CIMA’S New AML Audit Rules Effective 18 September 2026 And What Investment Funds Need To Know

Cayman Islands Monetary Authority (CIMA) registered or licensed investment funds have less than a month to prepare for a significant change in the audit requirements for their anti-money laundering (AML) compliance programmes, as new rules gazetted in July take effect on 18 September 2026.

CIMA’s new AML Effective Compliance Programme Rule and accompanying Compliance with Financial Sanctions Rule apply to all CIMA-registered or licensed investment funds, as well as managers, advisers, and any other regulated entities.

The rules introduce one central and consequential change: a fund’s entire compliance programme must now be independently audited by suitably qualified persons who had no role in designing, implementing, or operating the controls being assessed.

This represents a clear shift and departure from established practice. Until now, many funds had previously met the audit requirements under the Anti-Money Laundering Regulations by having their Anti-Money Laundering Compliance Officer conduct testing of investor procedures. That approach will no longer suffice. CIMA has confirmed that AML officers are not sufficiently independent to conduct audits under the new rule, and the regulator requires the audit function to be free from any conflict of interest that could impair objective judgement.

CIMA has confirmed the audit does not need to be conducted by a financial auditor. The regulator uses the term in the sense of an assessment or appraisal, meaning the function can be performed by appropriately qualified compliance professionals rather than accountancy firms, provided they have specific knowledge of the Cayman AML, counter-financing of terrorism, counter-proliferation financing, and targeted financial sanctions framework.

The scope of the audit requirement is broad. It must constitute a documented review and testing of the fund’s entire compliance programme, encompassing investor onboarding controls, ongoing due diligence, third-party relationships, outsourcing arrangements, internal reporting, training programmes, record keeping, risk assessments, and the application of a risk-based approach. Auditing investor due diligence and screening procedures in isolation will not satisfy the requirement.

There is no prescribed audit frequency. Funds must determine their audit cycle based on size, complexity, structure, nature of business, and risk profile, as established through a documented risk assessment conducted by the governing body. A lower-risk fund may be able to justify a cycle of every two, three, or even four years, provided that assessment is properly documented, approved, and current.

A reporting obligation has also changed. Audit reports must now be submitted to CIMA as soon as practicable after completion, which was noy previously required. CIMA has indicated no filing fee will apply and that it does not expect the submission process to be complex.

Where a fund’s manager or administrator operates an internal audit team that is genuinely independent, separate, and suitably qualified with respect to the Cayman framework, that team may conduct the first and second audits. Because managers and administrators are deemed internal to the fund for the purposes of the AML Rule, every third audit must be conducted by an external party.