2026 CIMA AML and Sanction Rules: What Cayman Fund Professionals Need to Know

The Cayman Islands Monetary Authority (“CIMA”) has finalised their 2026 CIMA AML and sanction rules, two important requirements that will directly affect Cayman-regulated funds and other financial service providers from 18 September 2026, marking a significant development in Cayman Islands AML compliance:

• the Rule on Effective Compliance Programme for the Prevention and Detection of Money Laundering, Terrorist Financing and Proliferation Financing for Financial Services Providers; and
• the Rule on Compliance with Financial Sanctions and Targeted Financial Sanctions.

For many market participants, the themes in the final rules will feel familiar. Cayman funds and their service providers have long operated within a mature anti-money laundering, counter-terrorist financing, counter-proliferation financing and financial sanctions (“AML/CFT/CPF/FS”) framework, and many of the practical expectations reflected in the 2026 CIMA AML and sanction rules may already be embedded in existing policies, procedures and governance arrangements. What is different now is that these expectations have been more expressly articulated in binding CIMA rules, particularly in areas such as governance, risk assessment, outsourcing oversight, sanctions controls, employee screening, record keeping and independent review of the compliance programme.

Why the 2026 CIMA AML Rules Are Binding, Not Just Guidance

One of the most important points for boards, AMLCOs and service providers to keep in mind is that these final CIMA AML and sanction rules are not merely guidance. They are issued under CIMA’s statutory powers and have the force of law. Although they remain subject to the Anti-Money Laundering Regulations (“AMLRs”) and the underlying legislation, they materially strengthen CIMA’s supervisory and enforcement position, including in relation to rule breaches that may give rise to enforcement action and, where applicable, administrative fines.

That distinction matters. The implementation discussion should not be framed solely as a question of waiting to see how broader market practice develops. The more immediate and practical question is whether a fund can demonstrate that it has taken reasonable steps to align its documented compliance framework with the rules as issued before they take effect.

A Practical Message for AMLCOs and Directors

Fund AMLCOs should now be engaging with Fund Directors to ensure their funds are in a compliant position prior to 18 September 2026. That does not mean every operational question must be settled immediately, nor does it mean the industry should ignore the possibility of further CIMA clarification. It does mean that funds should be reviewing and, where necessary, updating their AML/CFT/CPF/FS policies and governance framework now, rather than deferring action altogether.

There is a sensible middle ground. Funds can and should seek to ensure that they are appropriately aligned with the final rules ahead of the effective date, while allowing certain implementation components, such as audit frequency, filing mechanics and aspects of operational execution, to evolve as greater clarity emerges from CIMA or broader industry practice.

Key Priorities

Governance and Accountability
The final CIMA AML and sanction rules place clear emphasis on governance. Funds should ensure that the roles and responsibilities of the AMLCO, MLRO and DMLRO are properly documented, that the governing body remains satisfied as to their suitability and independence, and that the board receives appropriate reporting on the operation of the compliance programme.

Risk Assessment and the Risk-Based Approach
Funds should revisit their AML/CFT/CPF/FS risk assessment to ensure it remains proportionate, documented and current. The final rules require a risk-based approach that reflects the fund’s size, complexity, structure, business activities and risk profile, with updates made where material trigger events occur.

Policies, Procedures and Oversight of Delegation
Policies should be updated where necessary to reflect the final rule language and to clearly address governance, outsourcing oversight, sanctions compliance, employee screening, record keeping and escalation obligations. Funds that rely on administrators or other service providers should also ensure that this reliance is properly documented and overseen, without losing sight of the principle that ultimate responsibility remains with the fund and its governing body.

Sanctions Compliance
The CIMA sanctions rule is particularly explicit. Funds should ensure that their sanctions framework addresses onboarding and ongoing screening, re-screening upon list updates, false positive handling, freezing obligations, reporting to the Financial Reporting Authority (“FRA”), and unfreezing or licensing procedures where relevant.

Record Keeping and Evidence of Compliance
The finalised rules also reinforce the importance of maintaining records and evidence of compliance in a form that can be produced to CIMA without delay. This includes risk assessments, due diligence records, sanctions records, internal logs and other supporting documentation relevant to the operation of the compliance programme.

The Independent AML Audit Requirement: What Does it Mean in Practice?

The independent AML Audit
One of the most discussed features of the final rules is the new requirement for independent audit procedures to review and test the adequacy and effectiveness of the compliance programme. The final rule provides that:

• the audit must be carried out at a frequency commensurate with the fund’s size, complexity, structure, nature of business and risk profile;
• the audit may be conducted internally, provided the reviewer is suitably qualified, independent and separate from those involved in the design, implementation or operation of the controls under review; and
• the audit must not be undertaken internally for more than two consecutive audit cycles, after which the next audit must be conducted by an external service provider

Importantly, the final rule does not expressly prescribe when the first audit must take place, nor does it expressly require that an independent audit be undertaken immediately upon the rules taking effect. In practice, this appears to leave room for funds to adopt and document a reasonable, risk-based audit framework, provided the approach is supportable, appropriately documented and approved by the governing body. The key point is that the approach should be documented, justified and kept under review.

Filing Audit Reports with CIMA
The final rule states that the audit report is to be filed with CIMA as soon as practically possible after completion, or as otherwise prescribed by CIMA.

At the time of writing, the materials reviewed do not clearly identify a specific prescribed form or filing workflow for this new report. Funds should therefore monitor for further CIMA guidance in this area. It is possible that any such filing may ultimately be made through CIMA’s electronic filing portal, but this remains subject to confirmation once CIMA publishes the applicable mechanism or guidance.

AML Audit Approach

The uncertainty surrounding how the industry should approach the practical application of the audit requirement is understandable. However, that uncertainty should not lead funds to delay updating their AML/CFT/CPF/FS framework altogether.

A balanced approach would be for AMLCOs to work with fund directors now to ensure that funds are in a compliant position before 18 September 2026, while retaining flexibility to refine specific implementation points as further CIMA guidance or broader market practice develops.

That is likely to be a more balanced and more defensible approach than waiting for every operational question to be settled before taking action.

About JTC

JTC has over 36 years’ experience in providing solutions to complex corporate structures, funds and family offices.

We have grown our global footprint to 35 offices in 21 jurisdictions, with continued expansion in key international markets. Over the past three years, we have completed seven acquisitions in our Institutional Client Services division, enhancing not only our scale but also the depth and breadth of our services.

Our strength lies in our 2,300 people and their subject matter expertise. Through our shared ownership culture, we work as one team to deliver high-quality service and long-term value for our clients.

JTC offers a broad range of fund, corporate and ancillary services to institutional clients, including Fund Administration and Fund Governance through our AML Officer Service.

How JTC Supports Cayman Fund AML Compliance

JTC’s AML Officer Services team supports Cayman funds with:

• review and updating of AML/CFT/CPF/FS policies;
  governance and board oversight support;
• risk assessment review;
• practical interpretation of the new CIMA independent AML audit requirements; and
• broader Cayman Islands AML compliance framework enhancement considering the final CIMA rules.

If you would like to discuss the impact of the 2026 CIMA AML and sanction rules on your fund or wider Cayman structure, please contact your usual JTC representative.