Rule - Compliance with Financial Sanctions and Targeted Financial Sanctions

Summary

This CIMA Rule sets out mandatory requirements for compliance with Financial Sanctions and Targeted Financial Sanctions (TFS), including UN and UK sanctions extended to the Cayman Islands and local designations under the Terrorism Act and Proliferation Financing (Prohibition) Act. It applies specifically to Regulated Persons (financial service providers) that CIMA regulates and supervises under the Regulatory Acts, supplementing existing AML/CFT/CPF obligations under the Anti-Money Laundering Regulations.

• Compliance programme: Sanctions compliance must be built into the overall AML/CFT/CPF programme, with policies, procedures, systems and controls covering screening, monitoring and reporting.
• Risk assessment: Regulated Persons must factor applicable sanctions into risk assessments of applicants, customers and countries, and must not rate a customer's geographic risk as low where relevant sanctions apply.
• Asset freezing: Frozen funds, economic resources or related services must not be made available, directly or indirectly, to Designated Persons, entities they control, or persons acting on their behalf, absent a Governor's licence or statutory authorisation.
• False positives: Reasonable steps must be taken to verify potential sanctions list matches against other identifying data before treating a match as confirmed.
• Training: Regular staff training must be provided on identifying designated individuals, entities and frozen assets, and on the internal escalation process when matches are found.
• Reporting: Regulated Persons must have policies and controls to comply with the statutory sanctions reporting framework administered by the Financial Reporting Authority (FRA), including use of the Compliance Reporting Form.
• Unfreezing: Where an asset freeze no longer applies, appropriate policies and controls must be in place to follow FRA-guided unfreezing processes.
• Licensing: A Regulated Person seeking to carry out an act otherwise prohibited by sanctions must apply to the Governor, copying the FRA, using the prescribed Asset Freeze and Trust Services Prohibitions Licence Application Form.

The Rule has the force of law and is enforceable under CIMA's Enforcement Manual and the Regulatory Acts, with administrative fines possible for breaches; where AMLR and Rule breaches overlap, CIMA will avoid double jeopardy. It takes effect on 18 September 2026, sixty days after Gazette publication.

Key obligations

• Regulated Persons must maintain policies, procedures, systems and controls for compliance with Financial Sanctions and TFS as part of their AML/CFT/CPF compliance programme.
• Regulated Persons must consider applicable sanctions when conducting risk assessments of applicants, customers and countries, and must not rate geographic risk as low where sanctions apply to the relevant country.
• Regulated Persons must not make frozen funds, economic resources or related services available, directly or indirectly, to Designated Persons or those acting on their behalf, without a Governor's licence or statutory authorisation.
• Regulated Persons must take reasonable steps to verify potential sanctions matches against identifying information to rule out false positives.
• Regulated Persons must provide regular staff training on identifying sanctioned individuals, entities and frozen assets, including internal escalation processes.
• Regulated Persons must implement policies and controls to comply with the FRA's statutory sanctions reporting framework, including use of the Compliance Reporting Form.
• Regulated Persons must implement policies and controls to comply with FRA-guided processes for unfreezing assets once an asset freeze no longer applies.
• A Regulated Person seeking to perform an act otherwise prohibited by sanctions must apply to the Governor, with a copy to the FRA, using the prescribed licence application form.

Applies to

Regulated Persons, Financial Service Providers, insurers regulated under the Insurance Act, banks, funds, virtual asset service providers

Deadlines

• 18 September 2026: Effective date of the Rule, sixty days after publication in the Gazette.