The CIMA AML Rule Is in Force: The First 90 Days and What a CIMA AML Inspection Will Ask

The Rule on Effective Compliance Programme for the Prevention and Detection of Money Laundering, Terrorist Financing and Proliferation Financing takes effect today, 18 September 2026, sixty days after it was published in the Gazette on 20 July 2026. From this morning a CIMA AML inspection measures a registered fund against an instrument that, in its own words, has the force of law. The substance is familiar. What has changed is the standard of proof, the consequence of falling short, and the party expected to answer, which is the governing body rather than the administrator. This article sets out what an inspection in the first quarter is likely to request, where small managers most often fall short, how the administrative fines regime operates, and a 90-day sequence for closing the gaps.

"The first question we expect an examiner to ask is not whether a fund has a compliance programme. It is whether the board can show, from its own records, that it approved one, resourced it, read the reports and acted on them. That is a different standard from having a good administrator. Most of the funds we see are closer to it than they fear and further from it than they assume. The work has usually been done but never assembled in one place. The first ninety days are for assembling it, dating it and minuting it, before anyone asks." David Lloyd, Chief Executive Officer at CV5 Capital

Executive Summary

The Rule converts the core of CIMA's supervisory expectations into binding minimum requirements for every financial services provider CIMA regulates, including registered funds. Where day to day AML work is outsourced, the weight falls on the governing body and the evidence it can produce on request.

• The Rule is issued under section 34(1) of the Monetary Authority Act, states that it has the force of law and takes precedence over prior guidance, while the Anti-Money Laundering Regulations prevail where they conflict.
• CIMA's Regulatory Handbook classes a significant breach of a Rule as a matter requiring immediate attention in an inspection report.
• An inspection request list will track the Rule's own structure: governance framework, officer designations, risk assessment, policies, outsourcing oversight, training, independent audit and board reporting.
• CIMA's May 2025 inspection findings circular shows that the most common weaknesses are documentary: due diligence evidence, independent audit, training records and board oversight.
• Administrative fines run from a fixed CI$5,000 for a minor breach to a maximum of CI$1,000,000 for a very serious breach by a body corporate, but attach only to provisions prescribed in the Administrative Fines Regulations.
• A 90-day sequence that fixes designations and the risk assessment first, then documentation, then testing, addresses the items in the order an examiner will ask about them.

What Changed Today: A Rule Is Not a Guidance Note

Until today the operational detail of Cayman AML compliance sat in CIMA's Guidance Notes, which section 34(4) of the Monetary Authority Act deems to have been issued under section 34(1). Section 34(6) provides that a breach of rules or guidance issued under that section is not an offence. CIMA's consultation paper for the new Rules records why that mattered. The Caribbean Financial Action Task Force's fourth round mutual evaluation found that the Guidance Notes "do not meet the criteria of enforceable means", and the fifth round on-site visit is scheduled for 2027.

The Rule answers that finding directly. It is issued under sections 6(1)(b) and 34(1) of the Monetary Authority Act, and clause 13.2 states that it "shall have the force of law" and takes precedence over prior guidance notes, policy statements and interpretative materials. Clause 4.4 preserves the hierarchy above it: where the Rule and the Anti-Money Laundering Regulations conflict, the Regulations prevail. Clause 5.1 applies the Rule to every financial services provider regulated and supervised by CIMA under the Regulatory Acts. CIMA's published FAQs confirm that funds regulated under the Mutual Funds Act and the Private Funds Act are within that description.

The supervisory consequence is more precise than the phrase "force of law" suggests. Section 34(7) of the Monetary Authority Act preserves the power to fine for a breach of a rule only where the provision is prescribed under the Administrative Fines Regulations. Independently of fines, CIMA's Enforcement Manual lists "breaches a rule" as a ground for enforcement action, and the Regulatory Handbook treats a significant breach of a Rule as a matter requiring immediate attention. The Rule changes what an examiner can write in a finding before any question of a fine arises.

How CIMA Inspects, and What the First Quarter Looks Like

The Rule creates no new inspection programme. It changes what the existing one measures against. CIMA's Regulatory Handbook describes three main categories of on-site inspection. A full scope inspection covers all lines of business. A limited scope inspection may consist of a review of adherence to the Anti-Money Laundering Regulations. A thematic inspection is an in-depth review of a specific risk across a selection of regulated entities. The Handbook also lists desk reviews, surprise inspections and exploratory visits. CV5's guide to preparing for a CIMA regulatory examination covers the notification letter, the document request and the interview stage.

The output is an inspection report, or a letter where there are no material deficiencies. The Handbook categorises findings as matters requiring immediate attention, which are high priority, and matters requiring attention, which are medium or low priority, with remediation timelines attached. A significant violation of a Rule, a policy or procedural deficiency, and a repeat finding that has escalated through inaction are each characteristics of a high priority finding. CIMA may require progress reports and may perform follow-up inspections.

Three provisions of the Rule operate whether or not an inspection is scheduled. Clause 9.7 requires mechanisms to provide the risk assessment to CIMA. Clause 12.2(d) requires the independent audit report to be filed with CIMA as soon as practically possible after completion. Clause 10.3(e) requires written notification to CIMA, within a reasonable timeframe, of any material outsourced compliance function. Each either exists or does not, and each is visible off-site.

The Document Request: What an Inspection Will Ask For

An examiner's request list will follow the Rule's own structure because the Rule now defines the minimum. The table below maps the items a fund should expect to be asked for against the clause that requires them; the sanctions screening evidence required by the companion Sanctions Rule is examined alongside it. The third column distinguishes requirement from prudent practice. The Rule requires substance and documentation, but in several places it does not prescribe the form. A single dated document that an examiner can read in ten minutes is practice rather than requirement.

Two features of that list deserve emphasis. The record-keeping clauses require records to be available to CIMA "without delay" on request, so the practical test is retrieval time as much as existence. And the audit provisions are specific to the fund. CIMA's FAQ 37 states that relying solely on a service-provider-level internal audit or a population-based review, without evidence about the individual fund's programme, would not provide sufficient assurance. FAQ 33 adds that the AMLCO, MLRO and DMLRO cannot audit activities for which they are responsible.

Where Small Managers Most Often Fall Short

CIMA does not publish inspection findings by fund. It does publish findings for registered persons under the Securities Investment Business Act, the category into which most Cayman-registered investment managers fall, and states that all financial services providers may use them. The circular dated 8 May 2025 draws on inspections of 113 registered persons whose final reports were issued between 1 January 2022 and 31 March 2024, with 673 customer files sampled.

Almost every item in that table is a documentation failure rather than a control failure. The screening was often run, the file reviewed and the training delivered. What was absent was the dated record, the minute or the report that proved it. That is the gap the Rule closes, because it requires the documentation as well as the activity. The circular records customer risk assessment forms that were simply undated, which defeats any argument that they were kept current.

The fund-specific version of this pattern is reliance. A fund whose administrator performs onboarding, screening and monitoring can usually show that those activities occur. What it frequently cannot show is the clause 10.4 evidence: how the fund itself remained satisfied. The answer is the administrator's periodic compliance reporting, the exception reports, any sample testing by the AMLCO, and the board minute recording the discussion. CV5 has set out what that file contains in its guide to the compliance programme evidence file CIMA now expects, and the responsibilities of the individuals in the Cayman compliance officer's role for Cayman funds.

The Administrative Fines Framework

Figures current as at 5 September 2026. Part VIA of the Monetary Authority Act gives CIMA power to impose an administrative fine on a person who breaches a prescribed provision. The Monetary Authority (Administrative Fines) Regulations (2025 Revision) list those provisions in Schedule 1 and classify each breach as minor, serious or very serious. Section 42B of the Act fixes the amounts, and the Monetary Authority (Amendment) Act, 2023 extended the same bands to partnerships and unincorporated associations. CIMA's Enforcement Manual expresses the figures in Cayman Islands dollars.

The process is set by the Regulations. CIMA issues a breach notice stating the prescribed provision, the facts and the proposed fine, with a reply period of at least 30 days. For a fixed fine, a party that rectifies the breach within 30 days of the notice, and says so in a rectification notice, is not fined if CIMA is satisfied. For discretionary fines, regulation 5 lists the criteria, including the degree of negligence, the measures taken to prevent the breach, the conduct after becoming aware of it, how quickly it was self-reported, and compliance history over the previous five years. The Enforcement Manual describes a five-step calculation beginning with disgorgement of any benefit, and permits an early settlement discount of up to 40 per cent on the penalty element for serious and very serious breaches. Discretionary fines may be appealed to the Grand Court.

Two further points shape the exposure. Section 42A(2), as substituted in 2023, allows a fine to be imposed on a director, manager or similar officer where a body corporate's breach was committed with that officer's consent or connivance, or is attributable to that officer's neglect. Fines are also only one item on the Enforcement Manual's list. The others include conditions on a registration, substitution of officers, a finding that a person is not fit and proper, appointment of a controller or advisor, a required auditor's report on AML systems, and cancellation of registration. Fines and enforcement actions are usually published with the entity's name.

A 90-Day Remediation Sequence

The sequence below is CV5's recommended practice, not a regulatory timetable. It deals first with the items an examiner would classify as high priority and the items visible off-site. A fund that completed the pre-effective-date actions set out in CV5's note on what fund boards must do before 18 September will find that the first phase is largely confirmation.

Two principles govern prioritisation. Anything that does not exist at all, such as a designated DMLRO, a dated risk assessment or any audit addressed to the fund, matters more than anything that exists in an imperfect form. Anything CIMA can see without visiting matters more than anything it would need to request. The annual cycle of returns, audit and reporting into which these items fall is set out in CV5's annual compliance calendar for Cayman hedge funds.

How a Platform Structure Carries the Load

A segregated portfolio company is a single legal person. The company is the financial services provider for the purposes of the Rule, its board is the governing body, and the compliance programme, officer designations, audit cycle and board reporting operate at company level. The risk assessment must nonetheless reflect each segregated portfolio, because each has its own investor base, strategy, geography and delivery channels, which clause 9.2 requires to be assessed. Under CV5 SPC and CV5 Digital SPC, CV5 Capital provides the regulated platform, the governance framework and the coordination of the administrator, the AML officers, the auditor and the board. The investment manager appointed to a segregated portfolio operates the strategy. CV5 does not manage the strategy, select investments or generate returns.

That division has a direct bearing on the evidence file. The governance framework, the policies, the training programme, the audit engagement and the board minutes exist once, at platform level, and are maintained as a matter of course rather than assembled for an inspection. The manager contributes the portfolio-specific inputs: investor pipeline, geographies, product features and, for digital asset strategies, the delivery channels and counterparties that drive the risk rating. CV5 has described the components in the institutional fund stack and the underlying obligations in what the new AML and Sanctions Rules require.

One point is easily overlooked. A Cayman investment manager registered under the Securities Investment Business Act is itself a financial services provider within the Rule's scope, with its own programme, risk assessment and audit obligation. The platform's programme covers the fund; it does not discharge the manager's separate obligations.

Common Mistakes in the First Quarter

• Treating the administrator's own AML audit as the fund's audit, when CIMA's FAQ 37 states that a service-provider-level review without fund-specific evidence does not provide sufficient assurance.
• Holding a manager-level risk assessment and no fund-level one, or a fund-level one that is undated or was not revisited after a new share class or investor geography.
• Minuting that an AML report was "noted" without recording what it said, what the board asked and what it decided.
• Allowing the AMLCO, MLRO or DMLRO to perform or scope the independent audit, or accepting an audit whose independence cannot be documented on request under clause 12.2(c).
• Waiting for a breach notice to engage with CIMA, when the prescribed criteria reward early self-reporting and prompt rectification.

Key Takeaways

• Confirm today that the AMLCO, MLRO and DMLRO are designated natural persons at management level, with suitability evidence the board can retrieve.
• Date the fund-level risk assessment, record the inherent and residual ratings and the aggregation method, and minute the board's approval of it before the end of the first month.
• Commission an independent audit addressed to this fund's compliance programme, document why the chosen frequency is proportionate, and plan the filing with CIMA.
• Rewrite the board's AML agenda item so that the minutes record the report received, the challenge made and the decision taken, not merely that a report was tabled.
• Assemble the outsourcing file and confirm that the notification of material outsourced compliance functions has been made to CIMA in writing.
• Treat the fines regime as a reason to self-report and remediate early: the prescribed criteria, the 30-day rectification window and the settlement discount all reward speed.

Frequently Asked Questions

What does a CIMA AML inspection ask a Cayman fund to produce?

The request list follows the Rule's structure. Expect to be asked for the governance framework and officer designations, the fund-level risk assessment, board-approved policies and procedures, the outsourcing file and CIMA notification, and training plans and attendance records. Expect also employee screening records, the independent audit report with its independence and frequency rationale, the registers required by clause 8.5, and board minutes evidencing oversight. CIMA's Regulatory Handbook describes the inspection as document review, interviews and testing, followed by a report with prioritised findings and remediation timelines.

Is the CIMA AML Rule enforceable by administrative fine?

The Rule states that it has the force of law, and CIMA's Enforcement Manual lists breach of a rule as a ground for enforcement action. Administrative fines, however, attach only to provisions prescribed in Schedule 1 of the Monetary Authority (Administrative Fines) Regulations. The 2025 Revision prescribes the equivalent provisions of the Anti-Money Laundering Regulations, including the requirements for procedures, an independent audit function, training and the designation of an AMLCO. It contains no entry for the Rule itself as at 5 September 2026.

What are the administrative fine amounts for AML breaches in the Cayman Islands?

Under section 42B of the Monetary Authority Act, a minor breach carries a fixed fine of CI$5,000, with continuing fines up to a total of CI$20,000. A serious breach carries a discretionary fine of up to CI$50,000 for an individual or CI$100,000 for a body corporate or partnership. A very serious breach carries a discretionary fine of up to CI$100,000 for an individual or CI$1,000,000 for a body corporate or partnership. Directors and officers may be fined personally where a breach involved their consent, connivance or neglect.

Does a fund need its own AML audit if its administrator has already been audited?

Yes. CIMA's FAQ 36 states that a regulated fund must undertake an AML audit under regulation 5(a)(ix) of the Anti-Money Laundering Regulations even where substantially all of its operations are outsourced. FAQ 37 adds that relying solely on a service-provider-level internal audit or a population-based review, without sufficient evidence about the individual fund's compliance programme, would not provide sufficient assurance. A provider's audit report can inform the fund's audit, but the governing body must be able to show that its scope covered the activities performed for that fund.

How often must the independent AML audit be performed?

The Rule prescribes no fixed frequency. Clause 12.2(a) requires a frequency commensurate with the fund's size, complexity, structure, nature of business and risk profile, as determined by its risk assessment or as otherwise required by CIMA. CIMA's FAQ 32 gives an illustration, not a rule: a higher-risk entity might reasonably audit every two years, with medium and low risk entities at three and four years respectively. Clause 12.3 requires that the audit is not performed internally for more than two consecutive cycles, so at least every third audit must be external.

Can the AMLCO also be a director or perform other operational roles?

The Rule requires the AMLCO to perform the compliance function independently and objectively from the functions overseen and, where full separation is not practicable, to ensure that conflicts are effectively managed. CIMA's FAQ 10 describes independence as functional and reporting autonomy rather than complete separation from all business activity. FAQ 11 states that an AMLCO may hold additional operational duties if the fund can demonstrate that they do not impair independence or create an unmanaged conflict. The analysis should be written down, because it is the document an examiner will ask for.