CIMA AML Desk-Based Reviews Begin in October 2026

The Cayman Islands Monetary Authority (“CIMA”) has announced that it intends to commence AML desk-based reviews across regulated sectors from mid-October 2026. Entities selected for review will generally be given five business days to provide requested documentation.

The announcement provides useful insight into how CIMA intends to supervise compliance with the recently implemented AML Rule and Sanctions Rule, including areas it considers most important when assessing the effectiveness of an AML compliance programme. CIMA has supplemented these comments with its recently published New AML & Sanctions Rules Webinar Summary Highlights, which summarises key messages from its 30 September 2026 industry webinar and outlines its enhanced risk-based supervisory approach.

The clear message emerging from CIMA’s recent webinar and subsequent industry engagement is that regulated entities should be able to demonstrate the effectiveness of their AML compliance programmes in practice, rather than simply maintaining policies and procedures.

Key Takeaways

• CIMA intends to commence AML desk-based reviews from mid-October 2026
• Selected entities may have approximately five business days to provide requested documentation
• Initial reviews are expected to focus on business risk assessments
• Entities should ensure that AML records are current, approved and readily available
• Identified deficiencies may lead to remediation requirements or further supervisory action

Business Risk Assessments Take Centre Stage

CIMA has indicated that business risk assessments will be the starting point for the review programme. More broadly, CIMA noted that desk-based reviews will form part of its risk-based supervisory approach, with lower-risk entities generally being reviewed through desk-based processes.

For higher-risk entities, CIMA retains the ability to conduct onsite inspections as part of its supervisory and enforcement framework. According to the webinar summary, initial desk-based reviews will focus on business risk assessments, as this will drive the scope and frequency of the AML audit.

If selected for review, regulated entities may be asked to provide requested documentation within approximately five business days through CIMA’s designated secure process. Where deficiencies are identified, CIMA has noted that regulated entities will be given an appropriate remediation period based on the nature, scale and complexity of the findings. Repeat findings may carry greater supervisory weight, and enforcement action may be considered where warranted.

Under the AML Rule, the business risk assessment is a central component of an entity’s AML compliance framework. It informs the application of risk-based controls, governance and oversight arrangements and decisions relating to the frequency and scope of independent AML audits.

CIMA’s stated expectation is that the business risk assessment should already be approved, current and readily available for production. Investment funds should therefore ensure that their risk assessments are maintained at fund level and accurately reflect the fund’s activities, investor base, geographic exposure and operating model.

What Should Cayman Islands Regulated Entities Do Now?

The commencement of desk-based reviews does not create any new legal obligations. However, it does reinforce the importance of ensuring that AML documentation is current, complete and readily available.

Regulated entities may wish to consider whether:

• Their business risk assessment remains current and appropriately tailored to their activities
• The methodology and rationale underpinning the assessment are appropriately documented
• AML governance and oversight arrangements are adequately documented
• Compliance programme documentation reflects the requirements of the AML Rule and Sanctions Rule
• Identified deficiencies are appropriately tracked, escalated and remediated
• Key AML records can be produced within the relatively short timeframes indicated by CIMA.

How Maples Group Can Help

Maples Group can support regulated entities with their preparations for CIMA’s desk-based reviews through:

• AML risk assessment tools and reviews
• AML governance framework templates
• Compliance programme reviews against the AML Rule and Sanctions Rule
• Independent AML audits
• Broader AML regulatory readiness assessments

With desk-based reviews expected to commence shortly, regulated entities should review their AML documentation, governance arrangements and risk assessments to ensure that key records are current, approved and readily available for production to CIMA.

For further information, please reach out to your usual Maples Group contact or any of the persons listed.