CIMA Publishes New AML Compliance Rules

The Cayman Islands Monetary Authority (CIMA) has published two new Rules addressing anti-money laundering, counter-terrorist financing, counter-proliferation financing and financial sanctions compliance, together with Frequently Asked Questions (FAQs) to assist regulated entities with implementation. Both Rules will come into effect on 18 September 2026.

New AML / CFT / CPF Compliance Requirements

The first measure is CIMA's Rule on Effective Compliance Programme for the Prevention and Detection of Money Laundering, Terrorist Financing and Proliferation Financing for Financial Services Providers (Compliance Programme Rule).

The Compliance Programme Rule should be read together with the existing Cayman Islands AML / CFT / CPF legislative and regulatory framework, including, inter alia, the Proceeds of Crime Act, the Anti-Money Laundering Regulations (AMLRs), , the Terrorism Act, the Proliferation Financing (Prohibition) Act and CIMA’s Guidance Notes on the Prevention and Detection of Money Laundering and Terrorist Financing in the Cayman Islands.

The Compliance Programme Rule applies to financial service providers (FSPs) regulated and supervised by CIMA under the applicable Regulatory Acts. It establishes requirements relating to the design, implementation and maintenance of an effective compliance programme.

The Compliance Programme Rule requires an FSP's compliance programme to be proportionate to its size, complexity, structure, nature of business and risk profile. The requirements include matters relating to:

(i) the designation of a suitably qualified and experienced Anti-Money Laundering Compliance Officer (AMLCO), with appropriate authority, independence and resources;
(ii) written compliance policies and procedures;
(iii) risk identification, assessment, management and mitigation;
(iv) customer due diligence and ongoing monitoring;
(v) AML / CFT / CPF and targeted financial sanctions training;
(vi) record keeping and suspicious activity reporting;
(vii) oversight of outsourced compliance functions; and
(viii) ongoing evaluation of the effectiveness of the compliance programme.

The Compliance Programme Rule also places requirements on the governing body in relation to the oversight of the compliance programme, including the approval and periodic review of relevant policies and procedures.

Where compliance functions are outsourced, responsibility for compliance remains with the FSP. Relevant outsourcing arrangements must also preserve appropriate access to information and systems for CIMA and other applicable supervisory authorities.

Financial sanctions and targeted financial sanctions

The second measure is CIMA's Rule on Compliance with Financial Sanctions and Targeted Financial Sanctions (Sanctions Rule).

The Sanctions Rule addresses compliance with the financial sanctions and targeted financial sanctions framework applicable in the Cayman Islands. It should be read together with the relevant Cayman Islands legislation, including the Proceeds of Crime Act, Terrorism Act, Proliferation Financing (Prohibition) Act and AMLRs, as well as applicable sanctions extended to the Cayman Islands.

The Governor is the competent authority for the implementation of financial sanctions in the Cayman Islands. The function of receiving certain reports has been delegated to the Financial Reporting Authority (FRA), and reports relating to targeted financial sanctions are made to the Governor through the FRA.

The Sanctions Rule requires regulated persons within its scope to maintain appropriate arrangements for compliance with applicable financial sanctions and targeted financial sanctions requirements. Relevant requirements include:

(i) maintaining appropriate policies, procedures, systems and controls;
(ii) incorporating applicable sanctions risks into relevant risk assessments;
(iii) conducting appropriate sanctions screening;
(iv) maintaining and updating relevant sanctions lists and screening records;
(v) conducting ongoing monitoring of business relationships and transactions;
(vi) taking the required action in relation to funds or economic resources belonging to, owned, held or controlled by designated persons;
(vii) complying with applicable restrictions on dealing with, or making funds or economic resources available to, designated persons;
(viii) making required reports to the Governor through the FRA; and
(ix) maintaining appropriate records of actions taken in connection with sanctions compliance.

CIMA has also published FAQs to support industry's implementation and application of the Compliance Programme Rule and the Sanctions Rule and to provide general clarification on the associated compliance obligations.

Practical considerations before 18 September 2026

In-house counsel, directors, corporate service providers and other professional advisers should consider the application of the Rules to affected Cayman Islands regulated entities and ensure that applicable implementation requirements are addressed before 18 September 2026.

Relevant matters for review include:

(i) existing compliance programmes and documented risk assessments;
(ii) compliance policies and procedures and the required governing body approvals;
(iii) the appointment, authority, independence and resources of the AMLCO;
(iv) sanctions screening and ongoing monitoring systems and controls;
(v) record keeping and reporting arrangements;
(vi) AML / CFT / CPF and sanctions training;
(vii) outsourced compliance functions and related agreements; and
(viii) applicable group-wide compliance arrangements.

Any amendments identified as necessary should be implemented in accordance with the Rules and the existing Cayman Islands AML / CFT / CPF legislative and regulatory framework.

Next steps

Cayman Islands regulated entities should review the new Rules and CIMA's accompanying FAQs in advance of 18 September 2026. Governing bodies should ensure that any necessary amendments to compliance frameworks, policies, procedures, systems and oversight arrangements are identified and implemented within the applicable timeframe.

For further information or advice on the application of these regulatory measures, please contact a member of our Regulatory Team at jon.mclean@stuartslaw.com.