virtual assets

Who is caught

Bermuda regulates virtual assets (referred to in the instruments as digital assets) principally through two statutes administered by the Bermuda Monetary Authority (the Authority): the Digital Asset Business Act 2018, which licenses persons carrying on digital asset business, and the Digital Asset Issuance Act 2020, which authorises offerings of digital assets to the public. Related rules, codes and guidance sit under these Acts, and separate regimes address digital asset exposure in insurance and AML/ATF supervision.

Digital asset business

• Regulated activities: Under the Digital Asset Business Act 2018, digital asset business covers issuing, selling or redeeming digital assets, digital asset exchanges, payment services using digital assets, custodial wallet services, digital asset trust services, operating a derivative exchange, digital asset services vending, and digital asset lending or repurchase transaction services.
• Carrying on in or from Bermuda: No person may carry on digital asset business in or from Bermuda without a licence issued by the Authority under the Act, subject to any exemption orders.
• Licence classes: The regime distinguishes Class T (test), Class M (modified/sandbox) and Class F (full) licences, referenced across the rules, codes and application guidance.

Digital asset issuances

• Who is caught: Under the Digital Asset Issuance Act 2020, an undertaking (a company, limited liability company or partnership) may not conduct a digital asset issuance (for example a token sale or ICO) in or from Bermuda without authorisation from the Authority.
• Related parties: The Digital Asset Issuance Rules 2020 also reach local issuers, accredited digital asset businesses, and third-party custodians and service providers of issuers.

Adjacent regimes

• Class IIGB insurers: The Insurance (Technical Standards) (Class IIGB Insurers) Rules 2020 apply to Class IIGB insurers, a category of Bermuda insurer engaged in digital asset related insurance business.
• AML/ATF status: Licensed digital asset businesses are designated AML/ATF regulated financial institutions and fall within the Proceeds of Crime (Anti-Money Laundering and Anti-Terrorist Financing) Regulations 2008 and the Authority's AML/ATF guidance, including the sector-specific Annex VIII for digital asset business.
• Operational resilience: The Operational Resilience and Outsourcing Code (September 2025) applies to Class F digital asset businesses, among other regulated entities.

Sources: Proceeds of Crime (Anti-Money Laundering and Anti-Terrorist Financing) Regulations 2008 · Digital Asset Business Act 2018 · Digital Asset Issuance Act 2020 · Digital Asset Issuance Rules 2020 · Insurance (Technical Standards) (Class IIGB Insurers) (Solvency Requirement) Rules 2020 (BR 41 / 2020) · Operational Resilience and Outsourcing Code (September 2025) · Annex VIII - Sector-Specific Guidance Notes for Digital Asset Business (DAB) · Annex VIII - Sector-Specific Guidance Notes for Digital Asset Business

Key duties

The core continuing duties fall on digital asset business licensees under the Digital Asset Business Act 2018 and its subsidiary rules and codes, with a parallel set of obligations for authorised issuers under the Digital Asset Issuance Act 2020. Several filings recur annually or on dates set by the Authority.

Licensing and authorisation

• Licence or authorisation: Obtain and maintain the relevant licence (digital asset business) or authorisation (digital asset issuance) before carrying on the activity; licences must be displayed and registered.
• Fees: Digital asset business licensees pay annual fees calculated by formula based on activity and client receipts, subject to minimum and maximum amounts. Digital asset issuance applicants pay an application fee of $2,266 and authorisation fees tiered by offering size (from $5,000 up to $50,000 for direct offerings, half that through an accredited digital asset business). DAB application fees are $1,000 for a T licence and $2,266 for an M or F licence.

Periodic filings

• Annual return: Licensed undertakings must file an annual return under section 7 of the Act containing the Schedule I/II (or Schedules 1-3) prudential, AML/CFT and sanctions information, accompanied by audited financial statements, a business plan for the next financial year, a certificate of compliance, and a declaration signed by two directors, or a director and an officer.
• Statutory financial return: Under the Digital Asset Business Accounts Rules 2021, licensees prepare a statutory financial return (auditor's report, statutory balance sheet on Form 1SFS, and notes) on an unconsolidated basis, from the first financial year after obtaining the licence.
• Cyber risk return: Under the Digital Asset Business (Cyber Risk) Rules 2023, Class F holders file a written cyber risk return annually and Class M and Class T holders on a date set by the Authority, each with a declaration signed by the Chief Information Security Officer and a senior executive or director.
• Custody controls review: Under the Custody of Client Assets Rules, licensees providing custodial wallet services must have client asset controls reviewed annually by a qualified person, whose report is retained for at least five years and produced to the Authority on request.
• Issuer periodic returns: Authorised issuers must file periodic electronic returns within the periods and intervals specified in their authorisation, with a signed director/officer declaration.
• Insurer solvency return: Class IIGB insurers calculate their enhanced capital requirement at each financial year end and file a Capital and Solvency Return by the date set under section 17(4)(b) of the Insurance Act 1978.

Client assets and disclosure

• Segregation: Client assets must be kept separate from the licensee's own assets and paid into a designated client account, generally no later than the next day after receipt, with daily calculation of client balances and at least monthly reconciliation completed within 10 days.
• Client disclosure: Under the Client Disclosure Rules 2018, licensees must give pre-transaction risk disclosures, agreement-time disclosures (including at least 30 days notice of material changes to terms), post-transaction written confirmations, and notify affected clients of cyber reporting events.

Governance and notifications

• Senior representative: Licensees must appoint a senior representative who reports specified events to the Authority; issuers must appoint and maintain a local representative.
• Head office: Class M and Class F licensees must be directed and managed from a head office in Bermuda under section 21 of the Act (Class T is exempt).
• Material change: Licensees and authorised issuers must notify the Authority of material changes to their business; the guidance treats new products or business lines as a material change under section 22 unless a section 8 waiver is obtained.
• Shareholder control: New or increased shareholder control must be notified to the Authority.
• Pooling event: On a pooling event, the licensee must inform the Authority and affected clients as soon as practicable.
• Codes of practice: The Digital Asset Business Codes of Practice set governance, risk management, custody and operational cyber risk standards; failure to follow them is a factor the Authority weighs in assessing whether business is conducted in a sound and prudent manner.

AML/ATF

• AML programme: As AML/ATF regulated financial institutions, digital asset businesses must apply customer due diligence and ongoing monitoring, appoint a Compliance Officer and a Reporting Officer, screen against sanctions, train staff, keep records, and report suspicions to the Financial Intelligence Agency under the Proceeds of Crime (AML/ATF) Regulations 2008 and the related guidance.

Sources: Proceeds of Crime (Anti-Money Laundering and Anti-Terrorist Financing) Regulations 2008 · Digital Asset Business (Custody of Client Assets) Rules 2025 · Digital Asset Business Act 2018 · Digital Asset Business (Cyber Risk) Rules 2023 · Digital Asset Business Accounts Rules 2021 · Digital Asset Business (Prudential Standards) (Annual Return) Rules 2018 (BR 98 / 2018) · Digital Asset Business (Client Disclosure) Rules 2018 · Digital Asset Issuance Act 2020 · Digital Asset Issuance Rules 2020 · Insurance (Technical Standards) (Class IIGB Insurers) (Solvency Requirement) Rules 2020 (BR 41 / 2020) · Guidance Note - Digital Asset Business - Guidance for prospective applicants for licensing (September 2025) · Digital Asset Business - Operational Cyber Risk Management Code of Practice (January 2024) · Digital Asset Business Custody Code of Practice (February 2024) · Information Bulletin - DAB Application Process (February 2024) · Digital Asset Business - Code of Practice (February 2024) · Digital Asset Business Act 2018 - Head Office Guidance (April 2021) · Information Bulletin Digital Asset Business Application Process · Digital Asset Business (Prudential Standards) (Annual Return) Rules 2018 · Digital Asset Business (Custody of Client Assets) Rules 2024 · Annex VIII - Sector-Specific Guidance Notes for Digital Asset Business (DAB) · Annex VIII - Sector-Specific Guidance Notes for Digital Asset Business · Digital Asset Business Code of Practice (April 2022) · Digital Asset Business Act 2018 - Code of Practice (April 2023)

Exemptions and carve-outs

The instruments provide exemptions from digital asset business licensing, from public-offer treatment for issuances, and from separate investment business registration where digital asset activity is the primary business.

Licensing exemptions

• Specified persons: Under the Digital Asset Business Exemption Order 2023, the Authority, the Government of Bermuda and any entity it owns, and any public authority are automatically exempt from the licensing prohibition with no notification required.
• Non-specified persons: The same Order exempts, subject to notification and an annual declaration by 31 March, providers of affinity or rewards programmes with non-redeemable value, game publishers issuing in-game value usable only within their own platforms, data storage or security service providers not otherwise engaged in digital asset business for others, undertakings conducting digital asset activity solely for their own or a group undertaking's operations, and investment funds that have appointed a licensed or recognised investment manager.

Issuance exemptions

• Private placements: Under the Digital Asset Issuance Act 2020, offers to no more than 150 persons, to qualified acquirers, or to persons whose business involves dealing in digital assets can avoid public-offer treatment, but only if a digital asset placement declaration form is filed with the Authority before the transaction.
• Reduced rule sets: Under the Digital Asset Issuance Rules 2020, issuers relying on an accredited digital asset business, qualifying as a local issuer, or whose issuance is authorised or vetted by another competent authority benefit from reduced requirements, but must file an exemption form with the Authority before proceeding.

Ancillary investment business

• Non-registrable persons: The Investment Business (Non-Registrable Persons) (Designation) Order 2022 designates a digital asset business licensee carrying on investment business ancillary to its licensed activity as a Non-registrable Person, so no separate Investment Business Act 2003 licence is required.
• Ancillary revenue threshold: The related guidance treats investment activity as ancillary where its gross revenue does not exceed 25% of total gross revenue from combined activities, with a buffer zone up to 35% permitted for no more than one year subject to notification and a remediation or licensing plan.

Other carve-outs

• Class T head office: The head office requirement in section 21 of the Act applies only to Class M and Class F licensees; Class T licensees are exempt.
• Sandbox and test licensees: The Operational Resilience and Outsourcing Code excludes entities under a regulatory sandbox or test licence from its scope.

Sources: Investment Business (Non-Registrable Persons) (Designation) Order 2022 · Digital Asset Business Exemption Order 2023 (BR 66 / 2023) · Digital Asset Issuance Act 2020 · Digital Asset Issuance Rules 2020 · Guidance Notes - Guidance for DAB Conducting Investment Business in an Ancillary Manner - October 2022 (Revised) · Guidance for Entities Seeking Exemption from Dual Licensing Due to Ancillary Nature of Activities · Operational Resilience and Outsourcing Code (September 2025) · Operational Resilience and Outsourcing Code (September 2025) (Tracked Changes) · Digital Asset Business Act 2018 - Head Office Guidance (April 2021)

Enforcement and penalties

Enforcement powers differ by instrument. The digital asset statutes give the Authority a suite of supervisory and disciplinary powers, while specific fine amounts in the indexed documents appear in the AML/ATF context.

Digital asset statutes

• Under the Digital Asset Business Act 2018: The Authority may impose civil penalties, issue public censures, prohibition orders, warning and decision notices, restrict or revoke licences, and conduct investigations, with rights of appeal for licensees. Use of the words "digital asset business" by unlicensed persons is prohibited.
• Under the Digital Asset Issuance Act 2020: The Authority may restrict, revoke or attach conditions to authorisations, object to shareholder controllers, impose civil penalties, issue public censures and prohibition orders, obtain information and documents, and conduct investigations, subject to rights of appeal to a tribunal. Misstatements in an issuance document attract offence and civil liability provisions.

AML/ATF

• Criminal offences: The sector-specific AML/ATF guidance states that failure to comply with the underlying Regulations is a criminal offence carrying fines of up to $50,000 on summary conviction or up to $750,000 and/or two years' imprisonment on indictment.
• Civil penalties: The same guidance states the Authority may impose civil penalties of up to $10,000,000 per breach under the Supervision and Enforcement Act 2008.
• Regulations: Breach of specified requirements in Parts 3 and 4 of the Proceeds of Crime (AML/ATF) Regulations 2008 constitutes an offence.

Codes of practice

Non-compliance with the Digital Asset Business codes of practice is not itself framed as a standalone offence; it is a factor the Authority takes into account when assessing whether a licensee is conducting business in a sound and prudent manner.

Sources: Proceeds of Crime (Anti-Money Laundering and Anti-Terrorist Financing) Regulations 2008 · Digital Asset Business Act 2018 · Digital Asset Issuance Act 2020 · Digital Asset Business - Code of Practice (February 2024) · Annex VIII - Sector-Specific Guidance Notes for Digital Asset Business (DAB) · Annex VIII - Sector-Specific Guidance Notes for Digital Asset Business · Digital Asset Business Code of Practice (April 2022)