The Cayman Islands Monetary Authority (CIMA) has issued two new Rules which come into force on 18 September 2026:

• Rule on Effective Compliance Programme for the Prevention and Detection of Money Laundering, Terrorist Financing and Proliferation Financing for Financial Services Providers

• Rule on Compliance with Financial Sanctions and Targeted Financial Sanctions

While much of the content reflects existing AML and sanctions obligations, several provisions represent new requirements or elevate long-standing regulatory expectations into legally enforceable obligations.

Rules have legal bearing and not following the rules may result in fines after the inspection..

Key items for AML Compliance Programme

1. AML Audit requirements

The biggest change may not be sanctions compliance but rather the new requirement for firms to demonstrate the effectiveness of their AML compliance programme.

Under the new Rule:

• AML programmes must be independently audited.
• Auditors must be suitably qualified and demonstrably independent.
• Firms must remediate deficiencies identified through audits.
• Audit reports must be provided to CIMA when required.

Most notably, AML audits may be conducted internally for only two consecutive audit cycles. Thereafter, the next audit must be performed by an external provider.

Internally doesn’t mean the AML Officer can conduct it. It must be done by a person who is completely independent from the design of the AML framework.

2. Independence, Independence, Independece

The audit must be performed by individuals who:

• are suitably qualified;
• are independent from the design, implementation and operation of the controls being reviewed; and
• are free from conflicts of interest.

Importantly, firms must be able to provide evidence to CIMA demonstrating how independence was assessed and determined.

3. Trigger-Based Risk Assessment updates

Risk assessments must now be updated whenever material events occur, such as:

• New products or services;
• Expansion into higher-risk jurisdictions;
• Mergers and acquisitions;
• Significant restructuring; or
• Material geopolitical developments.

There will be greater focus on methodology and assessment itself. CIMA expects that both Inherent and residual risks will be appropriately documented.

4. Greater accountability for AMLCOs

AMLCOs must have:

• Direct access to senior management and the governing body;
• Sufficient resources;
• Independence from business functions; and
• Appropriate knowledge of emerging ML, TF, PF and sanctions-evasion risks.

Firms must also be able to demonstrate the ongoing competency of AMLCOs, MLROs and DMLROs.

5. Ongoing employee screening

The Rule introduces expectations around ongoing employee screening, including fitness and propriety assessments, integrity checks and background screening throughout employment, not just at onboarding.

Key items for Sanctions Compliance

1. Mandatory Re-Screening Following Sanctions Updates

Firms must re-screen all customers following updates to sanctions lists, regardless of the customer’s risk classification or whether simplified due diligence is applied.

2. Expanded Screening Obligations

This is very important. Screening is expected to extend beyond customers and beneficial owners to include:

• Transactions;
• Service providers;
• Connected persons; and
• Other relevant parties.

3. “Without Delay” Is Defined

The rule provides unusually explicit guidance on what “without delay” means.

In practical terms, sanctions-related actions should ideally occur within hours of a designation where feasible, given the objective of preventing asset dissipation.

This raises the bar for sanctions list management and screening technology.

What is really important:

Many firms will focus on updating policies. A more important question is whether they can evidence implementation.

Areas likely to attract regulatory attention include:

• AML audit independence and external audit rotation;
• Trigger-based risk assessment reviews;
• Board oversight of AML and sanctions compliance;
• Oversight of outsourced compliance functions; and
• Evidence supporting sanctions screening decisions.

Before the Rules take effect, firms should:

1. Perform a gap analysis against both Rules.
2. Review AML audit arrangements and future external audit requirements.
3. Assess whether risk assessment frameworks capture trigger events.
4. Review sanctions screening and re-screening processes.
5. Update AMLCO, MLRO and DMLRO governance arrangements.
6. Review outsourcing and third-party oversight frameworks.
7. Enhance employee screening and training programmes.

Final Thoughts

Many of the requirements will be familiar. What has changed is that CIMA is increasingly focused on evidence of effectiveness rather than the existence of policies and procedures.

The challenge is unlikely to be understanding the new requirements. The challenge will be demonstrating that they operate effectively in practice.

If you have any concerns or queries, don’t hesitate to get in touch with your contact @ Provenance!