New CIMA AML Rule And Sanctions Rule: What Regulated Entities Need To Consider

Key implications for Regulated Entities 

On 18 September 2026, new Rules published by the Cayman Islands Monetary Authority ("CIMA") relating to anti-money laundering ("AML") and sanctions compliance ("Rules") will come into force. CIMA has also published FAQs on its website concerning the application of the new Rules. These new Rules are not intended to significantly extend the substantive obligations in this area, but there is now greater clarity around their enforceability and the extent to which they apply to regulated entities ("Regulated Entities").

In particular, the governing body of any regulated entity ("Governing Body"), whether directors, general partner or trustee (or the governing body of any of the foregoing, as applicable) should take note of the following:

• Elements of the new Rules that were previously only covered by CIMA guidance, will now be directly enforceable under the administrative penalty regime.
• Each member of the Governing Body must receive annual AML training, even when the Regulated Entity has no employees and has outsourced its AML compliance programme.
• Each Regulated Entity's AML compliance programme must be independently audited at appropriate intervals (and every third audit must be an external audit).
• A Regulated Entity's AML compliance officer ("AMLCO") should be independent from its business and operational functions, and the AMLCO's obligations are more clearly defined.
• While Regulated Entities are already required to comply with applicable sanctions, the new Rule on sanctions turns existing CIMA guidance into enforceable requirements for Regulated Entities to have appropriate sanctions policies and procedures, to conduct sanctions screening, on-going monitoring of business relationships and re-screening when sanctions lists are updated.

Preparing for the new Rules

Specific actions needed will depend on whether the Regulated Entity's AML compliance programme (including the provision of its AMLCO and other AML officers) has been outsourced to an external service provider or is delivered from within the organisation. In either case, the Regulated Entity's Governing Body remains ultimately responsible for compliance with Cayman Islands laws, regulations and CIMA rules relating to AML and sanctions compliance (the "Cayman AML Regime").

In addition to ensuring the Regulated Entity's AML compliance programme has been developed in line with the Cayman AML Regime more generally, we recommend the following specific steps:

• Review the company's AMLCO and other AML officers. In particular:
  1. Ensure that any service provider is fit and proper, competent and capable of complying with the Cayman AML Regime. For example, is the service provider (or an affiliate to which it sub-contracts these services) itself subject to the Cayman AML Regime? If not, additional review of the policies and procedures it applies to the Regulated Entity is called for, to ensure they are fully compliant with the Cayman AML Regime.
  2. If the AMLCO is a member of the Governing Body or otherwise involved in its operations, or the AMLCO is not suitably qualified with sufficient skills and experience to perform the required functions, an appropriately independent role should be created and filled with a suitably skilled candidate. If that is not possible, the AMLCO role should be outsourced in line with the guidance above.
• Review the training plan the Governing Body has in place across the Regulated Entity to ensure compliance with the Cayman AML Regime. In particular, the training plan should ensure that the Governing Body is trained no less than once annually, along with any employees, agents or other persons authorised to act on behalf of the Regulated Entity. 
• A plan for periodic independent audits of the Regulated Entity's AML compliance programme should be implemented if there is not one in place already. For these purposes, an audit is "independent" if it is not conducted by persons involved in carrying out the audited functions and, every third audit (at least), must be conducted by a party external to the Regulated Entity and any outsourced AML service provider. Any AML service provider that is itself subject to the Cayman AML Regime will usually have a separate team that conducts these independent internal audits, and, being subject to the Cayman AML Regime, they will also be required to conduct independent external audits.