Shadow KYC · Oversight for Cayman fund boards
Your administrator runs the KYC on your investors. We test those files against your fund's AML policy and give your board its own evidence of oversight under CIMA's AML Rule.
The idea
Your administrator calculates the NAV. Your team reproduces it, investigates the breaks and shows the board and the auditor that someone supervised the delegate. You run that check because the accountability stayed with you.
AML has the same structure. Your administrator performs the KYC, and your board signs off on a service report the administrator wrote about its own work. Shadow KYC gives your board a second, independent view of the files.
| Shadow NAV | Shadow KYC | |
|---|---|---|
| Delegated to the administrator | NAV calculation | Investor onboarding and CDD |
| The independent check covers | Positions, pricing, cash and fees | Verification, ownership, screening and risk rating |
| The board receives | Breaks, tolerances and a resolution trail | Exceptions by category and age, each traced to a file |
Why now
The Rule binds CIMA-registered mutual funds and private funds. Your fund may rely on its administrator, and it keeps ultimate responsibility for the work (s.5.3).
s.10.4
On request, your fund gives CIMA “timely and sufficient evidence” that the functions it relies on comply.
AML Rule
s.10.7
Funds now carry binding outsourcing duties, from due diligence on each provider to an agreement that sets out both sides' obligations.
AML Rule
FAQ 25
CIMA expects ongoing monitoring of your providers and periodic testing of the work you outsource.
CIMA FAQs
FAQ 43
An audit that leans on a service-provider-level review, without evidence on your fund, “would not provide sufficient assurance”.
CIMA FAQs
The gap
The execution layer. The administrator collects documents, screens investors and rates their risk.
Produced byYour administrator, as delegate
SOC report and group audit. The auditors conclude on the administrator's controls across all its clients, with no finding specific to your fund.
Produced byYour administrator
Fund-level evidence that you tested the work. A delegate reporting on itself cannot supply this layer.
Produced byYour board, through shadow KYC
CIMA's Guidance Notes say a provider “shall not contract or transfer” its compliance obligations. Your administrator cannot produce layer three for you, because a report on its own work gives your board no independent view.
How it works
We test the full population of investor files against the standard your board adopted, and we report in days.
Your policy, risk appetite, jurisdiction rules and thresholds. We test against the standard your board adopted, with no generic checklist in between.
The records belong to the fund, and CIMA expects you to have timely access to them. We accept redacted copies wherever we can identify an exception without personal data.
Hundreds or thousands of files, each tested against your policy. If you prefer a sample, we fix the selection rule before requesting files: all PEP and high-risk investors, all onboarded in the last twelve months, and a random draw from the rest.
Each exception carries its file reference, so you can trace it to source and put it to the administrator.
Findings, severity, the Rule provision each one touches, and a remediation plan with owners and dates, written for the minutes.
We re-test at the frequency your risk assessment sets, so your oversight runs as a standing control.
Scope
Each test runs against your policy. Where your policy is silent, we flag the gap and leave the standard to your board.
Completeness against your policy, document validity, and certification where your policy requires it.
Traced to your threshold, with evidence for each link in the ownership chain.
Present where your risk rating calls for it, and backed by documents.
Proof of screening against the right lists, a recorded disposition for each hit, and re-screening after sanctions list updates.
Applied to each investor, with a rationale a reviewer can follow.
Due dates set and met, with overdue reviews aged.
Evidence that a second person reviewed the file before approval.
Complete, retrievable and held for at least five years after the relationship ends (s.10.6.1).
Output
412 investor files · 412 tested
| Category | Exceptions | Rate | Oldest |
|---|---|---|---|
| Identity and verification | 6 | 1.5% | 212 days |
| Beneficial ownership | 11 | 2.7% | 340 days |
| Source of funds and wealth | 9 | 2.2% | 188 days |
| Screening | 3 | 0.7% | 41 days |
| Risk rating | 14 | 3.4% | 263 days |
| Periodic refresh | 23 | 5.6% | 402 days |
Illustrative figures. Each exception opens to its file reference.
Questions
Our full guide to the Rule covers scope, outsourcing, notification and the AML audit.
Read the CIMA AML Rule guideShadow KYC is an independent, parallel review of the investor KYC files your fund administrator maintains. We test the files against your fund’s own AML policy and give the board exceptions it can act on. The name comes from shadow NAV, where a manager reproduces the administrator’s NAV to supervise it.
The Rule does not use the term. It requires your fund to remain satisfied that the functions it relies on comply, and to give CIMA evidence of that on request (s.5.3, s.10.4). CIMA’s FAQ 25 expects ongoing monitoring and periodic testing of outsourced activities. Shadow KYC produces that evidence at fund level.
No. Section 12 of the Rule requires an independent audit of your whole compliance programme. Shadow KYC is the board’s ongoing monitoring of the administrator’s file work. CIMA’s FAQ 43 says an audit that relies on a service-provider-level review, without evidence on the individual fund, would not provide sufficient assurance. Your auditor can test against the shadow KYC record.
Yes. The records belong to the fund, and CIMA’s FAQ 25 expects timely access to relevant information and records. The request comes from your board under the fund’s own engagement. We work alongside the administrator and never around it.
Days. Our agents test the files at machine speed, and qualified reviewers check each exception. The timeline depends on how fast the administrator releases the files and how many exceptions need human review.
Yes, in two ways. You can run your own KYC case review on our platform, and you can offer your clients shadow KYC results as evidence of their oversight of you. Boards will ask their administrators for that evidence this year.
The Rule binds the Cayman fund and any manager registered with CIMA. A manager licensed by the SFC or MAS alone sits outside its direct scope, but the fund it manages sits inside, and that fund’s board carries the oversight duty. This is our reading, not legal advice.
Next step
Send us your AML policy and the size of your investor population. We reply with scope, timeline and a fixed price within one business day.
Or send the case list to [email protected]
Shadow KYC is a service of AgentKYZ, operated by Cortexa Research Lab Limited.
References to the AML Rule and the Sanctions Rule are to the CIMA rules in force from 18 September 2026. Section numbers point to the AML Rule and FAQ numbers to CIMA’s AML/CFT FAQs. This page is general information and not legal advice.