Guide

The Cayman Islands virtual asset service providers regime

Introduction

The Virtual Asset (Service Providers) Act (as amended, the VASP Act) provides the framework for the conduct of virtual asset services in the Cayman Islands and for the registration and licensing of entities who provide virtual asset services. The virtual asset service providers regime, which includes subsidiary and related regulatory and financial services legislation (together, the VASP Regime), is being implemented in phases.

The core phase one provisions of the VASP Act requiring registration came into effect on 31 October 2020. Related enforcement provisions and offences came into effect on 31 January 2021. Phase two, which requires entities which provide virtual asset custody services or operate a virtual asset trading platform to apply for a licence, came into force on 1 April 2025. A further phase three, as summarised below, is expected to come into force in due course.

This guide sets out the current scope, key requirements and obligations of the VASP Regime, together with the practical steps that a virtual asset service provider (a VASP) should take.

Which entities are in-scope of the VASP Regime?

An entity registered in the Cayman Islands which carries on, or purports to carry on, virtual asset services in or from within the Cayman Islands is in-scope of the VASP Regime and is required to be registered with or licensed by the Cayman Islands Monetary Authority (CIMA). Natural persons are prohibited from providing or holding themselves out as providing virtual asset services.

What if an entity's activities fall under the scope of another regulatory law?

There is some overlap between the VASP Act and other Cayman Islands regulatory laws, such as the Securities Investment Business Act (as amended). As such, to avoid being 'double regulated' for the same business activity, an entity may be entitled to a waiver from registration or licence where certain requirements are met.

What are the key requirements?

In general terms, the key requirements under the VASP Regime are as follows:

• an entity carrying on virtual asset services must be either registered or licensed under the VASP Act, or if it is an existing licensee under another regulatory law in the Cayman Islands, be granted a waiver by CIMA (each, an existing licensee); and
• an entity providing virtual asset custody services or operating a virtual asset trading platform must apply for a licence under the VASP Act.

What are the key definitions?

A virtual asset means a digital representation of value that can be digitally traded or transferred and can be used for payment or investment purposes but does not include a digital representation of fiat currencies.

A virtual asset service means:

• the issuance of virtual assets; or
• the business of providing one or more of the following services or operations for or on behalf of a natural or legal person or legal arrangement:
  • exchange between virtual assets and fiat currencies;
  • exchange between one or more other forms of convertible virtual assets;
  • transfer of virtual assets;
  • virtual asset custody service; or
  • participation in, and provision of, financial services related to a virtual asset issuance or the sale of a virtual asset.

Virtual asset custody service means the business of safekeeping or administration of virtual assets or the instruments that enable the holder to exercise control over virtual assets.

A virtual asset trading platform means a digital platform:

• which provides a virtual asset service and facilitates the exchange of virtual assets for fiat currency or other virtual assets on behalf of third parties for a fee, commission, spread or other benefit; and
• which:
  • holds custody of or controls virtual assets on behalf of its clients to facilitate an exchange; or
  • purchases virtual assets from a seller when transactions or bids and offers are matched in order to sell them to a buyer,

and includes its owner or operator but does not include a platform that only provides a forum where sellers and buyers may post bids and offers and a forum where the parties trade in a separate platform or in a peer-to-peer manner.

Exemption for virtual service tokens

A virtual service token is a digital representation of value which is not transferrable or exchangeable with a third party at any time and includes digital tokens whose sole function is to provide access to an application or service or to provide a service or function directly to its owner. Virtual service tokens are excluded from the definition of 'virtual assets' and accordingly, an entity which provides services that involve virtual service tokens only is not required to be registered or licensed under the VASP Act.

How does an entity apply for a registration or licence?

Registration

An entity carrying on a virtual asset service for which a licence is not required, may apply to be a registered person under the VASP Act.  The entity needs to make an application (or, in the case of existing licensees, provide notification) through CIMA's online REEFS portal, in accordance with the form in the Schedule 1 of the Virtual Asset (Service Providers) Regulations (as amended, the VASP Regulations).  The form requires, amongst other things, details of:

• the virtual asset service to be provided, such as the nature, function and purpose of the virtual asset service, prior revenue or projected revenue, manner in which the service will be provided to the public, and identified risks and steps to mitigate such risks;
• the procedures in place for anti-money laundering/countering financing of terrorism/countering proliferation financing (AML/CFT/CPF); and
• virtual asset services provided in another jurisdiction (if any).

All applications for registration must be accompanied by a US$1,220 application fee. There is also a fee payable on approval of an application for registration and an annual renewal fee, each of which is determined in accordance with the VASP Regulations by reference to the nature of the virtual asset service and its actual or projected revenue. 

Licence

Virtual asset service licences are required by persons providing virtual asset custody services (such as wallet services) or operating a virtual asset trading platform. An application for a licence requires, amongst other things, details of:

• current business activities, if any, and proposed business activities;
• annual accounts, for the two years immediately preceding the year of application of each shareholder which is a body corporate holding more than ten per cent of the applicant’s issued share capital or total voting rights, together with similar accounts for the parent body (if applicable);
• an organisational chart of the company ownership structure together with the names and addresses of the registered offices of any subsidiary companies;
• information on, and evidence of, the applicant’s fully paid-up capital; and
• the name and address of the CIMA-approved auditor appointed.

The form also contains specific sections to be completed for a virtual asset custodian and virtual asset trading platform, as applicable.

Applications for a licence must be accompanied by a US$6,098 application fee. There is also a fee payable on the grant of a licence and an annual renewal fee¹,  each of which is determined in accordance with the VASP Regulations by reference to the nature of the virtual asset service and its actual or projected revenue.

Existing VASP registrants providing virtual asset custody and trading platform services prior to 1 April 2025 have 90 days from that date (ie, by 30 June 2025) to submit their application for a licence. Once a VASP registrant is licensed, their previous registration will be cancelled. New applicants will apply via the online REEFS platform.

CIMA will maintain a register of virtual asset service licensees, listing the business address and details of the activities that the licensee is permitted to carry on.

What are the approval requirements?

CIMA's Regulatory Policy on Registration or Licensing of Virtual Asset Service Providers (May 2024)² sets out the assessment criteria for CIMA to approve a VASP registration or licence application which include, amongst other things, the following:

• the applicant must be controlled and managed by a sufficient number of shareholders and senior officers who are fit and proper persons;
• a draft corporate governance framework for providing sound and prudent management and oversight;
• a sufficiently detailed business plan which aligns with the size, complexity, structure, nature of business and risk profile of the applicant; and
• a risk assessment and management framework which will identify, assess, mitigate and monitor all internal and external sources of risk that could have a material impact on the business and operations.

Are there any other obligations?

VASPs are required to:

• appoint at least three directors (one of whom must be independent);
• prepare annual accounts (which must be available to CIMA on request);
• comply with the requirements of the Cayman Islands AML/CFT/CPF regime[1] and targeted financial sanctions obligations, including the appointment of an anti-money laundering compliance officer, a money laundering reporting officer, and a deputy money laundering reporting officer;
• ensure the accuracy of disclosures, advertising materials and communications relating to virtual asset services;
• ensure that senior officers, trustees and beneficial owners are fit and proper persons; and
• secure the personal data and virtual assets of clients.

A Statement of Principles on the Conduct of Virtual Assets Services⁴ was published by CIMA in February 2021, setting out principles by which all VASPs should conduct their business and acting as the measure against which CIMA will assess compliance for AML/CFT/CPF and prudential purposes.

An entity registered under the VASP Act may be required to file audited financial statements with CIMA, depending on the complexity and the size of the virtual asset services they provide.

Ongoing obligations include a requirement to obtain the prior approval of CIMA for each of the following:

• the appointment of a senior officer or trustee of a virtual asset service provider;
• the issue of shares (or partnership interests) in the virtual asset service provider totalling ten per cent or more of the shares or interests in that entity; or
• the transfer or disposal of any issued shares or interests in a virtual asset service provider.

Additional registration and ongoing obligations applicable to the provision of virtual asset custody services and the operation of a virtual asset trading platform are set out in CIMA's Rule on Obligations for the provision of virtual asset services – Virtual Asset Custodians and Virtual Asset Trading Platforms (December 2024) and CIMA's related Statement of Guidance⁵ (December 2024). CIMA has also issued a VASP Licensing and Waiver Checklist which sets out the information and documents required for an application for a licence under the VASP Act.⁶

What are the enforcement provisions?

The VASP Act contains enforcement provisions, including those which empower CIMA to:

• revoke a licence or waiver;
• cancel a registration;
• impose conditions on a licence, registration or waiver;
• apply to the Court for an order to protect the interest of clients or creditors and require the substitution of any senior officer or trustee,

where it is aware, or has reasonable grounds to believe that a virtual asset service provider:

• • is, or appears likely to become, unable to meet its obligations as they fall due;
  • is carrying on business fraudulently or otherwise in a manner detrimental to the public interest, to the interest of its clients or to the interest of its creditors;
  • has contravened any provision of the VASP Act or the Anti-Money Laundering Regulations (as amended);
  • has failed to comply with a condition of the licence or registration;
  • has senior officers or trustees in control who are not fit and proper persons; or
  • has failed to comply with a lawful direction from CIMA.

It is an offence:

• to carry on or purport to carry on virtual asset services for which a registration or a waiver is required without obtaining the appropriate registration or waiver (leading, on summary conviction, to a fine of US$30,488 and imprisonment for one year, together with a daily default fine after conviction of US$12,195);
• to carry on or purport to carry on virtual asset custody services or operate a virtual asset trading platform without the requisite licence (leading, on summary conviction, to a fine of US$121,951 and imprisonment for one year, together with a daily default fine after conviction of US$12,195);
• for a person supervised by CIMA under another regulatory law to carry on virtual asset services without making an application under the VASP Act for a registration, licence or waiver (leading, upon summary conviction, to a fine of US$60,976); and
• to recklessly provide false or misleading material information to CIMA (leading, on summary conviction, to a fine of US$12,195 and imprisonment for six months).

The VASP Act also contains vicarious liability provisions relating to offences committed by corporate entities with the knowledge, or attributable to the neglect, of a senior officer, where that senior officer may become equally liable for the commission of the applicable offence. Further, a person who contravenes any provision of the VASP Act for which a penalty is not specifically provided commits an offence and is liable on conviction to a fine of US$4,878.

In addition to the above, CIMA has power under the Monetary Authority (Administrative Fines) Regulations (as amended) to issue administrative fines with respect to various breaches of the VASP Act, ranging in quantum from US$6,098 up to US$121,951 for individuals and US$1,219,515 for corporate bodies, depending on the seriousness of the breach. Please refer to our guide on The Cayman Islands administrative fines regime for further information.

Phase three of the VASP Regime

Phase three of the VASP Regime is expected to bring into force provisions in the VASP Act which relate to the issuance of newly created virtual assets directly to the public and a sandbox licensing regime. Under the sandbox licencing regime, CIMA may require an applicant to apply for a sandbox licence, subject to expanded regulatory oversight, instead of a standard registration or licence. An applicant may be redirected to the sandbox regime where, in summary, the service is novel or technologically innovative, if temporary extra safeguards are needed in the public or market interest, if the activity could create systemic risk, or if its money laundering and terrorism financing risks are not fully addressed under current rules.

Contacts

A full list of contacts specialising in the VASP Regime in the Cayman Islands can be found here.

¹ 'Local companies' as defined under section 2 of the Local Companies (Control) Act (as amended) are eligible for a 90% discount on the grant and renewal fees for a licence. These companies exclude exempted companies.

² CIMA's Regulatory Policy on Registration or Licensing of Virtual Asset Service Providers (May 2024) is available here.

³ Pursuant to the Anti-Money Laundering Regulations (as amended) as supplemented by the Guidance Notes on the Prevention and Detection of Money Laundering, Terrorist Financing and Proliferation Financing in the Cayman Islands.

⁴ CIMA's Rule on Obligations for the provision of virtual asset services – Virtual Asset Custodians and Virtual Asset Trading Platforms (December 2024) is available here.

⁵ CIMA's Statement of Guidance – Guidance for the provision of virtual asset services – Virtual Asset Custodians and Virtual Asset Trading Platforms (December 2024) is available here.

⁶ CIMA's VASP Licensing and Waiver Checklist is available here.