CIMA Publishes FAQs on the New AML Rule and Sanctions Rule

In our Legal Briefing dated 29 July 2026, we set out the scope, key requirements and practical implications of the new Rules gazetted by the Cayman Islands Monetary Authority (“CIMA“) on 20 July 2026, being: (i) the Rule on Effective Compliance Programme for the Prevention and Detection of Money Laundering, Terrorist Financing and Proliferation Financing for Financial Services Providers (the “AML Rule“) and (ii) the Rule on Compliance with Financial Sanctions and Targeted Financial Sanctions (the “Sanctions Rule“, and together with the AML Rule, the “Rules“).

The Rules came into force on 18 September 2026 (the “Effective Date“).

On 24 September 2026, CIMA published updated FAQs providing practical guidance on the application and enforcement of the Rules (the “CIMA FAQs“).

While the CIMA FAQs do not amend the Rules, they clarify several areas that were uncertain when the Rules were gazetted, particularly in relation to (i) governance and Anti-Money Laundering Compliance Officer (“AMLCO“) requirements, (ii) the independent audit function, and (iii) financial sanctions and targeted financial sanctions.

While our previous Legal Briefing noted that breaches of the AML Rule would be addressed under CIMA’s Enforcement Manual from the Effective Date, the CIMA FAQs provide some important context. CIMA has confirmed that it does not intend to take a blanket enforcement approach from the Effective Date and the administrative fines framework for breaches of the AML Rule is not yet in effect.

However, this should not be interpreted as a grace period. CIMA will continue to monitor compliance through its ordinary risk-based supervisory activities, including on-site inspections, desk-based reviews, thematic reviews and risk and compliance meetings, with the nature and extent of its oversight reflecting the size, complexity and risk profile of each Financial Services Provider (an “FSP“) such investment funds, VASP licensees, etc.

The CIMA FAQs provide clarity on the following aspects of the AMLCO role:

• Accountability of FSP and AMLCO: The FSP remains ultimately responsible for AML/CFT/CPF/TFS compliance. However, the AMLCO is expected to ensure that the requirements set out in the Rules and the Anti-Money Laundering Regulations (2025 Revision) (the “AMLRs“) are adopted by the FSP. Accordingly, an AMLCO may be personally liable for an FSP’s AML compliance failure where this amounts to a breach of the AMLRs and such breach is attributable to the AMLCO’s conduct.
• Qualifications: An AMLCO should have appropriate professional qualifications, relevant Cayman Islands AML/CFT/CPF/TFS knowledge and sufficient experience appropriate to the FSP’s business activities, size, complexity and risk profile, together with a good reputation and integrity.
• Operational duties: An AMLCO may perform additional operational duties. However, the FSP should be able to demonstrate to CIMA that these additional responsibilities do not impair the AMLCO’s independence, create a conflict of interest or impede the effective discharge of their AML/CFT/CPF/TFS responsibilities.
• Independence: An AMLCO must have sufficient autonomy and authority to act objectively, manage conflicts and escalate issues directly to senior management or the governing body. Complete separation from other business activities is not required.
• Outsourcing: The AMLCO function may be outsourced to a suitably qualified individual. However, outsourcing does not transfer the FSP’s or governing body’s accountability and the AMLCO must retain sufficient authority, independence, resources and access to information.
• Multiple roles: One individual may perform multiple AML roles (such as AMLCO and DMLRO) where permitted, provided conflicts are appropriately managed and the AMLCO can effectively discharge all responsibilities.

The CIMA FAQs clarify several aspects of the independent AML audit requirement:

• Timing and filing: FSPs do not need to conduct or commission an audit simply because the AML Rule is in force. There is no universal or industry-wide deadline for the first filing. AML audit reports should be submitted to CIMA following completion of the audit, in accordance with the FSP’s existing risk-based audit cycle. An FSP that has never completed an AML audit must do so under the pre-existing requirements and submit the report once the audit is complete.
• Scope: CIMA does not prescribe a standard audit methodology or report format. The audit should be proportionate to the FSP’s size, nature, complexity and risk profile, and should cover the effectiveness of its AML/CFT/CPF/TFS compliance programme (the “Compliance Programme“), including governance, risk assessments, CDD/EDD, sanctions screening, transaction monitoring, SAR reporting, training, employee screening and fitness and propriety controls, and outsourced functions.
• Frequency: Annual audits are not required and no frequency is prescribed by CIMA. The frequency, scope and depth of an AML audit should be determined using a risk-based approach, considering the FSP’s size, complexity, business activities and ML/TF/PF/TFS risk exposure. CIMA gives the following examples of risk-based audit cycles: two years for higher-risk FSPs, three years for medium-risk FSPs and four years for lower-risk FSPs.
• Rotation: At least one audit in every three audit cycles must be conducted externally.
• Auditor and independence: Audits may be conducted by internal audit, external auditors or suitably qualified independent consultants, provided the auditor is independent of the AML/CFT/CPF/TFS function and has no role in its operation, management or oversight. The AMLCO, MLRO and DMLRO cannot audit the areas they are responsible for, regardless of whether they are employees or outsourced providers.
• Deficiencies: An audit remains valid even where it identifies deficiencies. Findings should be documented and remediated and may be taken into account by CIMA as part of its supervisory assessment.
• Service provider audits: An FSP may rely on a service provider’s AML audit only if it specifically assesses the FSP’s own Compliance Programme and controls. A general audit of the service provider’s AML framework is not sufficient.

nvestment funds remain subject to the independent AML audit requirement even where their AML/CFT/CPF/TFS functions or other operations are outsourced, including to a Fund Administrator. The audit should obtain sufficient and appropriate evidence to assess the design and effectiveness of the investment fund’s own Compliance Programme, including its governing body’s oversight of any outsourced arrangements.

AML audits for investment funds may use risk-based sampling, provided the approach is proportionate to the size, nature, complexity and ML/TF/PF/TFS risk profile of the investment fund. The independent auditor should be able to demonstrate that the sample provides sufficient coverage to assess the effectiveness of the investment fund’s Compliance Programme.

As noted in section 4 above, an audit of the AML framework of a service provider engaged by an investment fund, such as its Fund Administrator, will not by itself satisfy the fund’s independent AML audit requirement. The audit for an investment fund must include fund-specific testing of how the outsourced arrangements are implemented and operate in practice. For example, where sanctions screening is outsourced to a service provider (“OSP“), the independent auditor should review relevant evidence of the OSP’s sanctions screening policies and procedures, testing and results relating to the investment fund. This evidence, together with fund-specific testing, should support the assessment of the design and operating effectiveness of the fund’s own Compliance Programme.

The CIMA FAQs clarify that the Sanctions Rule applies to all regulated persons supervised by CIMA, regardless of whether they carry out “relevant financial business” as defined under the Proceeds of Crime Act (2025 Revision). Accordingly, the Sanctions Rule has a broader scope than the AMLRs, which apply to FSPs conducting “relevant financial business”.

We can assist with assessing your existing Compliance Programme against the requirements of the AML Rule and Sanctions Rule, drafting or updating AML policies and training plans, arranging or reviewing independent AML audits, and preparing materials for governing body approval. If you would like to discuss how the Rules may apply to your business or need assistance with implementation, please get in touch with us.

View Full PDF

This publication is not intended to be a substitute for specific legal advice or a legal opinion. For specific advice on the matters covered above, please contact your usual Loeb Smith attorney or any of the following: