The CIMA Sanctions Rule 2026: key obligations
CIMA's Rule on Compliance with Financial Sanctions and Targeted Financial Sanctions came into force on 18 September 2026 alongside the AML Rule. This guide summarises the obligations CIMA-regulated persons must meet.
Scope
Everyone in the Cayman Islands must comply with financial sanctions and TFS (Rule 6.1). The Rule itself applies to Regulated Persons that CIMA regulates and supervises under the Regulatory Acts (6.3), whether or not they conduct relevant financial business (CIMA FAQ 52). CIMA recognises the Financial Reporting Authority (FRA) as the competent authority for financial sanctions. The Rule reinforces the requirement to follow the FRA's reporting guidance (FAQ 53).
Key definitions
- Without delay: ideally within a matter of hours of a designation by the UN Security Council or its relevant Sanctions Committee (2.1.23).
- Asset freeze: frozen funds are not confiscated or transferred to the FRA. Ownership does not change, but dealing with them or making them available is prohibited (3.4–3.5).
The core obligations (section 7)
Programme and risk assessment
Sanctions compliance must be an integral part of the AML/CFT/CPF programme, with its own policies, procedures, systems and controls (7.1). Risk assessments must consider sanctions (7.2). A customer's geographic risk cannot be rated "low" if the country is subject to relevant UK, UN or US (including OFAC) sanctions (7.3).
Screening and re-screening
Screen applicants, customers, beneficial owners, transactions, service providers and connected persons (7.4). Simplified due diligence does not reduce screening: all customers must be re-screened when a sanctions list is updated, whatever their risk rating (7.5), and this must happen without delay (7.11). Monitor sanctions regularly, including local designations by the Governor, and review customers and third-party providers against the lists of designated persons and the UK Sanctions List (7.13.1–7.13.2).
Matches, freezing and reporting
Verify potential matches against other identifiers to rule out false positives (7.19), and document every action and its rationale (7.9). Where there is a true match, freeze without delay and without prior notice (7.17), make nothing available to designated persons (7.18), and report to the FRA via the Compliance Reporting Form (CRF) without delay. The report should include details of frozen funds and attempted transactions (7.7, 7.13.3–7.13.4).
Monitoring, unfreezing and licensing
Maintain controls for designations and delistings (7.15), ongoing transaction monitoring and records (7.16), and unfreezing processes as guided by the FRA (7.22). Licences to permit otherwise prohibited acts are applied for to the Governor, with a copy to the FRA (7.23).
Training
Provide regular staff training on identifying designated persons and frozen assets, and on the steps to take when they are identified (7.20).
Enforcement
The Rule has the force of law (8.2). Where a breach of the AMLRs and a corresponding breach of the Rule arise from the same facts, CIMA says it will use its discretion so as to avoid duplicating administrative fines for the same breach (8.3).
How we can help
Our sanctions compliance audit tests each of these controls, including outsourced screening. Our gap analysis maps your sanctions policy to the Rule clause by clause.
Ready to scope your independent AML audit?
Tell us about your entity. We will come back with a proposed scope, timetable and quote. No obligation.