Guide

The Cayman Islands virtual asset service providers regime

Introduction

The Virtual Asset (Service Providers) Act (as amended, the VASP Act) provides the framework for the conduct of virtual asset business in the Cayman Islands and for the registration and licensing of persons who are providing virtual asset services. The virtual asset service providers regime, which includes subsidiary legislation and related amendments to other financial services and regulatory legislation (the VASP Regime), is being implemented in two phases.

The core provisions of the VASP Act requiring registration came into effect on 31 October 2020 and the related enforcement provisions and offences came into effect on 31 January 2021. This is referred to as Phase 1 of the implementation the VASP Regime. Phase 2, in relation to the licensing requirements, is expected to come into force during the course of 2023. When the Phase 2 licensing regime commences, entities engaged in virtual asset custody services or in the operation of virtual asset trading platforms will be required to apply for a licence.

This guide sets out the scope, key requirements and obligations of the VASP Regime, together with the practical steps that a VASP should take.

Which entities are in-scope of the VASP Regime?

A Cayman Islands registered entity which carries on, or purports to carrying on, virtual asset services in or from within the Cayman Islands is in-scope of the VASP Regime.

What are the key requirements?

In general terms, the key requirements under the VASP Regime are as follows:

• all persons carrying on virtual asset services must be either registered or licensed under the VASP Act, or be granted a waiver from Cayman Islands Monetary Authority (CIMA) if it is an existing licensee under another regulatory law in the Cayman Islands (existing licensee); and
• if an entity is specifically carrying on the provision of virtual asset custody services or the operation of a virtual asset trading platform, it will need to obtain a virtual asset service licence once Phase 2 has come into force.

What are the key definitions?

A virtual asset means a digital representation of value that can be digitally traded or transferred and can be used for payment or investment purposes but does not include a digital representation of fiat currencies.

A virtual asset service means:

• the issuance of virtual assets; or
• the business of providing one or more of the following services or operations for or on behalf of a natural or legal person or legal arrangement:
  • exchange between virtual assets and fiat currencies;
  • exchange between one or more other forms of convertible virtual assets;
  • transfer of virtual assets;
  • virtual asset custody service; or
  • participation in, and provision of, financial services related to a virtual asset issuance or the sale of a virtual asset.

Virtual asset custody service means the business of safekeeping or administration of virtual assets or the instruments that enable the holder to exercise control over virtual assets.

A virtual asset trading platform means a centralised or decentralised digital platform:

• which facilitates the exchange of virtual assets for fiat currency or other virtual assets on behalf of third parties for a fee, commission, spread or other benefit; and
• which:
  • holds custody of or controls virtual assets on behalf of its clients to facilitate an exchange; or
  • purchases virtual assets from a seller when transactions or bids and offers are matched in order to sell them to a buyer,

and includes its owner or operator but does not include a platform that only provides a forum where sellers and buyers may post bids and offers and a forum where the parties trade in a separate platform or in a peer-to-peer manner.

Issuance of virtual assets or virtual asset issuance means the sale of newly created virtual assets to the public in or from within the Cayman Islands in exchange for fiat currency, other virtual assets or other consideration but does not include the sale of virtual service tokens.

Establishing if there is an issuance of virtual assets

In determining whether there is an issuance of virtual assets to the public (as defined above), CIMA will assess whether:

• the sale, or offer for sale, of the virtual assets will be advertised in the Cayman Islands in a manner directed to, or accessible by, persons or entities in the Cayman Islands and whether such persons or entities will be able to participate in the issuance by purchasing the respective virtual assets either;
  • directly from the person or entity offering the virtual assets; or
  • indirectly by way of a third party¹ which has been engaged to facilitate the sale of the virtual assets.
• a Cayman Islands registered entity is offering newly created virtual assets for sale from within the Cayman Islands where the sale, or offer for sale, of newly created virtual assets will not be advertised to persons or entities in the Cayman Islands, who will not be able to participate in the issuance;
• the sale, or offer for sale, of newly created virtual assets is a sale to the public and not a private sale.²

Exemption for virtual service tokens

A virtual service token is a digital representation of value which is not transferrable or exchangeable with a third party at any time and includes digital tokens whose sole function is to provide access to an application or service or to provide a service or function directly to its owner. As such, virtual service tokens are not 'virtual assets' and specifically excluded from the definition of 'issuance of virtual assets'. Any person or legal arrangement providing services that involve virtual service tokens only is not therefore required to have a licence or registration under the VASP Act.

How does an entity register under the VASP Regime?

The entity needs to make an application (or, in the case of existing licensees, provide notification) through CIMA's online portal, known as REEFS, in accordance with the form in the Schedule to the Virtual Asset (Service Providers) Regulations, 2020 (the VASP Regulations). The form requires, amongst other things, details of:

• the virtual asset service to be provided, such as the nature, function and purpose of the virtual asset service, prior revenue or projected revenue, manner in which the service will be provided to the public, and identified risks and steps to mitigate such risks;
• the procedures in place for anti-money laundering/countering financing of terrorism/countering proliferation financing (AML/CFT/CPF); and
• virtual asset services provided in another jurisdiction (if any).

All applications for registration must be accompanied by a US$1,219 assessment fee. This fee can be paid via the REEFS portal at the time of the application submission. There will also be an application fee payable by registrants on approval of an application for registration which will be determined pursuant to the VASP Regulations (based on the expected revenue and the type and delivery method of virtual asset services). CIMA will provide further details with respect to the application fee during the application process.

Are there any other obligations?

VASPs are required to:

• have a registered office in the Cayman Islands;
• prepare annual accounts (which must be available for inspection on request);
• comply with the requirements of the Cayman Islands AML/CFT/CPF regime³ and targeted financial sanctions obligations, including the appointment of an Anti-Money Laundering Compliance Officer (AMLCO);
• ensure the accuracy of communications relating to virtual asset services;
• ensure that senior officers, trustees and beneficial owners are fit and proper persons; and
• secure the personal data and virtual assets of clients.

Additional requirements may be imposed in relation to the provision of virtual asset custody services or the operation of a virtual asset trading platform. Further, the prior approval of CIMA is required in relation to:

• the appointment of a senior officer, trustee or AMLCO of a virtual asset service provider;
• the issue of shares (or partnership interests) in the virtual asset service provider totalling 10 per cent or more of the shares or interests in that entity; or
• the transfer or disposal of any issued shares or interests in a virtual asset service provider.

A Statement of Principles on the Conduct of Virtual Assets Services⁴ was published by CIMA in February 2021, setting out principles by which all VASPs should conduct their business and acting as the measure against which CIMA will assess compliance for AML/CFT/CPF and prudential purposes.

What if an entity's activities fall under the scope of another regulatory law?

CIMA has indicated that it understands that there may be some overlap with other regulatory laws, such as the Securities Investment Business Act (as amended), given the way the various provisions operate under the VASP Act. As CIMA has the power to grant waivers, we believe that in most cases the intention is to avoid an entity being 'double regulated' for the same business activity.

What are the approval requirements?

When deciding whether to grant a licence or register a person (or grant a waiver), CIMA will take into account the size, scope and complexity of the virtual asset service, the underlying technology utilised, the knowledge and experience of the applicant, the procedures in place to combat money laundering, the data protection systems utilised and the risks that the service may pose to clients or the financial system.

Registered persons

A person carrying on a virtual asset service for which a licence is not required, may apply to be a registered person under the VASP Act. Registered persons may only issue virtual assets to the public under a certain threshold and must obtain prior approval for any issuance by submitting a request to CIMA.

If a registered person engages in activities which require a licence, the person commits an offence and is liable on conviction to a fine of US$24,390.

Licences

Once Phase 2 has been fully implemented, virtual asset service licences will be required for persons providing virtual asset custody services (such as wallet services) or operating a virtual asset trading platform (often referred to as a cryptocurrency exchange). In order to issue newly created virtual assets directly to the public (via an initial coin offering), in or from within the Cayman Islands, the issuer will need to be registered or licensed under the VASP Act.

CIMA will keep a register of virtual asset service licensees, listing the business address and details of the activities that the licensee is permitted to carry on, which will be available for inspection by the public.

Sandbox licences

Sandbox licences may also be granted for a period of up to one year and are subject to review by CIMA. Where CIMA considers that a virtual asset service represents an innovative use of technology that requires supervision not offered by a licence or registration under the VASP Act (or another regulatory law) and it is in the best interest of the public, other licensees and the financial markets for the service to be temporarily restricted, CIMA may require that person to apply for a sandbox licence.

CIMA may impose restrictions on the sandbox licence, such as limiting the number of clients to whom the services may be offered, imposing reporting requirements, restrictions on advertising or requirements for the disclosures made to clients. CIMA may amend the restrictions, extend the duration or revoke the sandbox licence where the sandbox licensee poses a material risk to the welfare of the public and the stability of financial services in the jurisdiction.

What are the enforcement provisions?

The VASP Act contains enforcement provisions, including those which empower CIMA to:

• revoke a licence;
• cancel a registration;
• impose conditions on a licensee;
• apply to the Court for an order to protect the interest of clients or creditors and require the substitution of any senior officer or trustee,

where it is aware, or has reasonable grounds to believe that a virtual asset service provider:

• • is, or appears likely to become, unable to meet its obligations as they fall due;
  • is carrying on business fraudulently or otherwise in a manner detrimental to the public interest, to the interest of its clients or to the interest of its creditors;
  • has contravened any provision of the VASP Act or the Anti-Money Laundering Regulations (as amended);
  • has failed to comply with a condition of the licence or registration;
  • has senior officers or trustees who have acquired control who are not fit and proper persons; or
  • has failed to comply with a lawful direction from CIMA.

It is an offence to carry on or purport to carry on:

• virtual asset services for which a registration or a waiver is required without obtaining the appropriate registration or waiver (leading, on summary conviction, to a fine of US$30,488 and imprisonment for one year, together with a daily default fine after conviction of US$12,195)
• virtual asset custody services or operate a virtual asset trading platform without the requisite licence (leading, on summary conviction, to a fine of US$121,951 and imprisonment for one year, together with a daily default fine after conviction of US$12,195).

A person who recklessly provides false or misleading material information to CIMA commits an offence and is liable on summary conviction to a fine of US$12,195 and to imprisonment for six months. The VASP Act also contains vicarious liability provisions relating to offences committed by corporate entities with the knowledge, or attributable to the neglect, of a senior officer, where that senior officer may become equally liable for the commission of the applicable offence. Further, a person who contravenes any provision of the VASP Act for which a penalty is not specifically provided commits an offence and is liable on conviction to a fine of US$4,878.

In addition to the above, CIMA has power under the Monetary Authority (Administrative Fines) Regulations (as amended) to issue administrative fines with respect to various breaches of the VASP Act, ranging in quantum from US$6,100 up to US$121,955 for individuals and US$1,219,515 for corporate bodies, depending on the seriousness of the breach. Please refer to our guide on The Cayman Islands administrative fines regime for further information.

Contacts

A full list of contacts specialising in the VASP Regime in the Cayman Islands can be found here.

¹  A 'third party' means a person or entity who is engaged by the issuer to facilitate the sale of newly created virtual assets and is compensated either directly or indirectly for the sale, distribution, transfer or disposal of newly created virtual assets which are the subject of the issuance.

²  A “private sale” means a sale, or offer for sale, which is not advertised and is made available to a limited number of persons or entities who are selected prior to the sale by way of a private agreement.

³  Pursuant to the Anti-Money Laundering Regulations (2023 Revision) as supplemented by the Guidance Notes on the Prevention and Detection of Money Laundering, Terrorist Financing and Proliferation Financing in the Cayman Islands

⁴  https://www.cima.ky/virtual-asset-service-providers-regulatory-measures