Consultation Paper - Regulation of Digital Identity Service Provider Business - Part II (2025-07-21)

Summary

This is a Bermuda Monetary Authority (BMA) consultation paper (Part II) setting out a detailed proposed licensing framework for Digital Identity Service Provider (DISP) businesses, to be enacted through a forthcoming Digital Identity Service Provider Business Act (DISPA). It builds on an earlier November 2024 consultation and an April 2025 stakeholder letter, and invites industry feedback before the framework is finalised. Nothing in this paper is yet legally binding; it describes what the Authority intends to require once DISPA is enacted.

• Licensing scope: A licence would be required for entities carrying on both identity proofing/enrolment with initial binding and credentialing, and authentication/life-cycle management of digital identities; in-house credentials for a company's own customers are excluded.
• Tiered licence classes: Three proposed classes: Class F (full licence), Class M (modified, time-limited licence for entities nearing full licensing), and Class T (test/pilot licence).
• Local presence: DISPs would need to maintain a principal place of business in Bermuda and appoint an Authority-approved senior representative physically present in Bermuda, who must report specified events (insolvency risk, licence condition breaches, criminal proceedings, material business changes, cyber events, cessation of business) within a specified time.
• Controller notifications: Prospective significant (10%+) or majority shareholder controllers would need to notify the Authority in writing before assuming control, with the Authority having 90 days (extendable) to object.
• Ongoing supervision: Proposed powers for the Authority to restrict, suspend or revoke licences, require annual and more frequent prudential/financial returns, impose civil penalties, and exempt or modify prudential requirements.
• Fees: A proposed fee schedule is set out in Appendix I, including application fees, licence-granting fees and annual business fees differentiated by licence class (e.g. Class T at $1,000 each; Class M/F application $2,266, grant $15,000, and annual fee the greater of $15,000 or 0.00075 x estimated client receipts).

The Authority is seeking stakeholder comments on the proposals, including specific questions on interoperability with international digital identity frameworks, with submissions to be emailed to policy@bma.bm by 2 September 2025. Feedback will inform the final legislative framework and subsequent secondary instruments (Rules, Regulations, Codes).

Key obligations

• Stakeholders wishing to comment must submit their feedback to policy@bma.bm by 2 September 2025.
• (Proposed, not yet in force) Once DISPA is enacted, DISPs would need to obtain a licence before carrying on DISP activities in or from Bermuda.
• (Proposed) DISPs would need to maintain a principal place of business in Bermuda and appoint an Authority-approved senior representative resident in Bermuda.
• (Proposed) Senior representatives would need to report specified events (e.g. insolvency risk, licence breaches, criminal proceedings, cyber events, cessation of business) to the Authority within a specified time period.
• (Proposed) Persons intending to become 10%+ or majority shareholder controllers would need to notify the Authority in writing before assuming control and await a decision within 90 days.
• (Proposed) DISPs would need to file annual prudential/financial returns, and more frequent returns if required by the Authority.

Applies to

Digital Identity Service Providers (DISPs), prospective DISP licence applicants, shareholder controllers of licensed DISPs, industry stakeholders commenting on the consultation

Deadlines

• 2 September 2025: Deadline for stakeholders to submit comments and feedback on the consultation paper's proposals to policy@bma.bm.