CIMA Finalises New Rules on AML / CFT / CPF Compliance and Financial Sanctions in the Cayman Islands

On 20 July 2026, the Cayman Islands Monetary Authority (“CIMA”) published two finalised Rules: (i) the Rule on Effective Compliance Programme for the Prevention and Detection of Money Laundering, Terrorist Financing and Proliferation Financing for Financial Services Providers (the “AML / CFT / CPF Compliance Rule”); and (ii) the Rule on Compliance with Financial Sanctions and Targeted Financial Sanctions (the “Sanctions Rule” and, together with the AML / CFT / CPF Compliance Rule, the “Rules”).

Both Rules take effect on 18 September 2026, 60 days after publication in the Gazette. The Rules establish binding, enforceable minimum standards for all financial service providers (“FSPs”) regulated by CIMA and represent a significant development in the Cayman Islands’ anti-money laundering, counter-terrorist and counter-proliferation financing and sanctions regulatory architecture.

Background

The Financial Action Task Force (“FATF”) Recommendations require countries to have “effective, proportionate and dissuasive sanctions” for failure to comply with AML / CFT / CPF requirements. To meet this standard and address a previous finding of the Caribbean Financial Action Task Force (“CFATF”) following its 4th Round Mutual Evaluation of the Cayman Islands, CIMA has converted specific sections of its non-binding Guidance Notes (“GNs”) into binding Rules.

The timing of the Rules is significant. The CFATF’s 5th Round Mutual Evaluation on-site visit is scheduled for 2027, and the Rules are designed to demonstrate that the Cayman Islands has enhanced its regulatory framework in line with FATF expectations.

Regulatory Hierarchy and Enforceability

The Rules sit within a defined enforceability hierarchy. The Proceeds of Crime Act (As Revised) (“POCA”) remains the primary legislation, supplemented by the Anti-Money Laundering Regulations (As Revised) (“AMLRs”). While enforceable, the Rules rank below the POCA and the AMLRs but above the GNs, which remain supplementary non-binding guidance. In the event of any conflict between the Rules and the POCA or the AMLRs, the POCA and the AMLRs expressly take precedence.

Importantly, a double jeopardy safeguard has been incorporated into the enforcement framework. CIMA will exercise its discretion to preclude duplication or avoid double jeopardy where a breach is sanctioned under both an Act or the AMLRs and the Rules.

AML / CFT / CPF Compliance Programme Rule

The AML / CFT / CPF Compliance Rule establishes the minimum requirements for an effective compliance programme for the prevention and detection of ML / TF / PF by FSPs. It supplements Regulations 3, 4, 5, 6 and 8 of the AMLRs, and requires each FSP to maintain a “documented framework” covering the following areas:

• Governance and oversight, including designation by the Governing Body of an Anti-Money Laundering Compliance Officer (“AMLCO”), Money Laundering Reporting Officer (“MLRO”), and Deputy MLRO (“DMLRO”), each of whom must be a natural person holding a management-level position;
• Risk-based approach, with a requirement that risk assessments be updated without delay upon material trigger events such as mergers, acquisitions, the introduction of new products or services or significant geopolitical developments;
• Customer due diligence (“CDD”) procedures, including provisions for electronic KYC verification;
• Record-keeping for a minimum of five years;
• Outsourcing controls, including the requirement to conduct due diligence on service providers and to retain ultimate responsibility for AML / CFT / CPF functions when relying on third parties;
• Training for all relevant staff at least annually; and
• Independent audit procedures to review and test the compliance programme. The audit must be carried out at a frequency commensurate with the FSP’s size, complexity, structure, nature of business, and risk profile, as determined by the FSP’s risk assessment or as otherwise required by CIMA. The audit may be conducted internally but must not be undertaken internally for more than two (2) consecutive audit cycles. The audit report is required to be filed with CIMA as soon as practically possible after the completion of the audit.

Financial Sanctions and Targeted Financial Sanctions Rule

The Sanctions Rule requires FSPs to integrate sanctions compliance into their broader AML / CFT / CPF compliance programme. Key obligations include:

• Screening all applicants, customers, beneficial owners, connected persons, and transactions against all applicable sanctions lists, including the UK Sanctions List maintained by the Foreign, Commonwealth and Development Office (“FCDO”);
• Freezing funds and economic resources of designated persons “Without Delay”;
• Filing Compliance Reporting Forms with the Financial Reporting Authority (“FRA”);
• Ensuring that geographic risk is not assessed as “low” where a country is subject to sanctions imposed by the UK, United Nations or the United States (including OFAC designations);
• Implementing false positives verification procedures to ensure accurate screening outcomes;
• Following a principles-based approach to unfreezing, in accordance with guidance issued by the FRA; and
• Applying to the Governor (with a copy to the FRA) for licences authorising otherwise prohibited acts in relation to frozen funds or economic resources.

Required Actions

Considering the above developments, all CIMA-regulated FSPs should take note of the following (as applicable):

• Review existing AML / CFT / CPF compliance and sanctions programmes to ensure their adequacy, effectiveness and alignment with the applicable legislative and regulatory obligations, including the AMLRs and the new Rules and make any required improvements;
• Ensure that risk assessments are current and / or updated where necessary;
• Ensure that an effective audit programme has been implemented that meets the requirements of the new Rules;
• Review sanctions screening procedures to ensure coverage of all applicable sanctions lists, including the UK Sanctions List (FCDO), and confirm that geographic risk assessments are not rated “low” for countries subject to UK, UN or US / OFAC sanctions;
• Ensure that sanctions screening obligations are applied irrespective of any simplified due diligence determination;
• Review outsourcing arrangements to confirm that appropriate due diligence has been conducted on service providers and that the FSP retains ultimate responsibility for outsourced AML / CFT / CPF functions; and
• Update training programmes to address the new Rules (including targeted financial sanctions obligations) and ensure delivery at least annually.

Further Assistance

Our Regulatory & Financial Services Advisory team can help if you need additional advice relating to your ongoing regulatory compliance obligations. We would be delighted to assist.