Welcome to our current edition of our Regulatory & Risk Advisory Review. This issue dives into regulatory shifts and emerging trends shaping the compliance landscape. Whether you are navigating new rules or anticipating what is next, we have curated insights to keep you informed.
Reach out to a member of our Regulatory & Risk Advisory team or connect with your usual Conyers contact - we are here to help.
The following topics are covered in this issue:
- Cayman Islands Virtual Asset Services Providers
- CIMA Rules, Statements of Guidance and General Industry Notices
- Department for International Tax Cooperation (DITC)
- Securities Investment Business
- Sanctions
- Financial Action Task Force (FATF) Updates
- Conyers Website Articles & Alerts
1. CAYMAN ISLANDS VIRTUAL ASSET SERVICES PROVIDERS
1.1. Cayman Islands Virtual Asset (Service Providers) (Amendment) Act, 2025 (Not Yet in Force)
The Cayman Islands Virtual Asset (Service Providers) (Amendment) Act, 2025 (Act 8 of 2025) amends the Virtual Asset (Service Providers) Act (2024 Revision). It revises the definition of "issuance of virtual assets" or "virtual asset issuance." Under the new definition, it specifically means the sale of newly created virtual assets to the public in or from within the Cayman Islands, in exchange for fiat currency, other virtual assets, or other consideration.
The following are excluded from the definition of "issuance of virtual assets" (a) the sale of virtual service tokens; and (b) the issuance of an equity interest (as defined under the Mutual Funds Act and the Securities Investment Business Act) or an investment interest (as defined under the Private Funds Act), provided this is in accordance with guidance or rules issued by the Authority.
The new definition applies to any tokenisation of an equity interest or investment interest that may have occurred prior to the commencement date of the Act.
The amendment aims to clarify the regulatory perimeter for virtual asset issuances in the Cayman Islands, ensuring that certain tokenised equity and investment interests, as well as virtual service tokens, are not inadvertently captured under the regime for virtual asset issuances. This provides greater legal certainty for market participants and aligns the legislation with evolving industry practices.
1.2. Virtual Asset Service Providers (VASPs) Application Form Updated (July 2025)
The VASP application form on the REEFS portal, APP 101-84-05, has been amended to further streamline the application process for registration, licensing and waivers by incorporating additional questions and clarifying document requirements for all applicants.
These updates have been implemented to ensure enhanced alignment with the Virtual Asset Service Provider Act (2024 Revision) and the Virtual Asset (Service Providers) Regulations (2020) as amended, improve the completeness of submissions, and facilitate a more efficient application process.
1.3 CIMA Rule – Cancellation of Licences, Registrations, or Waivers for Virtual Asset Service Providers (September 2025)
The Cayman Islands Monetary Authority (CIMA) has released new rules governing the cancellation of licences, registrations, or waivers for Virtual Asset Service Providers (VASPs), which came into effect on 10 September 2025. These rules set out clear procedures for both voluntary and involuntary exits from the market, with a strong focus on protecting client assets and data, ensuring regulatory compliance, and maintaining market integrity. VASPs are now required to notify CIMA in writing within 15 days of deciding to cease operations, and must follow specific steps to safeguard client interests and provide necessary documentation during the cancellation process.
These rules are designed to promote transparency and accountability, while supporting an orderly wind-down of VASP activities in the Cayman Islands. VASPs must also inform clients and other stakeholders of any cancellation and comply with all relevant anti-money laundering and financial reporting obligations. Entities considering ceasing virtual asset services or relocating operations should review these requirements carefully to ensure a compliant and efficient exit.
1.4 Regulatory Procedure – Cancellation of Licences, Registrations, or Waivers for Virtual Asset Service Providers (September 2025)
CIMA has issued a Regulatory Procedure setting out how Virtual Asset Service Providers (VASPs) may cancel their licence, registration, or waiver under VASPA when exiting the Cayman Islands market or ceasing virtual asset activities. The Procedure covers voluntary scenarios—including ceasing business, relocation to another jurisdiction, situations where a VASP never commenced operations, and cases where the entity no longer meets the VASP definition—and excludes enforcement-driven cancellations. Its objectives are to protect clients and other stakeholders, ensure orderly wind‑downs, and uphold Cayman's regulatory standards.
Key requirements include being in good standing (all fees and regulatory filings up to date), notarised AML/CFT and sanctions compliance attestations from the Compliance Officer, and clear stakeholder communications with evidence of client asset return or transfer (including bank and blockchain records). VASPs must submit a formal cancellation notice, return the original licence/registration (where applicable), provide a board resolution, pay any surrender fee, and file final audited financials or agreed alternative confirmations, plus proof of asset reconciliation and liability resolution. Additional, scenario‑specific materials may be required: a cessation plan when stopping business; 15‑day notice and liquidator confirmations for voluntary liquidations (with qualified liquidator oversight for complex assets); court orders and reports for court‑supervised wind‑downs; evidence of regulatory approval in the destination jurisdiction for relocations; and affidavits confirming no business activity where operations never commenced. CIMA may publish a notice in the Gazette and can request further information on a case‑by‑case basis.
Clients should plan early by preparing a detailed wind‑down or relocation plan, engaging auditors and liquidators promptly, maintaining rigorous records to evidence all distributions, and communicating with stakeholders in advance. Early legal and regulatory engagement will help ensure timely approval, protect stakeholder interests, and support a smooth, reputationally sound exit from Cayman virtual asset activities.
CIMA Rules, Statements of Guidance and General Industry Notices
2.1 CIMA Announces One-time Non-Compliant Directors Amnesty Scheme (September 2025)
CIMA has launched its One-time Non-Compliant Directors Amnesty Scheme (the "Scheme"). The Scheme provides a limited opportunity for eligible registered directors to voluntarily settle outstanding annual fees and accrued penalties at a discounted rate. This initiative, reflecting CIMA's commitment to supporting good governance and regulatory compliance, also recognises the practical challenges that may have contributed to past non-compliance and seeks to help directors return to good standing, ensuring the continued integrity of the Cayman Islands' regulatory framework.
The Scheme will run from 16 September to 15 October 2025. It is open to registered directors within the 1-19 covered entities category, who as of 31 August 2025 have more than two years of unpaid annual fees. Directors meeting this criteria have been contacted directly via email with the relevant participation instructions. Directors who believe they may be eligible but did not receive a notification should contact CIMA at amnesty@cima.ky. Full fees and penalties will apply without exception once the Scheme closes.
2.2 CIMA – Revisions to Regulatory Handbook & Enforcement Manual (July 2025)
Volume 1 – The Regulatory Handbook outlines the policies and procedures to be followed by the Authority, its committees, and officers in the discharge of CIMA's regulatory and co-operative functions. The recent amendments primarily enhance provisions related to external membership and stakeholder engagement.
Volume 2 – The Enforcement Manual, which should be read in conjunction with Volume 1, establishes the framework governing CIMA's enforcement regime in instances of non-compliance with the Regulatory Acts by Authorised Persons. The revised manual consolidates procedures concerning Enforcement Actions, Administrative Fines, Publication, and Lost Contact.
2.3 CIMA Update – The Countdown to 2027: Cayman's Preparation for the FATF 5th Round
CIMA is proactively preparing for the Financial Action Task Force's (FATF) 5th Round Mutual Evaluation, with the onsite inspection scheduled to commence in late 2027. This upcoming assessment, to be conducted by the Caribbean Financial Action Task Force (CFATF), will assess the effectiveness of Cayman's Anti-Money Laundering (AML), Counter-Terrorism Financing (CFT), and Counter-Proliferation Financing (CPF) measures. Among other areas, the evaluation will focus on how well the jurisdiction and its Financial Service Providers (FSPs) implement risk-based approaches, ensure beneficial ownership transparency, and facilitate asset recovery. The revised FATF standards require both countries and private sector entities to identify, assess, and mitigate proliferation financing risks, and to demonstrate robust frameworks for compliance with targeted financial sanctions.
Entities that are in-scope of the Cayman AML Regime (i.e. those conducting relevant financial business) are encouraged to proactively review and enhance their internal policies, procedures, and controls to ensure they address the legal requirements. This includes conducting entity-level risk assessments, maintaining accurate and accessible beneficial ownership information, and ensuring ongoing AML training for staff, including on legislative and regulatory changes. Entities may be asked to participate in the National Risk Assessment process which is currently underway.
2.4 CIMA Update – New FATF Insights on Terrorist Financing: Trends, Red Flags, and FSP Expectations
FATF has released a comprehensive report detailing the latest trends and risks in terrorist financing, with significant implications for Financial Service Providers (FSPs) in the Cayman Islands. The report underscores the increasing decentralisation of terrorist operations, which now rely more heavily on regional hubs, self-financed cells, and a blend of funding sources, including both criminal proceeds and legitimate business activities. Notably, terrorist organizations are adopting hybrid financing methods that combine traditional techniques—such as cash couriering, hawala, and shell entities—with digital innovations like social media, crowdfunding, gaming platforms, and cryptocurrencies. The report also highlights the ongoing vulnerability of humanitarian aid channels and non-profit organisations (NPOs) to abuse, emphasising the need for risk-based safeguards that protect legitimate activities while mitigating misuse.
FSPs should understand the nature and level of the risks that they are exposed to and ensure that systems and processes are in place to identify, assess, monitor, manage and mitigate terrorist financing risks.
FSPs are encouraged to review the report1, including the non-exhaustive list of TF risk indicators, which can help bolster the detection, disruption, and reporting of suspicious activity. A summary of the report is included at section 5.1 below.
Department for International Tax Cooperation (DITC)
The Cayman Islands Department for International Tax Cooperation (DITC) has announced the launch of its new portal for Country-by-Country Reporting (CbCR), effective 29 August 2025. All multinational enterprise (MNE) groups with Cayman Islands constituent entities (CEs) are now required to re-register on the DITC Portal by 30 November 2025, following the decommissioning of the legacy CbCR portal.
Key points:
- Mandatory Re-Registration: Every MNE group with Cayman Islands CEs must re-register via the new DITC Portal to ensure ongoing compliance with the CbCR Regulations. The process is centralized, requiring a single notification for all Cayman Islands CEs within the same MNE group. MNE groups will be required to identify the reporting entity (RE), which is typically the group's Ultimate Parent Entity (UPE), or in certain cases, a Surrogate Parent Entity (SPE).
- Updated Guidance: Revised CbCR guidelines and resources are now available on the DITC website, replacing all previous versions. These provide detailed instructions on registration and compliance.
- Reporting Functionality: The DITC expects to enable CbCR return filing on the new portal by November 2025, with further instructions to be communicated to registered contacts.
MNE groups should ensure timely re-registration and review the updated guidance to avoid compliance issues.
4.1 Russian Oil Sanctions Evasion Networks (July 2025)
The UK's National Crime Agency (NCA), in collaboration with the Office of Financial Sanctions Implementation (OFSI) and the Foreign Commonwealth & Development Office (FCDO), issued a Red Alert2 on the Shadow Fleet Sanctions Evasion and Avoidance Network. The report highlights the sophisticated schemes used to evade sanctions on Russian oil exports. The alert is particularly relevant for financial institutions, insurers, and professional service providers exposed to international energy and shipping markets.
The alert explains that over 100 "Shadow Fleet" oil tankers, typically older vessels, are used to transport Russian oil. These ships employ deceptive practices such as disabling tracking systems (AIS), conducting ship-to-ship transfers, and frequently changing flags to obscure the oil's origin.
Regulated entities were reminded of their duty to report suspicious activity and potential sanctions breaches to the NCA and OFSI. The alert provides specific references and reporting channels for such disclosures. The alert also underscores the importance of robust due diligence, particularly when dealing with new counterparties in the oil and shipping sectors, and highlights the ongoing evolution and resilience of sanctions evasion tactics.
This development signals heightened regulatory scrutiny and the need for enhanced compliance measures for any clients with exposure to global energy trading, shipping, or related financial services.
4.2 Recent Sanctions Notices (August 2025)
- Chemical Weapons – 28 August 2025: Targets individuals and entities involved in the proliferation or use of chemical weapons. Measures include asset freezes and restrictions on financial dealings.
- Iran – 21 August 2025: Updates to the list of designated persons under the Iran sanctions regime. Includes individuals linked to nuclear proliferation and human rights violations.
- Russia – 20 August 2025: Expands sanctions against individuals and entities involved in destabilizing Ukraine. Includes those linked to the Social Design Agency (SDA) and other propaganda efforts. Requires freezing of assets and reporting to the FRA.
- Democratic Republic of the Congo – 15 August 2025: Targets individuals contributing to instability and human rights abuses. Includes travel bans and asset freezes.
Financial Action Task Force (FATF) Updates
5.1 Overview of the FATF's 2025 Comprehensive Update on Terrorist Financing Risks
As noted above, the Financial Action Task Force (FATF) released its 2025 "Comprehensive Update on Terrorist Financing Risks," providing a timely and in-depth analysis of how terrorist groups continue to raise, move, and utilise funds globally. The report highlights the persistent adaptability of terrorist organisations, which increasingly exploit both traditional and emerging financial channels—including digital platforms, virtual assets, and informal value transfer systems—to support their activities. Notably, the FATF underscores that while cash and informal money transfer services remain prevalent, there is a marked rise in the abuse of online payment services, mobile money, and virtual assets, particularly in jurisdictions with less robust regulatory oversight.
The report identifies several key factors influencing Terrorist Financing (TF) risks, such as territorial control by terrorist groups, proximity to armed conflict, weak governance, porous borders, and the prevalence of informal or cash-based economies. These vulnerabilities are particularly acute in regions like sub-Saharan Africa and the Sahel, which have emerged as global epicentres of terrorist activity. The FATF also notes the growing convergence between terrorist financing and organised crime, with terrorist groups increasingly engaging in activities such as extortion, trafficking, and the exploitation of natural resources to generate revenue.
For jurisdictions like the Cayman Islands, the report's findings reinforce the importance of maintaining a robust, risk-based approach to anti-money laundering and counter-terrorist financing (AML/CFT) compliance. The FATF calls for enhanced international cooperation, effective implementation of its standards—especially in high-risk sectors such as money value transfer services and virtual asset service providers—and greater engagement with sectors not traditionally covered by AML/CFT regulations, including social media and crowdfunding platforms. The report also stresses the need to balance CFT measures with the safeguarding of legitimate humanitarian activities, ensuring that regulatory responses do not inadvertently impede essential aid.
5.2 Jurisdictions Under Increased Monitoring
Jurisdictions under increased monitoring are actively working with the FATF to address strategic deficiencies in their regimes to counter money laundering, terrorist financing, and proliferation financing. When the FATF places a jurisdiction under increased monitoring, it means the country has committed to resolve swiftly the identified strategic deficiencies within agreed timeframes and is subject to increased monitoring. This list is often externally referred to as the "grey list".
Following review completed in June 2025, the FATF now also identifies Bolivia and the Virgin Islands (UK) as requiring increased monitoring.
5.3 Overview of "Preparation for FATF 5th Round Mutual Evaluation"
The Financial Action Task Force (FATF) conducts periodic mutual evaluations of its member jurisdictions to assess their compliance with international standards on AML and Counter-Terrorist Financing (CTF). The upcoming 5th Round Mutual Evaluation represents a critical opportunity for the Cayman Islands to demonstrate the effectiveness of its AML/CTF framework and its commitment to global best practices. This evaluation will scrutinize both the technical compliance of the jurisdiction's laws and regulations, as well as the practical effectiveness of their implementation.
In preparation for the evaluation, Cayman Islands stakeholders—including government agencies, financial institutions, and professional service providers—are expected to review and, where necessary, enhance their internal policies, procedures, and controls. This process involves ensuring that customer due diligence, record-keeping, and reporting obligations are robust and in line with FATF recommendations. Additionally, there is an emphasis on ongoing training and awareness to ensure that all relevant personnel are equipped to identify and mitigate potential risks.
The 5th Round Mutual Evaluation is not only a regulatory exercise but also an opportunity for the Cayman Islands to reinforce its reputation as a well-regulated and transparent international financial centre. Proactive engagement and thorough preparation will be essential to achieving a positive outcome, which in turn will support continued access to global financial markets and bolster investor confidence.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
