AML/CFT Remediation

Key aspects to implementing and maintaining effective remediation of AML/CFT requirements

This supervisory circular describes how the Cayman Islands Monetary Authority (“CIMA” or the “Authority”) monitors AML/CFT remediation by financial service providers (“FSPs”) and sets out the key elements of a successful remediation plan. FSPs may use this publication to strengthen their respective compliance programmes and to ensure that any remediation plans they deploy are effective, adequate and meet regulatory requirements.

Background

AML/CFT onsite examinations are fundamental to the effective execution of the regulatory and supervisory mandate of CIMA. Inspections provide the Authority with an opportunity to evaluate compliance with the AML/CFT regulatory framework, and to validate the corrective measures implemented to address identified deficiencies. Where the Authority notes deficiencies through onsite inspections, it will issue an inspection report that provides information on the deficiencies identified during the inspection and includes specific actions to remediate the identified issues within specified timeframes set by the Authority (“Requirements”).

A range of supervisory tools are available to CIMA to ensure effective and timely remediation of Requirements. The chosen action will depend on the risks, nature of the deficiencies and the materiality of the potential breach, as well as the conduct of the regulated entity and/or where there are significant delays in the completion of Requirements. The Authority may, for example:

1. Require remediation action plans with timelines and reporting schedules;
2. Request supervisory meetings with the management to discuss the progress of remediation;
3. Request independent AML audits;
4. Issue Supervisory Letters, noting CIMA’s concerns and expectations to remediate;
5. Appoint a Special Advisor; and/or
6. Place the regulated entity under enhanced monitoring on the High-Risk Entities list and/or refer the matter for enforcement action where appropriate and proportionate.

FSPs increasingly recognise the level of importance of remediation and are dedicating further resources to manage their efforts. From January 2019 to June 2023, CIMA completed risk-based inspections for 603 FSPs to evaluate their AML/CFT policies, procedures, systems, and controls, and issued 5,262 Requirements, 93% of which have been met or are being completed within prescribed timeframes.

The Authority further notes a 20% decrease in the number of late Requirements between June 2022 and June 2023, and a 50% increase in the number of meetings requested by regulated entities to update the Authority on remediation progress over the same period.

The Authority’s approach to the ongoing monitoring of AML/CFT Requirements

Where AML/CFT Requirements have been issued, the Authority requests FSPs to report monthly or quarterly on their remediation progress. The frequency is related to the nature of the Requirements and the gravity of the deficiency. Clear and prompt reporting is very helpful to the Authority in tracking the progress being made by FSPs.

The Authority provides a template for FSPs to complete (the “Work Plan”) which forms the basis of communication between the FSP and the Authority on the progress of the remediation. The Work Plan includes the Requirements as set out in the Inspection Report and the FSP is expected to update the Authority on its progress including details of any outstanding issues. The Work Plan therefore functions as a means of tracking the progress of each requirement.

FSPs are required to provide detailed responses to the matters outlined in the Work Plan, along with Board approved supporting documents where required. FSPs are also expected to ensure that the documents or information submitted is clearly linked to the related Requirement. FSPs will be guided on how, and in what format, to submit the information to the Authority.

The Table below sets out some examples of more effective and less effective approaches to reporting on AML/CFT Requirements through the Work Plan:

FSPs may submit a request for an extension in writing where the set remediation timeframe cannot be met. Remediation extension requests will be considered at the discretion of the Authority, where appropriate and proportionate, based on the facts presented, and on a case-by-case basis.

Matters may be escalated to enforcement having regard to the principles set out in section 6.4 of CIMA’s revised Enforcement Manual. These include inter alia: the ability and extent to which remedial action will rectify the contravention; the willingness and ability of the FSP to cooperate with and assist the Authority with its investigations and in implementing Requirements; and the compliance history of the FSP.

Where extensions are granted, the FSP may be required to provide a revised remediation action plan to demonstrate how it intends to complete remediation within the extended timeframe. The Authority may also require the FSP to provide more frequent updates to the Work Plan.

The Authority will formally notify FSPs once it has no further comments and is satisfied that no additional remediation documents are required to address the Requirements from the Inspection Report. The Authority may also conduct a follow up inspection to test and validate the remedial actions taken to address Requirements.