Cayman Islands AML Rules for Funds: What Changed on 18 September 2026

CIMA opened private sector consultation on both Rules in March 2026, published feedback statements in July 2026 and gazetted the Rules the same month; each Rule states that it takes effect sixty days after gazettal, on 18 September 2026. On 24 September 2026 CIMA published updated FAQs in response to industry questions. Three points from the FAQs set the tone:

• The Rule on the compliance programme "does not introduce new obligations but rather enhance[s] the Authority's expectations for the design, implementation, and maintenance" of the programme; many provisions sharpen what the AMLRs already required (FAQ 4).
• CIMA will assess compliance through its risk-based supervision, with on-site inspections for higher and medium-risk entities and desk-based reviews for others, and "does not intend to adopt a blanket enforcement approach upon the Rule's effective date". The administrative fines framework for breaches of the Rule "is not yet in effect" (FAQs 3 and 4).
• Firms are not required to commission a new AML audit solely because the Rules came into force; audits continue on the entity's risk-based cycle (FAQ 34 and the 24 September notice).

Where the Rule and the AMLRs conflict, the AMLRs prevail (Rule 4.4). Where the Rule conflicts with earlier guidance notes or policy statements, the Rule prevails (13.2). The Rule cites sections 6(1)(b) and 34(1) of the Monetary Authority Act as its basis (4.1 and 4.2; CIMA's FAQ 9 refers to section 6(3)(b)) and has the force of law (13.2).

The Rule applies to all financial services providers regulated and supervised by CIMA under the Regulatory Acts, including branches, subsidiaries, affiliates and other members of a CIMA-regulated financial group (5.1). In the fund sector that means:

• Funds. CIMA's FAQs for funds state that a fund, regulated or unregulated, that conducts relevant financial business in or from the Cayman Islands must designate an AMLCO, MLRO and DMLRO under regulations 3(1) and 33. Regulated mutual funds (licensed, administered and registered funds under the Mutual Funds Act, the last requiring a minimum equity interest of CI$80,000, about US$100,000, per investor or a listing on an approved exchange) and registered private funds are regulated by CIMA and are therefore FSPs within the Rules. Asked in consultation whether funds regulated under the Mutual Funds Act and the Private Funds Act are in scope, CIMA answered in its July 2026 feedback statement that investment funds have their own obligations under the AMLRs, remain ultimately responsible for them even where they rely on administrators, and fall within relevant financial business under Schedule 6 to the Proceeds of Crime Act, at least under paragraph 19 (investing, administering or managing funds or money on behalf of other persons).
• Mutual fund administrators licensed under the Mutual Funds Act, which the Guidance Notes treat as having separate AML obligations from the funds they administer (Part VI, G.2).
• Managers and advisers licensed or registered under the Securities Investment Business Act. The Guidance Notes apply Parts I, II and the securities sector part to licensees and to persons specified in Schedule 4 of SIBA (the registered-person category), who do not need a licence but still carry on securities investment business (Part VIII, B.1).
• Branches, subsidiaries and affiliates of a CIMA-regulated financial group (Rule 5.1). Asked whether sector-specific exemptions will be granted, CIMA's FAQ 6 answers that the obligations apply to all CIMA-regulated FSPs conducting relevant financial business, regardless of business model or outsourcing arrangements.

Section 9 of the Rule turns the AMLR risk-assessment duty into a documentation standard that CIMA can inspect. The required elements:

• Assess ML, TF and PF risks in relation to customers, the countries where customers reside or operate, products, services and transactions, and delivery channels (AMLRs reg 8(1); Rule 9.2(a)).
• Start from the National Risk Assessment. The Rule requires the FSP to review and, at a minimum, consider the findings of the most recent Cayman Islands NRA (9.2(b)), and a finding of low risk is only valid if it is consistent with the NRA or the supervisory authority's findings, whichever is more recent (AMLRs reg 21(2); Guidance Notes Part VI, D.5).
• Document inherent and residual risk and how risks are aggregated into an overall rating (9.6), keep the assessment current, and update it without delay on trigger events such as new products or business lines, expansion into higher-risk geographies, mergers or restructuring, and economic or geopolitical developments (9.2(f)).
• Approve and review. Policies must be approved by the governing body; procedures and controls by senior management or the governing body (10.2). Controls approved by senior management must be consistent with national requirements (AMLRs reg 8(2)(d)).
• Fund-specific risk factors named in the Guidance Notes: investors in multiple countries, foreign PEPs and sanctioned countries; the investor profile (regulated institutional investors versus trusts, charities and high-net-worth individuals); low minimum subscriptions and funds not coming from a regulated institution; liquid redemption terms with no lock-up; non-face-to-face subscriptions, redemptions and transfers; frequent or unexplained changes of service provider (Part VI, C and D).

The second Rule consolidates what the AMLRs, the Terrorism Act, the Proliferation Financing (Prohibition) Act and the UK Overseas Orders in Council already required, and adds explicit operating standards. The Governor is the competent authority for financial sanctions, with reporting delegated to the FRA (1.2).

• Sanctions compliance must be an integral part of the AML/CFT/CPF programme, with policies, procedures, systems and controls (7.1), and sanctions must be considered in risk assessments (7.2). A customer's geographic risk cannot be rated "low" where its country is subject to ML/TF/PF-related sanctions by the United Kingdom, the United Nations, the United States or OFAC (7.3).
• Screen applicants, customers, beneficial owners, transactions, service providers and other relevant parties, including connected persons, against the UK Sanctions List and any other list that applies through the Overseas Orders in Council (7.4 and 2.1.18). Simplified due diligence does not reduce or waive screening: all customers must be re-screened whenever a sanctions list is updated, regardless of their risk classification (7.5 and 7.11), and the systems must act "without delay", which the Rule defines as ideally within hours of a UN designation (2.1.23).
• On a true match or suspicion, freeze funds and economic resources without delay and without prior notice, make nothing available to the designated person or entities it owns or controls unless licensed by the Governor, and report to the FRA on the Compliance Reporting Form (7.7, 7.13.3 and 7.17 to 7.18). Record every action and its rationale (7.9).
• Take reasonable steps to clear potential matches by comparing other identifying information before treating them as false positives (7.19), and train staff regularly on identifying designated persons and frozen assets (7.20). See our guide to sanctions screening.

Most Cayman funds outsource investor onboarding to an administrator and may rely on introducers for distribution. The Rule does not stop that; it sets the evidence the fund must hold.

• The AMLRs allow an FSP to delegate the performance of any function or rely on another person to perform it, but responsibility for compliance remains with the FSP (reg 3(2) and (3)); the Rule repeats that for third parties and group members (5.3 and 10.4) and requires the FSP to show CIMA on request how it remains satisfied (10.4).
• Before outsourcing any part of the compliance programme, assess the risks including country risk, perform due diligence on the provider's fitness, competence and capability, record the CDD done on the provider, and set out both parties' rights and obligations in the agreement (10.7.1 to 10.7.4). An arrangement must not go ahead or continue where CIMA's access to data could be impeded by confidentiality, secrecy, privacy or data-protection restrictions (10.7.5).
• Notify CIMA in writing of any outsourcing that relates to material functions of the compliance programme (10.3(e) and 10.7.6). Buying third-party training is not outsourcing for this purpose (footnote 4).
• For funds and administrators, the Guidance Notes say each has its own obligation to maintain procedures, and the operators should document, by board resolution or equivalent, how the fund's procedures are delegated or relied upon (Part VI, G.2 to G.7).

Three natural persons or two with a shared AMLCO/MLRO role, all at managerial level, with the MLRO and DMLRO different people. Hold the letters of appointment, CVs, the board resolution and the REEFS notifications, and the annual AMLCO report to the board.

Customer, geography, product, transaction and delivery-channel factors; the NRA findings; inherent and residual risk; trigger events; approval minutes. Where investors are rated low risk, record why that is consistent with the NRA.

Applicant-for-business table for each entity; the 10% beneficial-ownership threshold; timing and heightened monitoring where verification is deferred; redemption controls; the written basis for every simplified-due-diligence and eligible-introducer decision; EDD triggers and approvals.

Lists covered, re-screening on every list update for every customer regardless of risk tier, freeze and CRF procedures, false-positive clearance records and training logs.

Set the frequency from the risk rating, decide internal or external within the two-cycle limit, scope it to the fund's own programme including outsourced functions, and diarise the filing with CIMA.

Provider due diligence on file, agreements that set out rights and obligations and preserve CIMA's access, and written notification to CIMA of material compliance outsourcing.

Five-year retention clocks, the PEP and declined-business registers, and an annual training plan with attendance records.