A Cayman Islands fund does not need to commission an AML audit solely because CIMA’s AML/CFT/CPF Compliance Rule took effect on 18 September 2026. The Cayman Islands Monetary Authority (CIMA) confirmed in FAQs published on 24 September 2026 that the Rule sets no universal first-filing date or industry-wide completion date, and that audit timing should follow each entity’s own documented, risk-based audit plan.
The audit obligation predates the Rule
The requirement for an independent AML audit already sits in the Anti-Money Laundering Regulations (AMLRs), and for regulated funds it is found in Regulation 5(a)(ix).
CIMA’s FAQs describe the Rule as clarifying how effectiveness should be demonstrated, so an audit completed under an existing cycle does not automatically trigger another. A first audit under the Rule follows the pre-existing audit requirements and is reported to CIMA once it is complete.
How often should you audit?
The Rule does not mandate annual audits. CIMA’s FAQs give illustrative frequencies for the independent AML audit of roughly every two years for higher-risk entities, every three years for medium-risk entities and every four years for low-risk entities, and these apply whether a given cycle is performed by an internal audit function or an external auditor.
Each entity should set and document its frequency by reference to its risk assessment, size, complexity and exposure to money laundering, terrorist financing, proliferation financing and targeted financial sanctions risk.
When is an external auditor required?
Under Rule 12.3, an entity may use internal audit for no more than two consecutive audit cycles before the next audit must be performed externally. CIMA’s FAQs describe this as at least one external AML audit for every three independent audit cycles.
CIMA explains that this addresses the risks of familiarity, self-review and loss of objectivity that build up in purely internal arrangements.
When CIMA may ask for an audit sooner
CIMA will review an entity’s risk assessment and risk profile to judge whether its audit arrangements, frequency and scope are appropriate. Higher-risk or more complex entities may need more frequent or broader coverage, and CIMA may require an audit following supervisory findings. Completed audit reports are submitted to CIMA as soon as practicable.
The practical task for most funds is to document a defensible audit frequency now, so that the timing of the next audit is a recorded decision the board can explain to CIMA.
Related questions: How will CIMA supervise and enforce the AML/CFT/CPF Compliance Rule? | Can a Cayman Islands fund rely on its administrator’s AML audit to satisfy CIMA?
wb.group carries out independent AML audits for Cayman Islands funds and licensees. Contact us to plan your audit cycle.
FAQs
A Cayman Islands fund does not need to commission an AML audit solely because CIMA’s AML/CFT/CPF Compliance Rule took effect on 18 September 2026. The Cayman Islands Monetary Authority (CIMA) confirmed in FAQs published on 24 September 2026 that the Rule sets no universal first-filing date or industry-wide completion date, and that audit timing should follow each entity’s own documented, risk-based audit plan.
CIMA does not require annual AML audits. Its FAQs on the AML/CFT/CPF Compliance Rule state that the frequency of the independent AML audit should be risk-based, with illustrative cycles of two years for higher-risk entities, three years for medium-risk entities and four years for low-risk entities. Each cycle may be carried out internally or externally, but no more than two consecutive cycles can be internal before an external audit is required.
CIMA’s FAQs confirm there is no universal first-filing date, industry-wide completion date or simultaneous submission requirement under the AML/CFT/CPF Compliance Rule. Entities submit the report for an audit completed under their existing risk-based audit plan as soon as practicable after completion.
CIMA’s AML/CFT/CPF Compliance Rule requires at least one external AML audit for every three independent audit cycles. CIMA’s stated purpose is to limit the familiarity and self-review risks that arise when audits are performed internally.
CIMA can require an AML audit outside an entity’s planned cycle, including following supervisory findings. Its FAQs also note that higher-risk or more complex entities may need more frequent or broader audit coverage than their peers.