Cayman Tightens the Fund Rulebook, and September 18 Is the Date Managers Cannot Ignore

• Cayman’s new AML and sanctions rules are moving compliance closer to the boardroom, with independent testing, documented risk assessments and direct reporting to the regulator becoming harder to treat as someone else’s job.

The Cayman Islands has introduced a tougher compliance regime for investment funds, with new Anti-Money Laundering and Sanctions Rules coming fully into force on 18 September 2026.

The rules were gazetted by the Cayman Islands Monetary Authority, CIMA, on 20 July and apply to CIMA registered or licensed investment funds, as well as managers, advisers and other CIMA registered or licensed entities.

For investment funds, one of the biggest changes is the treatment of AML audits.

An AML Compliance Officer, or AMLCO, can no longer simply test the programme they helped design and operate. CIMA now expects audits to be performed by suitably qualified people who are independent and separate from those responsible for the policies, systems and controls being reviewed.

The audit is also broader than checking investor identification and screening.

It is expected to examine the fund’s wider compliance programme, including investor onboarding, ongoing due diligence, risk assessments, outsourcing, third party relationships, training, record keeping, internal reporting and the fund’s overall risk-based approach.

There is another important change.

Investment funds will now have to submit their AML audit reports to CIMA after the audit is completed. Previously, funds were not required to file those audit reports with the regulator.

CIMA has not imposed a blanket annual audit requirement. Instead, the frequency must be proportionate to the fund’s size, complexity, structure, business and risk profile, supported by a documented assessment by the fund’s governing body.

Analysis

The significance of the new rules is easy to miss if the discussion is reduced to another AML audit requirement. It is really about independence.

For years, many funds have relied on AMLCOs to conduct testing of their own compliance arrangements, particularly around investor procedures. Under the new framework, that is no longer enough.

The person responsible for running the controls cannot also be the person providing the independent assurance that those controls work.

That sounds obvious.

In practice, it changes the governance conversation.

A fund’s board, general partner or trustee now needs to be able to show that it has thought about the independence of its auditor, considered conflicts and chosen someone suitably qualified to assess compliance with the Cayman AML, counter terrorism financing, proliferation financing and targeted financial sanctions framework.

This is not simply about ticking an audit box.

The rules require the audit to test the effectiveness of the entire Compliance Programme.

That means a fund could have perfectly documented investor onboarding procedures and still have problems elsewhere.

Perhaps its sanctions screening is poorly configured. Perhaps its risk assessment has not been updated. Perhaps outsourced administrators are not being properly overseen. Perhaps training records are incomplete.

Perhaps the fund’s governing body receives compliance reports but does not properly track remediation.

Those weaknesses are now more likely to surface in a formal independent assessment.

The board has more work to do

One of the more important features of the new framework is that responsibility does not move from the governing body to the auditor.

The governing body remains ultimately responsible for ensuring that the fund’s Compliance Programme is adequate and effective.

That matters when an audit identifies weaknesses.

The board cannot simply point to the AMLCO and say the problem belongs to compliance.

The governing body has to understand the finding, agree what needs to be fixed, monitor remediation and make sure the fund can demonstrate that action was taken.

For fund managers operating across several jurisdictions, this also creates a practical question around how Cayman specific requirements are incorporated into wider group compliance programmes.

A group level audit may be useful.

It is not automatically enough.

CIMA expects sufficient evidence relating to the individual investment fund. A service provider level review on its own will not necessarily provide the assurance required under the new rule.

 September 18 is not an audit deadline

There is an important detail here that could easily be misunderstood.

The new rules become effective on 18 September.

That does not mean every fund must have completed and filed its first audit by that date.

Cayman Finance’s practical guide says there is no separate grace period beyond the period leading up to the commencement date, but the rules do not prescribe a deadline for the first audit report. Instead, funds should determine an appropriate audit frequency based on their risk assessment and plan accordingly.

For example, a fund that documents a two-year audit cycle could potentially have its first audit due by 18 September 2028.

But that should not be confused with permission to do nothing now.

Funds are expected to start determining their audit frequency, identifying an independent auditor and assessing their existing compliance programmes.

Sanctions compliance is part of the same conversation

The new Sanctions Rule is also significant.

Investment funds are operating in a world where sanctions lists change quickly and where ownership structures can be deliberately complicated.

A fund may not knowingly deal with a sanctioned person.

The exposure can arise through an investor, beneficial owner, intermediary, investment counterparty or other relationship.

That is why sanctions controls cannot be treated as a one-time screening exercise at onboarding.

They need to remain effective throughout the relationship.

The new Cayman framework places sanctions compliance alongside the broader AML and financial crime control environment, giving governing bodies another reason to examine whether their policies actually work in practice.

Compliance Takeaway

Cayman’s message to investment funds is fairly clear.

Independent assurance has to be genuinely independent.

Funds should identify an appropriately qualified auditor, document why that person or firm is independent, assess conflicts of interest and determine how often the compliance programme should be independently tested.

They should also review whether their existing programme covers more than investor due diligence. It should.

The review should extend to risk assessments, sanctions controls, outsourcing, third parties, training, record keeping, reporting and board oversight. The bigger point is governance.

A fund that discovers a weakness through an independent audit has a problem.

A fund that discovers the same weakness after CIMA asks questions has a much bigger one.