CIMA AML Desk-Based Reviews: What Cayman Funds Need to Produce

CIMA has told the industry it is starting desk-based AML reviews of regulated entities, including investment funds, from October 2026. The request arrives as a letter, the response window is short, and the documents requested are the ones many funds hold in the least usable form: the fund's own risk assessment, the method behind it, and evidence that the compliance programme actually runs. This article sets out what is confirmed, what is reported, what the pack should contain, and what boards should do before the letter arrives.

"A desk-based review is a retrieval test before it is a compliance test. A fund that cannot find its risk assessment, its methodology and its board minutes within the week has already told the regulator most of what it needs to know."David Lloyd, Chief Executive Officer at CV5 Capital

What Is Confirmed and What Is Reported

The distinction matters, because the five-day planning assumption that is circulating does not yet appear in a published CIMA document.

The practical conclusion does not change with the status column. If the window turns out to be longer, a fund that planned for five days loses nothing. If it is five days, a fund that planned for thirty has a problem.

Where Desk-Based Reviews Sit in CIMA's Approach

CIMA's FAQs on the AML Rule describe a risk-based model in which the intensity of supervisory engagement follows the size, nature, complexity and risk profile of the regulated entity. On-site inspections are described as generally the more appropriate tool for higher-risk entities, with desk-based reviews a reasonable tool for others and a way to bridge the period between inspections. For most Cayman investment funds, that makes the desk-based review the likeliest first point of contact with the new Rules.

For the full examination process, including notification letters and interviews, see our guide to preparing for a CIMA regulatory examination. For the Rules themselves, see CIMA's new AML and Sanctions Rules.

What CIMA Is Reported to Request

The reported request covers four items: the business plan where applicable, the risk assessment, the risk assessment methodology, and evidence of the compliance programme. The first three are documents. The fourth is proof of operation, which is harder to produce on demand.

The Five-Day Pack

Build one indexed folder that the AMLCO, MLRO or platform can send without assembling anything new.

1. The fund's own risk assessment

CIMA's FAQs expect risk assessment documentation to show how money laundering, terrorist financing, proliferation financing and targeted financial sanctions risks are identified, assessed, mitigated, monitored and reviewed, across customers, geography, products, transactions and delivery channels. Group or manager-level assessments may be used where appropriate, but the FAQs state that risks specific to the Cayman entity must still be identified and addressed. In practice, a fund should be able to hand over an assessment that is about the fund: its investor base, its distribution channels, its subscription currencies and its counterparties.

2. The methodology

How risk was scored, which data was used, how inherent and residual risk were distinguished, when the assessment was last updated and who approved it. CIMA's FAQs expect periodic review and updates whenever there is a material change, including a change in investors, products or geography. An undated document with conclusions but no working is the most common weakness here.

3. Compliance programme evidence

Policies and procedures are necessary but not sufficient. The pack should show the programme operating: customer due diligence and enhanced due diligence triggers, PEP handling, the sanctions screening workflow, suspicious activity escalation to the MLRO, staff and officer training records, and oversight of outsourced functions. CIMA's FAQs expect outsourcing oversight to include clear roles, escalation arrangements, performance monitoring, access to records and periodic testing. Where the administrator performs investor onboarding, the fund should hold evidence that it oversees that work, not only a copy of the administrator's policy. Our guide to AML, KYC and investor onboarding in Cayman funds covers the day-to-day controls that sit underneath this section.

4. The governance record

• Board minutes approving the risk assessment and compliance programme, and recording receipt of AML reporting.
• AMLCO, MLRO and deputy MLRO appointment records, as set out in our note on the Cayman compliance officer's role.
• Service agreements for the administrator, AML officer provider and auditor.
• The independent AML audit position: when the last audit was performed, its scope, its findings and remediation status.

5. Business plan, where applicable

The reported request includes a business plan where applicable, which is most relevant to non-fund financial services providers. For a fund, the equivalent discipline is making sure the offering terms, structure chart and service provider list match what CIMA holds on record.

The Independent Audit Position

This is where funds most often rely on assumptions rather than the FAQs. CIMA's position, as published, is precise:

Because frequency is a risk-based judgement, the fund should be able to show that judgement in writing: the risk rating that drove the cycle chosen and the date the board approved it.

What Trips Funds Up

• A manager-level assessment presented as the fund's. It may be good work, but it does not answer the question about the fund.
• An assessment that predates 18 September 2026. The Rules changed the reference point; the assessment should show it has been reviewed against them.
• Conclusions without a method. A rating table with no explanation of how ratings were reached.
• Governance held in inboxes. Approvals that happened by email and were never minuted.
• Audit frequency with no recorded basis. A two-year cycle may be entirely reasonable; an undocumented one is harder to defend.
• No single owner. The administrator, the AML officers and the manager each assume another party will assemble the response.

Five Board Actions for October

1. Confirm the fund holds its own risk assessment covering every risk category in CIMA's FAQs, reviewed since 18 September 2026.
2. Confirm the methodology is written down, dated and board-approved.
3. Map the compliance programme against the AML Rule and the Sanctions Rule, clause by clause, and minute any gaps with an owner and a date.
4. Run a retrieval test: ask for the full pack and time how long it takes to assemble.
5. Name one person responsible for responding to a CIMA letter, and record who covers in their absence.

For the wider board agenda under the new Rules, see the first 90 days under the CIMA AML Rule and the board-level actions for Cayman funds.

Conclusion

CIMA's question is simple: show the fund's risk assessment, show how it was reached, and show that the programme works. Funds that assemble the pack before the letter arrives can answer within the week. Funds that start when the letter arrives are assembling evidence under time pressure, which is the condition in which gaps become findings.

Frequently Asked Questions

What is a CIMA desk-based review?

A remote supervisory review in which CIMA requests documents and assesses them without visiting the regulated entity. CIMA's FAQs list desk-based reviews alongside on-site inspections and risk and compliance meetings as tools for assessing an AML compliance programme.

How long does a fund have to respond?

CIMA was reported, following its 30 September 2026 industry briefing, to expect a response within five business days as a general rule. We have not found that period in a published CIMA document as at 9 October 2026, so funds should treat it as a planning assumption and check the letter itself.

Can a fund rely on its administrator's AML documents?

Partly. Group and service-provider materials can be used where appropriate, but CIMA's FAQs expect risks specific to the Cayman entity to be identified, and state that a service-provider-level audit alone does not give enough assurance about an individual fund's programme.

Does CIMA require an annual independent AML audit?

No. CIMA's FAQs state that the Rule does not mandate annual audits and prescribes no frequency. Frequency is risk-based, and the Rule requires at least one external audit in every three independent audit cycles.

What happens after a desk-based review?

CIMA is reported to issue a summary report setting out any findings, with further steps where appropriate, and to treat repeat findings more seriously when deciding whether to escalate.