CIMA Regulatory Update: June 2023 to December 2023 (2024-03-31)

Summary

This is CIMA's periodic regulatory update summarizing legislative and regulatory developments between June and December 2023. It is an informational circular rather than a stand-alone rule, but it consolidates and references several substantive changes that already took effect or are scheduled to take effect.

• Legislative amendments: Expanding CIMA's administrative fining powers and liability provisions.
• Regulatory Policy: A revised Regulatory Policy on Consolidated Supervision.
• AML/CFT/CPF Guidance Notes: Updated Guidance Notes on AML/CFT/CPF.
• New Rules and Statements of Guidance: Covering records retention (for company management licensees), Domestic Systemically Important Deposit-Taking Institutions, corporate governance, and internal controls.

The update applies broadly across CIMA-regulated sectors, since several of the referenced rules apply to "all regulated entities" or specific licensee categories.

• Sectors affected: Banks and deposit-taking institutions, insurers, securities investment businesses, money services businesses, virtual asset service providers, company management and directors registration licensees, and collective investment vehicles/funds.

• Other matters reported: Cayman's removal from the FATF grey list, progress toward EU AML delisting, and removal from the UK's high-risk third country list.
• Consumer education: Deposit fee summaries.
• Thematic review: A cybersecurity thematic review.

While the circular itself does not create new obligations beyond referencing already-published instruments, readers should treat it as a pointer to compliance deadlines and effective dates for the underlying Rules, Statements of Guidance, and Guidance Notes it describes, and should consult those source documents directly for full requirements.

Key obligations

• Licensees conducting company management business must maintain records in accordance with the new Rule and Statement of Guidance on Nature, Accessibility, and Retention of Records once it takes effect on 1 April 2024
• Domestic Systemically Important Deposit-Taking Institutions designated by CIMA must comply with the Rule and Regulatory Policy on Domestically Systemically Important Deposit-Taking Institutions once it takes effect on 27 May 2024
• The Governing Body of all CIMA-regulated entities must comply with the Rule and Statement of Guidance on Corporate Governance, subject to proportional application, effective 14 October 2023
• All entities regulated by CIMA must implement internal controls meeting the requirements of the Rule and Statement of Guidance on Internal Controls, subject to proportional application, effective 14 October 2023
• Regulated entities must apply the updated AML/CFT/CPF Guidance Notes published 30 August 2023, which replace the June 2020 version and consolidate prior sector-specific guidance
• Insurers should follow CIMA's stress testing guidance issued via supervisory circular on 28 June 2023 when developing and implementing stress testing frameworks

Applies to

banks, deposit-taking institutions, insurers, securities investment businesses, money services businesses, virtual asset service providers, company management licensees, directors registration and licensing entities, collective investment vehicles/funds, Domestically Systemically Important Deposit-Taking Institutions, all regulated entities

Deadlines

• 1 April 2024: Effective date of the Rule and Statement of Guidance on Nature, Accessibility, and Retention of Records for licensees conducting company management business
• 27 May 2024: Effective date of the Rule and Regulatory Policy on Domestically Systemically Important Deposit-Taking Institutions
• 14 October 2023: Effective date of the Rule and Statement of Guidance on Corporate Governance for Regulated Entities
• 14 October 2023: Effective date of the Rule and Statement of Guidance on Internal Controls for Regulated Entities
• 30 August 2023: Publication/effective date of the revised AML/CFT/CPF Guidance Notes, replacing the June 2020 version
• 26 May 2023: Gazettal date of legislative amendments expanding CIMA's administrative fining and disclosure powers