Cayman Islands enforces new AML compliance and sanctions rules.
Written by Acclime Global Business,
The Cayman Islands Monetary Authority (CIMA)’s new Rule on Effective Compliance Programme for the Prevention and Detection of Money Laundering, Terrorist Financing and Proliferation Financing for Financial Services Providers (the AML Rule), and its companion Rule on Compliance with Financial Sanctions and Targeted Financial Sanctions (the Sanctions Rule), took legal effect on 18 September 2026.
Every CIMA-regulated or licensed entity, including all registered investment funds, is now bound, and a breach is directly enforceable. Firms can face fines or regulatory action for gaps that would previously have drawn only a warning or a request to remediate.
From guidance to binding law
Much of the detail in these Rules previously appeared only in CIMA’s Guidance Notes. Regulated entities were expected to follow that guidance, but it did not, on its own, carry the force of law. Issued under CIMA’s statutory powers, the Rules now have the force of law and take precedence over earlier guidance where the two conflict.
CIMA can now take direct enforcement action for non-compliance with obligations that previously sat in guidance form, rather than establishing that a breach amounted to unsafe or unsound practice under a separate legal test.
AML officers, audits and training take effect
Every regulated financial service provider must have designated an AML Compliance Officer, a Money Laundering Reporting Officer and a Deputy Money Laundering Reporting Officer, each a natural person at management level. The AML Compliance Officer must operate independently from the business functions under their oversight, with conflicts of interest actively managed where full separation is not practicable.
Independent audit is now a standing requirement. Audits may be conducted internally for up to two consecutive cycles before an external party must take over. The frequency must reflect the firm’s size, complexity and risk profile based on its own risk assessment. Reports must be filed with CIMA as soon as practically possible after completion.
Training obligations are similarly explicit. AML, CFT and sanctions training must be delivered at least annually, tailored to staff roles, with records of attendance and content maintained. Transaction and due diligence records, including beneficial ownership information, must be retained for at least five years from the end of the relevant business relationship, transaction or entity dissolution.
New sanctions compliance duties now in force
Regulated persons must screen applicants, customers, beneficial owners, transactions and connected parties against sanctions lists, and re-screen existing customers without delay whenever a list is updated, regardless of risk classification. When a true match or reasonable suspicion arises, funds or economic resources must be frozen immediately and reported to the Financial Reporting Authority through a compliance reporting form.
Firms must not disclose to a designated person, directly or indirectly, that they are frozen or under investigation, and must keep internal records of the actions taken and the reasoning behind them.
What CIMA-regulated entities should do now
With the Rules now in force, CIMA-regulated entities should confirm without delay that the required officers are designated, audit cycles comply with the two-cycle internal limit and sanctions screening triggers automatically on list updates. Firms relying on third parties or group affiliates remain fully responsible and must be able to demonstrate this to CIMA on request.
These Rules are no longer optional guidance to work toward. Businesses with a Cayman Islands presence should engage experienced counsel to confirm their compliance programme meets the new standard without delay.
