by CIMA in its supervisory and enforcement determinations.

The AML Rule departs from this position by making these key obligations fully enforceable, in contrast to the Guidance Notes, which are technically not enforceable although treated as binding in practice. Breaches of the AML Rule and the Sanctions Rule may lead to the imposition of a fine or regulatory action, and each Rule’s provisions take precedence over any prior or existing guidance notes, policy statements or interpretative materials issued by CIMA in the event of any inconsistency.

The reform should also be viewed against the wider context of the Cayman Islands’ preparation for its next FATF/CFATF mutual evaluation, with the onsite assessment currently expected in late 2027. The introduction of directly enforceable, auditable Rules, in place of non-binding guidance, is consistent with FATF’s emphasis on demonstrable effectiveness rather than mere existence of AML/CFT frameworks.

Section 5.1 of the AML Rule states that it applies to “all FSPs that are regulated and supervised by CIMA under the Regulatory Acts, including branches, subsidiaries, affiliates and any other members of a CIMA-regulated financial group.” This extends to all categories of CIMA-registered or licensed business, including registered mutual funds and private funds, Registered Persons under the Securities Investment Business Act, banks and trust companies, insurance and reinsurance licensees, securities investment business licensees, virtual asset service providers, money services businesses, and company managers and corporate services providers, together with branches, subsidiaries and affiliates forming part of a CIMA-regulated financial group.

The AML Rule does not apply to persons who are not registered with or licensed by CIMA. As the definition of “FSP” under the Rule tracks the AMLRs’ concept of “relevant financial business,” FSPs should confirm their regulatory status carefully rather than assume they fall outside scope.

Each FSP is required to implement a Compliance Programme that is commensurate with its size, complexity, structure, nature of business and risk profile. A proportionality principle accordingly applies throughout the Rule, such that the scale of a FSP’s Compliance Programme is expected to reflect its risk profile rather than a uniform standard applicable to all regulated entities.

The AML Rule and the Sanctions Rule come into force on 18 September 2026, being sixty days after their publication in the Gazette on 20 July 2026.  FSPs should treat this as the operative deadline by which any required amendments to their Compliance Programme, including documentation, governance and training arrangements, should be implemented.

The AML Rule identifies five (5) core components of an effective Compliance Programme, being: (i) designation of an AMLCO, MLRO and DMLRO; (ii) documented policies, procedures and controls; (iii) a documented risk-based approach and periodic risk assessment; (iv) an ongoing compliance training programme, supported by a documented training plan; and (v) ongoing evaluation of the Compliance Programme’s effectiveness, including independent audit. Each is addressed in turn below.

5.1. Governance and Designation of the AMLCO, MLRO and DMLRO

The Governing Body of the FSP (being, as applicable, the board of directors, general partner, manager or board of trustees) is required to establish and maintain a clear governance framework for the Compliance Programme, including documenting and assigning the roles and responsibilities of senior persons involved in its implementation and oversight, and designating an AMLCO, MLRO and DMLRO, each a natural person operating at no lower than management level.

1. The AMLCO must perform the compliance function “independently and objectively from the business and operational functions subject to their oversight, and, where full separation is not practicable, ensure conflicts of interest are effectively managed.” This is expressed as an expanded requirement, building on the AMLCO suitability criteria that already applied under the Guidance Notes.
2. The AMLCO retains overall responsibility for the Compliance Programme notwithstanding any delegation of specific duties, and is required to keep the Governing Body informed of the Compliance Programme’s operation, including escalation of any ML/TF/PF or sanctions issues, at least annually.
3. Neither the AML Rule nor the AMLRs require the AMLCO, MLRO or DMLRO to be based in the Cayman Islands. CIMA has separately confirmed, in its published AML FAQs for Funds, that these officers may be based outside the Cayman Islands, provided the applicable suitability criteria are satisfied and the FSP is able to comply with its Cayman Islands AML/CFT obligations.

5.2. Risk-Based Approach and Risk Assessment

FSPs are required to establish, implement and document a risk-based approach designed to identify, assess, manage and mitigate ML/TF/PF risks, having regard to customer/applicant types, geographic exposure, products, services, transactions and delivery channels, and taking into account the findings of the Cayman Islands National Risk Assessment.

The AML Rule introduces an express requirement to update the risk assessment “without delay” upon the occurrence of specified trigger events, namely: new products or business lines; expansion into higher-risk geographic areas; mergers, acquisitions or significant corporate restructuring; and economic or geopolitical developments affecting risk exposure.

5.3. Policies, Procedures and Customer Due Diligence

1. FSPs are required to document policies, procedures and controls covering, at minimum: risk assessment and application of the risk-based approach; customer due diligence (“CDD”) and ongoing monitoring, including enhanced measures for higher-risk customers such as politically exposed persons; record-keeping and retention; outsourcing of the Compliance Programme; suspicious activity detection, monitoring, investigation, escalation and reporting (including travel rule requirements, where applicable); and financial sanctions compliance, including screening against official sanctions lists. Policies should be formally approved by the Governing Body of the relevant FSP; and related procedures and controls require approval from senior management, the Governing Body, or both.
2. CDD is required to be conducted, among other triggers, in respect of any one-off transaction exceeding Cayman Islands Dollars 10,000 (or its equivalent), including where linked transactions of smaller value appear structured to circumvent that threshold, and in respect of all wire transfers.
3. Where a business relationship or transaction is established prior to completion of CDD, the AML Rule requires the FSP to apply heightened monitoring and scrutiny until verification is completed. This is a conditional accommodation rather than a general deferral of CDD obligations.
4. Authorisation documents evidencing a person’s authority to act on behalf of a customer must be certified, verified and retained, and CDD must be conducted on such a person to the same standard applicable to the customer.
5. The use of electronic-KYC and digital identity verification technologies remains expressly permitted, subject to the onboarding decision being risk-based.
6. Simplified due diligence remains available in respect of low-risk customers consistent with the National Risk Assessment, save that sanctions screening must continue to be applied irrespective of the application of simplified due diligence, and simplified due diligence is not available where any suspicion of ML/TF/PF exists.

5.4. Record-Keeping and Beneficial Ownership Information

1. Identification, verification, account, correspondence and transaction records must be retained for a minimum of five years following the end of the relevant business relationship or completion of the relevant one-off transaction, and must be available to CIMA without delay upon request.
2. The AML Rule imposes an express, standalone requirement that beneficial ownership information be maintained “accurate, adequate and up-to-date” and kept under periodic review, rather than merely retained, in respect of all customers that are legal persons or legal arrangements.¹¹ Such records must be retained for at least five years following dissolution of the customer or cessation of the customer relationship.

5.5. Independent Audit

1. FSPs are required to maintain an independent audit function to review and test the adequacy and effectiveness of the Compliance Programme. This requirement supplements Regulation 5 of the AMLRs and represents one of the more materially expanded obligations under the AML Rule.
2. The audit must be conducted by persons who are “suitably qualified” and “independent and separate from those involved in the design, implementation, or operation of the policies, procedures, systems, and controls under audit, and who are free from any conflict of interest that could impair their objective judgment.” FSPs must, upon request, be able to provide CIMA with documentation evidencing the basis on which such independence was determined.
3. Audit frequency remains risk-based, but the AML Rule imposes a new limit on internally-conducted audits: the audit must not be conducted internally for more than two consecutive audit cycles; the following cycle must be conducted by an external service provider.
4. The audit report must be filed with CIMA “as soon as practically possible” following completion, or as otherwise prescribed by CIMA. This is a new filing obligation for FSPs not previously required to submit audit reports as a matter of course.

5.6. Outsourcing

1. Pre-existing requirements to conduct risk assessment (including country risk) and due diligence prior to outsourcing, and to maintain a written outsourcing agreement addressing the parties’ respective rights and obligations, are reiterated.
2. The AML Rule introduces an express requirement to notify CIMA in writing, within a reasonable timeframe, of any outsourcing arrangement relating to a “material function” of the Compliance Programme, as “material function” is defined in CIMA’s Statement of Guidance on Outsourcing. Many FSPs are already subject to a general obligation to notify CIMA of material outsourcing arrangements under that Statement of Guidance; the AML Rule places the AML-specific limb of that obligation on an express, standalone footing.
3. An FSP may not enter into or continue an outsourcing arrangement where CIMA’s access to relevant data, information or systems may be impeded by confidentiality, secrecy, privacy or data protection restrictions.

5.7. Compliance Training

1. The AML Rule introduces a standalone requirement for a documented, forward-looking training plan, distinct from the delivery of training itself, addressing: (i) training recipients; (ii) training topics and materials; (iii) delivery methods; and (iv) training frequency.
2. Mandatory training recipients include client-facing staff and agents; persons involved in client transaction activities; persons handling cash, funds or virtual currency; and persons responsible for implementing or overseeing the Compliance Programme, including the AMLCO, senior management, information technology staff, Governing Body members and internal auditors.
3. Minimum training content must address the statutory framework (POCA, the AMLRs, the PFPA and the TA); ML/TF/PF background, terminology and typologies; sector-specific vulnerability indicators; recognition of transactions linked to ML/TF/PF or sanctioned parties; the FSP’s own policies and reporting, record-keeping and KYC requirements; and internal roles and responsibilities for detecting and escalating suspicious activity.
4. Training must be delivered at least annually, in addition to being delivered on the occurrence of relevant trigger events (for example, prior to a new employee dealing with clients, or following a change in procedure or applicable regulation).
5. Engagement of a third-party training provider does not, of itself, constitute outsourcing of the Compliance Programme, provided the FSP retains responsibility for determining training requirements, assessing the suitability of the provider and content, and overseeing the adequacy of delivery.
6. Training records, comprising at minimum the date of training, a list of attendees and the topics and content covered, must be maintained and made available to CIMA upon request.

The majority of the AML Rule’s provisions restate obligations already applicable under the AMLRs and the Guidance Notes, but now are consolidated into an enforceable instrument. The following represent the most significant substantive or procedural changes for FSPs to address.

By contrast, the substantive CDD framework, record-retention periods, suspicious activity reporting obligations, the concept of AMLCO/MLRO/DMLRO appointment, and the general risk-based approach are not materially altered from the position under the existing AMLRs and Guidance Notes.

CIMA has concurrently gazetted the Sanctions Rule, which applies to the same group of CIMA regulated FSPs and takes effect on the same date, 18 September 2026. The AML Rule expressly cross-refers to the Sanctions Rule in respect of detailed sanctions-screening obligations. As sanctions and targeted financial sanctions compliance is embedded throughout the AML Rule’s CDD, policy and training requirements, FSPs are advised to address compliance with both Rules as a single, coordinated exercise.

Any breach of the AML Rule is dealt with in accordance with CIMA’s Enforcement Manual, in addition to any other powers available to CIMA under the Regulatory Acts, the AMLRs and the Monetary Authority Act. As noted in Section 2 above, the Rule’s provisions take precedence over any inconsistent prior guidance, policy statement or interpretative material issued by the Authority.

FSPs, and their Governing Bodies, are advised to take the following steps in advance of the 18 September 2026 effective date:

1. Review existing AML/CFT/CPF policies, procedures and Compliance Programme documentation against the minimum requirements of the AML Rule, and remediate any identified gaps.
2. Confirm that arrangements evidencing the AMLCO’s independence are documented, particularly where full functional separation from business operations is not practicable.
3. Review recent audit history to determine whether the two most recent audit cycles were conducted internally and, if so, arrange for the next cycle to be conducted by an external service provider.
4. Establish a mechanism for timely filing of the Compliance Programme audit report with CIMA following completion.
5. Review and, where necessary, update the FSP’s (or, in the case of investment funds, the fund’s) documented risk assessment, ensuring it addresses the trigger events specified in the AML Rule.
6. Prepare or update a documented, forward-looking training plan addressing recipients, topics, delivery methods and frequency, as a deliverable distinct from training records.
7. Confirm that all outsourcing arrangements relating to material functions of the Compliance Programme have been, or will be, notified to CIMA in writing.
8. Review beneficial ownership data maintenance processes to confirm a periodic review mechanism, rather than mere retention, is in place.
9. Diarise the 18 September 2026 effective date and allow sufficient time for Governing Body approval of any updated policies and procedures prior to that date.

We can assist with a gap analysis of your existing Compliance Programme against the AML Rule and Sanctions Rule, drafting or updating AML policies and the required training plan, arranging or reviewing independent audits, and preparing board papers for Governing Body approval. Please get in touch if you would like to discuss any of the above.

View Full PDF

This publication is not intended to be a substitute for specific legal advice or a legal opinion. If you require further advice relating to the matters discussed in this Briefing Note, please contact us.  We would be delighted to assist.

E: gary.smith@loebsmith.com

E: robert.farrell@loebsmith.com

E: elizabeth.kenny@loebsmith.com

E: vanisha.harjani@loebsmith.com

E: vivian.huang@ loebsmith.com

E: yun.sheng@loebsmith.com  

E: faye.huang@loebsmith.com