The Rule on an Effective Compliance Programme for the Prevention and Detection of Money Laundering, Terrorist Financing and Proliferation Financing – generally referred to as the AML/CFT/CPF Compliance Rule – was issued by the Cayman Islands Monetary Authority (CIMA) and took effect on 18 September 2026. It sets out, with the force of law, what every financial services provider (FSP) regulated and supervised by CIMA must have in place to prevent and detect money laundering, terrorist financing and proliferation financing.
From Guidance Notes to a Binding Rule
Before 18 September 2026, most of this content existed only in CIMA’s Guidance Notes on the Prevention and Detection of Money Laundering, Terrorist Financing and Proliferation Financing in the Cayman Islands. CIMA could enforce a departure from the Guidance Notes only indirectly, by relying on a separate provision elsewhere in law. The Compliance Programme Rule is issued directly under CIMA’s statutory rule-making power in section 34(1) of the Monetary Authority Act and carries the force of law in its own right, so CIMA can now identify a breach of the Rule itself.
Who the Rule reaches
The Rule applies to all FSPs that are regulated and supervised by CIMA, including branches, subsidiaries, affiliates and any other members of a CIMA-regulated financial group. The Rule requires each FSP to implement a compliance programme commensurate with its own size, complexity, structure, nature of business and risk profile, rather than a single fixed programme applied identically across the industry.
What the Rule requires day to day
FSPs in scope must maintain a documented, risk-based compliance programme. This entails customer due diligence proportionate to risk, ongoing monitoring of business relationships, a properly resourced compliance function led by a qualified Anti-Money Laundering Compliance Officer (AMLCO) and Money Laundering Reporting Officer (MLRO), staff training, and recordkeeping CIMA can review on request.
The requirement that moved furthest from the Guidance Notes
Testing of the compliance programme is where the Rule goes furthest beyond the earlier Guidance Notes. Under Rule 12, the programme must be audited periodically by suitably qualified persons who are independent and separate from those who designed, implemented or operate it. And the audit report must be filed with CIMA once complete.
A companion instrument on sanctions
CIMA issued a second, separate instrument alongside the Compliance Programme Rule under sections 6(1)(b) and 34(1) of the Monetary Authority Act – the Rule on Compliance with Financial Sanctions and Targeted Financial Sanctions. This also took effect on 18 September 2026 and covers sanctions screening and asset-freezing obligations rather than the broader AML/CFT/CPF programme.
Understanding the Compliance Programme Rule is the starting point for everything else that followed from 18 September 2026, from who falls in scope to how the independent audit cycle works.
Related questions: Which Cayman Islands entities are in scope of CIMA’s AML/CFT/CPF Compliance Rule? | How often must a Cayman Islands fund complete an independent AML audit under CIMA’s Compliance Programme Rule? | What does CIMA’s Sanctions Rule require, separately from the AML/CFT/CPF Compliance Rule?
wb.group supports funds and managers building or reviewing an AML/CFT/CPF compliance programme against CIMA’s requirements. Contact us for more information.
FAQs
The Rule on an Effective Compliance Programme for the Prevention and Detection of Money Laundering, Terrorist Financing and Proliferation Financing – generally referred to as the AML/CFT/CPF Compliance Rule – was issued by the Cayman Islands Monetary Authority (CIMA) and took effect on 18 September 2026. It sets out, with the force of law, what every financial services provider (FSP) regulated and supervised by CIMA must have in place to prevent and detect money laundering, terrorist financing and proliferation financing.
The Guidance Notes still exist and continue to provide interpretive detail, but the Compliance Programme Rule now sets the binding legal standard. Where the two overlap, compliance with the Rule is what CIMA will test against.
No. The Anti-Money Laundering Regulations set out the underlying customer due diligence, officer-appointment and recordkeeping obligations. The Compliance Programme Rule sits alongside them and adds the binding programme-effectiveness and independent audit standard, issued under section 34(1) of the Monetary Authority Act.
It applies to every FSP regulated and supervised by CIMA under the Regulatory Acts, including branches, subsidiaries, affiliates and other members of a CIMA-regulated financial group. The specific scope for funds is covered in a related question in this series.
Yes. Because the Rule carries the force of law, CIMA can point directly to a breach of it, and can use its usual supervisory tools, including directions, licence or registration conditions, or referral for further investigation, where a deficiency is material.