Overview of New Rules
- CIMA has issued two new Rules:
- Rule on Effective Compliance Programme for the Prevention and Detection of Money Laundering, Terrorist Financing and Proliferation Financing (AML/CFT/CPF compliance programme for FSPs)
- Rule on Compliance with Financial Sanctions and Targeted Financial Sanctions These Rules take effect 18 September 2026. (cima.ky)
Key Requirements for Regulated Financial Services Providers (FSPs)
- Must maintain robust governance including appointment of an AML Compliance Officer, independent audit function, regular risk assessments.
- Must adopt a risk-based approach to both money laundering and sanctions compliance; tailor controls proportionate to size and complexity of operations.
- Sanctions compliance uplift: TFS obligations include screening, reporting, and strictly observing UN/UK sanctions regimes.
Practical Steps for Compliance
- Review internal frameworks: Ensure policies and procedures are updated to reflect the new Rules.
- Train staff: AML/CFT/CPF training for all employees; sanctions screening and audit process.
- Engage external audits: Independent audit functions need to test effectiveness of controls.
- Document risk assessments and decision making: key in event of regulatory inquiry or investigation.
Implications of Non-Compliance
- Entities falling short may face administrative penalties, loss of licence, reputational harm.
- Given Cayman’s role as a financial centre, failure to satisfy FATF standards can impact correspondent banking relationships and international operations.
Related Policy Landscape
- These Rules support Cayman’s wider financial crime prevention strategy and strengthen alignment ahead of its forthcoming FATF 5th Round Evaluation.
- Consultations are ongoing in several other areas (Recovery Planning, Beneficial Ownership Transparency) which may introduce further obligations. (cima.ky)
Example: Matching Rules to Practice
- If you're a ride-sharing payment platform registered in Cayman, you must ensure your AMLCO is in place, onboard new users with required jurisdictional sanctions checks, and undergo periodic independent audits.
- An insurer providing Risk-Relevant Financial Business (RFB) must separately comply with sanctions and AML-CFT obligations even if core business is regulatory exempt otherwise.
Takeaway: Effective 18 September 2026, every FSP must carefully assess and bolster its AML and sanctions risk frameworks—evaluate eligibility under new Rules and engage early.