Cayman Islands anti-money laundering and sanctions compliance requirements

Cayman Islands AML and sanctions rules now in effect

The Cayman Islands Monetary Authority (CIMA) introduced new rules that raise expectations for anti-money laundering (AML), counter-terrorist financing (CFT), counter-proliferation financing (CPF) and sanctions compliance programs.

Both rules took effect on 18 September 2026 and now apply to financial services providers:

• Rule on Effective Compliance Programme for the Prevention and Detection of Money Laundering, Terrorist Financing and Proliferation Financing for Financial Services Providers
• Rule on Compliance with Financial Sanctions and Targeted Financial Sanctions

These rules move beyond having policies and procedures in place. Financial services providers are now expected to demonstrate that their compliance programs are effective, appropriately governed and operating on an ongoing basis. Requirements include enhanced governance and oversight, a documented risk-based approach, expanded sanctions compliance obligations, and independent testing of AML programs.

What has changed under the new CIMA regulations?

Key areas of focus include:

Stronger governance and accountability

Financial services providers must establish clear governance arrangements, define responsibilities for AML compliance and confirm appropriate oversight by senior management and governing bodies. Anti-money laundering compliance officers (AMLCOs), money laundering reporting officers (MLROs) and deputy MLROs (DMLROs) are expected to have sufficient authority, independence, expertise and access to senior decision-makers.

Enhanced risk-based approach requirements

Organizations must maintain documented AML/CFT/CPF risk assessments that consider customer, geographic, product, transaction and delivery channel risks. Risk assessments must be kept current and updated when material changes occur.

Expanded sanctions compliance obligations

The new sanctions rule requires financial services providers to maintain robust sanctions programs, including screening customers, beneficial owners, service providers and relevant transactions; monitoring sanctions list updates; maintaining appropriate controls; and meeting freezing and reporting obligations where applicable.

Independent assessment requirements

A significant change is the requirement for independent testing of the effectiveness of AML/CFT/CPF compliance programs. Organizations must establish and maintain independent audit procedures to review and test the adequacy, effectiveness and compliance of their AML/CFT/CPF program against applicable legislative and regulatory requirements. Such reviews must be performed by suitably qualified and independent persons at a frequency commensurate with the organization’s size, complexity and risk profile. Internal reviews may be conducted for up to two consecutive audit cycles; thereafter, the next review must be performed by an external independent service provider. Audit findings should be supported by timely remediation of identified deficiencies and weaknesses. 

What does this mean for financial services providers regulated by CIMA?

Regulators expect firms to demonstrate that compliance programs are operating effectively in practice, not simply that policies exist. Organizations should consider whether they can clearly evidence:

• Governance responsibilities and accountability
• Current and comprehensive risk assessments
• Effective sanctions screening and monitoring controls
• Ongoing staff training and competency
• Independent testing and remediation of identified issues
• Documented evidence supporting compliance activities

Failure to demonstrate program effectiveness may increase regulatory scrutiny and expose organizations to enforcement action where deficiencies are identified. 

How can EY teams support CIMA compliance?

Our financial services risk and compliance professionals on the ground in the Cayman Islands—and in The Bahamas, Bermuda, and British Virgin Islands—support organizations in responding to evolving AML, sanctions and regulatory requirements.

Our services include:

Why EY for AML and sanctions compliance?

• We conduct regulatory inspection and independent review work across the financial services sector and understand the areas regulators commonly focus on during examinations. 
• We have one of the largest Certified Anti-Money laundering Specialists (CAMS) certified teams in the region with deep financial services experience. 
• Our professionals have AMLCO, MLRO and compliance practitioner experience and provide direct input to local regulators on AML laws and regulations. 
• We support a broad range of financial institutions and bring insight into emerging industry practices and common regulatory themes. 

With the rules now in effect, organizations should assess whether their compliance programs are appropriately governed, documented, independently tested and capable of demonstrating ongoing effectiveness under the new regulatory framework.