CIMA's New Rules: What Cayman Funds Need to Know About Demonstrating Effectiveness

Author: Kenyon Shubert

The Cayman Islands Monetary Authority's (CIMA) new AML Rule and Sanctions Rule are now in effect, marking one of the more significant AML compliance developments for Cayman-regulated entities in recent years.

While much of the underlying guidance will be familiar to fund industry participants, the new Rules formally codify regulatory expectations and provide additional clarity around AML program governance, independent testing, sanctions compliance, and risk-based oversight.

For Cayman funds and their service providers, the key question is not whether AML obligations have changed dramatically, but rather how existing programs should evolve to meet the regulator's clarified expectations as articulated through the new Rules, the published FAQs and CIMA’s recent webinar.

From Guidance to Enforceable Requirements 

In February 2026, CIMA opened consultations on two proposed measures: 

• The Rule on Effective Compliance Programme for the Prevention and Detection of Money Laundering, Terrorist Financing and Proliferation Financing for Financial Services Providers

• The Rule on Compliance with Financial Sanctions and Targeted Financial Sanctions

The initiative was driven in part by feedback received during the Caribbean Financial Action Task Force's Fourth Round Mutual Evaluation. CIMA's stated objective was to make portions of its AML Guidance Notes legally enforceable while providing greater clarity around regulatory expectations.

Following consultation, both Rules were gazetted on July 20, 2026, and became effective on September 18, 2026. The AML Rule establishes requirements for maintaining an effective AML/CFT compliance program, while the Sanctions Rule establishes clear standards for sanctions reporting, recordkeeping, risk assessments, and asset-freezing obligations. Both Rules essentially put existing guidance into enforceable terms but also clarify key rules of the road in both areas.

The Emerging Focus on AML Program Audits 

For many sophisticated fund structures, the practical impact of the new Rules may be less dramatic than initially anticipated. Perhaps the most consequential aspect of the AML Rule is its clarification of regulatory expectations surrounding independent AML audits.

The Rule reinforces CIMA's expectation that regulated entities conduct independent reviews of their AML programs and that testing be performed by individuals independent from the design, implementation, or operation of the controls being assessed.

While the principle itself is straightforward, applying it within a Cayman fund structure can be more complex. AML and sanctions compliance responsibilities are often distributed across multiple stakeholders, including:

• Investment managers

• Fund administrators

• AML officers and AML service providers

• Directors

• Legal and compliance advisers

Customer due diligence, transaction monitoring, program development, portfolio risk assessment and AML governance are rarely housed within a single organization. As a result, determining how a comprehensive program-level audit should be structured requires coordination among several parties.

The AML Rule establishes the expectation, but many of the practical questions related to implementation remain under active discussion across the industry.

What CIMA Has Clarified in Helpful Summaries

Recognizing these questions, CIMA has supplemented the Rules with Frequently Asked Questions that provide important context regarding audit expectations and other aspects of the Rules. Further, they held a webinar at the end of September and have made Summary Highlights from that webinar available, as well as the video itself. (Links to both the most recent version of the FAQs and the Summary Highlights are provided below).   

In both of these helpful resources, CIMA has provided clarity that:

• Initial modifications to audits made in response to the new AML Rule, to the extent necessary, do not need to occur immediately

  CIMA has stated that entities are not expected to conduct an off-cycle AML audit simply because the Rules have become effective. Instead, the timing of an initial audit should be determined using the appropriately documented risk assessment and risk-based approach established by each financial service provider.

• Audit frequency should reflect risk and be tied directly to a company’s risk assessment

  The Rule does not prescribe a fixed audit cycle. Rather, each fund should determine audit frequency based on its documented risk assessment. CIMA's FAQs note that AML audits for medium-risk and low-risk funds may reasonably occur every three and four years, respectively.  

• External audits are not required every cycle 

  The AML Rule requires that at least one external AML audit be conducted for every three independent audit cycles. This provides funds with flexibility to utilize independent internal reviews between external assessments, provided the Rule's independence requirements are satisfied.

• Sanctions compliance is a legal obligation, not a risk-based determination

  Sanctions compliance must be integrated into the AML program without fail, and all customers must be re-screened when sanctions lists are updated. Further, simplified due diligence does not reduce sanctions screening obligations.  

• Regulators are focused on effectiveness 

  One of the key overarching messages from CIMA's webinar was that regulators are increasingly focused on evidence of effectiveness, not simply the existence of documented policies. Funds should be prepared to demonstrate how risk assessments drive controls, how weaknesses are identified and remediated, and how governance bodies oversee compliance activities. Documentation, testing results, training records, and remediation tracking may become increasingly important components of regulatory examinations.

Next Steps to Applying the New Rules to Reality

While the AML Rule, the FAQs and the Webinar Highlights provide greater clarity around CIMA's expectations for the depth and breadth of independent AML audits and sanctions screening, many of the practical implementation questions are still being worked through across the industry. Administrators, investment managers, AML officers, directors, legal counsel, compliance consultants, and audit firms continue to evaluate their respective roles in a fund's AML oversight framework.

For Cayman Islands FSPs generally, the challenge is not necessarily understanding the requirement itself but determining how it should be applied within a structure where AML responsibilities are shared among multiple stakeholders. In the absence of a standardized industry model, funds specifically should ensure that their audit approach is appropriately supported by their governance framework, operating model, and documented risk assessment.

CIMA also clarified that a review of a service provider's controls may not, by itself, satisfy the fund's independent testing obligations. Funds should ensure that audits address their own governance structure, risk profile, and oversight of outsourced activities. In other words, the operational-level audit needs to be complemented by a governance-level audit as well. Historically, the latter may not have been a focus for many funds, but that expectation has now been clearly set.

Across both Rules, CIMA's focus appears increasingly directed toward a fund's ability to evidence compliance activity, oversight, testing, and remediation. Demonstrating the effectiveness of compliance controls by showing precisely how a given AML program works as an integrated whole whose sum is greater than its many parts may prove just as important as maintaining the controls themselves.

As industry continues to refine its approach, Stone Coast is actively working with clients to assess how these new requirements apply within each fund's operating model. Our focus remains on helping managers implement practical, effective compliance frameworks that meet regulatory expectations while reflecting the operational realities of today's fund environment. 

CIMA AML/CFT FAQs - https://www.cima.ky/aml-cft-faqs

CIMA Understanding the New AML Sanctions Rules: https://www.cima.ky/understanding-the-new-aml-sanctions-rules