New CIMA AML Rule And Sanctions Rule: What Regulated Funds Need To Consider

Key implications for Funds 

On 18 September 2026, new Rules published by the Cayman Islands Monetary Authority ("CIMA") relating to anti-money laundering ("AML") and sanctions compliance ("Rules") will come into force. CIMA has also published FAQs on its website concerning the application of the new Rules. These new Rules are not intended to significantly extend the substantive obligations in this area, but there is now greater clarity around their enforceability and the extent to which they apply to regulated investment funds ("Funds").

In particular, each Fund's governing body ("Governing Body"), whether directors, general partner or trustee (or the governing body of any of the foregoing, as applicable) should take note of the following:

• Elements of the new Rules that were previously only covered by CIMA guidance, will now be directly enforceable under the administrative penalty regime.
• Each member of the Governing Body must receive annual AML training.
• Each Fund's AML compliance programme must be independently audited at appropriate intervals (and every third audit must be an external audit).
• A Fund's AML compliance officer ("AMLCO") should be independent from the Fund's business and operational functions, and the AMLCO's obligations are more clearly defined.
• While Funds are already required to comply with applicable sanctions, the new Rule on sanctions turns existing CIMA guidance into enforceable requirements for Funds to have appropriate sanctions policies and procedures, to conduct sanctions screening, on-going monitoring of business relationships and re-screening when sanctions lists are updated.

Preparing for the new Rules

In almost all cases, a Fund's AML compliance programme (including the provision of its AMLCO and other AML officers) will have been outsourced to its administrator and/or another external service provider. Notwithstanding this, the Fund's Governing Body remains ultimately responsible for the Fund's compliance with Cayman Islands laws, regulations and CIMA rules relating to AML and sanctions compliance (the "Cayman AML Regime"). The practical implications of the new CIMA Rules for the Governing Bodies of such Funds are:

• Revisit the choice of outsourced AML service provider and AMLCO.
  • Check that the service provider is fit and proper, competent and capable of complying with the Cayman AML Regime. For example, is the Fund's AML service provider (or an affiliate to which it sub-contracts these services) itself subject to the Cayman AML Regime? If not, additional review of the policies and procedures it applies to the Fund is called for, to ensure they are fully compliant with the Cayman AML Regime.
  • If the Fund's AMLCO is a member of the Governing Body or otherwise involved in its operations, or the AMLCO is not suitably qualified with sufficient skills and experience to perform the required functions, the role should be reassigned, which will generally mean outsourcing the role to an appropriate AML service provider.
• If the Governing Body is not already receiving annual training on the Cayman AML Regime, arrange for this to be provided and documented. One option is to have the AMLCO provide this training annually at a meeting of the Governing Body, since the Governing Body is already required to meet at least annually, to document its proceedings and to receive a report on AML compliance from the AMLCO at that meeting. Additional training will need to be scheduled for any new members of the Governing Body at the time they join.
• Check that the AML service provider is conducting periodic independent audits to evaluate the effectiveness of the outsourced AML compliance programme that it provides to the Fund and others, and discuss with the AMLCO whether these audits may be sufficient for the Fund to rely on. For these purposes, an audit is "independent" if it is not conducted by persons involved in carrying out the audited functions. Any AML service provider that is itself subject to the Cayman AML Regime will usually have a separate team that conducts these independent internal audits, and, being subject to the Cayman AML Regime, they will also be required to conduct independent external audits. A Fund may need to engage a separate service provider to conduct audits of its AML compliance programme where its AML service provider is not conducting independent audits itself or if any such audits do not relate sufficiently to the services provided to the Fund (e.g. where they are focussed only on the service provider's own AML risks).

Further information and support

To review copies of CIMA's new Rules and FAQs click on the links below:

• AML Rule
• Sanctions Rule
• CIMA FAQs