Rule and Statement of Guidance – Nature, Accessibility, and Retention of Records for Licensees Conducting the Business of Company Management

Summary

This is a Rule and Statement of Guidance issued by the Cayman Islands Monetary Authority (CIMA) in August 2023, setting minimum requirements and expectations for how licensees conducting the business of company management must create, store, secure, and retain records. It applies to holders of licences under the Companies Management Act, Banks and Trust Companies Act, Mutual Funds Act, and Insurance Act who carry out company management activities (e.g. company formation agents, registered office providers, nominee directors/shareholders, corporate secretaries, beneficial ownership register administrators, and similar corporate service providers).

• General principles: Records must be legible, accessible, kept up to date, and provided to CIMA without delay or within a timeframe CIMA specifies.
• Record categories: Licensees must maintain accounting records, organisational records, client due diligence and communication records, service provider contracts, trust deeds, annual returns, etc.
• Records management programme: A formal programme is required covering categorisation, retention periods and disposal.
• Retention period: A minimum five-year retention period applies from each transaction date (or longer if other law requires).
• Other coverage: The document also addresses accounting records, records held outside the Cayman Islands, records held by third parties or group entities, and electronic records, requiring that electronic records meet the same standards as paper records and remain accessible to CIMA.

The Rules and Guidance take effect immediately (on Gazette publication) for new licence applicants, and on 1 April 2024 for existing licensees. Breach of the Rule portions is subject to CIMA's enforcement powers under its Enforcement Manual and the relevant regulatory Acts.

Key obligations

• Maintain all records in a legible, easily accessible form and keep them up to date without unjustifiable delay.
• Process personal data in accordance with the Data Protection Act, including appropriate security measures, retention policies, and data breach response plans.
• Provide records to CIMA within a reasonably short timeframe, or immediately/without delay where CIMA so expects, regardless of where records are stored.
• Keep, maintain and administer records as required by the CMA, BTCA, CA, LLCA, LLPA, PA, POCA, PTCR and other relevant legislation, including books of account, corporate records, client due diligence records, service provider contracts, trust deeds, and annual returns.
• Maintain record keeping sufficient to enable CIMA to monitor compliance with regulatory and AML/CFT/CPF obligations.
• Establish and maintain a records management programme addressing categorisation, retention periods, and disposal of records, including a comprehensive retention policy.
• Retain records for a minimum of five years after each related transaction date, or longer if required by other applicable law.
• Maintain adequate procedures to safeguard records against loss, unauthorised access, alteration or destruction, including electronic records.
• Retain records in English or provide professional translation without delay upon CIMA's request, while keeping the original-language version.
• Ensure due diligence information and transaction records are available to CIMA without delay upon request.
• Review record keeping arrangements, including third-party arrangements, at least once per year and adjust as necessary.
• Maintain ultimate responsibility for records retention and accessibility even when records are held by a third party or another group entity.
• Have a plan for the treatment of records upon merger, transfer, or cessation of business, and inform CIMA of how and where records can be accessed after cessation.
• Ensure CIMA has access to records held outside the Cayman Islands at all reasonable times, and avoid keeping records abroad where access could be restricted or delayed by foreign law.
• Apply the same record-keeping standards to electronic records as to paper records, ensuring they are accurate, complete, accessible, and reproducible in hard copy.

Applies to

Licensees under the Companies Management Act conducting the business of company management, Licensees under the Banks and Trust Companies Act conducting the business of company management, Licensees under the Mutual Funds Act conducting the business of company management, Licensees under the Insurance Act conducting the business of company management

Deadlines

• immediately on the date the measure is published in the Gazette: Effective date of the Rules and Guidance for all new licence applicants.
• 1 April 2024: Effective date of the Rules and Guidance for existing licensees.