New AML and sanctions rules issued in the Cayman Islands

The Cayman Islands Monetary Authority (CIMA) has published two new Rules relating to the implementation of an effective compliance programme and financial sanctions compliance obligations. This Update introduces those Rules and new obligations which Cayman financial services providers must adhere to.

Introduction

On 20 July 2026, CIMA published the following Rules:

• Rule – Effective Compliance Programme for the Prevention and Detection of Money Laundering, terrorist Financing and Proliferation Financing for Financial Services Providers (July 2026) (the Compliance Programme Rule); and
• Rule – Compliance with Financial Sanctions and Targeted Financial Sanctions (July 2026) (the Sanctions Rule).

Both Rules will come into force on 18 September 2026 and apply to Cayman Islands financial services providers (FSPs) regulated or supervised by CIMA, including regulated investment funds, fund administrators and virtual asset service providers.

Status of Rules

The Rules supplement the Anti-Money Laundering Regulations (as revised) of the Cayman Islands (the AMLRs) and are to be read subject to the provisions of the AMLRs. Whilst the Guidance Notes¹ currently, and will continue to, provide guidance to FSPs in the interpretation and application of the AMLRs, the Rules create binding obligations on FSPs, and a breach of a Rule issued by CIMA may lead to the imposition of a fine or regulatory action being taken.

The compliance programme rule

This Rule sets out the minimum requirements of an effective compliance programme² for the prevention and detection of money laundering (ML), terrorist financing (TF) and proliferation financing (PF) by FSPs. Whilst the Compliance Programme Rule does create new obligations, there is substantial overlap with the Guidance Notes, which were intended to establish the minimum requirements for implementation of the AMLRs as well as providing guidance to FSPs.

Pursuant to the Compliance Programme Rule, an FSP’s governing body must establish and maintain a clear governance framework for the compliance programme, including the assignation and documentation of roles and responsibilities and the appointment of an Anti-Money Laundering Compliance officer (AMLCO), Money Laundering Reporting Officer (MLRO) and Deputy Money Laundering Reporting Officer (DMLRO and, together with the AMLCO and the MLRO, the AML Officers).

FSPs must establish, implement and maintain a comprehensive and effective compliance programme designed to detect, prevent and report on ML/TF/PF and comply with targeted financial sanctions (TFS), as required by Cayman’s AML/CFT/CPF regime. As a minimum, the compliance programme must include the following core components:

• Designation of an AMLCO responsible for the implementation and oversight of the compliance programme.
• Documentation of detailed written policies and procedures.
• Development, documentation and implementation of a risk management framework which applies a risk-based approach to the evaluation, mitigation and management of ML/TF/PF risks.
• Delivery of an ongoing compliance training programme and a training plan for all staff, the governing body and any other relevant parties.
• Development, maintenance and conduct of ongoing effectiveness evaluations of the compliance programme (ie, independent audit procedures).

Those components are considered in more detail within the Rule, alongside obligation to:

• identify and verify the identity of all customers, beneficial owners and persons purporting to act on behalf of customers;
• maintain adequate records; and
• implement requirements applicable to the outsourcing of any part of the compliance programme.

The sanctions rule

This Rule requires that FSPs regulated by CIMA make their sanctions compliance programme an integral part of their overall AML/CFT/CPF compliance programme. Accordingly, amongst other things, FSPs must:

• establish, implement and maintain policies, procedures, systems and controls for sanctions compliance;
• consider sanctions when conducting risk assessments;
• comply with all sanctions-related obligations under applicable law, including asset-freezing and reporting;
• maintain records relating to true matches, false positives and actions taken; and
• provide regular training to staff on the identification of individuals, entities, funds or economic resources subject to TFS.

Next steps

The governing bodies of all FSPs should consider what action is required to ensure compliance with the Rules by 18 September 2026.  This will likely include the update of AML/CFT/CPF compliance manuals and the formal adoption of the same.

In addition, where compliance functions are outsourced by an FSP, the FSP retains ultimate responsibility for compliance with the Rules. Accordingly, the FSP’s governing body should make documented enquiries of the outsource service provider (OSP) to ensure that the OSP’s policies, procedures or controls are compliant with the new Rules.

Please reach out to your usual Mourant contact for further guidance or assistance, or to one of the named contacts below.

Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur.

Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.

Heading 2

Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.

Heading 3

Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.

Heading 3

Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.

Heading 3

Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.

Heading 2

• Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.
• Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.

Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.