Investment funds registered or licensed with the Cayman Islands Monetary Authority (CIMA) have less than a month to prepare for a fundamental shift in how their anti-money laundering (AML) compliance programmes must be audited, as new rules gazetted in July come into force on 18 September.
CIMA’s new AML Rule and accompanying Sanctions Rule apply to all CIMA-registered or licensed investment funds, as well as managers, advisers, and any other regulated entities. The rules introduce one central and consequential change: a fund’s entire compliance programme must now be subject to independent audit by suitably qualified persons who are entirely separate from those who designed, implemented, or operate the controls being assessed.
The shift marks a clear departure from established practice. Many funds had previously satisfied the audit requirement under the Anti-Money Laundering Regulations by having their Anti-Money Laundering Compliance Officer conduct testing of investor procedures. That approach will no longer be acceptable. CIMA has confirmed that AML officers are not sufficiently independent to carry out audits under the new rule, and the regulator requires the audit function to be free from any conflict of interest that could impair objective judgement.
“The AML Rule requires that the audit be carried out by suitably qualified persons who are independent and separate from those involved in the design, implementation, or operation of the policies, procedures, systems, and controls under audit,” said Cayman Islands partner Lucy Frew in a recently published Walkers practical advisory. She added that the auditor must also be free from any conflict of interest that could impair objective judgement.
The scope of what the audit must cover is broad. It must constitute a documented review and testing of the fund’s entire compliance programme, encompassing investor onboarding controls, ongoing due diligence, third-party relationships, outsourcing arrangements, internal reporting, training programmes, record keeping, risk assessments, and the application of a risk-based approach. Auditing investor due diligence and screening procedures in isolation will not satisfy the requirement.
CIMA has confirmed the audit does not need to be conducted by a financial auditor. The regulator uses the term in the sense of an assessment or appraisal, meaning the function can be performed by appropriately qualified compliance professionals rather than accountancy firms, provided they have specific knowledge of the Cayman AML, counter-financing of terrorism, counter-proliferation financing, and targeted financial sanctions framework.
There is no prescribed audit frequency. Funds must determine their audit cycle based on size, complexity, structure, nature of business, and risk profile, as established through a documented risk assessment conducted by the governing body. A lower-risk fund may be able to justify a cycle of every two, three, or even four years, provided that assessment is properly documented, approved, and current.
A further change concerns reporting. Audit reports must now be submitted to CIMA as soon as practicable after completion, a requirement that did not previously exist. CIMA has indicated no filing fee will apply and that a complex submission process is not anticipated.
Where a fund’s manager or administrator operates an internal audit team that is genuinely independent, separate, and suitably qualified with respect to the Cayman framework, that team may conduct the first and second audits. Because managers and administrators are deemed internal to the fund for the purposes of the AML Rule, every third audit must be conducted by an external party.
