CIMA commences AML desk-based reviews

From mid-October, the Cayman Islands Monetary Authority has begun a programme of anti-money laundering desk-based reviews across all regulated sectors.

Key takeaways

• The initial focus will be on business risk assessments and their underlying methodology

• Entities will have five business days to respond

• Funds should ensure that their business risk assessment and its underlying methodology are current, approved by the governing body and can be provided to the Cayman Islands Monetary Authority's (CIMA)

The desk-based reviews will form part of CIMA's risk-based supervisory framework and will focus on assessing the effectiveness of regulated entities' anti-money laundering (AML) compliance programmes in practice. CIMA has indicated that desk-based reviews will be used for lower-risk entities and, where appropriate, between on-site inspection intervals for higher-risk entities. Although investment funds are not subject to onsite inspections, they are included in the review.

The initiative follows the recent implementation of two new rules:

• Effective Compliance Programme for the Prevention and Detection of Money Laundering, Terrorist Financing and Proliferation Financing

• Compliance with Financial Sanctions and Targeted Financial Sanctions

See our previous client update on the introduction of these rules.

This update focuses on how this may impact regulated investment funds, but the principles apply equally to other regulated entities.

What are AML desk-based reviews?

AML desk-based reviews are supervisory examinations conducted remotely by CIMA. Rather than carrying out an on-site inspection, which is comprehensive and time-consuming, CIMA will issue a notification letter requesting specific documentation from an investment fund for review. CIMA has indicated that the initial focus will be on business risk assessments and their underlying methodology, and that the expected response time is five business days.

Following its review, CIMA may issue findings, require remediation (within specified timeframes) or determine that further supervisory action is appropriate - particularly where there are repeat findings.

Key focus on business risk assessments

The focus on business risk assessments aligns with the broader Cayman Islands AML regime, which requires financial service providers to assess and document their exposure to money laundering, terrorist financing, proliferation financing and sanctions risks, and to use that business risk assessment as the foundation of their risk-based AML framework, informing:

• the development of AML controls

• governance and oversight arrangements

• investor and investment due diligence and monitoring measures

• the scope and frequency of independent AML audits

Ordinarily, the business risk assessment of an investment fund is maintained by its AML Compliance Officer, with oversight and input from the governing body.

What should a business risk assessment cover?

While the content can be quite technical and should be tailored to the investment fund's specific circumstances, a business risk assessment should generally consider:

• investor specific risks

• geographic and jurisdictional risks (in relation to both investors and investments)

• product, service and transaction risks

• delivery channel risks, including technology-enabled and remote onboarding processes

• outsourcing risks

Importantly, investment funds should ensure not only that the assessment exists, but also that the methodology supporting risk ratings and conclusions (including consideration of inherent risk, mitigating factors and residual risk) is documented and capable of being explained to CIMA.

Practical steps for investment funds

Given the short response time expected for desk-based reviews and the focus on business risk assessments, investment funds should first ensure that their assessment remains current and that the underlying methodology and approval by the governing body are readily available.

We advise funds to contact their AML Compliance Officer first to discuss their business risk assessment and underlying methodology.

Investment funds may also consider reviewing the following areas:

• confirming that AML and sanctions compliance policies and procedures have been reviewed and updated to align with the requirements of the rules

• confirming that AML records, including resolutions, service provider agreements, customer due diligence and transaction screening records, can be located and produced quickly to evidence compliance, including where they are held by managers and administrators

• confirming that governance structures, roles, responsibilities and reporting lines are clearly documented

• ensuring that any decisions regarding audit frequency and scope are supported by the investment fund's documented business risk assessment

Looking ahead

The commencement of AML desk-based reviews signals CIMA's clear expectation that Cayman Islands investment funds maintain AML compliance programmes which are appropriately designed, documented and operating effectively in practice.

How Ogier can help

If you have yet to develop your business risk assessment programme, or if you believe it may not satisfy CIMA’s requirements, Ogier can either review, or provide you with the necessary documentation.

Our experts can review your AML documentation, risk assessments and governance arrangements to make sure you are fully prepared for a CIMA desk-based review.

For more information, contact our Cayman Regulatory team.

About Ogier

Ogier is a professional services firm with the knowledge and expertise to handle the most demanding and complex transactions and provide expert, efficient and cost-effective services to all our clients. We regularly win awards for the quality of our client service, our work and our people.

Disclaimer

This client briefing has been prepared for clients and professional associates of Ogier. The information and expressions of opinion which it contains are not intended to be a comprehensive study or to provide legal advice and should not be treated as a substitute for specific advice concerning individual situations.

Regulatory information can be found under Legal Notice