Preparing for CIMA’s New AML & Sanctions Rules: Key Considerations for Cayman Investment Funds and Managers

The Cayman Islands Monetary Authority’s (“CIMA”) new AML & Sanctions Rules, effective 18 September 2026, represent a significant shift in regulatory expectations. While firms have long been required to maintain and implement effective AML/CFT/CPF and sanctions policies and controls, the new Rules place increased emphasis on demonstrating and evidencing that those frameworks are operating effectively in practice. For Financial Service Providers (the “FSPs”), this raises the bar for governance, independent oversight, sanctions compliance and ongoing AML programme testing. Firms that respond proactively will not only strengthen regulatory resilience but also enhance investor confidence and operational credibility.

Increased Focus on Demonstrable Effectiveness

The publication of CIMA’s Rule – Effective Compliance Programme for ML/TF/PF and Rule – Compliance with Financial Sanctions and Targeted Financial Sanctions (“The Rules”) reinforces and enhances existing obligations under the Anti-Money Laundering Regulations and Guidance Notes. By elevating key requirements into enforceable Rules, CIMA has provided greater regulatory clarity and supervisory focus on how firms implement and evidence compliance programmes in practice.

For many FSPs, particularly organizations that continue to rely on internal personnel to perform the Anti-Money Laundering Compliance Officer (“AMLCO”), Money Laundering Reporting Officer (“MLRO”), and Deputy MLRO (“DMLRO”) (“The AML Officers”) responsibilities, this is an appropriate time for those charged with the governance of funds and The AML Officers to reassess whether existing governance arrangements remain fit for purpose in accordance with current Anti-Money Laundering Regulations (As Revised) (“AMLRs”), Rules and Guidance Notes.

What Has Changed

The new Rules reinforce several important regulatory expectations supplementing the AMLRs and Guidance Notes as noted below:

Rule on AML/CFT/CPF Compliance Programme:

• The AML Officers – must be demonstrably independent, appropriately qualified, adequately resourced and have direct access to senior management and the board
• Risk-based approach – FSPs must regularly assess and document the risk assessment program’s effectiveness, supported by clear evidence of risk identification, monitoring, mitigation and timeous reporting
• Due diligence – FSPs should have an effective Customer Due Diligence (“CDD”) and screening program and Know Your Client (“KYC”) procedures
• Outsourcing – FSPs are required to perform due diligence on service providers and retain ultimate responsibility for AML/CFT/CPF functions when delegated to third parties
• Training – FSPs are required to establish, document, and implement an effective training programme and plan that ensures that all relevant employees, agents, and other persons authorized to act on their behalf understand and comply with the requirements of all applicable regulations
• Record keeping – FSPs should retain all records for at least five years after the end of a business relationship or the completion of a one-off transaction
• Independent audit – In addition to the oversight of the AML Compliance Framework, which is undertaken by the AMLCO, FSPs must undertake independent AML audits to review and test their AML Compliance Framework at a frequency commensurate with its size, complexity, structure, nature of business, and the risk profile, as determined by the FSP’s risk assessment or as otherwise required by the Authority. The Independent Auditor should be suitably qualified, independent and separate from those involved in the design, and day-to-day implementation and operation of the AML Compliance Framework (i.e., not the AMLCO, MLRO or Deputy MLRO). The audit report should be filed with CIMA as soon as possible after completion. The Rules indicate that the audit may be conducted internally, but not for more than two consecutive audit cycles. After two consecutive internal audit cycles, the next audit must be conducted by an external service provider
• Governance – Governing bodies retain ultimate accountability for the effectiveness of the AML programme, regardless of outsourcing arrangements

Rule on Financial Sanctions and Targeted Financial Sanctions:

The Sanctions Rule formalizes and strengthens existing sanctions compliance obligations and places additional focus on governance, documentation, screening controls and reporting requirements. FSPs must be able to demonstrate that sanctions obligations are effectively implemented and monitored. This Rule reinforces and obliges that FSPs must:

• Screen all applicants, customers, beneficial owners, connected persons and transactions against all applicable sanctions lists
• Ensure accurate screening outcomes by implementing procedures to review and validate potential false positives
• Put measures in place to ensure that geographic risk is not assessed as “low” where a country is subject to sanctions imposed by the UK, United Nations or the United States (including OFAC designations)
• File Compliance Reporting Forms (“CRFs”) with the Financial Reporting Authority (“FRA”) and freeze assets of designated persons without delay
• Apply to the Governor for licenses authorizing otherwise prohibited acts in relation to frozen assets and follow acceptable principles when unfreezing such assets, in accordance with guidance issued by the FRA
• Have well documented procedures for freezing and unfreezing assets

Why This Matters

Most organizations have historically engaged AML Officers from independent third-party providers. Some allocated AML officer responsibilities to senior legal, operational or compliance staff as an additional duty. This remains permissible, provided firms can demonstrate that conflicts of interest are appropriately managed and that AML officers have sufficient independence, expertise, authority and resources to discharge their responsibilities effectively.

FSPs should consider whether they can confidently demonstrate:

• Independent oversight and challenge
• Current technical expertise across AML and sanctions requirements
• Adequate time and resources are dedicated to AML and Sanctions governance
• Robust independent testing that demonstrates that controls operate effectively in practice
• Regular and timely review of the existing AML/CFT/CPF compliance and sanctions programmes, risk assessments, outsourcing arrangements and other AML regulatory obligations. Please refer to the CIMA FAQ document (link below) regarding obligations on individual Funds
• For AML Audits of Funds, consideration needs to be given to the specific Fund’s policies, controls and procedures, which should incorporate investor onboarding controls, ongoing due diligence, investment objective and policies, third party relationships/outsourcing, internal reporting, training programme, record keeping and the application of a risk-based approach
• The Fund and its Governing Body must obtain sufficient evidence regarding assurance of the effectiveness of their outsourced partners’ program
• The scope of an independent audit should include the AML activities performed by the outsourced service provider on behalf of the FSP

The FSP must implement a programme to evaluate the effectiveness of the system of internal controls over such activities.

Turning Compliance into Competitive Advantage

Viewed strategically, these developments represent more than a regulatory obligation. A demonstrably effective AML framework strengthens governance, enhances investor confidence and provides boards with greater assurance that financial crime risks are being appropriately managed. In an increasingly competitive fundraising environment, strong governance has become a differentiator.

Conclusion

The FSPs’ best positioned for the next phase of regulatory scrutiny will be those that can evidence effective AML and sanctions governance, independent oversight and robust operational controls. With The Rules taking effect on 18 September 2026, organizations should ensure that any required enhancements are implemented before the effective date to demonstrate readiness for regulatory scrutiny.

How Waystone Can Help

Should you require advice relating to your ongoing regulatory compliance obligations, we would be delighted to assist as Waystone has:

Specialist AML Officer Services: Experienced AMLCO, MLRO and DMLRO professionals delivering independent oversight, regulatory expertise and board reporting.

Independent AML Audits: Independent assessments of the compliance programme designed to evaluate whether AML frameworks operate effectively, identify gaps and support regulatory readiness.

Independent Sanctions Governance Reviews: Assessment of sanctions screening, escalation, reporting, governance and recordkeeping to strengthen resilience against evolving global sanctions obligations.

Helpful Links

The Rules can be found in the following links:

1. the Rule on an Effective Compliance Programme for the Prevention and Detection of Money Laundering, Terrorist Financing and Proliferation Financing for Financial Services Providers (the AML Rule)
2. the Rule on Compliance with Financial Sanctions and Targeted Financial Sanctions (the Sanctions Rule)
3. AML-Sanctions Rules FAQs

Fortune Muhlanga Executive Director – Cayman Compliance Services	Ricky Chiu Director, Cayman Compliance Services
Ashley Arnardu Associate Director

Contact Us

Disclaimer

This client briefing has been prepared for clients and professional associates of Waystone. The information and expressions of opinion which it contains are not intended to be a comprehensive study or to provide legal advice and should not be treated as a substitute for specific advice concerning individual situations.