CIMA Requires AML Audits of SIBL Excluded Persons
11 Jul 2018
CIMA has recently contacted certain persons registered as Excluded Persons under SIBL requiring them to obtain and provide an audit report (the "Report") on the entity's AML procedures and compliance with the AML Regulations.
AML Obligations of SIBL Excluded Persons
Anti-money laundering procedures to be maintained under the AML Regulations include processes for the reporting of suspicious activity and the appointment of a money laundering reporting officer and AML compliance officer. Other procedures include client identification and verification (i.e. KYC/due diligence), risk-based assessment, record keeping, internal controls and communication for ongoing monitoring of relationships and screening against sanctions and non-compliant jurisdictions and (to the extent the entity is staffed), employee screening, training and awareness (the "AML Procedures").
A compliant SIBL Excluded Person is expected to have chosen one of two main options in relation to maintaining the AML Procedures. The SIBL Excluded Person may have chosen either to maintain the AML Procedures itself in accordance with the laws of the Cayman Islands, or to delegate the maintenance of the AML Procedures to a suitable party. If the SIBL Excluded Person has elected to maintain the AML Procedures itself, it will need to have adopted and be following a Cayman Islands compliant anti-money laundering manual.
Alternatively, the SIBL Excluded Person may have elected to delegate the maintenance of their AML Procedures to, or rely on the maintenance of such procedures by, another appropriate person, subject to certain conditions being met. Where the delegate is subject to the anti-money laundering regime (i.e. is obliged by law to maintain similar AML Procedures) in a jurisdiction regarded as having equivalent anti-money laundering legislation to the Cayman Islands (an "Approved Jurisdiction"), the delegate can maintain the AML Procedures on behalf of the SIBL Excluded Person in accordance with the delegate's own jurisdiction's anti-money laundering requirements, which will be regarded by CIMA as compliance by the SIBL Excluded Person with the AML Regulations. Identification and due diligence requirements will then be determined by the rules which apply in the delegate's jurisdiction and the money laundering reporting officer and AML compliance officer will likely be the money laundering reporting officer and AML compliance officer of the delegate. The delegation will likely have been formalised by recording the terms in either a service level agreement or a short form stand-alone anti-money laundering delegation agreement.
By way of example, Cayman management entities registered as SIBL Excluded Persons may rely on the maintenance of AML Procedures by the UK FCA authorised investment manager in the structure (to whom management activities are commonly also delegated). The UK FCA authorised investment manager can maintain the AML Procedures in accordance with the anti-money laundering requirements of the UK and such reliance can be documented in the investment management agreement between the parties.
CIMA AML Audit Requirements
Letters recently sent by CIMA to certain SIBL Excluded Person request such entities to obtain and provide CIMA with a Report on the entity's AML Procedures and compliance with the AML Regulations (the "Request"). CIMA has, to date, required that the scope of such a Report must contain findings in relation to determination of whether: (i) the operations of the entity are in compliance with the AML Regulations, the Guidance Notes on the Prevention and Detection of Money Laundering and Terrorist Financing in the Cayman Islands and SIBL; and (ii) the entity and its directors (or equivalent) are carrying on business in a fit and proper manner.
CIMA expects the review to be carried out by an "accredited institution" in the Cayman Islands or an Approved Jurisdiction. We understand that the term "accredited institution" will be interpreted fairly broadly, and could include auditors, law firms and compliance consultants. However, the "auditor" is expected to be independent from the day to day management of the entity. CIMA also expects a site visit to be conducted by the auditor, and a desktop review of policies and procedures will not suffice.
A typical Request requires provision of the Report within 30 days. However, if the 30 day response period cannot be met, CIMA may consider extension requests if there is prompt acknowledgment by the SIBL Excluded Person of the Request and steps are put in place to engage an auditor. The availability and schedule of the auditor will also be relevant in requesting an extension.
Is there action to be taken immediately?
All SIBL Excluded Persons should already have in place AML Procedures along the lines outlined above to ensure compliance with the AML Regulations. To the extent any such SIBL Excluded Person does not already have AML Procedures in place, steps should be taken to address this as soon as possible.
In addition, revisions to the AML Regulations in October 2017 brought about some important changes to the Cayman Islands AML regime. SIBL Excluded Persons with existing AML arrangements in place should review any existing arrangements and update them, as necessary, to ensure they remain compliant with the AML Regulations.
As noted above, the AML Regulations expressly permit reliance or delegation of the maintenance of AML Procedures and certain SIBL Excluded Persons may wish to look to delegate to, or rely on, a staffed and experienced service provider to maintain some or all of their AML Procedures on their behalf. Maples Fund Services and Maples Compliance Services (Cayman) Limited, affiliates of Maples and Calder, may be able to assist in this regard.
For further information, please liaise with your usual Maples and Calder team or any of the contacts above.
Consultant Cayman Islands
T: +1 345 814 5471
Partner Cayman Islands
T: +1 345 814 5525
T: +44 20 7466 1655