Cayman Islands Fund Compliance: Understanding the New CIMA Rules for 2026

Key Fact: As of 18 September 2026, CIMA makes non-legally binding guidance legally binding by implementing specific administrative, audit, and outsourcing-related measures in the event of non-compliance.

Introduction

Going from guidance-based requirements to direct legal requirements, Cayman-regulated firms are now required to be in compliance with regard to AML, financial sanctions, outsourcing, and independent testing.

The regulation of investment funds, fund managers, and business service providers in the Cayman Islands is witnessing a revolutionary development in its regulatory structure. Two revolutionary regulatory instruments have been formally adopted by the Cayman Islands Monetary Authority (CIMA):

1. The AML/CFT/CPF Compliance Rule (Anti-Money Laundering, Counter-Terrorist Financing, and Counter-Proliferation Financing).
2. The Financial Sanctions Rule.

The rules will be applicable from 18 September 2026 and will apply to CIMA-regulated Financial Services Providers (FSPs), such as mutual funds, private funds, fund managers, advisors, and corporate administrators. For those who use outsourcing in order to comply with their business services and compliance, this change in regulation means a new era.

Why Is CIMA Moving from Guidance to Direct Enforcement?

Traditionally, CIMA would depend on the use of Guidance Notes in order to define regulatory expectations. Failure to follow Guidance Notes may indicate bad governance, but the Guidance Notes themselves did not provide any statutory route to administrative penalties.

With the new set of rules for 2026, CIMA fills this gap in preparation for the international assessment like the FATF 5th Round Mutual Evaluation. CIMA can now have statutory authority to start administrative penalty proceedings and levy monetary penalties.

Understanding the Legal Hierarchy

• Primary Legislation: Statutory legislation such as the Proceeds of Crime Act (POCA), Anti-Money Laundering Regulations (AMLRs), and Terrorism Act remain supreme.
• New CIMA Rules: Come next after Primary Legislation, as they are legally binding and enforceable.
• Guidance Notes: Persuasive in nature and give guidance. In case of conflict between a Guidance Note and a Rule, the Rule takes precedence.

What Changed Under the New CIMA Rules?

What Must a Cayman FSP Include in Its AML & Sanctions Compliance Programme?

Every CIMA-licensed FSP should have a written structure addressing the following basic pillars:

Governing Body Approval

The ultimate approving body, such as the Board of Directors, General Partner or Trustee, should formally consider and approve all AML/CFT/CPF and sanctions compliance programmes. No longer will governing bodies be able to see compliance as an oversight issue.

Appointment of AML Officers

FSPs should appoint three types of AML officers:

• AML Compliance Officer (AMLCO): Responsible for overall compliance oversight and acts as the first point of contact with regulators.
• Money Laundering Reporting Officer (MLRO): Responsible for receiving and evaluating internal suspicious activity disclosures.
• Deputy MLRO (DMLRO): Operates in place of the MLRO.

All officers should have fitness and propriety records, qualifications, and enough independence from operations.

Risk-Based Compliance Controls

The written policy should apply the principles of a risk-based approach (RBA), which will be based on the nature of the investors in the fund, delivery methods, geographic exposure, and level of complexity of the products offered.

Annual Training & AMLCO Reporting

• Training: Every year, all relevant personnel and those members of the governance body must undergo compliance training irrespective of whether operational activities are completely outsourced or not.
• Report: Annually, there is a need for the AMLCO to provide a written report to the governance body concerning the effectiveness of the controls implemented in AML and sanctions.

Financial Sanctions Controls

Financial Services Providers must have written sanctions controls that will cover the following:

• Real-time screening of counterparties, investors, directors, service providers, and beneficial owners based on the applicable list (FSP must follow the FCDO, UK, UN, and OFAC equivalent lists).
• Asset Freezing and Unfreezing process “without delay”.
• Immediately reporting to FRA and CIMA once the designated person or frozen assets are discovered.

The Independent AML Audit Mandate | What Does the 2-Cycle Limit Mean?

CIMA now mandates that all regulated FSPs implement independent testing to evaluate the operational effectiveness of their compliance programmes.

Who Can Conduct the AML Audit?

The audit has to be conducted by a qualified individual who is wholly independent of the process that is being audited. The auditor cannot be the AMLCO, MLRO, or anyone involved in drafting, implementing, or managing the fund’s daily compliance framework.

How Does the Two-Cycle Rule Work?

Independent auditing by an internal group (such as the internal audit team of the investment manager or internal compliance testing team of the administrator) can be undertaken for up to two consecutive cycles; the third consecutive cycle has to be undertaken by an independent external third party before an internal group can undertake it again.

CIMA Filing & Remediation

Independent audit reports have to be made available to CIMA upon demand or in accordance with the statutory deadlines. Deficiencies identified during the process have to be remedied through a properly documented remediation program.

What Do the New Outsourcing Rules Mean for Cayman Investment Funds?

Since many Cayman funds function as self-managed corporate or LP vehicles without employees, operational tasks are commonly delegated to fund administrators, investment managers, and compliance consultants. Delegation of tasks under the new 2026 rules does not relieve the fund from regulatory responsibility.

Mandatory Vendor Due Diligence

Before the use or renewal of any service providers, fund managers have to perform due diligence with respect to:

• Technical capabilities, regulatory status, and qualifications of personnel.
• Ability to adapt to changing regulatory requirements of Cayman.
• Financial stability and contingency planning arrangements.

Assessing Country Risk

Country risk assessment shall be performed by fund managers in relation to the jurisdictions where outsourcing of operational functions takes place. If the functions are performed offshore (India, Philippines or European centers), fund managers have to ensure that local data protection or confidentiality laws do not restrict CIMA’s access to regulation.

Mandatory Contractual Provisions

The outsourcing contract should specify clearly that:

• Scope of delegated responsibility and measures of performance.
• Unrestricted right of access to records, data, and systems by the fund, auditor, and CIMA.
• Compliance with Cayman Islands standards is mandatory.

CIMA Notifications & Recordkeeping

FSPs subject to regulation shall give notice to CIMA of any outsourced arrangements. Registers of third-party contractual agreements, diligence reports, and risk assessments have to be kept centrally.

5 Steps to Prepare Your Cayman Entity Before 18 September 2026

1. Perform a Compliance Gap Analysis
   Conduct a gap analysis of your existing AML/CFT/CPF policies, sanctions screening tool, and governance documentation against the official 2026 Rules.
2. Review Service Providers & Contracts
   Re-perform vendor due diligence for all administrators and compliance providers. Amend the terms of service agreements to ensure CIMA access to records and necessary regulatory provisions.
3. Confirm AML Officer Readiness
   Make sure AMLCO, MLRO, and DMLRO designations are officially recorded; independence criteria are met, and annual reporting templates are updated.
4. Appoint an Independent AML Auditor
   Set your audit plan, check auditor independence, and plan a rotation cycle according to the two-cycle limit of the internal rule.
5. Strengthen Sanctions Controls
   Audit your sanctions screening tools to ensure the real-time updating of FCDO, UN, and OFAC lists. Confirm that there are freezing, unfreezing, and FRA reporting procedures in writing.

How Arnifi Helps You Stay Compliant in the Cayman Islands

Adapting to the changing CIMA regulatory environment needs active corporate management, strong vendor management, and automation. Arnifi can help with all aspects of Cayman Islands company formation, business structuring, and business structuring follow-up.

With continuous corporate management, Arnifi can help fund managers and corporates to ensure that their business services meet the changing laws. The Arni AML Checker, an automated tool, can be used to check the sanctions status of clients and counterparties against international watchlists.

Frequently Asked Questions (FAQs)

Do the new CIMA rules apply to private funds as well as mutual funds?

Yes. All CIMA-regulated entities are covered, including registered mutual funds and private funds.

Can our fund administrator provide the independent AML audit?

Yes, only if the auditor is independent of the day-to-day activities and restricted to two cycles in a row.

What happens if an entity fails to comply by the September 18, 2026 deadline?

CIMA can initiate administrative penalty procedures and impose monetary fines directly on non-compliant entities.

Do non-regulated Cayman entities need to follow these new Rules?

No. They apply only to CIMA-regulated entities, though general primary AML laws still apply to all.

How does this impact directors of funds with no employees?

Directors remain legally accountable, requiring annual AML training and documented oversight of all outsourced providers.

Does the AMLCO role have to be a dedicated external hire?

No, but the individual must act independently with operational authority and documented conflict management.

How often must the independent AML audit take place?

Frequency depends on the fund’s risk profile, but must be formally risk-assessed and documented.

What specific trigger forces a continuous sanctions re-screening?

Any update to international designated lists (UK, UN, OFAC) requires immediate re-screening of all counterparties.

What if an outsourced service provider fails to cooperate with CIMA?

The fund’s governing body is held directly liable for failing to maintain effective oversight and contractual access.

References

• Cayman Islands Monetary Authority (CIMA) – Official Home & Guidance
• CIMA AML/CFT Legislative Framework & FAQs
• Financial Reporting Authority (FRA) – Cayman Islands FIU Portal
• Cayman Islands Government Legislation Portal