Rule and Statement of Guidance - Nature, Accessibility, and Retention of Records for Licensees Conducting the Business of Company Management

Summary

This is a CIMA Rule and Statement of Guidance (August 2023) that sets minimum requirements and supervisory expectations for how licensees carrying on the business of company management must keep, secure, retain, and make accessible their business records. It applies to holders of licences under the Companies Management Act, Banks and Trust Companies Act, Mutual Funds Act, and Insurance Act who conduct any of the company management activities listed in section 3(1)(a)-(l) of the CMA.

• Company formation
• Registered office/address provision
• Filing statutory forms
• Acting as director, officer, secretary, or nominee shareholder
• Beneficial ownership register services
• Other corporate services

The document covers the nature and categories of records to be kept, including accounting records, corporate records, client due diligence and communication records, service provider contracts, and risk management policies. It requires records to be legible, up-to-date, and accessible to CIMA within a short timeframe, and sets a minimum five-year retention period after each related transaction.

• Third-party or group records: Addresses records held by third parties or group entities.
• Records held outside the Cayman Islands: Sets expectations for records kept outside the Cayman Islands.
• Electronic records: Addresses the keeping of electronic records.
• Cessation of business: Covers what happens to records on cessation of business.
• Non-compliance: Ties non-compliance to CIMA's Enforcement Manual and other statutory powers.

Parts of the document marked with an "R" are binding Rules setting minimum requirements, while the remaining guidance sets out CIMA's expectations without being strictly mandatory, though licensees are expected to have regard to it. The Rules and Guidance do not override existing legislation; where inconsistent, the relevant Act prevails.

Key obligations

• Licensees conducting the business of company management must assess whether group-wide record keeping practices meet the objectives of these Rules and Guidance and, if not, adopt compliant practices themselves; records kept by another group member must remain accessible to the Authority.
• All records must be legible and easily accessible, and personal data must be processed in accordance with the Data Protection Act, with appropriate security measures, retention policies, breach response plans, and processes for data subject rights.
• Records must be provided to the Authority within a reasonably short timeframe, generally without delay or within a timeframe set by the Authority, regardless of where they are stored.
• Licensees must keep, maintain, and administer records required under the CA, LLCA, LLPA, PA, CMA, BTCA, POCA, PTCR, and other relevant legislation, including books of account and records sufficient to enable the Authority to monitor regulatory and AML/CFT/CPF compliance.
• Licensees must maintain records for a minimum of five years after each related transaction date, or longer if required by other Acts/regulations or fiduciary obligations.
• Licensees must maintain adequate procedures to safeguard records (including electronic records) against loss, unauthorised access, alteration, or destruction.
• Records not in English must be professionally translated into English without delay upon CIMA's request, while retaining the original-language version.
• Where a licensee holds records belonging to another company management licensee that is its client, it must ensure those records are maintained in accordance with these Rules and Guidance.
• Licensees should review their record keeping arrangements, including third-party arrangements, at least once per year and adjust as necessary.
• Licensees must have a plan for treatment of records upon merger, transfer, or cessation of business, and must inform the Authority of where and how records can be accessed after cessation, continuing to meet retention requirements for the legally required period.
• A licensee must record information sufficient to give a true and fair view of its affairs and enable transactions to be traced and balances identified.
• Due diligence information and transaction records related to company management business must be available without delay upon CIMA's request.
• When records are held outside the Cayman Islands, the licensee must ensure CIMA has access to them at all reasonable times and within the timeframe stipulated in Rule 5.3; records should not be kept abroad if access would likely be restricted or delayed by foreign law.
• Electronic records must meet the same standards as paper records: accurate, complete, unaltered, easily accessible, and reproducible in hard copy, with safeguards against premature destruction of converted paper records.

Applies to

licensees under the Companies Management Act, licensees under the Banks and Trust Companies Act, licensees under the Mutual Funds Act, licensees under the Insurance Act, licensees conducting the business of company management

Deadlines

• immediately on the date the measure is published in the Gazette: Effective date of the Rules and Guidance for all new licence applicants.
• 1 April 2024: Effective date of the Rules and Guidance for existing licensees.
• minimum of five years after each related transaction date: Minimum records retention period required under section 6.1, unless a longer period is stipulated elsewhere.
• at least once per year: Recommended frequency for licensees to review their record keeping arrangements, including third-party arrangements.