CIMA Finalises New Rules on AML/CFT/CPF Compliance and Financial Sanctions

On 20 July 2026, the Cayman Islands Monetary Authority (“CIMA“) published two finalised Rules applicable to regulated financial services providers (“FSPs“): the Rule on Effective Compliance Programme for the Prevention and Detection of Money Laundering, Terrorist Financing and Proliferation Financing for Financial Services Providers (the “AML/CFT/CPF Rule“) and the Rule on Compliance with Financial Sanctions and Targeted Financial Sanctions (the “Sanctions Rule“). Both take effect on 18 September 2026 and carry the force of law.

The Rules were issued following a Private Sector Consultation and give legal enforceability to parts of CIMA’s existing Guidance Notes on the Prevention and Detection of Money Laundering, Terrorist Financing and Proliferation Financing in the Cayman Islands, which whilst comprehensive, constitutes guidance only, to address findings of the Caribbean Financial Action Task Force (“CFATF“) in the Cayman Islands 4^th Round Mutual Evaluation.

AML/CFT/CPF Rule

This Rule sets out the minimum requirements for an effective compliance programme, requiring FSPs to implement a documented framework covering governance, risk-based policies, customer due diligence, record-keeping, outsourcing controls, training, and independent audit. The Governing Body must designate an Anti-Money Laundering Compliance Officer (“AMLCO“), a Money Laundering Reporting Officer (“MLRO“) and a Deputy MLRO — all natural persons at management level. Notably, audits may not be conducted internally for more than two consecutive cycles, after which an external provider must be engaged.

Sanctions Rule

This Rule requires ‘Regulated Persons’ to integrate sanctions compliance into their broader AML/CFT/CPF programme. Key obligations include:

• screening applicants, customers, beneficial owners, transactions and ‘Connected Persons’ against all applicable Sanctions Lists;
• freezing funds and economic resources (being assets of any kind, including property) of ‘Designated Persons’ “without delay” (ideally, within a matter of hours of a designation);
• filing Compliance Reporting Forms with the Financial Reporting Authority (“FRA“); and
• providing regular staff training on targeted financial sanctions identification.

Practical Implications and Next Steps

Regulated entities should conduct a gap analysis of their AML/CFT/CPF and sanctions compliance programme against the finalised Rules, update compliance programmes and sanctions screening procedures where necessary, revise governance documentation and ensure training programmes reflect the new requirements ahead of the 18 September 2026 effective date.

The Maples Group has extensive experience in advising on AML/CFT/CPF and Sanctions compliance obligations. Please reach out to your usual Maples’ contact if we can be of assistance.