RE: Updated AML & Sanctions Rules FAQs Now Available

The Cayman Islands Monetary Authority ("the Authority" or "CIMA") has updated its AML & Sanctions Rules FAQs in response to various queries and scenarios raised by industry following the enforcement of the new Rules, which came into effect on 18 September 2026.

The updated FAQs are intended to support industry in applying and implementing the new requirements, and to provide clearer guidance to help entities better understand their obligations and strengthen ongoing compliance.

The revisions are mainly in relation to the Authority's risk-based supervisory approach, and expectations upon the Rule becoming effective, and independent AML audit requirements. They also clarify the purpose of the Rule, audit timing, reliance on service providers, sampling, and outsourced arrangements.

Key amendments include:

• Audit timing remains risk-based - firms are not required to conduct a new AML audit solely because the Rules have come into force; audits should continue to align with the entity's risk profile and established audit programme.
• Clearer guidance on audit expectations - including scope, independence, frequency, reporting, and examples illustrating how audit cycles may vary based on the nature and risk profile of the business.
• Responsibility remains with the regulated entity - even where AML functions are outsourced, accountability for compliance cannot be delegated.
• Audit findings do not invalidate the audit - eficiencies identified during an AML audit do not automatically undermine its validity, findings and remediation are recognised as part of a healthy compliance process.

To view the new Rules and the full FAQs, visit: https://www.cima.ky/aml-cft-faqs