New AML and sanctions rules issued in the Cayman Islands

The Cayman Islands Monetary Authority (CIMA) has published two new Rules relating to the implementation of an effective compliance programme and financial sanctions compliance obligations. This Update introduces those Rules and new obligations which Cayman financial services providers must adhere to.

Introduction

On 20 July 2026, CIMA published the following Rules:

• Rule – Effective Compliance Programme for the Prevention and Detection of Money Laundering, terrorist Financing and Proliferation Financing for Financial Services Providers (July 2026) (the Compliance Programme Rule); and
• Rule – Compliance with Financial Sanctions and Targeted Financial Sanctions (July 2026) (the Sanctions Rule).

Both Rules will come into force on 18 September 2026 and apply to Cayman Islands financial services providers (FSPs) regulated or supervised by CIMA, including regulated investment funds, fund administrators and virtual asset service providers.

Status of Rules

The Rules supplement the Anti-Money Laundering Regulations (as revised) of the Cayman Islands (the AMLRs) and are to be read subject to the provisions of the AMLRs. Whilst the Guidance Notes¹ currently, and will continue to, provide guidance to FSPs in the interpretation and application of the AMLRs, the Rules create binding obligations on FSPs, and a breach of a Rule issued by CIMA may lead to the imposition of a fine or regulatory action being taken.

The Compliance Programme Rule

This Rule sets out the minimum requirements of an effective compliance programme² for the prevention and detection of money laundering (ML), terrorist financing (TF) and proliferation financing (PF) by FSPs. Whilst the Compliance Programme Rule does create new obligations, there is substantial overlap with the Guidance Notes, which were intended to establish the minimum requirements for implementation of the AMLRs as well as providing guidance to FSPs.

Compliance programme

Pursuant to the Compliance Programme Rule, an FSP’s governing body must establish and maintain a clear governance framework for the compliance programme, including the assignation and documentation of roles and responsibilities and the appointment of an Anti-Money Laundering Compliance officer (AMLCO), Money Laundering Reporting Officer (MLRO) and Deputy Money Laundering Reporting Officer (DMLRO and, together with the AMLCO and the MLRO, the AML Officers).

FSPs must establish, implement and maintain a comprehensive and effective compliance programme designed to detect, prevent and report on ML/TF/PF and comply with targeted financial sanctions (TFS), as required by Cayman’s AML/CFT/CPF regime. As a minimum, the compliance programme must include the following core components:

• Designation of an AMLCO responsible for the implementation and oversight of the compliance programme.
• Documentation of detailed written policies and procedures.
• Development, documentation and implementation of a risk management framework which applies a risk-based approach to the evaluation, mitigation and management of ML/TF/PF risks.
• Delivery of an ongoing compliance training programme and a training plan for all staff, the governing body and any other relevant parties.
• Development, maintenance and conduct of ongoing effectiveness evaluations of the compliance programme (ie, independent audit procedures).

New requirements for investment funds

The key areas where new requirements, or clarity around existing requirements, have been provided for investment funds are as follows:

• Outsourcing: the Compliance Programme Rule requires that where any part of the compliance programme is outsourced, the investment fund must (amongst other things):
  • ensure that the outsourcing arrangement does not impair the fund’s ability to meet its AML/CFT/CPF/TFS obligations or manage its risk effectively and does not impede regulatory access; and
  • conduct and keep records on the due diligence conducted on the service provider prior to entering into the outsourcing arrangement.
• Training plan: investment funds must have a documented training plan applicable to all employees, agents and persons authorised to act on the fund’s behalf. Training must be delivered at least annually.
• Effectiveness review; ie, independent AML/CFT audit: investment funds must establish and implement a documented independent³ audit plan to review and test the compliance programme. Key features of this independent audit requirement are as follows:
  • The scope and frequency of the audit must be determined using a risk-based approach, considering the fund’s structure, business activities, outsourcing arrangements and ML/TF/PF risks.
  • The audit must be conducted by a suitably qualified person, but this need not be a CIMA-approved financial auditor. An auditor must be independent and the FSP must be able to provide CIMA with documentation confirming the independence of the auditor appointed upon request.
  • Whilst an audit may be conducted internally⁴(where there is an independent in-house function), internal independent audits may be undertaken for no more than two consecutive cycles before an external audit is required.
  • The audit report must be filed with CIMA as soon as reasonably practicable after completion, or as otherwise prescribed by CIMA.

CIMA has published some helpful FAQs, which provide more detail regarding CIMA’s expectations, including who may conduct an audit.

The sanctions rule

This Rule requires that FSPs regulated by CIMA make their sanctions compliance programme an integral part of their overall AML/CFT/CPF compliance programme. Accordingly, amongst other things, FSPs must:

• establish, implement and maintain policies, procedures, systems and controls for sanctions compliance;
• consider sanctions when conducting risk assessments;
• comply with all sanctions-related obligations under applicable law, including asset-freezing and reporting;
• maintain records relating to true matches, false positives and actions taken; and
• provide regular training to staff on the identification of individuals, entities, funds or economic resources subject to TFS.

Next steps

The governing bodies of all FSPs, including investment funds, should consider what action is required to ensure compliance with the Rules by 18 September 2026.  This will likely include:

• The update of AML/CFT/CPF policies and procedures and the formal adoption of the same.
• Where AML/CFT/CPF compliance functions have been outsourced, making documented enquiries of the outsource service providers (OSP) to ensure that the OSP’s policies, procedures or controls are compliant with the new Rules.
• Establish a documented independent audit plan, including the frequency of the audit.
• A review of outsourcing arrangements and agreements to ensure that they meet the requirements of the Rules.

Please reach out to your usual Mourant contact for further guidance or assistance, or to one of the named contacts below.