CIMA Cybersecurity and Outsourcing Requirements: What Applies to Cayman Funds and Their Managers?

CIMA's Rule on Cybersecurity for Regulated Entities, its accompanying Statement of Guidance, and its Statement of Guidance on Outsourcing for Regulated Entities, all in their April 2023 form, expressly exclude regulated mutual funds and private funds from their scope. They do apply to most other CIMA-regulated entities, including investment managers regulated under the Securities Investment Business Act and licensed fund administrators. A Cayman fund is therefore not directly subject to the cybersecurity rule, but its board remains responsible for overseeing the service providers that are, and other CIMA measures that do apply to funds, including the 2026 AML Rule's outsourcing provisions, reach the same territory.

The distinction is frequently blurred. Commentary often states that Cayman funds must comply with CIMA's cybersecurity rule. They do not. The fund's investment manager, if CIMA-regulated, usually must, and the fund's administrator must. Getting this right matters for offering document disclosures, due diligence questionnaire responses and the way a board frames its oversight. Our earlier piece on cybersecurity for digital asset funds covers CIMA's thematic findings on virtual asset service providers.

What the measures say about scope

Section 3.1 of the Rule on Cybersecurity for Regulated Entities applies it to entities regulated by CIMA, including controlled subsidiaries. Footnote 1 then lists the exceptions: regulated mutual funds as defined in the Mutual Funds Act, and private funds as defined in the Private Funds Act. The Statement of Guidance on Outsourcing for Regulated Entities uses the same structure, excepting regulated mutual funds, private trust companies and private funds. The April 2023 revisions extended the cybersecurity measures to virtual asset service providers and to persons registered under the Securities Investment Business Act, and confirmed that the existing fund exemption covers private funds as well as mutual funds.

What a SIBA-regulated manager must do

For a manager within scope, the Rule is binding. Its core requirements are:

• a documented cybersecurity framework designed to identify, measure, assess, report, monitor and control cybersecurity risks, and to respond to and recover from breaches (Rule 5.1);
• a cybersecurity risk management strategy, policies and an incident response process, approved and overseen by the governing body, which carries ultimate responsibility, including approval of the cybersecurity audit plan (Rule 6.1);
• a training and awareness programme and sufficient suitable personnel (Rule 6.4);
• continued responsibility for outsourced IT functions, with assessment of service providers against the Rule and the outsourcing guidance (Rule 6.5);
• data protection integrated into the strategy, having regard to the Data Protection Act (Rule 7.1); and
• written notification to CIMA immediately, and no later than 72 hours after discovery, of an incident that has or may have a material impact, together with notice to affected persons where non-public information is breached (Rule 8).

A manager regulated elsewhere, for example by a US, UK or Singapore regulator, is outside the CIMA Rule. Its own regulator's cybersecurity and operational resilience requirements apply instead. The fund's exposure to that manager's controls is the same either way, which is why the board's oversight cannot depend on which regime applies to the manager. Managers considering a Cayman regulated manager entity can read our guide to SIBA registration for crypto fund managers.

Why the fund's board is not off the hook

The exception removes the fund from two specific measures. It does not remove the board's responsibility for how the fund's operations are run. Four sources keep that responsibility in place.

Corporate governance and internal controls

CIMA's Rule on Corporate Governance and its Rule on Internal Controls apply to regulated mutual funds and private funds. CIMA's Statement of Guidance on Corporate Governance for Mutual Funds and Private Funds treats the operator as holding ultimate responsibility for the fund's activities, including functions delegated to the investment manager and the administrator. A board that has delegated operations still has to oversee them, and a cyber incident at a delegate is an operational event for the fund.

The AML Rule's outsourcing provisions

The 2026 AML Rule applies to funds. Where a fund outsources any part of its AML compliance programme, Rule 10.7 requires it to assess the associated risks, including country risk, to conduct due diligence on the service provider's fitness and propriety and capability before outsourcing, to set out rights and obligations in the agreement, and not to enter or continue an arrangement that impedes CIMA's access to data or systems. Rule 10.7.6 requires notification to CIMA of outsourcing agreements relating to material functions of the compliance programme. In practice this is outsourcing governance for funds, applied to the function every fund outsources. Our guide to Cayman fund administrator due diligence covers the review itself.

Data protection

The fund usually holds investor personal data as a data controller under the Data Protection Act, with the administrator and manager processing it on the fund's behalf. A breach at a processor is a matter the fund must be able to assess and respond to.

Tokenised fund disclosures

For tokenised funds, the 2026 amendments to the Mutual Funds Act and Private Funds Act require the offering document to disclose token-specific risks, including cybersecurity. For those funds, cyber risk is a statutory disclosure item even though the cybersecurity rule does not apply to the fund itself.

A board oversight framework for service providers and cyber incidents

The following is CV5's recommended practice for a fund board. It is not a list prescribed by CIMA for funds, but it draws on the controls CIMA requires of the regulated service providers the fund relies on.

Two further items complete the framework. Each material agreement should require the service provider to notify the fund of incidents affecting it, which mirrors the obligation CIMA places on governing bodies of managed entities to require service providers to report breaches. And the board should receive a periodic report on service-provider incidents, assurance findings and changes, minuted as considered. Continuity planning is covered in our guide to the hedge fund business continuity plan, and exchange controls in our analysis of exchange account control for digital asset funds.

The fund is outside the cybersecurity rule. Its money, its data and its investors are not outside the risk. A board that understands which of its providers are regulated, and what each has committed to tell it, is governing the fund. One that relies on the exemption is not.

David Lloyd, Founder and CEO, CV5 Capital

Common mistakes

• Stating in offering or DDQ documents that the fund complies with CIMA's cybersecurity rule, when the rule does not apply to it.
• Concluding from the exemption that the board has no cyber oversight role.
• Assuming an offshore manager is subject to the CIMA cybersecurity rule, or that a CIMA-regulated manager's compliance covers the fund's other providers.
• Overlooking the AML Rule's outsourcing and notification requirements, which do apply to funds.
• Service agreements with no obligation on the provider to notify the fund of incidents.

What this means for managers on the CV5 platform

CV5 Capital is registered with CIMA under the Securities Investment Business Act and is therefore within the scope of the cybersecurity rule in its own right. CV5 SPC and CV5 Digital SPC, as regulated mutual funds, are excepted, and their boards oversee the platform's service providers through the governance framework described above. Appointed investment managers remain responsible for investment decisions and for meeting the cyber requirements of their own regulators. How the platform's governance is evidenced to allocators is set out under fund governance and ODD readiness, and managers establishing a Cayman management entity can review fund manager formation.

Frequently asked questions

Does CIMA's cybersecurity rule apply to Cayman hedge funds?

No. The Rule and Statement of Guidance on Cybersecurity for Regulated Entities expressly except regulated mutual funds and private funds. They apply to other CIMA-regulated entities, including SIBA-regulated managers and licensed fund administrators.

Does CIMA's outsourcing guidance apply to Cayman funds?

The Statement of Guidance on Outsourcing for Regulated Entities excepts regulated mutual funds and private funds. The 2026 AML Rule, which does apply to funds, contains its own outsourcing requirements for AML compliance functions, including due diligence and notification of material outsourcing to CIMA.

How quickly must a Cayman regulated manager report a cyber incident to CIMA?

Immediately, and no later than 72 hours after discovery, where the incident is deemed to have a material impact or has the potential to become material. Affected persons must also be notified where non-public information is breached.

What should a fund board do about cyber risk if the rule does not apply?

Oversee it through the service providers. Confirm each provider's regulatory status and framework, require incident notification in each material agreement, and receive periodic reports, consistent with CIMA's corporate governance and internal controls rules, which do apply to funds.

This article is published by CV5 Capital for general information only. It does not constitute legal, tax, regulatory or investment advice, or an offer or solicitation to invest in any fund. References to legislation and CIMA regulatory measures reflect the position as understood at the date of publication and may change. CV5 Capital provides regulated fund infrastructure, governance and operational oversight through CV5 SPC and CV5 Digital SPC; investment strategies and portfolio management are the responsibility of each appointed investment manager. CV5 Capital, CIMA Registration No. 1885380, LEI 984500C44B2KFE900490.