Stakeholder Letter - Consultation on the Proposed Framework for Digital Identity Service Providers (DISP) (2025-04-29)

Summary

This is a stakeholder letter from the Bermuda Monetary Authority summarising feedback received during its consultation on a proposed regulatory framework for Digital Identity Service Providers (DISP) and outlining the resulting policy direction. It does not itself create binding rules; it signals the design choices the Authority intends to carry into the eventual DISP legislation and regulatory instruments, which will be subject to further public consultation before implementation.

• Scope: All providers engaging in licensable DISP activities will fall within the framework, except those acting solely as an outsourced service provider to a licensed DISP; details of licensable activities will appear in a future draft bill.
• Outsourcing: Outsourcing will be permitted, but the licensed DISP retains full responsibility and accountability for outsourced functions.
• Vetting/KYC: DISPs will be limited to Identification and Verification (IDV) functions; KYC and vetting responsibility remains with Relying Parties (RPs) such as financial institutions.
• Standards: No specific international standard will be mandated, but the framework will impose core cybersecurity and data protection standards aligned with existing international norms.
• Licensing model: A tiered licensing framework will be adopted, and the regime will be mandatory rather than opt-in.
• Physical presence: Physical presence in Bermuda remains a requirement, which can be satisfied by appointing a designated senior representative responsible for regulatory compliance and liaison with Bermuda authorities.
• Public-private partnership: The Authority will relay stakeholder support for a government-issued Digital ID (PPP model) to the Government for further exploration.

The Authority states it will next finalise the framework's provisions and develop supporting regulatory instruments, all of which will go through further public consultation before taking effect. No specific dates or deadlines for these next steps are given in this letter.

Applies to

Digital Identity Service Providers (DISP), Registered Financial Institutions (RFIs), Relying Parties (RP)