Cayman AML Obligations for Relevant Financial Business

Cayman AML obligations apply to every person carrying on relevant financial business in or from the Cayman Islands, including funds, fund managers, company managers, VASPs and single family offices. Under the Proceeds of Crime Act (As Revised) and the Anti-Money Laundering Regulations (As Revised), they must appoint AML officers, adopt a risk-based approach, conduct customer due diligence, keep records and report suspicious activity.

Key takeaways

• The Proceeds of Crime Act (As Revised) and the Anti-Money Laundering Regulations (As Revised) are the principal Cayman AML and counter-terrorist financing legislation.
• "Relevant financial business" is defined broadly and includes regulated mutual funds, company management, securities investment business, virtual asset services and operating a single family office.
• Each person carrying on relevant financial business must designate an AML compliance officer, a money laundering reporting officer and a deputy.
• Customer due diligence, a documented risk assessment, sanctions screening, record keeping, internal reporting and staff training are required.
• New products, delivery mechanisms and technologies must be risk-assessed before launch or use.

The Cayman AML legislation

The principal legislation in the Cayman Islands to combat money laundering and the financing of terrorism is the Proceeds of Crime Act (As Revised) (POCA) and the Anti-Money Laundering Regulations (As Revised) (the Regulations). Bell Rock's Cayman AML and compliance support is built around these obligations.

Are you carrying on relevant financial business?

Under POCA, "relevant financial business" means the business of engaging in one or more of the following:

• banking or trust business carried on by a licensee under the Banks and Trust Companies Act (As Revised);
• acceptance by a building society of deposits made by any person, including raising money from members by the issue of shares;
• business carried on by a co-operative society within the meaning of the Co-operative Societies Act (As Revised);
• insurance business, and the business of an insurance manager, insurance agent or insurance broker licensed under the Insurance Act (As Revised), connected with insurance business;
• mutual fund administration, or the business of a regulated mutual fund within the meaning of the Mutual Funds Act (As Revised); and
• the business of company management as defined by the Companies Management Act (As Revised), with the services specified in section 3(4)(a) of that Act not excluded for the purposes of the Regulations.

Activities within the definition of relevant financial business

Relevant financial business also covers activities including, but not limited to:

1. acceptance of deposits and other repayable funds from the public;
2. lending;
3. financial leasing;
4. money or value transfer services;
5. issuing and managing means of payment, such as credit and debit cards, cheques, traveller's cheques, money orders, bankers' drafts and electronic money;
6. financial sureties and other financial commitments given for others;
7. trading in money market instruments (cheques, bills, certificates of deposit, derivatives and similar), foreign exchange, exchange, interest rate and index instruments, transferable securities, or commodity futures;
8. participation in securities issues and the provision of financial services related to them;
9. advice to undertakings on capital structure, industrial strategy and related questions, and advice and services relating to mergers and the purchase of undertakings;
10. money broking;
11. individual and collective portfolio management and advice;
12. safekeeping and administration of cash or liquid securities on behalf of other persons;
13. safe custody services;
14. financial, estate agency (including real estate agency or brokering), legal and accounting services provided in the course of business relating to the sale, purchase or mortgage of land or interests in land on behalf of clients, management of client money, securities or other assets, organisation of contributions for the creation, operation or management of companies, management of bank, savings or securities accounts, or the creation, operation or management of legal persons or arrangements and the buying and selling of business entities;
15. undertaking property development within the meaning of section 2 of the Trade and Business Licensing Act (As Revised) and the subsequent sale of that property without using a real estate agent or broker;
16. undertaking property investment without using a real estate agent or broker;
17. the services of listing agents and broker members of the Cayman Islands Stock Exchange, as defined in its listing rules and membership rules;
18. the conduct of securities investment business;
19. dealing in precious metals or precious stones when engaging in a cash transaction equivalent to US$15,000 or more;
20. the provision of registered office services to a private trust company by a company holding a trust licence under section 6(5)(c) of the Banks and Trust Companies Act (As Revised);
21. otherwise investing, administering or managing funds or money on behalf of other persons;
22. underwriting and placement of life insurance and other investment-related insurance;
23. providing virtual asset services; and
24. operating a single family office.

Fund managers registering under the Securities Investment Business Act are within this definition; see our guide to setting up a Cayman fund management company. So are virtual asset service providers, whose additional Travel Rule duties are covered in our article on Cayman VASP registration.

How does a Cayman entity conducting relevant financial business comply?

Appoint an AML compliance officer

Regulation 3(1) of the Regulations requires any person carrying on relevant financial business to designate a person at managerial level as AML compliance officer. The compliance officer ensures that the measures in the Regulations are adopted by the business, and acts as the point of contact with competent authorities for the purposes of the Regulations.

Appoint an MLRO and a deputy MLRO

Regulation 33(1) requires any person carrying on relevant financial business to designate a person at managerial level as money laundering reporting officer (MLRO), and an alternate. The MLRO is the person to whom suspicious activity reports are made, and the deputy MLRO (DMLRO) performs the MLRO's functions in the MLRO's absence. Where a fund delegates these functions, the officers must still be designated natural persons, as noted in our summary of CIMA's governance guidance for regulated funds.

Customer due diligence procedures

Part IV of the Regulations sets out specific customer due diligence requirements. In particular, a person carrying on relevant financial business must:

• not keep anonymous accounts or accounts in fictitious names;
• undertake customer due diligence when establishing a business relationship, when carrying out a one-off transaction valued in excess of US$15,000 (whether in one transaction or a series of smaller transactions), when carrying out a one-off transaction that is a wire transfer, when there is a suspicion of money laundering or terrorist financing, or when it doubts the veracity or adequacy of previously obtained customer identification data;
• identify a customer and verify their identity using reliable, independent source documents, data or information;
• verify that a person purporting to act on behalf of a customer is properly authorised, and identify and verify that person;
• identify any beneficial owner and take reasonable measures to verify the beneficial owner's identity;
• understand, and obtain information on, the purpose and intended nature of the business relationship; and
• conduct ongoing due diligence on the business relationship.

Ongoing due diligence

Ongoing due diligence includes:

• scrutinising transactions throughout the relationship to ensure they are consistent with the person's knowledge of the customer, the customer's business and its risk profile;
• ensuring that documents, data and information collected under customer due diligence are kept current and relevant; and
• putting in place risk-management systems to determine whether a customer or beneficial owner is a politically exposed person, or a family member or close associate of one.

For funds, investor due diligence under these rules runs alongside the US status checks required for Cayman FATCA reporting.

Adopt a risk-based approach

Part III of the Regulations requires a person carrying on relevant financial business to take steps appropriate to the nature and size of the business to identify, assess and understand its money laundering and terrorist financing risks in relation to its customers, the areas where they reside or operate, its products, services and transactions, and its delivery channels.

Of particular relevance to funds, a person carrying on relevant financial business must, in respect of new products and business practices, new delivery mechanisms and new or developing technologies, assess the risk before launch or use, and take appropriate measures to manage and mitigate it.

Other required procedures

Employee screening

Prospective and current employees should be screened to ensure high standards.

Record keeping

Part VIII of the Regulations requires records to be kept in relation to business relationships and customers, and all customer due diligence information and transaction records must be available without delay on request by competent authorities.

Sanctions compliance

A person carrying on relevant financial business must maintain adequate systems to identify risk in relation to persons, countries and activities, including checks against all applicable sanctions lists. It must also adopt risk-management procedures for the conditions under which a customer may use the business relationship before verification is complete.

Non-compliant countries

The business must observe the lists, published by any competent authority, of countries that do not comply, or do not sufficiently comply, with the recommendations of the Financial Action Task Force.

Internal reporting

Regulation 34 requires procedures for the internal reporting of suspicious activity.

Internal controls and independent audit

The business must maintain other procedures of internal control, including an appropriate, effective and risk-based independent audit function, and communication procedures appropriate for the ongoing monitoring of business relationships and one-off transactions, to forestall and prevent money laundering and terrorist financing.

Employee training

Employees must be made aware of these procedures and trained to recognise and deal with transactions carried out by, or on behalf of, any person who is or appears to be engaged in money laundering.

Meeting the obligations from the Cayman Islands

AML officers for a Cayman entity need a working understanding of the Cayman legislation and the Regulations. Many entities therefore appoint officers through a Cayman service provider. Bell Rock Group, licensed by CIMA as a company manager under the Companies Management Act (As Revised), provides AML compliance officer, MLRO and DMLRO roles for Cayman entities through named, qualified individuals. Where Bell Rock individuals hold these roles, Bell Rock does not also provide the entity's independent AML audit.

Frequently asked questions

Does a Cayman investment fund carry on relevant financial business?

Yes. The business of a regulated mutual fund is listed in the POCA definition, and otherwise investing, administering or managing funds or money on behalf of other persons is also within it.

What AML officers must a Cayman entity appoint?

An AML compliance officer under regulation 3(1), and a money laundering reporting officer and deputy under regulation 33(1), each at managerial level.

When must customer due diligence be carried out?

When establishing a business relationship, for one-off transactions above US$15,000 or that are wire transfers, when money laundering or terrorist financing is suspected, and when earlier identification data is in doubt.

Does a single family office have AML obligations in the Cayman Islands?

Yes. Operating a single family office is listed as relevant financial business.

Related reading

• Beneficial ownership contact person for Cayman funds
• Cayman family office structuring and governance
• Cayman economic substance requirements
• AML Officers for Cayman Funds: MLRO, DMLRO and AMLCO Explained
• CIMA's Rule on an Effective Compliance Programme: What Changes for Cayman Entities
• Financial Sanctions Compliance for Cayman Funds and Companies

For AML officer appointments, see Bell Rock's AML and compliance service.