CIMA’s New AML Rules Take Effect on 18 September

We already comply with Cayman AML requirements. What actually changes?

For many established Cayman funds, 18 September did not mean starting again.

Risk assessments, AML policies, designated officers, training, investor screening and ongoing monitoring are already familiar parts of the Cayman anti-money laundering framework.

The change is that requirements previously addressed through CIMA’s anti-money laundering and counter-terrorist financing (AML/CFT) Guidance Notes now sit in binding Rules, which take precedence over the Guidance Notes where the two conflict.

That makes the distinction between having a compliance programme and being able to demonstrate that programme increasingly important.

For a fund board, the practical question is therefore not simply “Are we compliant?” It is “Can we evidence that we are compliant?”

Answering it means knowing where responsibilities sit, whether appointments and delegations are properly documented, whether the fund’s risk assessment remains current and how the effectiveness of the overall framework is independently tested.

Does this apply to my Cayman fund?

The Rules apply to entities registered or licensed by the Cayman Islands Monetary Authority (CIMA). That covers regulated investment funds, and also managers and advisers. Walkers notes that entities subject to the Anti-Money Laundering Regulations but not registered or licensed by CIMA fall outside the Rules, and gives single investor funds, debt issuers and lenders as examples.

For managers operating multiple Cayman vehicles, look at the structure entity by entity rather than assuming the same answer applies across the platform.

Your Cayman legal counsel can confirm how the Rules apply to your particular structure.

Our administrator and AML providers handle most of this. What is the board still responsible for?

Outsourcing the work does not mean outsourcing oversight.

Many Cayman funds rely on administrators and specialist providers for investor due diligence, screening, ongoing monitoring and the anti-money laundering compliance officer, money laundering reporting officer and deputy money laundering reporting officer functions. That model can continue.

What matters is whether the fund can demonstrate appropriate oversight of those arrangements.

The board needs a clear map: who does what, where each responsibility is written down, and how the fund satisfies itself that the delegated work is being done properly. That matters most where different parts of the compliance framework sit with different providers.

Do we need to revisit our AML officer appointments?

Yes, at least far enough to confirm they still hold. Each fund needs an Anti-Money Laundering Compliance Officer (AMLCO), a Money Laundering Reporting Officer (MLRO) and a Deputy Money Laundering Reporting Officer (DMLRO). That is three roles rather than necessarily three people: the same individual can hold the AMLCO role alongside either of the others, but the MLRO and DMLRO must be separate individuals. The DMLRO acts for the MLRO in the MLRO’s absence. The question for a board is whether the appointments remain appropriate and documented, not simply whether the names are on file.

Check too that the officers have appropriate access to senior management and the governing body, enough authority to carry out their responsibilities, and genuine functional independence. The AMLCO must perform the role independently and objectively from the business and operational functions, and where full separation is not practicable, conflicts of interest must be effectively managed.

We outsource our AML functions. Is the appointment itself enough?

No. Whilst the appointment of an Anti-Money Laundering Compliance Officer (AMLCO), Money Laundering Reporting Officer (MLRO) and Deputy Money Laundering Reporting Officer (DMLRO) will satisfy the appointment requirement, by itself it evidences nothing about how the outsourced function is governed. The fund also needs to show how the provider was assessed, what it is responsible for, and how the board oversees it.

Where AML responsibilities are delegated, that means due diligence on the provider, a documented scope of responsibility and ongoing oversight of the arrangement. Material outsourced compliance functions must also be notified to CIMA.

Look beyond the service agreement. Ask:

Delegation is fine. Fragmentation is the failure mode, and the governance around the delegation is what has to stand up.

Do we need to update the fund’s risk assessment?

Not on a fixed calendar. The Rules do not set an annual review cycle. The fund’s documented risk assessment should reflect its actual structure, activities and exposure to money laundering, terrorist financing and proliferation financing risks and be reviewed and updated as necessary, so the trigger for revisiting it is change rather than elapsed time.

It shouldn’t become a document that is refreshed once a year and then forgotten. The AMLCO must also report to the governing body at least annually.

New products or business lines, expansion into higher-risk jurisdictions, a significant restructuring or an economic or geopolitical development that alters the fund’s risk exposure may require the assessment to be revisited, and the Rules require it to be updated without delay after trigger events of that kind.

A useful question for a board is: has anything changed since this assessment was last approved that would cause us to answer it differently today? If the answer is yes, it warrants another look.

What about sanctions? Is anything changing operationally?

The Rule on Compliance with Financial Sanctions and Targeted Financial Sanctions makes sanctions compliance part of the overall risk and control framework, and it became binding on 18 September.

For investment managers and directors, the practical issue is whether screening is being treated as an ongoing process rather than an onboarding exercise.

That means understanding how existing investors are monitored as relevant sanctions lists change, how potential matches are investigated and how the decisions taken are recorded. Existing customers and connected persons must be screened without delay when a sanctions list is updated, and simplified due diligence does not reduce or waive the screening obligation.

If your administrator or another provider does this work, the board still needs to understand the process and be satisfied that appropriate evidence is retained.

Do Cayman funds now need an independent AML audit?

Yes. The AML Rule requires an independent audit of the compliance programme, and a board should be able to answer three things about testing: when the compliance programme was last independently tested, by whom, and what came out of it.

The purpose of that testing is to establish whether the programme is operating effectively in practice, rather than to confirm that policies exist.

For an outsourced fund structure, that can include areas such as investor onboarding and ongoing due diligence, governance and reporting, training, risk assessments and oversight of third-party arrangements.

Independence matters. The person testing the programme should be appropriately independent from the activities being reviewed.

The frequency of the audit must be commensurate with the fund’s size, complexity, structure, nature of business and risk profile, rather than being treated simply as an automatic annual exercise. An audit can be carried out internally for no more than two consecutive audit cycles, and the next audit must then be carried out by an external service provider. The audit report must be filed with CIMA as soon as practically possible after the audit is completed.

Managers should speak with their service providers and Cayman counsel about what the Rules require for their particular fund and how the audit should be planned.

We already receive assurance from our administrator. Is that enough?

Not necessarily. Assurance over a service provider’s own control framework is a different thing from independent testing of the fund’s compliance programme, and the second is what sits with the fund. An audit at service-provider level is unlikely to be enough on its own. CIMA’s FAQs on the Rules confirm the fund still needs an audit of its own compliance programme, and the fund’s AML officers cannot carry it out. An audit carried out by the fund’s administrator or investment manager is likely to count as internal for the two-cycle limit. The fund remains ultimately responsible for the compliance programme being adequate and operating effectively.

A fund’s compliance framework may rely heavily on its administrator, but it also encompasses the fund’s own governance, officer appointments, delegations, risk assessment and oversight.

Establish what the existing assurance actually covers, and whether anything is left untested at fund level.

What should fund directors be asking now?

For a manager or director that already has an established Cayman compliance framework, the priority is unlikely to be rebuilding everything. It is making sure the existing framework can be evidenced.

We would start with five questions:

For many established funds, answering those questions will quickly show where attention is required. The Rules also require AML training to be delivered at least annually, covering AML officers, senior management and members of the governing body, among others.

What if we are not yet fully ready?

The distinction that matters is that these are Rules, not simply guidance.

That changes what a gap costs. The Rules have been binding on regulated entities since 18 September. They have the force of law, and any breach falls under CIMA’s Enforcement Manual.

Resist treating the new Rules as a reason for indiscriminate remediation. Identify where genuine gaps exist and prioritise them by risk.

In many cases, the weakness may not be that a control is absent. It may be that the fund cannot readily demonstrate who performed it, when it happened, how it was overseen or why a particular decision was made.

Start there.

Where should investment managers start?

For managers that outsource much of the day-to-day operation of their Cayman funds, the new Rules are a useful reason to look at the compliance framework as a whole rather than provider by provider.

What happens after 18 September

The obligations the Rules create do not resolve on the effective date. Sanctions re-screening runs whenever a list is updated. Training records accumulate. The independent audit of the compliance programme follows a cycle set by the fund’s own risk profile, within the limit on consecutive internal audits. A fund that was ready on 18 September is one that has built something it can keep evidencing, not something it finished in September.

That is where fragmentation shows up. Administration, investor due diligence, AML officer functions, board oversight and independent testing may sit with four or five different parties, each doing its part competently. The gap is rarely in the work. It is in whether anyone can see the whole framework at once, and whether the governing body can show that it did.

The Catalyst Group works with investment managers on the operational side of that framework, across fund administration and investment operations. Our affiliated firm Clearwater provides AML officer and governance services. In practice, the work is usually mapping who owns each function and making the evidence behind it retrievable, rather than rebuilding a programme that already works. If you are working out how the new Rules sit against your existing Cayman operating model, we can work alongside your team and your Cayman legal counsel to find where responsibilities, evidence or oversight need attention.