The Cayman Islands Monetary Authority (CIMA) published updated FAQs on 24 September 2026 confirming that its AML/CFT/CPF Compliance Rule largely builds on obligations that already existed under the Anti-Money Laundering Regulations (AMLRs) and sets enhanced expectations for how they are met. The FAQs confirm that audit timing remains risk-based, that no AML audit is required solely because the Rule took effect, and that accountability for compliance stays with the regulated entity even where functions are outsourced.
Why CIMA issued the FAQs
New Rules on AML/CFT/CPF and Financial Sanctions took effect on 18 September 2026. CIMA subsequently issued FAQs in response to industry queries, concentrating on risk-based supervision, expectations from the effective date and the independent AML audit. The FAQs do not amend either Rule and, where the Compliance Rule and the AMLRs are inconsistent, the AMLRs prevail.
Enforcement from the effective date
CIMA has stated that it will not apply blanket enforcement from 18 September 2026, and the administrative fines framework for breaches of the Rule is not yet in effect. Compliance will instead be assessed through risk-based supervision, including on-site inspections, desk-based reviews and thematic reviews. The underlying obligations in the AMLRs remain enforceable throughout this period.
The independent AML audit
The FAQs confirm there is no universal filing date or industry-wide completion date, and the Rule does not mandate annual audits. CIMA gives illustrative frequencies for the independent AML audit of roughly every two years for higher-risk entities, every three years for medium-risk entities and every four years for low-risk entities. Each cycle may be internal or external, but no more than two consecutive cycles can be internal before an external audit is required.
Funds, outsourcing and sanctions
Regulated funds must still complete an AML audit under Regulation 5(a)(ix) of the AMLRs even when their operations are fully outsourced, and an audit of an administrator’s general framework will not be sufficient on its own. The Sanctions Rule reaches further than the Compliance Rule, applying to every entity that CIMA supervises, whether or not it conducts Relevant Financial Business.
For most Cayman Islands funds and licensees, the FAQs ease the pressure on timing while raising the standard of evidence CIMA expects to see.
Related questions: Does a Cayman Islands fund need to commission an AML audit now that CIMA’s AML/CFT/CPF Compliance Rule is in effect? | Can a Cayman Islands fund rely on its administrator’s AML audit to satisfy CIMA?
wb.group provides AML Compliance services and independent AML audits for Cayman Islands funds and licensees. Contact us to discuss what CIMA’s new Rules mean for your compliance programme.
FAQs
The Cayman Islands Monetary Authority (CIMA) published updated FAQs on 24 September 2026 confirming that its AML/CFT/CPF Compliance Rule largely builds on obligations that already existed under the Anti-Money Laundering Regulations (AMLRs) and sets enhanced expectations for how they are met. The FAQs confirm that audit timing remains risk-based, that no AML audit is required solely because the Rule took effect, and that accountability for compliance stays with the regulated entity even where functions are outsourced.
CIMA published updated FAQs on the AML/CFT/CPF Compliance Rule and the Sanctions Rule on 24 September 2026, six days after both Rules took effect on 18 September 2026. The revisions focus on risk-based supervision, expectations from the effective date and the independent AML audit.
CIMA’s FAQs state that the administrative fines framework for breaches of the Rule is not yet in effect and that CIMA will not apply blanket enforcement from the 18 September 2026 effective date. Obligations under the Anti-Money Laundering Regulations remain enforceable, and CIMA may still act where supervisory findings warrant it.
The Anti-Money Laundering Regulations prevail. CIMA’s FAQs describe the Rule as supplementing the AMLRs, and it is issued under sections 6(3)(b) and 34(1) of the Monetary Authority Act.
CIMA’s FAQs confirm that the Sanctions Rule applies to all entities supervised under the Regulatory Acts, whether or not they conduct Relevant Financial Business. This reflects the fact that sanctions obligations apply to all persons and legal arrangements in the Cayman Islands.