Independent AML Audits for Cayman Funds: CIMA's 2026 Requirements Explained

Every CIMA-regulated fund must maintain independent audit procedures that review and test its AML compliance programme. Since 18 September 2026, CIMA's Rule on Effective Compliance Programmes sets out how: the audit must be carried out by suitably qualified persons independent of the functions they test, at a frequency driven by the fund's own risk assessment, internally for no more than two consecutive cycles, and with the report filed with CIMA. There is no universal annual audit requirement. The AML Compliance Officer cannot audit their own work, and a service provider's firm-wide audit will not, on its own, satisfy CIMA for an individual fund.

The obligation itself is not new. Regulation 5(a)(ix) of the Anti-Money Laundering Regulations has long required an independent audit function. What changed in 2026 is the detail. CIMA gazetted the Rule on 20 July 2026, it took effect on 18 September 2026, and CIMA then updated its AML and Sanctions Rules FAQs in late September to answer the questions funds were asking. This article draws on the Rule and those FAQs. The wider set of board actions under both Rules is covered in our CIMA AML and Sanctions Rules checklist for Cayman funds.

What the Rule requires

Rule 12.1 requires each financial service provider to establish and maintain independent audit procedures that review and test its compliance programme for adequacy, effectiveness and alignment with the AML Regulations and CIMA's requirements. Rule 12.2 then requires that:

• the audit is carried out at a frequency commensurate with the fund's size, complexity, structure, nature of business and risk profile, as determined by its risk assessment or as CIMA otherwise requires;
• the audit is carried out by suitably qualified persons who are independent and separate from those involved in the design, implementation or operation of the policies, procedures, systems and controls under audit, and free from any conflict of interest that could impair objective judgement;
• the fund can provide CIMA, on request, with documentation of the auditor's independence and the basis on which it was determined; and
• the audit report is filed with CIMA as soon as practically possible after completion.

Rules 12.4 and 12.5 add that deficiencies identified must be remediated within appropriate timeframes, and that the fund remains ultimately responsible for its compliance programme whether or not the audit is outsourced. The Rule applies to every financial service provider regulated by CIMA, which includes registered mutual funds and registered private funds.

Who can conduct an independent AML audit

CIMA's FAQs identify the categories of person who may perform the audit, subject in every case to independence from the functions and activities being audited:

Why the AMLCO cannot audit their own compliance work

Until 2026, many funds met the audit expectation by having the AMLCO or the administrator's compliance team test investor procedures. That model no longer works. The AMLCO is responsible for the implementation and oversight of the compliance programme under Rule 7.3(a), and the audit exists to test that implementation. An officer testing their own design and operation is the self-review threat the independence requirement is written to exclude. CIMA's FAQs state directly that the AMLCO, MLRO and Deputy MLRO cannot independently audit activities for which they have responsibility.

Internal or external: the two-cycle limit

Rule 12.3 permits the audit to be conducted internally, but not for more than two consecutive audit cycles. After two internal cycles, the next audit must be conducted by an external service provider. CIMA's FAQs express the same principle as at least one external audit in every three independent cycles, to mitigate familiarity, self-review and loss of objectivity.

The Rule's definition of "internally" is broad. It covers any individual or unit employed by, engaged under contract by, or otherwise forming part of the fund's organisational structure and subject to the fund's direction, control or oversight. A fund has no employees, so the question is how its contracted service providers are treated. On the wording, an internal audit team within the fund's investment manager or administrator, engaged by contract and overseen by the fund, falls within "internally", and several market commentaries read it that way. Boards should plan on that basis: such a team may perform up to two consecutive cycles if it is genuinely independent of the AML function, and the following audit must come from outside that structure.

How often: a risk-based cycle, not an annual one

CIMA does not impose a universal annual AML audit requirement. Its FAQs state that the Rule does not mandate annual audits and that there is no prescribed frequency. As an illustration, CIMA suggests that a higher risk entity might reasonably be audited every two years, and medium and lower risk entities every three and four years respectively.

Two points follow. First, the frequency must flow from a documented, board-approved risk assessment. A cycle chosen for cost with no risk rationale behind it will not withstand supervisory review. Second, CIMA's FAQs confirm that the Rule does not require a fund to commission an audit solely because the Rule became effective. A fund that sets a two-year cycle from 18 September 2026 would, on that basis, expect to file its first audit by September 2028. A higher-risk profile, such as a digital asset fund accepting subscriptions in virtual assets from investors across many jurisdictions, may justify a shorter cycle.

Why a service provider's general audit may be insufficient

Most Cayman funds outsource AML functions to an administrator. CIMA's FAQs address this directly. A regulated fund must still undertake an AML audit under regulation 5(a)(ix) even where all or substantially all of its operations are outsourced. CIMA states that relying solely on a service-provider-level internal audit or a population-based review, without sufficient evidence about the individual fund's compliance programme, would not provide sufficient assurance. A fund may rely on a service provider's audit only where that audit adequately assesses all elements of the fund's own programme.

In practice, an administrator's firm-wide audit samples files across hundreds of clients. It may conclude that the administrator's procedures are sound without examining a single investor file in the fund in question. That gives the board assurance about the administrator, not about the fund. The audit the fund files with CIMA needs fund-specific testing: investor onboarding files, risk ratings, screening results, transaction monitoring alerts and escalations relating to that fund's investors.

Umbrella platforms and shared compliance infrastructure

The point carries particular weight on an umbrella platform. In a segregated portfolio company the regulated fund is the company itself, but investors subscribe portfolio by portfolio, and investor profiles, risk ratings and screening outcomes differ between portfolios. An audit that tests the platform's shared procedures without sampling investor files across the portfolios leaves the same gap CIMA identifies for service-provider audits. In CV5's view, a platform audit should state its sampling basis by portfolio, so that each manager can show its own investors were within the population tested. The complete guide to the Cayman segregated portfolio company explains why the portfolio, not the umbrella, is where the investor relationship sits in practice.

Filing the report and the enforcement position

Filing the audit report with CIMA is new for investment funds. The Rule requires filing as soon as practically possible after completion. CIMA's FAQs indicate that a fund may submit the final report of an audit completed under its existing risk-based plan, and that there is no universal filing date or simultaneous submission requirement.

On enforcement, CIMA has said it does not intend to adopt a blanket enforcement approach from the effective date and that the administrative fines framework for breaches of the Rule is not yet in effect. That is a transitional window, not a moratorium. The underlying obligation in the AML Regulations remains enforceable on its existing terms, and the Rule forms part of CIMA's supervisory toolkit through inspections and desk-based reviews, which we cover in CIMA AML desk-based reviews for Cayman funds.

The question CIMA is now asking is simple: show me the evidence for this fund. An administrator's clean firm-wide report answers a different question. Boards that understand that distinction will commission the right audit the first time.

David Lloyd, Founder and CEO, CV5 Capital

A board checklist

1. Approve a written AML risk assessment for the fund and record the audit frequency it supports.
2. Appoint an auditor and document its qualifications and independence from the AMLCO, MLRO, Deputy MLRO and the administrator's compliance function.
3. Classify the engagement as internal or external and track the two-cycle limit.
4. Agree a scope covering every component of the compliance programme, including sanctions screening and outsourcing oversight.
5. Require fund-specific sampling of investor files and, on a platform, a stated sampling basis by portfolio.
6. Minute receipt of the report, file it with CIMA and track remediation to closure.

Common mistakes

• Treating the AMLCO's annual compliance report as the independent audit.
• Assuming the administrator's firm-wide audit covers the fund.
• Choosing an audit frequency with no documented risk rationale.
• Commissioning a third consecutive internal audit.
• Limiting scope to investor due diligence and omitting sanctions, monitoring and training.

What this means for managers on the CV5 platform

On CV5 SPC and CV5 Digital SPC the AML compliance programme, AMLCO and MLRO arrangements and audit cycle are governed at platform level by the board, with investor onboarding and screening applied to each portfolio's investors. Managers retain responsibility for investment decisions, not for building a parallel AML framework. How investor onboarding operates under that framework is set out in our guide to AML and KYC investor onboarding for Cayman funds, and the evidence allocators will ask for is covered under fund governance and ODD readiness.

Frequently asked questions

Does CIMA require an annual AML audit for Cayman funds?

No. CIMA's FAQs state that the Rule does not mandate annual audits. Frequency must be set by the fund's risk assessment. CIMA gives illustrative cycles of two years for higher risk, three for medium and four for lower risk entities.

Can the AML Compliance Officer perform the independent AML audit?

No. CIMA's FAQs state that the AMLCO, MLRO and Deputy MLRO cannot independently audit activities for which they are responsible, whether the function is held internally or outsourced.

Can the administrator's internal audit team audit the fund?

It may, if it is independent of the AML function and its work tests the fund's own programme. On the Rule's definition, a contracted service provider's internal team is likely to count as internal, so it can perform no more than two consecutive cycles before an external audit is required.

Must the AML audit report be filed with CIMA?

Yes. The Rule requires the report to be filed as soon as practically possible after the audit is completed. This is a new requirement for investment funds.

This article is published by CV5 Capital for general information only. It does not constitute legal, tax, regulatory or investment advice, or an offer or solicitation to invest in any fund. References to legislation and CIMA regulatory measures reflect the position as understood at the date of publication and may change. CV5 Capital provides regulated fund infrastructure, governance and operational oversight through CV5 SPC and CV5 Digital SPC; investment strategies and portfolio management are the responsibility of each appointed investment manager. CV5 Capital, CIMA Registration No. 1885380, LEI 984500C44B2KFE900490.