Cayman Islands AML Rule and Sanctions Rule 2026: What CIMA Requires

The Cayman Islands Monetary Authority (CIMA) has set out its anti-money laundering expectations in two new binding rules. According to the law firm Walkers, CIMA published a new AML Rule and a new Sanctions Rule on 20 July 2026, gazetted the same day, and they took effect on 18 September 2026. This guide summarises the main obligations for regulated firms and investment funds, based on Walkers' briefing. It is a secondary source, so read the rules themselves and take advice before you act.

Who the rules apply to

Walkers says the rules apply to all CIMA registered or licensed financial service providers (FSPs), including all registered investment funds and other CIMA registered or licensed entities. They do not apply to FSPs that are not CIMA registered or licensed. The article does not give a separate compliance deadline and says CIMA expects regulated FSPs to review their compliance programmes against the rules and make any necessary changes. It also notes that the existing Guidance Notes remain in place and that the new rules distil their key obligations.

The compliance programme

The AML Rule defines the compliance programme as a documented framework of policies, procedures, controls, oversight and reporting mechanisms. It must set out clear governance, including the roles of the governing body, the anti-money laundering compliance officer (AMLCO), the money laundering reporting officer (MLRO), the deputy MLRO and any outsourced providers. The FSP remains ultimately responsible, even where work is outsourced.

Independent audit

Audits must be performed by suitably qualified, independent persons, and audit reports must be filed with CIMA as soon as practicable. Walkers reports that an audit cannot be internal for more than two consecutive cycles, after which an external provider must carry out the next one. Frequency depends on the FSP's size, complexity and risk profile.

Risk assessment

FSPs must document their own money laundering, terrorist financing and proliferation financing risk assessment, including the data points prescribed by the Anti-Money Laundering Regulations. For investment funds the assessment must be done at fund level. Written assessments must be given to CIMA on request, and the assessment also underpins the risk-based audit frequency. Our guide to the firm-wide AML risk assessment explains the general approach.

Officers and records

The AMLCO must perform the compliance function independently and objectively. Where full separation is not practicable, conflicts must be managed effectively. The AMLCO, MLRO and deputy MLRO need not be based in the Cayman Islands, subject to any licence-specific requirements. The AMLCO must also ensure that records are maintained, including for declined business, politically exposed persons, competent authority requests, suspicious activity reports, transaction alerts and sanctions. For more on the reporting officer role in general terms, see our guide to the MLRO role in an accountancy firm.

Policies, procedures and customer due diligence

• At a minimum, policies and procedures must cover risk assessment, customer due diligence (CDD) and ongoing monitoring, record-keeping, outsourcing, suspicious activity handling and reporting, and financial sanctions compliance.
• The governing body approves policies. Procedures and controls are approved by senior management, the governing body, or both.
• Where CDD is completed after a relationship starts or a transaction occurs, heightened monitoring must apply until verification is complete.
• Authorisation documents for persons acting for a customer must be certified.
• Electronic KYC and digital ID may be used, depending on the assessed risk.
• Sanctions screening is still required even where simplified due diligence applies.

Record-keeping

Walkers says records of CDD data, account files, correspondence and transactions must be kept for at least five years after the relationship ends or the one-off transaction completes. Beneficial ownership records must be accurate, up to date and kept for at least five years after the customer is dissolved or ceases to be a customer. Records must be available to CIMA without delay.

The Sanctions Rule

The Sanctions Rule covers compliance with financial sanctions and targeted financial sanctions. Screening against official sanctions lists must be included in the firm's policies and procedures. For the practical side, see our guide to sanctions screening for accountants.

Penalties

The Walkers article states that breaches may result in a fine or regulatory action. It does not specify fine amounts or maximums.

What regulated firms should do

1. Compare your compliance programme with the AML Rule definition and fill any gaps in governance and roles.
2. Check your audit arrangements, especially the limit on consecutive internal audits.
3. Confirm that fund-level risk assessments exist and can be produced to CIMA on request.
4. Review your record-keeping periods against the five-year minimums.
5. Update sanctions screening procedures.
6. Have the governing body approve the revised policies.

Frequently asked questions

When did the new rules take effect?

18 September 2026, according to Walkers. CIMA published them on 20 July 2026.

Do they apply to accountants in the Cayman Islands?

They apply to CIMA registered or licensed FSPs. Other businesses are not covered by these particular rules, but may have separate AML duties.

Can the MLRO be based outside the Cayman Islands?

The AMLCO, MLRO and deputy MLRO need not be based in the Cayman Islands, subject to any licence-specific requirements.

Next steps

Read the rules, then run a gap analysis against your current programme. This article is general information and not legal advice. For further training on AML fundamentals, explore Learnsignal's CPD courses.