A Cayman Islands fund can rely on a service provider’s AML audit only if that audit specifically tests the fund’s own AML programme and controls. The Cayman Islands Monetary Authority (CIMA) stated in FAQs published on 24 September 2026 that an audit covering only the provider’s general AML framework, or a population-based review, is not sufficient evidence for an individual fund.
Outsourcing does not remove the AML audit requirement
Regulated funds must complete an AML audit under Regulation 5(a)(ix) of the Anti-Money Laundering Regulations (AMLRs) even when most or all of their operations are outsourced to an administrator, investment manager or other provider.
CIMA’s FAQs state plainly that accountability for compliance cannot be delegated, and the fund and its Governing Body remain responsible for every outsourced function.
What a fund-level AML audit must cover
CIMA expects an audit of an individual fund to examine that fund’s own controls, including investor onboarding, ongoing due diligence, third-party and outsourcing arrangements, internal reporting, training and record keeping. The auditor must gather enough evidence to reach a conclusion on both the design and the operating effectiveness of the fund’s programme.
Sampling and testing outsourced functions
Risk-based sampling is acceptable where the auditor can show that the sample gives adequate coverage. For outsourced functions, the audit must test how the arrangement works for that specific fund. In CIMA’s own example, where sanctions screening is outsourced, the auditor should obtain the provider’s screening policies, its testing and the results relevant to the fund.
What this means for fund boards
Funds that have relied on an administrator’s firm-wide assurance should expect future audits to include fund-specific sampling of investor onboarding, screening and monitoring. Boards should confirm that each provider can supply fund-level evidence on request, and should build that expectation into service agreements where it is not already there.
For funds with fully outsourced operating models, the useful question for every provider is whether its evidence will stand up at the level of the individual fund.
Related questions: Does outsourcing AML functions transfer away a fund’s compliance responsibility? | Does a Cayman Islands fund need to commission an AML audit now that CIMA’s AML/CFT/CPF Compliance Rule is in effect?
wb.group performs fund-level independent AML audits for Cayman Islands funds. Contact us to discuss the evidence your providers will need to supply.
FAQs
A Cayman Islands fund can rely on a service provider’s AML audit only if that audit specifically tests the fund’s own AML programme and controls. The Cayman Islands Monetary Authority (CIMA) stated in FAQs published on 24 September 2026 that an audit covering only the provider’s general AML framework, or a population-based review, is not sufficient evidence for an individual fund.
CIMA’s FAQs confirm that regulated funds must complete an AML audit under Regulation 5(a)(ix) of the Anti-Money Laundering Regulations even where operations are fully or substantially outsourced. Scope and frequency are set on a risk basis, taking account of the fund’s structure and outsourcing arrangements.
An administrator’s firm-wide internal audit or population-based review is not enough on its own. CIMA requires evidence on the design and operating effectiveness of the individual fund’s AML programme, including testing specific to that fund.
CIMA accepts risk-based sampling where it is proportionate and the auditor can show it gives adequate coverage. Where functions are outsourced, the audit must include testing of how those functions operate for the specific fund.
The fund and its Governing Body remain accountable. CIMA states that accountability for compliance cannot be delegated and that a fund cannot rely entirely on service providers to manage its AML risk.