Sanctions Screening for Cayman Funds: What CIMA's Sanctions Rule Requires From 18 September 2026

From 18 September 2026 the sanctions screening Cayman funds perform becomes an enforceable regulatory requirement rather than a matter of guidance. CIMA's Rule on Compliance with Financial Sanctions and Targeted Financial Sanctions, published in its regulatory measures library, sets out in twenty-three numbered paragraphs who a fund must screen, when it must re-screen, and what it must freeze, report and record. The Rule does not create the freezing and reporting duties, which already sit in the Terrorism Act, the Proliferation Financing (Prohibition) Act and the UK Orders in Council extended to the Cayman Islands. It turns the operating discipline around those duties into a standard CIMA can inspect. This article works through it from the fund's side and shows how the work divides between fund, administrator and manager.

"The funds that will find 18 September uneventful are the ones that already treat a list update as an operational event rather than a compliance memo. When we review a sanctions framework we look for three things. Every party in the structure has been screened, not just the subscribing investor. A list change triggers a re-screen the same day, with a log to prove it. And the file shows the reasoning behind every match that was cleared. The Rule now asks for exactly that evidence, and a fund that cannot produce it on request has a gap however good its administrator is." David Lloyd, Chief Executive Officer at CV5 Capital

Executive Summary

The Sanctions Rule applies to every person regulated by CIMA, including registered mutual funds and private funds, and has the force of law from 18 September 2026. It requires a documented sanctions programme, screening of a defined population, re-screening without delay on every list update, freezing without prior notice, reporting to the Financial Reporting Authority, and a record of every action and its rationale.

• Rule 7.4 requires screening of applicants, customers, beneficial owners, transactions, service providers and connected persons, well beyond the subscribing investor.
• Rules 7.5 and 7.11 require all customers and connected persons to be re-screened without delay whenever a Sanctions List is updated, regardless of risk rating.
• Rule 7.3 prohibits rating a customer's geographic risk as low where its country is subject to UK, UN or US sanctions, wider than regulation 8A of the AMLRs.
• Rules 7.13, 7.17 and 7.18 restate the statutory duties to freeze without prior notice, to make nothing available to a designated person, and to report to the FRA on the Compliance Reporting Form.
• Rules 7.9, 7.10, 7.14 and 7.20 turn policies, screening records, match rationales and training into inspectable evidence.
• The fund remains the Regulated Person and cannot delegate responsibility, so the administrator's screening must be governed, evidenced and supplemented.

What the Sanctions Rule Is and Who It Binds

CIMA issued the Rule under section 34(1) of the Monetary Authority Act. Rule 8.2 states that it "shall have the force of law" and takes precedence over earlier CIMA guidance where they conflict. Rule 9.1 fixes the effective date at 18 September 2026, sixty days after Gazette publication. Figures current as at 5 September 2026: the final text sits in CIMA's investment funds regulatory measures library alongside the companion AML Rule.

Rule 6.3 applies the Rule to Regulated Persons, meaning any natural person, legal person or legal arrangement regulated by CIMA under the Regulatory Acts. A fund registered under the Mutual Funds Act or the Private Funds Act is in scope in its own right. Rule 6.1 adds that everyone in the Cayman Islands must comply with financial sanctions, so the underlying prohibitions bind the manager, the administrator and the directors too.

Rule 5.3 describes the Rule as supplementing regulations 5 and 8 of the Anti-Money Laundering Regulations, and Rules 5.4 and 8.2 provide that the AMLRs and the underlying Acts prevail in any conflict. CV5's earlier analysis of CIMA's new AML and Sanctions Rules treats the two instruments together; this piece takes the sanctions half on its own.

One distinction runs through it. Where the article says the Rule requires something, the reference is to a numbered paragraph with the force of law. Where it cites the FRA's Financial Sanctions Guidance, that is guidance which Rule 1.6 directs Regulated Persons to read alongside the Rule. Where it describes how the work is divided, that is market practice and CV5's recommended approach.

The Lists a Cayman Fund Must Screen Against

Rule 2.1.18 defines "Sanctions List" as the UK Sanctions List and any other list that applies to the Cayman Islands under the UK's Overseas Orders in Council. The UK Sanctions List is published by the Foreign, Commonwealth and Development Office under the Sanctions and Anti-Money Laundering Act 2018, and each regime made under that Act reaches the Islands through an Order in Council. The Russia (Sanctions) (Overseas Territories) Order 2020, for example, extends the Russia (Sanctions) (EU Exit) Regulations 2019 to the Cayman Islands. UN designations arrive by the same route.

Two sources sit outside the UK list. Terrorism-related designations are implemented directly under the Terrorism Act, and proliferation-related designations under the Proliferation Financing (Prohibition) Act; the definition of "Designated Person" at 2.1.5 captures both. Rule 7.13.1 then requires a Regulated Person to monitor sanctions regularly and to amend its systems or lists to include local designations made by the Governor, published in the Gazette and on the FRA's website. A tool fed only by a commercial consolidated list may miss a local designation on the day it is made.

Rule 7.3 is the provision most likely to catch a fund whose risk model follows the AMLRs. Regulation 8A(2)(c) prevents a country being rated low risk where it is subject to UK or UN sanctions related to its money laundering, terrorist financing or proliferation financing risk. Rule 7.3 extends that bar to sanctions imposed by the United States and the Office of Foreign Assets Control. The Rule does not make US designations enforceable in the Islands and creates no freezing duty by reference to them. It does mean the fund's country risk methodology must show that US country-level sanctions were considered.

Who and What Must Be Screened, and When

Rule 7.4 sets the population. A Regulated Person must screen applicants, customers, beneficial owners, transactions, service providers and other relevant parties, including connected persons, to determine whether it is doing business with a designated person, an associate of one, or a sanctioned country. For a fund that means the investor and its ownership chain, the directors, the manager and its principals, every service provider, and the counterparties and assets on the portfolio side.

Rule 7.5 states that simplified due diligence does not reduce screening obligations and that all customers must be re-screened whenever a Sanctions List is updated, whatever their risk classification. Rule 7.11 requires systems that screen existing customers and connected persons against the updated list "Without Delay". The definition at 2.1.23 explains the phrase: ideally within a matter of hours of a UN designation, read against the need to prevent the flight or dissipation of assets. A monthly batch re-screen does not meet that standard on its own.

Rule 7.12 extends the framework from names to assets. Monitoring policies must set out the process for identifying assets subject to targeted financial sanctions, mirroring regulation 5(a)(viiia) of the AMLRs. A security issued by a designated entity or a wallet controlled by one is an asset the fund may be dealing with, whoever the investors are. The investor side is covered in CV5's guide to AML, KYC and investor onboarding in Cayman funds; the Rule demands the same discipline on the asset and counterparty side.

When a Match Occurs: Freeze, Report and Record

The Rule does not invent the consequences of a true match; it restates them and attaches an evidence requirement. Under Rule 7.13.3, a Regulated Person that knows or has reasonable cause to suspect it holds the funds of a designated person must freeze them and must not deal with them unless licensed by the Governor. It must also report to the FRA on the Compliance Reporting Form without delay. Rule 7.17 adds that the freeze is applied without prior notice. Rule 7.18 extends the prohibition to entities owned or controlled by a designated person and to anyone acting on their behalf.

The statutory footing is explicit. Paragraph 12 of Schedule 4A to the Terrorism Act requires any person to freeze, without delay and without prior notice, funds owned, held or controlled by a designated person. Paragraph 20 requires a relevant institution to inform the Governor as soon as practicable of a known or suspected designated person and to state what it holds for that customer. Sections 2B and 2C of the Proliferation Financing (Prohibition) Act impose the same freezing duty for proliferation designations and require disclosure to the FRA of frozen funds and actions taken, including attempted transactions. The mechanics of running a frozen position inside a fund are set out in CV5's article on Cayman AML, KYB and KYA requirements for fund launches and are not repeated here.

Three paragraphs deal with the aftermath. Rule 7.9 requires every action taken under Rule 7.6 to be documented with its rationale. Rule 7.22 requires unfreezing procedures for delisted persons, as guided by the FRA. Rule 7.23 requires any licence application to go to the Governor, copied to the FRA, on the Asset Freeze and Trust Services Prohibitions Licence Application Form or such other form as the FRA prescribes. The FRA's guidance states that a licence will not be issued retrospectively.

Fund, Administrator and Manager: Who Does What

The Rule addresses the Regulated Person and says nothing about how the work is organised; the allocation comes from the AMLRs and the fund's contracts. Regulation 3(2) permits a person carrying out relevant financial business to delegate any function or rely on another person to perform it, and regulation 3(3) keeps responsibility for compliance with that person. For a fund, that is the fund. The administrator performs; the fund answers for the result.

In practice the administrator, as transfer agent, screens applicants, investors and beneficial owners at onboarding and re-screens the register on list updates. That covers the investor limb of Rule 7.4 and nothing else. Service providers, the manager's principals, trading counterparties, portfolio assets and, for digital asset strategies, wallets and venues sit outside the register and the transfer agency mandate. Rule 7.13.2 expressly requires third-party service providers to be reviewed against the lists, and the compliance framework should say who owns that work.

A manager regulated in the United States, the United Kingdom or elsewhere has its own sanctions obligations and usually its own screening. That does not discharge the fund's duty, because the fund is the Regulated Person and its assets are the ones being dealt with. The cleaner arrangement is a short sanctions schedule in the investment management agreement requiring the manager to screen counterparties and issuers to a stated standard, report exceptions to the fund's AML officers and provide its records on request. The Cayman compliance officer's role for Cayman funds is the natural coordinating point for that line.

The Evidence File: What CIMA Will Expect to See

Rule 1.5 describes what CIMA assesses: whether Regulated Persons know the applicable sanctions and local designations and understand their screening, reporting, monitoring and training obligations. Rules 7.1, 7.9, 7.10, 7.14 and 7.20 describe the artefacts that demonstrate it, and together they define the file a fund should be able to produce on request.

• A sanctions programme integrated into the AML/CFT/CPF programme (Rule 7.1), with procedures a member of staff could follow (Rule 7.14).
• Screening records showing who was screened, against which list version, when, with what result and by whom, plus the ownership and control records under Rule 7.10.
• A list-update log evidencing that each update triggered a re-screen of the register and connected persons without delay (Rules 7.5, 7.11, 7.15).
• Match dispositions recording the identifying information compared and the reasoning, for true matches and false positives alike (Rules 7.9, 7.19).
• Reporting evidence: any Compliance Reporting Form filed, any licence application, and the minute recording the decision (Rules 7.7, 7.13.4, 7.21, 7.23).
• Training records for AML officers, directors and the administrator's team on identifying designated persons and frozen assets (Rule 7.20).

Retention is governed by the AMLRs. Regulation 31 requires customer due diligence records, account files, correspondence and the results of any analysis to be kept for at least five years after the relationship ends, and to be available without delay on request. Screening outputs and match dispositions are results of analysis, so a fund that cannot retrieve the result for an investor who redeemed three years ago has a record-keeping gap as well as a sanctions one. The wider programme file under the companion AML Rule is addressed in CV5's article on the compliance programme evidence file CIMA now expects.

The board oversees rather than executes, but oversight is demonstrable only if it is minuted. A quarterly sanctions report from the AML officers covering list updates processed, matches raised and cleared, and reports filed is the simplest proof that the governing body knew what its delegates were doing. The steps a board should take before the effective date are set out in what fund boards must do now that Cayman's AML rules become enforceable.

Digital Asset Funds: Where the Rule Reaches On-Chain

The Rule's definition of targeted financial sanctions at 2.1.20 refers expressly to preventing funds or other assets, "including virtual assets", from reaching designated persons. That is its only reference to digital assets, and it is enough. A wallet controlled by a designated person is an economic resource of that person, a stablecoin transfer to it makes funds available, and an in-kind subscription from it is dealing with the funds of a designated person. The freezing and reporting duties apply without modification.

What the Rule does not do is prescribe a method. Rule 7.4 requires transactions and other relevant parties to be screened, and Rule 7.16 requires effective transaction monitoring, but neither names a technology. Address-level screening of subscription wallets, counterparty wallets and protocol contracts is established practice for digital asset funds and CV5's recommended approach on CV5 Digital SPC, but it is not a regulatory requirement and a fund's policy should say so.

Exchanges and OTC desks fall within the service providers limb of Rule 7.4 and the third-party review in Rule 7.13.2, so venue onboarding that omits the fund's own screening of the venue is incomplete. Proliferation financing risk, which the AMLRs define by reference to UN targeted financial sanctions and address at regulation 8(2)(h), needs particular care where counterparties include venues in higher-risk jurisdictions. The custody, exchange and wallet governance behind this is described on CV5's digital asset fund platform.

Key Takeaways

• Map the full Rule 7.4 screening population for each fund, including providers, manager principals, counterparties and assets, and assign a named owner to each segment.
• Confirm with the administrator that list updates trigger a same-day re-screen of the register and connected persons, and obtain the log that proves it.
• Add a sanctions schedule to the investment management agreement covering counterparty and issuer screening, exception reporting and access to records.
• Update the country risk methodology so that UK, UN and US sanctions each prevent a low geographic risk rating, as Rule 7.3 requires.
• Adopt a match disposition template recording the identifying data compared and the rationale, retained for the five years required by regulation 31 of the AMLRs.
• Put a standing sanctions item on the board agenda, minuted quarterly, covering list updates processed, matches, reports filed and training completed.

Frequently Asked Questions

What does CIMA's Sanctions Rule require Cayman funds to do?

The Rule requires a Regulated Person, which includes a CIMA-registered fund, to integrate a sanctions programme into its AML/CFT/CPF programme, to screen applicants, customers, beneficial owners, transactions, service providers and connected persons, to re-screen all customers without delay on every Sanctions List update, to freeze the assets of designated persons without prior notice, to report to the Financial Reporting Authority on the Compliance Reporting Form, and to document every action and its rationale. It has the force of law from 18 September 2026.

Which sanctions lists apply to a Cayman Islands fund?

The Rule defines the Sanctions List as the UK Sanctions List published by the Foreign, Commonwealth and Development Office, together with any other list that applies to the Cayman Islands under the UK's Overseas Territories Orders in Council, which extend UK and UN regimes to the Islands. Terrorism and proliferation designations under the Terrorism Act and the Proliferation Financing (Prohibition) Act, and local designations made by the Governor, also apply. US sanctions are relevant to geographic risk rating under Rule 7.3 but are not extended to the Islands by the Rule.

How often must a Cayman fund re-screen its investors for sanctions?

The Rule does not set a calendar frequency. Rules 7.5 and 7.11 require all existing customers and connected persons to be re-screened without delay whenever a Sanctions List is updated, regardless of their risk rating or whether simplified due diligence was applied. The Rule defines without delay as ideally within a matter of hours of a UN designation. A periodic batch re-screen may sit alongside that but does not replace event-driven re-screening.

Is the fund or the administrator responsible for sanctions screening?

The fund. Regulation 3(2) of the Anti-Money Laundering Regulations allows functions to be delegated, and regulation 3(3) keeps responsibility for compliance with the person carrying out relevant financial business. The administrator typically performs investor screening as transfer agent, but the fund must govern that work, obtain the evidence, and ensure the remaining population of service providers, manager principals, counterparties and assets is screened by someone.

What must a Cayman fund do if an investor is a sanctions match?

Where the fund knows or has reasonable cause to suspect that it holds funds of a designated person, it must freeze them without delay and without prior notice, make nothing available to the designated person unless licensed by the Governor, and report to the FRA on the Compliance Reporting Form. The statutory duties sit in Schedule 4A to the Terrorism Act and sections 2B and 2C of the Proliferation Financing (Prohibition) Act, and the Rule restates them at 7.13, 7.17 and 7.18. Every action and its rationale must be recorded under Rule 7.9.

Does the Sanctions Rule apply to digital asset funds and wallets?

Yes. The Rule's definition of targeted financial sanctions refers to funds or other assets including virtual assets, and the freezing, prohibition and reporting duties apply to a wallet controlled by a designated person in the same way as to a bank account. The Rule does not prescribe address-level screening; that is established practice for digital asset funds rather than a regulatory requirement, and exchanges and OTC desks fall within the service providers that Rule 7.4 requires to be screened.