CIMA's Rule on an Effective Compliance Programme: What Changes for Cayman Entities

CIMA's compliance programme rule, the Rule on Effective Compliance Programme for the Prevention and Detection of Money Laundering, Terrorist Financing and Proliferation Financing for Financial Services Providers, took effect on 18 September 2026. It converts long-standing expectations under the Anti-Money Laundering Regulations (As Revised) into enforceable minimum requirements for the entities CIMA regulates, covering governance, risk assessment, procedures, training and independent testing.

Key takeaways

• The rule came into effect on 18 September 2026, sixty days after publication in the Gazette, and has the force of law.
• It applies to all financial services providers regulated and supervised by CIMA under the regulatory Acts, in proportion to each entity's size, complexity and risk profile.
• The governing body must set a documented governance framework and designate an AMLCO, an MLRO and a DMLRO who are natural persons at management level or above.
• Risk assessments must consider the most recent National Risk Assessment and be updated without delay when a material trigger event occurs.
• The programme must be independently audited, with the report filed with CIMA, and an internal audit may not be used for more than two consecutive cycles.

What the rule is and why it matters

CIMA issued the compliance programme rule in July 2026. It cites section 34 of the Monetary Authority Act, which allows CIMA, after consultation, to issue rules on the conduct of regulated persons and to reduce the risk of financial services business being used for money laundering. The rule supplements Regulations 3, 4, 5, 6, 8 and 8A of the Anti-Money Laundering Regulations, which deal with compliance programmes, the AMLCO, systems and training, group-wide programmes and risk assessment.

Two features change its status compared with earlier guidance. First, the rule states that it has the force of law, and breaches are dealt with under CIMA's Enforcement Manual in addition to its other statutory powers. Second, where the rule conflicts with prior guidance notes or policy statements, the rule prevails; where it conflicts with the Anti-Money Laundering Regulations, the Regulations prevail. CIMA published a companion rule on financial sanctions compliance with the same effective date.

Who the rule applies to

The rule applies to all financial services providers regulated and supervised by CIMA under the regulatory Acts, including branches, subsidiaries, affiliates and other members of a CIMA-regulated financial group. The regulatory laws listed in the Monetary Authority Act include the Mutual Funds Act, the Securities Investment Business Act and the Companies Management Act, and further Acts may be prescribed by regulations.

Each provider must implement a programme commensurate with its size, complexity, structure, nature of business and risk profile. Where it relies on a third party or a group member to perform AML functions, as most funds rely on their administrator, it remains satisfied that those functions comply and retains ultimate responsibility. On request, it must give CIMA timely evidence of how it remains satisfied. Bell Rock's Cayman AML and compliance support is built around that oversight responsibility.

Governance and the AML officers

The governing body (the board of a company, the general partner of a partnership, the manager of an LLC, or equivalent) must establish and maintain a governance framework that documents and assigns the roles of all senior persons involved in the programme. It must designate an AMLCO, an MLRO and a DMLRO, each a natural person operating at no lower than management level.

The designated AMLCO must:

• have the authority to oversee the effectiveness of the provider's AML systems and compliance with the Regulations and the rule;
• have direct access to senior management and the governing body;
• perform the function independently and objectively from the business functions under oversight, managing conflicts where full separation is not practicable;
• have sufficient resources and a sound understanding of the business, its products and structure; and
• keep the governing body informed, escalating issues as appropriate and reporting at least annually.

The MLRO receives and assesses internal suspicious activity reports and, where appropriate, reports externally to the Financial Reporting Authority. The DMLRO acts in the MLRO's absence. The provider must be able to show CIMA, on request, that each officer is suitably qualified and experienced. Designation does not transfer responsibility: the provider remains ultimately responsible for the programme. The roles themselves are described in our article on AML obligations for relevant financial business.

The risk-based approach

A provider must identify, assess and understand its money laundering, terrorist financing and proliferation financing risks across customer types, geography, products, services, transactions and delivery channels. In doing so it must, at a minimum, consider the findings of the most recent Cayman Islands National Risk Assessment.

Risk assessments must be documented, including inherent and residual risk and how risks are aggregated into an overall rating, and kept current. They must be updated without delay on a material trigger event, which the rule illustrates with new products or business lines, expansion into higher-risk geographies, mergers or significant restructuring, and economic or geopolitical developments. Enhanced due diligence applies where risk is higher. Simplified due diligence may be applied where risk is lower, but never where there is a suspicion, and its basis must be documented.

Policies, procedures and controls

Policies must be approved by the governing body; procedures and controls by senior management, the governing body or both. At a minimum they must address risk assessment, customer due diligence and ongoing monitoring, record-keeping, outsourcing, notification to CIMA of material outsourced compliance functions, suspicious activity detection and reporting (including travel rule requirements where applicable), and financial sanctions compliance.

Customer due diligence and records

The rule sets detailed due diligence requirements, including verification of persons acting on behalf of a customer to the same standard as the customer, identification of the settlor, trustees, protector, enforcer and beneficiaries of trusts, and controls on remote onboarding. Records of transactions and due diligence must be kept for at least five years after the relationship ends, and beneficial ownership records for at least five years after the customer ceases to exist or to be a customer, in a form CIMA can obtain without delay. Fund boards will recognise the overlap with the beneficial ownership contact person regime.

Outsourcing

Before outsourcing any part of the programme, the provider must assess the risks, including country risk, carry out due diligence on the provider's fitness, competence and capability, and set out each party's rights and obligations in the agreement. It must not enter into or continue an arrangement that impedes CIMA's access to data or systems, and it must notify CIMA of any outsourcing that relates to material functions of the programme.

Training and staff screening

Training must be documented in a plan describing recipients, topics, methods and frequency, delivered at least annually, and recorded with the date, attendees and content. Recipients include client-facing staff, those handling transactions, compliance staff, senior management and members of the governing body. Providers must also screen prospective employees through fitness and propriety, integrity and background checks, and keep that screening up to date.

Demonstrating effectiveness: the independent audit

A provider must maintain independent audit procedures that review and test the programme. The audit frequency must reflect the provider's size, complexity and risk profile, or any CIMA requirement. Auditors must be suitably qualified, independent of the design and operation of what they test, and free of conflicts, and the provider must be able to document that independence. The audit report is filed with CIMA as soon as practically possible after completion.

The audit may be performed internally, but not for more than two consecutive cycles; the next audit must then be performed by an external provider. Deficiencies must be remediated within timeframes that reflect their materiality. Separately, all suspicious activity must be reported to the MLRO or DMLRO, a suspicious activity report must be filed with the Financial Reporting Authority without delay where there is knowledge or suspicion, and tipping off is prohibited.

What to do now

For most regulated entities the practical steps are:

• run a gap analysis of existing policies and procedures against each section of the rule and present it to the board;
• have the governing body approve the updated policies, and record that approval;
• refresh the risk assessment against the current National Risk Assessment and document the methodology;
• map every outsourced AML function, complete or refresh due diligence on each provider, and notify CIMA of material arrangements;
• document the training plan and attendance records; and
• schedule the independent audit and decide whether the next cycle must be external.

The same exercise should cover the fund's other reporting regimes, such as FATCA classification and reporting, where the same service providers and records are involved.

Frequently asked questions

When did CIMA's compliance programme rule take effect?

On 18 September 2026, sixty days after its publication in the Gazette.

Can the AML audit be carried out internally?

Yes, by suitably qualified persons who are independent of the systems under review, but not for more than two consecutive audit cycles. The following audit must be external.

Does outsourcing the AML function to an administrator satisfy the rule?

Outsourcing is permitted, but the provider remains ultimately responsible. It must assess and document the arrangement, notify CIMA of material outsourcing, and be able to evidence how it remains satisfied that the functions comply.

Does the rule replace the AML Guidance Notes?

No. The rule is to be read with the Guidance Notes and other instruments. Where the rule conflicts with earlier guidance, the rule prevails; where it conflicts with the Anti-Money Laundering Regulations, the Regulations prevail.

Where Bell Rock fits

Bell Rock Group Financial Services Limited is licensed by CIMA as a Company Manager under the Companies Management Act (As Revised), Licence No. 633916. Bell Rock provides AMLCO, MLRO and DMLRO appointments through named individuals and coordinates the governance records the rule requires, including board reporting, policy approvals and outsourcing notifications. Bell Rock does not provide an internal or independent AML audit to any entity for which its individuals act as AML officers.

Related reading

• CIMA governance guidance for regulated fund boards
• Cayman VASP registration and licensing
• Cayman investment funds: structures and regulation
• AML Officers for Cayman Funds: MLRO, DMLRO and AMLCO Explained
• Financial Sanctions Compliance for Cayman Funds and Companies
• SIBA Registered Persons: Registration and Annual Obligations for Cayman Managers

Bell Rock supports regulated entities through its Cayman AML and compliance support service.