Code of Practice Virtual Currency Business Act 2018

Summary

This Code of Practice, issued by the Bermuda Monetary Authority under section 6 of the Virtual Currency Business Act 2018, sets out the governance, risk management, and operational standards that licensed virtual currency business service providers (VCBs) must observe to conduct business in a sound and prudent manner. It should be read together with the Virtual Currency Business Statement of Principles, and compliance is assessed proportionately based on each VCB's nature, scale, and complexity.

• Corporate governance: VCBs must establish a sound governance framework with an effective board that oversees strategy, risk, and internal controls, and ensures fitness and propriety of directors, officers, and controllers.
• Senior representative: Every VCB must appoint an approved senior representative resident in Bermuda and maintain a head office in Bermuda, who monitors compliance with the Act and reports certain events to the Authority.
• Risk management: VCBs must establish a risk management function with documented policies covering risk identification, assessment, monitoring, and reporting, including cyber security and private key storage policies.
• Client due diligence and AML/CFT: VCBs must perform due diligence on new clients, verify identity, retain KYC records, and comply with Bermuda's anti-money laundering and anti-terrorist financing legislation.
• Internal controls: VCBs must maintain segregation and protection of client assets, adequate record keeping, competent management, an internal audit function, a compliance function, and conduct periodic self-assessment.
• Cybersecurity: VCBs must maintain a cybersecurity program appropriate to their risk profile.
• Client protection: VCBs must have clear client agreements, complaint handling procedures, and policies to identify and mitigate conflicts of interest, including market manipulation risks.
• Outsourcing: VCBs remain fully responsible for any outsourced functions and must ensure board oversight, accountability, and that agreements do not restrict the Authority's access to data.
• Regulatory cooperation: VCBs must deal openly with the Authority and ensure contracts do not frustrate the Authority's supervisory access or powers.

Failure to comply with the Code will be considered by the Authority when determining whether a VCB is meeting its statutory obligation to conduct business in a sound and prudent manner.

Key obligations

• Establish and maintain a sound corporate governance framework with an effective, appropriately skilled board
• Ensure processes exist to assess and document the fitness and propriety of board members, controllers, and officers
• Appoint an approved senior representative who is resident in Bermuda and maintain a head office in Bermuda
• Establish a risk management function with documented policies, procedures, and internal controls for identifying, assessing, monitoring, and reporting material risks
• Carry out client due diligence, verify client identity, retain KYC records, and comply with Bermuda's Proceeds of Crime and Anti-Terrorism financial legislation
• Maintain detailed records of transactions and client dealings
• Segregate and protect client assets
• Maintain an adequate cybersecurity program
• Establish and maintain internal audit and compliance functions
• Conduct periodic self-assessment against the Code
• Maintain client agreements and a documented complaint handling procedure
• Implement policies and procedures to identify, disclose, and mitigate conflicts of interest, including measures against market manipulation
• Ensure board oversight and accountability for any outsourced functions and ensure outsourcing agreements permit the Authority's access to data and records
• Cooperate openly with the BMA and other relevant regulatory authorities and ensure contracts do not frustrate the Authority's supervisory powers

Applies to

licensed virtual currency business service providers (VCBs)

Related documents

• This document is made under Virtual Currency Business Act 2018