Financial services providers have less than two months to prepare for two new regulatory rules issued by the Cayman Islands Monetary Authority, according to Grant Thornton (Cayman).
The professional services firm said the new Rule on an Effective Compliance Programme and Rule on Compliance with Financial Sanctions and Targeted Financial Sanctions, which were gazetted on 20 July, will come into force on 18 September.
In a press release, Grant Thornton said the rules largely consolidate and clarify existing anti-money laundering and sanctions requirements.
But because they are directly enforceable, they provide CIMA with a stronger basis for supervision, inspections and enforcement.
Scott Blench, a director in Grant Thornton (Cayman)’s advisory team, told Cayman Independent that while “most of the content in the AML Rule and Sanctions Rule should be familiar to financial service providers”, there are “some practical considerations that firms need to be aware of ahead of the 18 September 2026 implementation date”.
The firm said one of the most significant practical changes is the expansion of requirements for independent anti-money laundering, countering the financing of terrorism and countering proliferation financing (AML/CFT/CPF) audits.
Under the new AML Rule, financial services providers must be able to demonstrate that auditors are suitably qualified, independent from the controls being reviewed and free from conflicts of interest.
Where audits are carried out internally, firms must also show that internal auditors have received appropriate AML and sanctions training.
The rule also limits organisations to carrying out independent AML audits internally for two consecutive audit cycles, requiring the third audit to be completed by an external service provider.
In addition, firms will be required to submit AML audit reports to CIMA as soon as practicable after completion and address any deficiencies identified within timeframes proportionate to the level of risk.
Grant Thornton noted that while the frequency of AML audits will continue to be determined using a risk-based approach, CIMA will have the authority to require audits to be conducted more frequently.
The firm also highlighted guidance for investment funds, with CIMA confirming that funds carrying out relevant financial business remain subject to AML audit requirements.
Where funds rely on regulated service providers, AML audits may be performed at the service-provider level, provided the financial service provider’s activities are appropriately covered.
Blench urged firms to “conduct a gap analysis of existing AML/CFT/CPF and Sanctions policies, procedures and controls” to identify any gaps before the rules take effect.
He also recommended that financial services providers review “their independent audit function and business risk assessment to ensure compliance with the additional requirements relating to independent AML audits”.
