The Virtual Currency Regulation Review: Cayman Islands

Introduction to the legal and regulatory framework

Owing to its neutral tax treatment, political stability and respected legal regime, the Cayman Islands is the global jurisdiction of choice for the formation of investment funds, which are increasingly investing in virtual assets and taking advantage of the investment opportunities in this space. The Cayman Islands has been, and remains, the leading domicile for virtual asset investment funds globally.2 A number of virtual asset exchanges have been launched by Cayman Islands entities.

The Cayman Islands Special Economic Zone provides a simplified route to establishing a physical presence and employing staff in the Cayman Islands.

In mid-2020, the Cayman Islands government introduced a new framework for regulating virtual asset businesses, known as virtual asset service providers (VASPs). The framework implements Financial Action Task Force (FATF) recommendations on international standards on combating money laundering and the financing of terrorism and proliferation applicable to VASPs (including virtual asset issuances, exchanges, transfer and custodian services, and financial services related to a virtual asset issuance); defines virtual assets and which virtual assets constitute securities; enables funds to use virtual assets as representations of equity interests; recognises virtual asset trading exchanges; and introduces a regulatory sandbox licence. No case law has yet considered issues arising in the virtual assets space.

i Structuring of virtual currency businesses

There is no direct taxation imposed on Cayman Islands entities and structuring will largely be driven by onshore tax considerations, Cayman Islands regulatory requirements and business needs.

Exempted companies

The most common type of entity used by VASPs to form investment funds investing in virtual assets, virtual asset issuances (commonly known as initial coin offerings (ICOs) and security token offerings) and virtual asset exchanges in the Cayman Islands is the exempted company. Exempted companies conduct business on the basis of a declaration by the incorporating subscriber that the operations of the company are to be carried on mainly outside the Cayman Islands.

An exempted company must have a minimum of one shareholder and one director. The appointment of officers is optional. There is no requirement for Cayman-resident directors or officers.

Exempted limited partnerships

Exempted limited partnerships are more commonly used to form closed-ended funds investing in virtual assets, which may be investing in illiquid virtual asset issuances rather than more commonly traded virtual assets. The Exempted Limited Partnership Act (the ELP Act) governs the formation of exempted limited partnerships.

The ELP Act also contains provisions relevant to the affairs of an exempted limited partnership, being the primary legislation governing partnerships generally. An exempted limited partnership is a partnership consisting of at least one general partner (who has responsibility for the business affairs of the partnership) and any number of limited partners that is registered as such under the ELP Act.

An exempted limited partnership is not a separate legal entity. It is instead a set of contractual obligations affecting the partners, between themselves, where a general partner is vested with certain powers and obligations in relation to a business and the assets of the business.

Exempted limited partnerships are often treated differently to companies for onshore tax purposes, typically being treated as fiscally transparent. The general partner holds the partnership's assets in statutory trust for the partners and is tasked with managing the business and affairs of the exempted limited partnership. If the assets of the partnership are inadequate to satisfy the claims of creditors, the general partner is liable for the debts and obligations left unpaid.

Foundation companies

A foundation company shares many of the features of an exempted company. A foundation company is a body corporate with limited liability and separate legal personality from its members and directors and other officers. It can sue and be sued and hold property in its own name. The key feature of a foundation company that often makes it an attractive vehicle for issuing virtual assets is that it is not required to have members following incorporation. This is a particularly useful structure for those projects that will ultimately be decentralised and governed by the community.

A foundation company must, however, unlike an exempted company, appoint a qualified person as a secretary, namely a person who is licensed or permitted by the Companies Management Act (revised) to provide company management services in the Cayman Islands, and that secretary must maintain a full and proper record of its activities and enquiries made for giving notice, and ensure that the company complies with Cayman Islands anti-money laundering, countering the financing of terrorism and anti-proliferation financing obligations when accepting transfers of virtual assets without consideration.


If ownership and autonomy are concerns, which may be relevant particularly for issuing virtual assets, they can be addressed to a certain degree by having a Cayman Islands charitable trust or STAR trust (introduced by the Special Trusts (Alternative Regime) Act) hold all the shares in issue of the exempted company. A Cayman Islands STAR trust is a non-charitable purpose trust that can hold assets for a specific purpose. The trustee must be a licensed trustee in the Cayman Islands.

ii Summary of Cayman laws to be considered in the virtual currency space

The following Cayman Islands statutory and regulatory regimes must be considered when structuring a virtual currency business in the Cayman Islands:

  1. the Virtual Assets (Service Providers) Act (VASPA);
  2. the Securities Investment Business Act (SIBA);
  3. the Mutual Funds Act (MFA);
  4. the Private Funds Act (PFA);
  5. the Money Services Act (MSA);
  6. the Bank and Trust Companies Act;
  7. the Proceeds of Crime Act (PCA), the Proliferation Financing (Prohibition) Act, the Anti-Money Laundering Regulations (the AML Regulations) and existing guidance notes, and the Terrorism Act;
  8. the Stock Exchange Companies Act;
  9. the US Foreign Account Tax Compliance Act (FATCA) and the Organisation for Economic Co-operation and Development's Common Reporting Standard (CRS);
  10. the beneficial ownership regime; and
  11. the International Tax Co-operation (Economic Substance) Act (the ES Act).

Virtual assets service providers regulation

The VASPA took effect on 31 October 2020. At the time of writing, the registration obligations under the VASPA are in effect; however, the licensing, sandbox and notification regime for existing licensees is not yet in effect but is expected to be so before the end of 2021. In the meantime, all VASPs must apply to register with the Cayman Islands Monetary Authority (CIMA) and have that application accepted before they can commence virtual asset operations, regardless of whether they may subsequently require licensing or are an existing licensee (existing licensees must notify CIMA of their proposed virtual asset services).

i Definition of a VASP

The VASPA defines a VASP as: a Cayman entity that provides a virtual asset services as a business, or within the course of a business, in or from within the Cayman Islands and that is registered or licensed in accordance with the VASPA or is an existing licensee that has been granted a waiver.

A virtual asset service is the issuance of virtual assets (i.e., the sale of newly created virtual assets to a public virtual asset exchange (whether to or from fiat or other virtual assets) and any of the following businesses provided for or on behalf of another party:

  1. exchange between virtual assets and fiat currencies or other virtual assets;
  2. transfers of virtual assets (which includes facilitation of such transfers);
  3. custody services (i.e., safekeeping and administration of virtual assets); or
  4. participation in, and provision of, financial services related to a virtual asset issuance or the sale of a virtual asset.

The VASPA licenses and regulates those engaged in providing virtual asset services for or on behalf of a third party. Virtual assets themselves, and those using virtual assets or VASPs for their own private purposes or as principals, are not affected.

ii Definition of a virtual asset

The VASPA implements the FATF definition of a virtual asset, which is 'a digital representation of value that can be digitally traded or transferred and can be used for payment or investment purposes but does not include a digital representation of fiat currencies'. The central elements of the definition are transferability and exchangeability, intending to capture activities rather than asset types. This definition does not include digital representations of fiat currencies, which are intended to cover central bank digital currencies that may be issued by national central banks in future.

The VASPA excludes 'virtual service tokens' from the definition of a virtual asset. Virtual service tokens are non-transferable or non-exchangeable digital representations of value, including digital tokens whose sole function is to provide access to an application or service or to provide a service or function directly to its owner.

iii Registration and licensing requirements

All VASPs – including businesses acting as VASPs on an occasional or limited basis – must either be registered with or licensed (or granted a waiver if an existing licensee) by CIMA before commencing any virtual asset operations (including issuances). If the VASP is a virtual assets custodian or exchange business, it must be licensed by CIMA (whether under the sandbox, the VASPA or under its existing licence having been granted a VASPA waiver by CIMA, as applicable) before commencing operations. All other VASPs must apply to and be registered with CIMA (or be granted a waiver from CIMA, as applicable) before commencing operations. A breach of this requirement is a criminal offence that may result in a fine or imprisonment.

VASPs already licensed under any other regulatory laws may not need to be registered separately or licensed under the VASPA; however, they will need to notify CIMA of the details of their activities. The need for separate licensing or registration may be waived by CIMA on a discretionary basis. A notice is not required where an existing licensee is carrying on activities that involve virtual service tokens only.

Investment funds wishing to accept subscriptions in virtual assets or make redemptions in kind must take structuring advice to determine whether they or their Cayman Islands service providers may fall within the framework. For example, if a Cayman Islands investment manager or administrator owns and operates a virtual assets wallet on behalf of an investment fund, it may be undertaking custodian or virtual asset transfer activities and may need to be licensed or registered under the VASPA. Most non-tokenised investment funds investing in virtual assets are unlikely to be VASPs. Funds issuing tokenised equity interests or contractual rights in the fund's profits are likely to be VASPs, as they will be undertaking a virtual asset issuance. Any VASP considerations in respect of an investment fund are in addition to that fund's obligations under the PFA, MFA and Cayman anti-money laundering obligations.

All VASPs will be subject to ongoing requirements, including regulatory audits by CIMA, preparing audited financial statements, appointing and maintaining compliance officers and obtaining CIMA's written approval before issuing or transferring equity interests representing 10 per cent or more of its total equity interests.

The VASPA requires virtual asset custodian services to demonstrate that they meet capital, disclosure and safekeeping standards as part of their licensing application. Virtual asset exchanges must meet not only capital and safekeeping standards but also disclosure, onboarding, trading supervision, operational and clearance and settlement standards. At the time of writing, details of these standards are not yet available.

iv Regulatory sandbox

The VASPA introduced a time-limited regulatory sandbox licence available to both virtual asset service providers and fintech businesses. An initial licence is valid for up to one year and may be reviewed when CIMA deems appropriate.

The flexible sandbox licence permits CIMA to tailor restrictions, monitoring covenants, limits on the offering of the service, or specific obligations. It is intended for VASPs whose virtual asset activity is not properly supervised by an existing regulatory law or may pose substantial market, systemic or anti-money laundering (AML) and counter-terrorist financing risks. For fintech companies, the sandbox licence can help accelerate adoption of the innovative technology or delivery channel they have developed. At the time of writing, details of the sandbox licence, eligibility and conditions are not yet available.

Sandbox licensees must comply with the sandbox principles of honesty, integrity, fair treatment of customers, the protection of customer data and assets, and such other principles as CIMA may prescribe by way of regulations and publish on its website.

Securities and investment laws


The SIBA regulates securities investment business in the Cayman Islands. Securities investment business refers to dealing in securities, arranging deals in securities, managing securities and advising on securities.

The definition of a security is set out in the SIBA and contains a list of instruments that are common in today's financial markets (securities, instruments creating or acknowledging indebtedness, instruments giving entitlements to securities, certificates representing certain securities, options, futures and contracts for differences).

Virtual assets that can be sold, traded or exchanged at any time that represent or can be converted into any of the instruments listed in the SIBA or represent a derivative of any such instruments are themselves securities. If a Cayman entity was deemed to be issuing securities, it would be exempt from any form of licensing under the SIBA if the nature of the security was an equity interest, debt interest, or a warrant or similar for equity or debt interests.

If a Cayman entity was issuing or trading digital assets that were securities, it would be subject to registration or licensing under the VASPA.

ii MFA and PFA

The MFA gives CIMA responsibility for regulating certain categories of mutual funds operating in and from the Cayman Islands. The PFA gives CIMA responsibility for regulating certain categories of private funds operating in and from the Cayman Islands.

To be categorised as a mutual fund under the MFA, the fund must:

  1. be issuing equity, and not debt or contractual interests: in other words, shares, limited partnership interests, LLC interests or trust units (this therefore excludes token issuers, but the fund's equity interests can be represented by tokens);
  2. be a collective investment vehicle effecting the pooling of investor funds;
  3. issue equity interests that are redeemable or repurchasable at the option of the investors; and
  4. be established in the Cayman Islands or be a foreign fund seeking to make an offer or invitation to the public in the Cayman Islands to subscribe for its equity interests.

Mutual funds that are master funds are also covered by the MFA. To be categorised as a private fund under the PFA, the fund must adhere to the same requirements as those listed above with the exception of point (c): the PFA must issue equity interests that are not redeemable or repurchasable at the option of the investors.

All mutual funds and private funds must be registered with CIMA. The only funds that are not regulated, and therefore are not required to be registered with or licensed by CIMA, are:

  1. in the case of mutual funds, those that are single investor funds – these are not master funds and are not mutual funds as there is no pooling of investor funds;
  2. in the case of private funds, those that constitute 'non-fund arrangements', which include joint venture vehicles, proprietary vehicles, debt issues and debt issuing vehicles, and preferred equity financing vehicles; and
  3. for both mutual funds and private funds, those that are listed or otherwise regulated funds that are not incorporated or established in the Cayman Islands and that make invitations to the public in the Cayman Islands to subscribe for a fund's equity interests through a person licensed under the SIBA, provided that the fund in question is either listed on a stock exchange recognised for the purpose by CIMA or regulated in a category and by a regulator recognised for the purpose by CIMA.

Banking and money transmission


The MSA regulates money services businesses in the Cayman Islands. Such businesses include the business of providing (as a principal business) money transmission and currency exchange. The applicability of this law will depend upon the specifics of any virtual asset issuance, virtual asset exchange or decentralised finance business. While any specific virtual asset issuance may, by its nature, fall within the remit of the MSA, the MSA is unlikely to apply to most virtual asset issuances.

The MSA provides that an entity in the business of providing, inter alia (as a principal business), money transmission or currency exchange requires a licence. The meaning of a currency exchange is not defined by the law; however, the Penal Code defines currency notes as legal tender in the country in which they are issued. If a money service business intends to offer services around digital representations of fiat currencies, which are not virtual assets under the VASPA, it will be subject to regulation under the MSA and not the VASPA. However, if the money service business also intends to offer services around virtual assets, it needs to consider whether it requires registration or a waiver under the VASPA.

ii Bank and Trust Companies Act

Cayman entities require licences to conduct banking business or trust business. Banking business means the 'business of receiving (other than from a bank or trust company) and holding on current, savings, deposit or other similar account money which is repayable by cheque or order and may be invested by way of advances to customers or otherwise'. Trust business means the 'business of acting as trustee, executor or administrator'.

Following the introduction of the VASPA, businesses that previously required licensing as a trust company under the Bank and Trust Companies Act because of undertaking custodian activities will need to be licensed as a VASP under the VASPA.

Anti-money laundering


The PCA has general application to all Cayman-domiciled entities. It is an offence under the PCA to enter into or become concerned in an arrangement that a person knows or suspects facilitates (by whatever means) the acquisition, retention, use or control of criminal property by or on behalf of another person (commonly known as money laundering). In addition, the PCA prescribes ancillary offences to money laundering, including aiding, abetting, counselling or procuring money laundering.

Schedule 6 of the PCA provides that certain businesses that are considered to be conducting relevant financial business (RFB) must also comply with the AML Regulations.CIMA has published specific guidance notes on the application of the AML Regulations for VASPs.

Virtual asset services undertaken by VASPs are included in the definition of RFB under the PCA, as well as money or value transfer services, and this definition specifically includes transfers of virtual assets. Undertaking activities in connection with tokens that represent or constitute the activities of otherwise investing, administering or managing funds or money on behalf of other persons will also constitute RFB.

ii AML Regulations

If an entity is conducting RFB, which means it is subject to the AML Regulations, it is required to implement know your client (KYC) and AML policies and procedures that comply with the AML Regulations.

In addition to monitoring the business of an entity and downstream investment activities, the AML Regulations require that the entity obtain customer due diligence information, including regarding the source of funds and information on the beneficial owners of customers.

The AML Regulations require that an entity conducting RFB (or its delegate – i.e., the service provider):

  1. appoint an anti-money laundering compliance officer (AMLCO) at a managerial level: the role of the AMLCO is to ensure that the entity adopts measures as set out in the AML Regulations and functions as a point of contact for CIMA;
  2. appoint a money laundering reporting officer (MLRO), which may be the same person as the AMLCO, and a deputy MLRO: the entity must maintain procedures with respect to internal reporting of suspicious activity to the MLRO or deputy MLRO, and the MLRO and deputy MLRO are responsible for reporting to the Financial Reporting Authority;
  3. maintain, and comply with, identification and verification procedures in accordance with the AML Regulations: this refers to the maintenance of customer due diligence procedures, which are detailed in Section V.iv;
  4. adopt a risk-based approach to monitor financial activities, including identifying high-risk activities, which requires the entity to identify risks and to implement policies, controls and procedures to mitigate those risks;
  5. ensure that appropriate records of documentation and information obtained to comply with the AML requirements are maintained;
  6. maintain adequate systems to identify risk in relation to persons, countries and activities, including checks against all applicable sanction lists;
  7. adopt risk management procedures concerning the conditions under which a customer may utilise the business relationship prior to verification;
  8. observe a list of countries, published by any competent authority, which are non-compliant or do not sufficiently comply with the recommendations of the FATF;
  9. implement such other procedures of internal control, including appropriate, effective risk-based independent audit and communication functions, as may be appropriate for the ongoing monitoring of business relationships; and
  10. provide employee training in respect of money laundering risks and procedures.

iii Risk assessment

An entity (or its delegate) is required to undertake an assessment of the risks of money laundering and terrorist financing based on its customers, the country in which customers reside or operate, the products and services offered, and the delivery channels by which they are offered, and to determine the appropriate level and type of mitigation of such risks.

It is arguable that, as most business involving virtual currency is conducted online, this represents a delivery channel with a higher risk of money laundering and therefore should be considered in the risk assessment undertaken by a business.

iv Customer due diligence

If simplified due diligence cannot be applied (see below) and a customer is a legal person or arrangement, identification and verification procedures need to be applied not only to the legal person or arrangement itself, but also its beneficial owner.

The due diligence information and documentation required will depend on whether the customer is an entity or an individual. However, original or certified documentation of identity (i.e., a certified copy of a passport), address (i.e., a certified copy of a utility bill) and source of funds or wealth in respect of an individual and corporate documents in respect of entities, are generally required.

Simplified due diligence procedures

In certain instances, the entity conducting RFB can rely on simplified due diligence procedures.

If simplified due diligence is permitted, and the payment for subscriptions is remitted from an account held in a customer's name at a bank in the Cayman Islands or a bank regulated in an equivalent jurisdiction, detailed verification might not be required at the time of subscription (although evidence identifying the branch or office of the bank from which the moneys have been transferred, verification that the account is in the name of the applicant and the retention of a written record of these details is required). However, verification of the identity of the customer will need to be carried out prior to any payment of proceeds or distributions.

If simplified due diligence cannot be applied, and the customer is a legal person or arrangement, identification and verification procedures need to be applied not only to the legal person or arrangement itself, but also its beneficial owner.

Simplified due diligence cannot be applied to any business relationship or one-off transaction believed to present a higher risk of money laundering or terrorist financing by the entity. However, where a customer has been assessed as lower risk, a entity is permitted to apply simplified due diligence. Any assessment of lower risk must be consistent with the findings of CIMA or any risk assessment carried out by the Cayman Islands Anti- Money Laundering Steering Group.

Depending on the circumstances, it may be possible to apply simplified due diligence where:

  1. the customer is conducting RFB and is required to comply with the AML Regulations, or is a majority-owned subsidiary of such a business;
  2. the customer is acting in the course of a business in relation to which a regulatory authority exercises regulatory functions, and that is in an equivalent jurisdiction or is a majority-owned subsidiary of such a customer;
  3. the customer is a central or local government organisation, statutory body or agency of government in the Cayman Islands or an equivalent jurisdiction;
  4. the customer is a company that is listed on a recognised stock exchange and subject to disclosure requirements that impose requirements to ensure adequate transparency of beneficial ownership, or is a majority-owned subsidiary of such a company;
  5. the customer is a pension fund for a professional association or trade union, or is acting on behalf of employees of an entity referred to above; or
  6. the application is made through an intermediary that falls within one of the above categories and provides written assurance from that intermediary in accordance with the AML Regulations.

Enhanced due diligence

Where a customer relationship has been assessed as higher risk by an entity, persons conducting RFB must apply enhanced due diligence. Enhanced due diligence must also be applied to politically exposed persons (and their family members and close associates); and when a customer or business is from a country that has been identified by credible sources as having serious deficiencies in its AML and combating of financing of terrorism regime, or a prevalence of corruption.

The person conducting RFB is required to develop and implement procedures in circumstances where enhanced due diligence is required, such as obtaining additional information from customers and updating it more frequently, enhanced monitoring or requiring additional information in respect of the source of funds.

Wire transfer information

Any VASP conducting a transfer of virtual assets to a beneficiary must collect, verify and record the information for each transaction, such as the name of the originator and beneficiary, account numbers or transaction reference numbers as applicable and the originator's address and government issued identification number or customer identification number, and date and place of birth. This information must be provided to the beneficiary VASP simultaneously or concurrently with the transfer of virtual assets. Beneficiary VASPs must comply with equivalent obligations.

For batch transfers, originator information can accompany the batch file rather than each transaction. The batch file must also the name, account number or unique identifier of the beneficiary that is traceable in the beneficiary country.

Both originating and beneficiary VASPs must produce transaction information to a competent authority where requested in a written notice.

v Penalties

Any person who breaches certain provisions of the AML Regulations commits an offence and is liable on summary conviction to a fine of up to CI$500,000, or on indictable conviction to an unlimited fine and imprisonment for two years. Where an offence is committed by an entity with the consent or connivance of, or is attributable to neglect on the part of, a director, member, partner, manager, secretary or other similar officer as applicable, that person is liable as well as the entity.

In addition, under amendments to the Monetary Authority Act (2020 Revision) and the Monetary Authority (Administrative Fines) Regulations 2019, CIMA will have the power to impose administrative fines for non-compliance with certain provisions of the AML Regulations and the VASPA.

The penalties under the PCA for the offences described in Section IV are, on summary conviction, a fine of CI$15,000 or imprisonment for a term of two years, or both; or, on conviction on indictment, imprisonment for a term of 14 years or a fine, or both.

vi Terrorism Act

Section 19 of the Terrorism Act (TA) makes it an offence to solicit, receive or provide property with the intention that it be used, or having reasonable cause to suspect that it may be used, for the purposes of terrorism.

According to Section 20 of the TA, it is an offence for a person to use property for the purposes of terrorism or to possess property intending that it be used, or having reasonable cause to suspect that it may be used, for the purposes of financing acts of terrorism, terrorists or terrorist organisations.

Section 21 of the TA makes it an offence for a person to enter into or become concerned with an arrangement as a result of which property is made available to another knowing, or having reasonable cause to suspect, that it will or may be used for the purposes of terrorism.

Under Section 22 of the TA, a person commits a money laundering offence if he or she 'enters into or become concerned in an arrangement that facilitates the retention or control by or on behalf of another person of terrorist property by concealment, by removal from the jurisdiction or by transfer to nominees'.

Regulation of exchanges

i Stock Exchange Company Act (Revised)

The Stock Exchange Company Act was introduced to regulate traditional stock exchanges.

Pursuant to the Stock Exchange Company Act, the Cayman Islands Stock Exchange does not have the sole and exclusive right to operate the securities markets in the Cayman Islands that trade in securities that are virtual assets. A securities market is defined broadly, and includes offering a place where, or a facility or arrangement by which (and situated in whole or in part in the Cayman Islands), securities are listed or regularly offered for purchase or sale.

Securities are defined to include securities of all descriptions, including virtual assets that constitute securities. As there is no further definition of securities under the Stock Exchange Company Act, reference must be made to the list of securities in the SIBA. The characteristics of each virtual asset offered must be considered to determine whether or not it constitutes a security.

Whether a stock exchange is operating within the Cayman Islands will need to be determined based on the operations of the exchange: for instance, where its employees and servers are located.

ii PCA

The PCA applies to all Cayman-domiciled virtual asset trading platforms, which will need to ensure that they implement policies and procedures to avoid breaching the PCA.

An exchange conducting business that is considered to be RFB will be required to comply with the AML Regulations. As stated earlier, RFB includes virtual asset services.

The requirements applicable to businesses conducting RFB are detailed in Section IV, and includes obtaining KYC and AML information in respect of both the initial purchasers and subsequent purchasers of tokens.

iii MSA

As virtual assets (subject to very limited potential exceptions) are not legal tender in any country, a virtual asset exchange is unlikely to be considered a currency exchange and, therefore, would not require a licence.

A virtual asset exchange that only permits virtual asset-to-virtual asset exchange is not likely to be considered as offering, as a principal business, a money transmission service. However, whether a virtual asset exchange is considered to be a money services business will need to be determined on a case-by-case basis depending on the service offered on the platform.


Under the VASPA, a virtual assets exchange is considered a 'virtual asset trading platform' and, therefore, a virtual asset service if it: (1) is a centralised or decentralised digital platform that facilitates the exchange of virtual assets for fiat currency or other virtual assets on behalf of third parties for a fee, commission, spread or other benefit; (2) holds custody of or controls virtual assets on behalf of its clients to facilitate an exchange; or (3) purchases virtual assets from a seller when transactions or bids and offers are matched to sell them to a buyer.

For decentralised platforms where no single entity or group may be identifiable, the VAPL deems the operator of the platform, being the person or persons who exercise control, to be the owner of the entity under which the platform operates.

Virtual asset trading platforms must be licensed by CIMA. A range of conditions may be imposed by CIMA on the VASP's licence, including, among other things:

  1. the type of client that it may market its services to;
  2. the types of virtual assets that may, or may not, be traded on the virtual asset trading platform;
  3. requirements for the listing of virtual assets;
  4. net worth and reporting requirements;
  5. disclosures to clients around operational transparency;
  6. custodial and insurance arrangements;
  7. the clearing and settlement process; and
  8. the provision of financing for the purchase of virtual assets.

Licensed VASPs operating virtual asset trading platforms are subject to outright and conditional restrictions, including:

  1. providing financing to their clients for the purchase of virtual assets, unless disclosures are made regarding the financing terms, and risk, trading or market making for their own account if this conflicts with client interests, unless vital to the operation of the platform and disclosed to clients;
  2. a prohibition on trading virtual assets not subject to individual due diligence by the platform, restricting trading access until a client has disclosed its understanding of risks around virtual assets; and
  3. an outright prohibition on fiat-to-fiat exchange services.

A VASP licensee operating a virtual asset trading platform must apply to CIMA for separate approval prior to engaging in securities investment business that relates to virtual assets. This may involve a separate licence under the SIBA.

Where a VASP operates a custody service pursuant to operating a virtual asset trading platform, it does not automatically require separate licensing to provide that custody service. However, if the VASP also provides custodian services as a separate business line, it may require an additional licence.

Regulation of virtual asset custodians

A virtual asset custody service is the business of safekeeping or administering virtual assets or the instruments that enable the holder to exercise control over virtual assets. It is a virtual asset service that falls under the VASPA. A person who provides virtual asset custody services in or from within the Cayman Islands must be licensed by CIMA.

CIMA may impose requirements on a virtual assets custody services licence relating to net worth; reporting; disclosures to clients concerning the transparency of operations, including the risks associated with the custodial arrangements; internal safeguards; methods of access to virtual assets held; insurance arrangements; and safekeeping of client assets, including the segregation of assets, insurance requirements and cybersecurity measures.

Custodian agreements must be entered into between a virtual assets custodian and each client, containing minimum provisions relating to the scope of the arrangement, safekeeping measures, fees and client access to custodied assets. Custodians must also account to the client for all ancillary or subsidiary proceeds relating to custodied virtual assets, and are prohibited from granting, or allowing a third party to grant, security interests over custodied virtual assets.

Regulation of issuers and sponsors

A virtual asset issuance is the sale of newly created virtual assets to the public in or from within the Cayman Islands in exchange for fiat currency, other virtual assets or other considerations. The sale of virtual service tokens is not deemed a virtual asset issuance. A virtual asset issuance itself, together with participation in, and provision of financial services related to, a virtual asset issuance or the sale of a virtual asset are virtual asset services under the VASPA.

As VASPs, issuers and relevant providers of financial services must register with CIMA. A registered person may not issue virtual assets directly to members of the public in excess of a threshold prescribed by CIMA. Any issuances above the threshold must, or alternatively the entire issuance may, be issued through a Cayman licensed virtual assets exchange.

When Section 12 of the VASPA becomes effective, a VASP must request and obtain CIMA's approval prior to any issuance, whether directly to the public or through a virtual assets exchange. CIMA may impose requirements on any approval relating to: marketing; disclosures of material risks associated with the virtual asset; use of funds; terms and conditions of the issuance; information the issuer must collect from the public; and CIMA reporting requirements and timings that are specific to the issuance.

A licensed virtual assets exchange may, if permitted under its licence and subject to prior CIMA approval, issue virtual assets on its own behalf directly to the public over the prescribed threshold. CIMA may impose conditions on the approval similar to those imposed on direct issuers.


There is no taxation imposed on Cayman entities. However, parties interested in virtual asset businesses in the Cayman Islands will need to obtain tax advice in their own jurisdictions. Cayman entities will need to consider their reporting obligations (if any) under FATCA and the CRS, as detailed below.

FATCA, the US–Cayman intergovernmental agreement and implementing legislation, and the CRS

FATCA requires foreign financial institutions and certain other non-financial foreign entities to report on foreign assets held by US account holders, or to be subject to a 30 per cent withholding tax on payments of United States source income and proceeds from the sale of property that could give rise to United States source interest or dividends. The Cayman Islands has entered into an intergovernmental agreement with the United States in respect of FATCA, and has passed legislation to implement FATCA in the Cayman Islands.

The CRS is a global standard for the automatic exchange of financial account information in respect of holders of financial accounts, and requires participating jurisdictions to obtain and report certain information. The Cayman Islands is a participating jurisdiction of the CRS. It has passed legislation implementing both FATCA and the CRS (Automatic Exchange of Information (AEOI) legislation that imposes reporting obligations on Cayman entities considered to be reporting financial institutions.

The definition of financial institutions for the purposes of the AEOI legislation includes investment entities, which are entities 'that conduct as a business (or is managed by an entity that conducts as a business)' and are 'investing, administering, or managing financial assets or money on behalf of other persons'. The definition of investment entity would include investment funds investing in virtual assets and tokenised funds. The definition of financial assets is very broad, and includes securities and financial instruments; however, it specifically excludes a non-debt direct interest in real property.

An entity that is considered to be an investment entity will be required to implement a compliance and diligence programme to allow the company to identify and report reportable accounts. A reportable account is an account held by one or more reportable persons, or by a passive non-financial entity with one or more controlling persons that is a reportable person.

The definition of an account of an investment entity is 'any equity or debt interest in the investment entity other than interests which are regularly traded on established securities markets'.

It is arguable that the tokens issued by an investment entity do not constitute either equity or debt interest, which are not further defined in respect of an investment entity. However, there are anti-avoidance provisions in both the Cayman FATCA and CRS legislation that would arguably apply to these interests.

Custodial institutions and depository institutions are also considered to be financial institutions for the purposes of the AEOI legislation.

The term custodial institution means any entity that holds, as a substantial portion of its business, financial assets for the account of others. An entity holds financial assets for the account of others as a substantial portion of its business if the entity's gross income attributable to the holding of financial assets and related financial services equals or exceeds 20 per cent of the entity's gross income during the shorter of the three-year period that ends on 31 December (or the final day of a non-calendar year accounting period) prior to the year in which the determination is being made; or the period during which the entity has been in existence.

The term depository institution means any entity that accepts deposits in the ordinary course of a banking or similar business.

An entity is considered to be engaged in a banking or similar business if, in the ordinary course of its business with customers, it accepts deposits or other similar investments of funds and regularly engages in one or more of the following activities:

  1. makes personal, mortgage, industrial or other loans, or provides other extensions of credit;
  2. purchases, sells, discounts or negotiates accounts receivable, instalment obligations, notes, drafts, cheques, bills of exchange, acceptances or other evidences of indebtedness;
  3. issues letters of credit and negotiates drafts drawn thereunder;
  4. provides trust or fiduciary services;
  5. finances foreign exchange transactions; or
  6. enters into, purchases or disposes of finance leases or leased assets.

A virtual asset exchange may fall within the above definitions depending on the operations of the exchange.

Financial institutions are required to register with the US Internal Revenue Service for a global intermediary identification number, appoint a principal point of contact and authorised person, and register with the Cayman Tax Information Authority.

Financial institutions are required to report, by 31 May each year, names, addresses, taxpayer identification numbers, dates of birth (where applicable), account numbers, and account balances or values as at the period's end and in respect of any accounts closed during the period.

Financial institutions issuing tokens will need to obtain self-certification forms in respect of the initial purchasers and subsequent transferees of the tokens.

Other issues

i Beneficial ownership legislation of the Cayman Islands

The beneficial ownership legislation requires certain companies to maintain details of their beneficial owners and related legal entities on a beneficial ownership register.

If a virtual asset business is established as a Cayman company, the company will need to provide the full name, residential address and identification document details of any entity or person holding more than 25 per cent of the shares or control of the company. If the company is an issuer in respect of an ICO, whether the company will be required to disclose any details in respect of the holders of tokens pursuant to the beneficial ownership legislation will depend on the rights attaching to the tokens.

ii ES Act

The ES Act came into force on 1 January 2019 and the Cayman Islands Tax Information Authority published detailed Guidance Notes on 30 April 2019.

Under the ES Act any relevant entity that carries on a relevant activity and receives relevant income in a financial period must satisfy the economic substance test in relation to that activity (the ES Test) and make an annual filing with the Tax Information Authority.

Aside from the basic filing requirements, a relevant entity that does not carry on any relevant activity is not required to satisfy the ES Test.

Under the ES Act, all Cayman Islands companies incorporated under the Companies Act or the Limited Liability Companies Act, all exempted limited partnerships registered under the ELP Act, limited liability partnerships registered under the Limited Liability Partnerships Act and all overseas companies registered in the Cayman Islands under the Companies Act are relevant entities except those entities that are: an investment fund; tax resident outside the Cayman Islands; or a domestic company.

Relevant income is 'all of an entity's gross income from its relevant activities and recorded in its books and records under applicable accounting standards'. Any income that is not generated from relevant activities is not to be considered when determining adequate substance in the Cayman Islands.

Relevant activities include the business of holding, exploiting or receiving income from 'intellectual property assets', being any intellectual property right (including a copyright, design right, patent or trademark) that may be relevant to a VASP.

As income derived from intellectual property assets are considered to be at higher risk of profit shifting from higher to lower (or zero) tax jurisdictions, a more rigorous requirement applies to certain entities that carry on intellectual property business. Virtual assets issued by entities located in the Cayman Islands will need to consider the potential requirement to maintain physical substance in the Cayman Islands, depending on where the intellectual property is held.

Looking ahead

The registration element of the VASPA is in force at the time of writing. The licensing and existing licensee notification elements are not yet in force but are expected to take effect by the end of 2021. Regulatory guidance is expected from CIMA as to the licensing process, fees and minimum requirements for VASPs.


1 Daniella Skotnicki is a partner and Marc Piano is an associate at Harneys.

2 According to PwC's 3rd Annual Global Crypto Hedge Fund Report 2021, 34 per cent of virtual asset investment funds are domiciled in the Cayman Islands.

The Law Reviews content