New CIMA AML Rule and Sanctions Rule: what regulated funds need to consider
This briefing outlines the key implications of CIMA’s new AML and Sanctions Rules for regulated investment funds, with a focus on the practical steps governing bodies should consider before the Rules take effect.
Key implications for Funds
On 18 September 2026, new Rules published by the Cayman Islands Monetary Authority ("CIMA") relating to anti-money laundering ("AML") and sanctions compliance ("Rules") will come into force. CIMA has also published FAQs on its website concerning the application of the new Rules. These new Rules are not intended to significantly extend the substantive obligations in this area, but there is now greater clarity around their enforceability and the extent to which they apply to regulated investment funds ("Funds").
In particular, each Fund's governing body ("Governing Body"), whether directors, general partner or trustee (or the governing body of any of the foregoing, as applicable) should take note of the following:
- Elements of the new Rules that were previously only covered by CIMA guidance, will now be directly enforceable under the administrative penalty regime.
- Each member of the Governing Body must receive annual AML training.
- Each Fund's AML compliance programme must be independently audited at appropriate intervals (and every third audit must be an external audit).
- A Fund's AML compliance officer ("AMLCO") should be independent from the Fund's business and operational functions, and the AMLCO's obligations are more clearly defined.
- While Funds are already required to comply with applicable sanctions, the new Rule on sanctions turns existing CIMA guidance into enforceable requirements for Funds to have appropriate sanctions policies and procedures, to conduct sanctions screening, on-going monitoring of business relationships and re-screening when sanctions lists are updated.
Preparing for the new Rules
In almost all cases, a Fund's AML compliance programme (including the provision of its AMLCO and other AML officers) will have been outsourced to its administrator and/or another external service provider. Notwithstanding this, the Fund's Governing Body remains ultimately responsible for the Fund's compliance with Cayman Islands laws, regulations and CIMA rules relating to AML and sanctions compliance (the "Cayman AML Regime"). The practical implications of the new CIMA Rules for the Governing Bodies of such Funds are:
- Revisit the choice of outsourced AML service provider and AMLCO.
- Check that the service provider is fit and proper, competent and capable of complying with the Cayman AML Regime. For example, is the Fund's AML service provider (or an affiliate to which it sub-contracts these services) itself subject to the Cayman AML Regime? If not, additional review of the policies and procedures it applies to the Fund is called for, to ensure they are fully compliant with the Cayman AML Regime.
- If the Fund's AMLCO is a member of the Governing Body or otherwise involved in its operations, or the AMLCO is not suitably qualified with sufficient skills and experience to perform the required functions, the role should be reassigned, which will generally mean outsourcing the role to an appropriate AML service provider.
- If the Governing Body is not already receiving annual training on the Cayman AML Regime, arrange for this to be provided and documented. One option is to have the AMLCO provide this training annually at a meeting of the Governing Body, since the Governing Body is already required to meet at least annually, to document its proceedings and to receive a report on AML compliance from the AMLCO at that meeting. Additional training will need to be scheduled for any new members of the Governing Body at the time they join.
- Check that the AML service provider is conducting periodic independent audits to evaluate the effectiveness of the outsourced AML compliance programme that it provides to the Fund and others, and discuss with the AMLCO whether these audits may be sufficient for the Fund to rely on. For these purposes, an audit is "independent" if it is not conducted by persons involved in carrying out the audited functions. Any AML service provider that is itself subject to the Cayman AML Regime will usually have a separate team that conducts these independent internal audits, and, being subject to the Cayman AML Regime, they will also be required to conduct independent external audits. A Fund may need to engage a separate service provider to conduct audits of its AML compliance programme where its AML service provider is not conducting independent audits itself or if any such audits do not relate sufficiently to the services provided to the Fund (e.g. where they are focussed only on the service provider's own AML risks).
Further information and support
To review copies of CIMA's new Rules and FAQs click on the links below:
Please get in touch with your usual attorney contact at Carey Olsen for more information on the subject matter of this update.
Frequently asked questions
常见问题解答
What are the key changes under the new CIMA AML and sanctions Rules effective 18 September 2026?
The new Rules elevate previously non-binding CIMA guidance to directly enforceable requirements under the administrative penalty regime. Key changes include mandatory annual AML training for all Governing Body members, requirements for independent audits of AML compliance programmes (with every third audit being external), enhanced independence requirements for AML Compliance Officers (AMLCOs), and the introduction of enforceable sanctions compliance obligations including screening, ongoing monitoring, and re-screening when sanctions lists are updated.
What are the independence requirements for a Fund's AMLCO under the new Rules?
Under the new Rules, a Fund's AMLCO must be independent from the Fund's business and operational functions. If the current AMLCO is a member of the Governing Body or otherwise involved in the Fund's operations, or lacks suitable qualifications, skills, and experience, the role must be reassigned. This typically necessitates outsourcing the AMLCO function to an appropriate external AML service provider that meets independence and competency requirements.
What are the audit requirements for a Fund's AML compliance programme?
The new Rules require that each Fund's AML compliance programme be independently audited at appropriate intervals, with every third audit being conducted by an external auditor. An audit is considered 'independent' if it is not conducted by persons involved in carrying out the audited functions. Funds should verify that their AML service provider conducts such periodic independent audits, or alternatively engage a separate service provider to conduct these audits if the current provider does not perform them or if existing audits do not adequately cover services provided to the Fund.
Who bears ultimate responsibility for AML and sanctions compliance when these functions are outsourced?
Notwithstanding the outsourcing of AML compliance programmes to administrators or other external service providers, the Fund's Governing Body (whether directors, general partner, or trustee) remains ultimately responsible for the Fund's compliance with the Cayman Islands AML Regime. This means the Governing Body must actively oversee the outsourced arrangements, ensure service providers are fit and proper, verify their competence and capability to comply with applicable requirements, and maintain documented oversight of the compliance programme.
What training obligations exist for Fund Governing Body members under the new Rules?
In addition to ensuring an effective training plan is in place for all relevant employees, agents, and other persons to ensure compliance with the Cayman AML Regime, each member of a Fund's Governing Body must receive annual AML training on the Cayman AML Regime. This training must be documented. One practical approach is to have the AMLCO provide this training annually at a Governing Body meeting, which aligns with existing requirements for the Governing Body to meet at least annually and receive AML compliance reports from the AMLCO. Additional training must be scheduled for new Governing Body members at the time they join.
