Regulated entities in the Cayman Islands face tightening AML obligations, with CIMA consulting on rules that would require an annual review of each entity’s compliance programme and an independent review at least once every three years. Getting the framework right – policies, risk assessments, CDD, ongoing monitoring, and board oversight, is foundational. wb.group’s compliance team supports regulated entities in building, maintaining, and independently reviewing AML programmes that meet CIMA’s expectations and stand up to scrutiny.
AML compliance in the Cayman Islands has never been a box-ticking exercise, but the bar is rising. CIMA’s supervisory activity has intensified in recent years, with on-site inspections, desk-based reviews, and administrative fines becoming more frequent.
The findings from those reviews have been consistent. Business risk assessments are often weak or outdated. Customer due diligence falls short. Board oversight of the compliance function is insufficient. And independent AML audits, which are already required under the Anti-Money Laundering Regulations, are either not taking place or are not conducted by a genuinely independent party.
Against that backdrop, CIMA published a private sector consultation paper setting out proposed new rules that would formalise and sharpen compliance expectations across the board. For regulated entities, this is worth close attention.
What the framework already requires
The Anti-Money Laundering Regulations (AMLRs) set out the core obligations for every financial service provider regulated in the Cayman Islands. These include appointing qualified AML Officers (AMLCO / MLRO / DMLRO), maintaining a documented business risk assessment, applying a risk-based approach to customer due diligence, keeping ongoing monitoring records, and operating an independent audit function. The CIMA Guidance Notes on the Prevention and Detection of Money Laundering, Terrorist Financing and Proliferation Financing sit alongside those regulations and provide the interpretive framework that CIMA uses when inspecting.
What CIMA’s inspection programme has repeatedly found is that many entities understand the rules but have not embedded them in practice. Policies exist but haven’t been reviewed. Risk assessments were prepared years ago and haven’t been refreshed. CDD files are incomplete. Boards receive little meaningful reporting on AML matters. These aren’t minor housekeeping issues; they are the gaps that CIMA is fining entities for.
The question is no longer whether a framework exists, it is whether it can withstand CIMA inspection.
What the proposed new rules would add
CIMA’s consultation in March 2026 marked a significant shift in approach, from broadly principles-based regulation to increasingly structured and testable expectations. Rather than setting high-level obligations and leaving implementation largely to entities’ discretion, the proposed rules would introduce clearer minimum expectations and documentation standards.
Two areas stand out in particular. First, governance: the proposed rules would require governing bodies to establish and maintain a documented AML governance framework, with clearly defined roles, responsibilities, and lines of accountability. Board-level oversight of AML effectiveness would become explicitly enforceable rather than merely expected.
Second, and perhaps most significant for many entities, the consultation proposes a mandatory annual review of the AML compliance programme, with an independent review required at least once every three years. The proposed rules would also introduce a new deadline, the independent audit report to be submitted to CIMA by 15 September each year. (You can read the full consultation paper on the CIMA website.)
This matters because, under the existing regulations, independent audit obligations are already in place, but no frequency or external reporting deadline is prescribed. The result has been significant variation in practice and, as CIMA’s inspections have found, widespread non-compliance. The proposed rules would remove that ambiguity.
Building a compliance programme that works
Whether or not the proposed rules come into force in their current form, they signal the direction of travel. CIMA expects compliance frameworks that are documented, actively maintained, overseen at board level, and periodically tested by someone independent of day-to-day operations. That is the benchmark against which entities will be measured.
In practice, a programme that meets those expectations typically involves the following:
- A business risk assessment that is current, documented, and demonstrably applied to decisions about customer onboarding and ongoing monitoring, not a document prepared once and left untouched.
- Customer due diligence procedures that are proportionate to risk, with enhanced due diligence applied and evidenced where clients or transactions warrant it.
- Ongoing monitoring that is genuinely operational, transaction monitoring, periodic file reviews, and documented escalation of concerns.
- AML Officers with the authority, access, and competence to do the role effectively, and who reports directly to the governing body.
- Board-level engagement with AML matters, reflected in meeting agendas, minutes, and the approval of key policies.
- An independent audit function that is operationally separate from the compliance team, conducted with the regularity and rigour the programme’s risk profile demands.
None of this is new in principle. What is changing is CIMA’s willingness to hold entities to account when these elements are absent or inadequate.
How wb.group can help
WB Group’s compliance team works with regulated entities across a range of AML and compliance needs, from initial framework design and policy drafting to annual programme reviews and independent AML audits. We understand the Cayman regulatory environment in depth, and we work alongside boards and compliance officers to ensure their programmes are fit for purpose and ready for scrutiny.
If you are a regulated entity thinking about how your AML framework measures up, or if the proposed new rules raise questions about your current programme, we would be glad to have that conversation.
Speak with Tony Walton about your AML compliance programme