How will CIMA supervise and enforce the AML/CFT/CPF Compliance Rule?

The Cayman Islands Monetary Authority (CIMA) will apply its AML/CFT/CPF Compliance Rule through risk-based supervision, using on-site inspections, desk-based reviews, thematic reviews and risk and compliance meetings scaled to each entity’s risk profile. CIMA confirmed in FAQs published on 24 September 2026 that it will not apply blanket enforcement from the Rule’s 18 September 2026 effective date, and that the administrative fines framework for breaches of the Rule is not yet in effect.

Supervision scaled to risk

CIMA has indicated that on-site inspections are generally suited to higher-risk entities. Meanwhile, desk-based reviews are better suited for lower-rated entities, with desk-based work also used to fill the gaps between inspections. Medium-rated entities may see either approach. The intensity of supervision will reflect each entity’s size, nature, complexity and risk profile.

What the absence of fines means

The administrative fines framework for breaches of the Rule has not yet commenced, but the obligations the Rule builds on remain enforceable under the Anti-Money Laundering Regulations (AMLRs). CIMA describes many of the Rule’s provisions as enhanced expectations on existing requirements, so the current period is best used to close gaps before fines can attach to breaches of the Rule itself.

How CIMA treats audit findings

Findings, exceptions or deficiencies identified in an AML audit do not automatically invalidate it. CIMA will treat them as areas for remediation that may inform its supervisory assessment. At its industry webinar on 30 September 2026, CIMA added that remediation periods will reflect the scale and complexity of findings and that repeat findings may carry more supervisory weight.

Evidence of board oversight

CIMA expects the Governing Body’s oversight of the compliance programme to be evidenced through minutes, reports, documented decisions and remediation tracking. These records are what supervisors are likely to ask for first in an inspection or desk-based review. Gaps here are difficult to repair after the fact.

CIMA’s enforcement position rewards entities that can show a documented and remediated compliance record before the fines framework commences.

Related questions: What did CIMA’s FAQs of 24 September 2026 clarify about the AML/CFT/CPF Compliance Rule and the Sanctions Rule? | What happens if a fund has no internal review history when its first independent audit comes due?

wb.group supports Cayman Islands funds and licensees with AML Compliance services, independent audits and remediation planning. Contact us to prepare for CIMA’s supervisory review.