CIMA's New Auditor Approval Policy for 2027: Implications for Cayman Hedge Funds

From 1 January 2027, CIMA's revised Regulatory Policy on the Approval of an Auditor for a Regulated Entity sets the criteria an audit firm must meet to sign the financial statements of a Cayman regulated fund: a physical presence in the Cayman Islands, registration with the Cayman Islands Institute of Professional Accountants, independence aligned with the international ethics code, demonstrable competence, quality management under ISQM 1 and ISQM 2, and adequate professional indemnity insurance. Firms already approved before that date are deemed to meet the criteria and keep their status without re-evaluation, provided they continue to comply. For fund boards, the Policy is a checklist for appointing an auditor and a reminder of what the auditor must report to CIMA.

Every registered mutual fund and registered private fund must have its accounts audited annually by a CIMA-approved auditor, with audited financial statements filed within six months of the financial year end. Those duties are statutory. The Policy, dated June 2026, governs a different question: which firms CIMA will approve to perform that audit, and what it expects of them once approved. The audit cycle itself, including first-year filings, is covered in our guide to the Cayman hedge fund audit and first-year filings.

What the Policy requires of an approved auditor

Physical presence and local sign-off

Section 6.3 confirms a model the Cayman market already uses. CIMA distinguishes local sign-offs, where some audit work is performed outside the Cayman Islands but the report is signed by a CIIPA-licensed practitioner, from full audits performed entirely in Cayman. Either is acceptable. What is not acceptable is an audit signed by a firm without the Cayman resources the Policy describes. CIMA's existing local audit sign-off policies cover both regulated mutual funds and private funds, and the new Policy builds the presence requirement directly into approval for every regulated entity within its scope.

Approval can be limited by sector

Section 6.15 allows CIMA to limit the industries or regulated entities a firm may be approved to audit where its partners lack the necessary experience. For a digital asset fund, this is the practical point. A firm's presence on CIMA's list of approved auditors confirms eligibility. It does not, by itself, confirm the firm's capacity to audit custody arrangements, on-chain positions or valuation of illiquid tokens. Our analysis of who will sign a crypto fund audit in Cayman covers the evidence an auditor will test.

Transitional arrangements and timing

Section 12.2 provides that firms recognised as approved auditors before 1 January 2027 are deemed to have met the qualifications and approval criteria. They retain approved status without re-evaluation, provided they remain in compliance with ongoing requirements, including continuing education and ethical standards. A fund whose auditor is already approved does not need to procure a new approval for the firm.

Section 12.1 provides that regulated entities must comply starting from the first accounting period that begins after the Policy's effective date. Read literally, a fund with a 31 December year end has a first period beginning after 1 January 2027 on 1 January 2028. The alternative reading treats a period beginning on 1 January 2027 as within scope. Boards should plan on the earlier date. The cost of preparing a year early is negligible; the cost of an engagement that does not meet the Policy when CIMA expects it to is not.

Deemed approval protects the firm's status. It does not suspend the ongoing requirements. A firm that ceases to meet them may face revocation under section 7.7, and CIMA may require a regulated entity to replace its auditor where it considers the auditor's objectivity impaired or its competence insufficient (section 7.2).

What the auditor must report to CIMA

The Policy restates the auditor's reporting role. Under section 7.3, approved auditors are expected to notify CIMA where, during an audit, they obtain information or suspect that the regulated entity is:

• unable, or likely to become unable, to meet its obligations as they fall due;
• carrying on business, or winding up voluntarily, in a manner prejudicial to its investors or creditors;
• carrying on business without sufficient accounting records to allow its financial statements to be properly audited;
• carrying on business in a fraudulent or criminal manner; or
• carrying on business without complying with the relevant Acts, regulations or conditions of its registration.

Section 7.4 adds that significant deficiencies, material weaknesses and other internal control observations should be documented, communicated in writing to management or those charged with governance, and provided to CIMA on request. Section 7.5 requires the firm itself to notify CIMA within 21 days of material changes to the information on which its approval was based. And under section 7.1, when a fund changes auditor, CIMA may require the fund or the former auditor to explain why.

The board should therefore assume that the management letter may be read by CIMA, and that an auditor change will be examined. Neither is a reason for concern where controls are sound. Both are reasons to keep accounting records audit-ready throughout the year.

What boards should verify before appointing an auditor

CIMA's Rule on Corporate Governance for Regulated Entities makes the governing body, through an audit committee or equivalent, responsible for overseeing the external auditor and for approving, or recommending to the board, its appointment. Section 4.4 of the Policy expects regulated entities and auditors to ensure compliance through their governance mechanisms. The following checks are CV5's recommended practice for discharging that responsibility.

The valuation policy is where independence and capability meet. The firm that signs the accounts should not design the policy it will later test. Our guide to the fund valuation policy covers what that document must contain.

An approved auditor is a necessary condition, not a sufficient one. The board's job is to confirm that the firm can audit this fund, these assets and this custody model, and to do it before launch. Discovering the answer at the first year end is the most expensive way to find out.

David Lloyd, Founder and CEO, CV5 Capital

Common mistakes

• Assuming approval on CIMA's list confirms capability for every asset class.
• Appointing the auditor after launch, leaving no time to resolve custody evidence or valuation questions.
• Allowing the audit firm to draft the valuation policy it will audit.
• Treating the 2027 effective date as relevant only to audit firms.
• Changing auditor without a documented rationale, when CIMA may ask for one.

Implications for emerging hedge funds and digital asset managers

For an emerging manager the Policy changes little for funds whose auditor is already approved. It changes more for funds that have not yet chosen one. Sector-limited approvals, the five-year partner experience benchmark and the express capacity criteria all point the same way: the auditor should be chosen for its ability to audit the specific strategy, not for price or availability alone. On CV5 SPC and CV5 Digital SPC, auditor engagement forms part of the launch process and is overseen by the board, so the auditor's acceptance of the strategy, custody model and valuation policy is established before the first subscription. The annual cycle that follows is mapped in our Cayman fund annual reporting, audit and FAR governance calendar, and the CIMA return that accompanies the audit is covered in our guide to the Fund Annual Return.

Frequently asked questions

When does CIMA's new auditor approval policy take effect?

On 1 January 2027. Regulated entities must comply from the first accounting period that begins after that date. Funds with calendar year ends should plan for the 2027 financial year.

Does an existing CIMA-approved audit firm need to be re-approved?

No. Firms approved before 1 January 2027 are deemed to have met the criteria and retain their status without re-evaluation, provided they continue to meet ongoing requirements such as continuing education and ethical standards.

Must the audit of a Cayman fund be performed in the Cayman Islands?

Not entirely. CIMA does not require all audit work to be performed in Cayman, but it will approve only firms with a physical presence in the Islands, and the audit report must be signed off by the approved auditor.

What must a fund's auditor report to CIMA?

Matters such as inability to meet obligations, conduct prejudicial to investors or creditors, insufficient accounting records, fraudulent or criminal conduct, and non-compliance with the relevant Acts or registration conditions. Significant control deficiencies should be communicated in writing and provided to CIMA on request.

This article is published by CV5 Capital for general information only. It does not constitute legal, tax, regulatory or investment advice, or an offer or solicitation to invest in any fund. References to legislation and CIMA regulatory measures reflect the position as understood at the date of publication and may change. CV5 Capital provides regulated fund infrastructure, governance and operational oversight through CV5 SPC and CV5 Digital SPC; investment strategies and portfolio management are the responsibility of each appointed investment manager. CV5 Capital, CIMA Registration No. 1885380, LEI 984500C44B2KFE900490.