CIMA AML and Sanctions Rules: What You Need to Know 31 August 2026
Overview
Two new rules published by CIMA, effective 18 September 1. AML Rule
2. Sanctions Rule
Rule on Effective Compliance Programme for the Prevention and Detection of Money Laundering, Terrorist Financing and Proliferation Financing
Rule on Compliance with Financial Sanctions and Targeted Financial Sanctions
• Many provisions codify existing Guidance Notes into binding rules with force of law • Non-compliance can result in regulatory consequences and administrative fines • Represents an evolution, rather than an overhaul, of the existing AML/CFT/CPF regime • Effective date: 18 September 2026
Who is affected?
The Rules apply broadly to CIMA-regulated financial service providers CIMA-Regulated Service Providers
CIMA-Registered Funds
Investment Managers & Advisors
All financial service providers regulated by the Cayman Islands Monetary Authority ("CIMA") including licensees and registrants
Private funds registered under the Private Funds Act and mutual funds registered under the Mutual Funds Act
Investment managers and advisors registered with CIMA pursuant to the Securities Investment Business Act
What is CIMA trying to achieve? Effectiveness Over Form
Governance & Accountability
Demonstrating effectiveness, not just having policies on paper. Greater emphasis on evidence of compliance.
Enhanced governance, documentation, oversight and clear accountability frameworks.
Proportionate Approach
Third-Party Oversight
Compliance programme commensurate with size, complexity, structure and nature of business (Rule 5.2).
Reliance on third parties is not a panacea. Entities must be satisfied their service providers comply (Rule 5.3).
International Context Part of the Cayman Islands' continuing enhancement of its AML/CFT/CPF framework, reflecting international standards and regulatory expectations "The Rule is intended to support the strengthening of the effectiveness of AML/CFT/CPF Compliance Programmes for Financial Services Providers."– CIMA FAQ
Seven Key Areas of Focus 1. 2. 3. 4. 5. 6. 7.
Governance Framework & AML Oversight AML Officer Appointments Independent AML Audit Risk Assessment & Client Due Diligence Outsourcing & Administrator Oversight Training & Documentation Sanctions Compliance Enhancements
Independent AML Audit • FSPs must arrange for an independent audit function to test compliance programme effectiveness • Audit reports must be filed with CIMA • AMLCOs are not considered independent for audit purposes • Internal audit, including service provider level audits, permitted for up to two consecutive cycles; external provider required every third audit • Rationale for audit frequency must be documented
Risk-Based Audit Frequency CIMA FAQ Guidance
Higher Risk
~2 years
Medium Risk
~3 years
Lower Risk
~4 years
audit cycle
audit cycle
audit cycle
Frequency determined using a risk-based approach. No fixed cycle is prescribed.
Governance Framework Documented Framework
Governing Body Oversight
Express requirement for a documented AML governance framework defining roles, responsibilities and accountability.
Governing bodies must document roles and oversee the framework through minuted meetings, including review of the AMLCO annual report.
Funds Integration
AMLCO Independence
For CIMA-registered funds, this dovetails with existing corporate governance frameworks and arrangements already in place.
The AMLCO must perform the compliance function independently and objectively. May not be a member of the governing body.
Annual AMLCO Reporting The AMLCO must report annually to the governing body. This reporting is a key element of the governance framework and provides documented evidence of compliance oversight. AML officers may be employees of a sponsor provided they meet the relevant qualifications and apply an independent and objective mind to their role. The governing body retains ultimate responsibility for the compliance programme
Documented Training Programme Training is no longer simply "do annual AML training" 1. Documented Training Programme 2. Documented Training Plan The Training Plan must identify:
Key Requirements •
Boards, senior management and oversight persons expressly included as recipients
• Who receives training
•
Training required at least annually
• Topics covered
•
Records must be available to CIMA on request
•
Delivery method not prescribed, online or in-person training is acceptable
• Delivery method (online or in-person) • Frequency of training
Sanctions Compliance Enhancements Screen & Re-screening
Board Application
Re-screening must take place whenever sanctions lists are updated. Screening obligations extend to connected persons.
Screening applies even where simplified due diligence ("SDD") is used. No exemptions from sanctions screening.
Sanctions Reporting
Geographic Risk
Reports to the Financial Reporting Authority (FRA) via the Compliance Reporting Form.
Restrictions on assigning "low" geographic risk where countries are subject to UK, UN or US sanctions.
Important Note The Sanctions Rule formalises screening, monitoring and escalation procedures. CIMA-registered funds should confirm these with their administrator, AML service provider or AML officers. Documenting the basis for SDD being applied should also be reviewed and confirmed.
How Maples Group Can Assist We can provide a variety of solutions
1
Compliance Programme Refresh Review and gap analysis of existing AML compliance programmes against the new Rules
2
Independent AML Audits Standalone AML Assurance team to satisfy the independent audit requirement
3
Governance & Documentation Documented AML governance frameworks tailored to your operating model and fund structure
4
Service Provider Coordination
5
AML Training & Records
Coordination with administrators and service providers to confirm and document compliance
Proprietary online AML training programme with completion certificates for CIMA
Stay Up-to-Date with the Latest Developments
The Regulatory 15/15 Podcast
Regulatory Round Up Blog
maples.com/15-15
maples.com/regulatory-round-up
A 15-minute summary of the latest
A dedicated platform designed to keep you informed of the latest developments and insights in the regulatory landscape.
regulatory developments.
This presentation was presented on, and is only accurate to [31] August 2026. The information within this presentation is provided for general guidance only, is not intended to be comprehensive and does not constitute legal advice or give rise to an attorney / client relationship. Specialist legal advice should be taken in relation to specific circumstances. If you require legal advice, please reach out to your usual Maples and Calder contact. Published by Maples and Calder (Cayman) LLP.
August 2026 © MAPLES GROUP