virtual assets

Who is caught

Bermuda regulates virtual assets through two parallel licensing regimes plus a separate issuance regime, all administered by the Bermuda Monetary Authority (BMA). Scope turns on carrying on the relevant activity in or from Bermuda. Related instruments extend to digital-asset-focused insurers and to anti-money-laundering supervision.

Digital asset business

• Digital Asset Business Act 2018 (DABA): Catches persons carrying on digital asset business, including issuing, selling or redeeming digital assets, digital asset exchanges, payment services using digital assets, custodial wallet services, digital asset trust services, derivative exchange operation, digital asset services vending, and digital asset lending or repurchase transaction services.
• Licence classes: DABA licences are issued in classes, referred to across the rules as Class F (Full), Class M (Modified/sandbox) and Class T (Test).

Virtual currency business

• Virtual Currency Business Act 2018 (VCBA): Catches persons (companies, partnerships or individuals) carrying on virtual currency business, including issuing/selling/redeeming virtual currency, operating a virtual currency payment service, operating an electronic exchange, providing custodial wallet services, and acting as a virtual currency services vendor.

Digital asset issuances

• Digital Asset Issuance Act 2020 (DAIA): Catches undertakings (companies, limited liability companies and partnerships) that conduct a digital asset issuance (token sale or ICO) in or from Bermuda, replacing the earlier initial coin offering regime.

Adjacent regimes

• Class IIGB insurers: A category of Bermuda insurer engaged in digital asset (crypto) related insurance business, subject to bespoke solvency, capital and return rules under the Insurance Act 1978.
• Stablecoin issuers: DABA licensees that issue Single Currency Pegged Stablecoins (SCPS) are subject to additional supervisory expectations.
• AML/ATF supervision: Licensed digital asset businesses are designated AML/ATF regulated financial institutions and are covered by the Proceeds of Crime (AML/ATF) Regulations 2008 and related guidance.

Sources: Proceeds of Crime (Anti-Money Laundering and Anti-Terrorist Financing) Regulations 2008 · Digital Asset Business Act 2018 · Digital Asset Issuance Act 2020 · Insurance (Technical Standards) (Class IIGB Insurers) (Solvency Requirement) Rules 2020 (BR 41 / 2020) · Digital Asset Business Single Currency Pegged Stablecoins (SCPS) Guidance · Digital Asset Business Act 2018 - Head Office Guidance (April 2021) · Digital Asset Business Single Currency Pegged Stablecoins (SCPS) Guidance (May 2024) · Annex VIII - Sector-Specific Guidance Notes for Digital Asset Business (DAB) · Annex VIII - Sector-Specific Guidance Notes for Digital Asset Business · Virtual Currency Business Act 2018 · General Guidance Notes for AML/ATF Regulated Financial Institutions on AML/ATF (July 2021)

Key duties

The core duty is to be licensed or authorised before carrying on the regulated activity, followed by recurring filings, client-asset protection, governance and notification obligations. Several duties carry fixed deadlines.

Licensing and authorisation

• DABA licence: No person may carry on digital asset business in or from Bermuda without a BMA licence; the licence must be displayed and registered, and the term 'digital asset business' may not be used by unlicensed persons.
• VCBA licence: No person may carry on virtual currency business without a BMA licence; persons already operating at commencement had to apply within three months or cease. The term 'virtual currency business' is reserved to licensees.
• DAIA authorisation: An undertaking may not conduct a digital asset issuance without BMA authorisation, and must publish an issuance document containing the prescribed minimum information.

Periodic filings and deadlines

• VCBA statutory returns: Licensed undertakings must file applicable prudential rules or statutory returns no later than four months after their financial year end, keep a copy at the head office for at least five years, and file an annual certificate of compliance within the same four-month period.
• DABA annual return: Licensed undertakings must file an annual return (business, governance, AML/CFT and sanctions information per the prescribed Schedules) tied to section 7 of the Act, accompanied by audited financial statements, a business plan, a certificate of compliance and a declaration signed by two directors (or a director and an officer).
• DABA statutory financial return: Licensees must prepare a statutory financial return (auditor's report, Form 1SFS statutory balance sheet and notes) on an unconsolidated basis, in English, with comparative figures, for financial years commencing on or after 31 December 2020.
• Cyber risk return: Under the Cyber Risk Rules 2023, Class F holders file a written cyber risk return annually and Class M and Class T holders on a date determined by the Authority, each with a declaration signed by the CISO and a senior executive or director. VCBA licensees file an annual CISO cybersecurity report with independent audit.
• Annual fees: DABA licensees pay an annual fee calculated by formula based on activity and client receipts; the amended fee schedules set digital asset business fees due on or before 31 March. DAIA sets an application fee of $2,266 and authorisation fees tiered by offering size.

Client asset protection

• Segregation: Licensees providing custodial wallet services must keep client assets separate from their own, pay them into a designated client account no later than the next day after receipt, and obtain written acknowledgement (in the 2024 rules) that the bank or intermediary will not exercise set-off.
• Reconciliation and daily calculation: Client account balances must be reconciled at least monthly, completed within 10 days of the reconciliation date, and each client's credit balance calculated daily with any shortfall made good.
• Controls review and pooling: Client asset controls must be reviewed annually by a qualified person, whose report is retained at least five years; the Authority and affected clients must be informed of any pooling event as soon as practicable.
• Client disclosure: DABA and VCBA licensees must give pre-transaction risk disclosures, agreement-stage disclosures (including at least 30 days notice of material changes to terms), post-transaction written confirmations, and notify clients of cyber reporting events.

Governance and notifications

• Senior representative and head office: Licensees must appoint a senior representative who reports specified events to the Authority; DABA Class M and Class F licensees must be directed and managed from a head office in Bermuda (Class T is exempt).
• Material change and controllers: Licensees and authorised undertakings must notify the Authority of material changes to their business and of new or increased shareholder control before it takes effect.
• Auditors and accounts: Licensees must prepare annual financial statements, appoint auditors, and auditors must communicate certain matters to the Authority.
• Codes of practice: DABA and VCBA licensees must have regard to the applicable Codes of Practice covering governance, risk management, client dealings, operational cyber risk and custody; the operational cyber risk code required full compliance by 30 June 2024.
• AML/ATF obligations: As regulated financial institutions, digital asset businesses must apply customer due diligence and enhanced measures, conduct ongoing monitoring, keep records, appoint a Compliance Officer and Reporting Officer, train staff, screen for sanctions and file suspicious activity reports.
• Operational resilience: Class F digital asset businesses fall within the Operational Resilience and Outsourcing Code, requiring identification of important business services, impact tolerances, scenario testing and an annual board-approved self-assessment retained for five years, with a general compliance deadline of 31 March 2028.

Sources: Proceeds of Crime (Anti-Money Laundering and Anti-Terrorist Financing) Regulations 2008 · Digital Asset Business (Custody of Client Assets) Rules 2025 · Digital Asset Business Act 2018 · Digital Asset Business (Cyber Risk) Rules 2023 · Digital Asset Business Accounts Rules 2021 · Schedules - Digital Asset Business Account Rules · Digital Asset Business (Prudential Standards) (Annual Return) Rules 2018 (BR 98 / 2018) · Digital Asset Business (Client Disclosure) Rules 2018 · Digital Asset Business Exemption Order 2023 (BR 66 / 2023) · Digital Asset Issuance Act 2020 · Digital Asset Business - Operational Cyber Risk Management Code of Practice (January 2024) · Digital Asset Business - Code of Practice (February 2024) · Digital Asset Business Act 2018 - Head Office Guidance (April 2021) · ALC Information Bulletin - DAB Application Process · Digital Asset Business (Prudential Standards) (Annual Return) Rules 2018 · Digital Asset Business (Custody of Client Assets) Rules 2024 · Virtual Currency (Cybersecurity) Rules 2018 · Virtual Currency (Client Disclosure) Rules 2018 · Virtual Currency Business (Prudential Standards) (Annual Return) Rules 2018 · Virtual Currency Business Act 2018 · General Guidance Notes for AML/ATF Regulated Financial Institutions on AML/ATF (July 2021)

Exemptions and carve-outs

The instruments provide licensing exemptions, private-offer carve-outs and reduced rule sets, several of which are conditional on notifying the Authority or filing declarations.

Digital asset business licensing

• Specified persons: Under the Digital Asset Business Exemption Order 2023, the Authority, the Government of Bermuda and entities it owns, and public authorities are automatically exempt from the DABA licensing prohibition with no notification required.
• Non-specified persons: Affinity or rewards programme providers with non-redeemable value, game publishers issuing in-game value usable only within their platform, certain data storage or security service providers, undertakings conducting digital asset activity solely for their own or group business, and investment funds with a licensed or recognised investment manager are exempt, but must notify the Authority and file an annual declaration signed by a director on or before 31 March each year.

Issuance private placements

• DAIA private offers: Offers to no more than 150 persons, to qualified acquirers, or to persons whose business involves dealing in digital assets avoid public-offer treatment, but only if a digital asset placement declaration form is filed with the Authority before the transaction.
• Reduced rule sets: Under the Digital Asset Issuance Rules 2020, issuers relying on an accredited digital asset business, qualifying as a local issuer, or whose issuance is authorised or vetted by another competent authority benefit from reduced rule sets, but must first file an exemption form with the Authority.

Investment business overlap

• Non-registrable persons: The Investment Business (Non-Registrable Persons) (Designation) Order 2022 designates DABA licensees carrying on investment business ancillary to their licensed digital asset business (along with investment funds and various insurance registrants) as outside the Investment Business Act 2003 registration requirement.
• Ancillary revenue threshold: Guidance treats a DAB as a non-registrable person only where investment business revenue does not exceed 25% of total gross revenue; a 25% to 35% buffer is permitted for up to one year, with breaches notified forthwith by the senior representative.

Other carve-outs

• Head office: The section 21 head office requirement applies only to Class M and Class F licensees; Class T (Test) licensees are exempt.
• Operational resilience: Only Class F digital asset businesses are within scope of the Operational Resilience and Outsourcing Code, and entities under a regulatory sandbox or test licence are excluded.

Sources: Investment Business (Non-Registrable Persons) (Designation) Order 2022 · Digital Asset Business Exemption Order 2023 (BR 66 / 2023) · Digital Asset Issuance Act 2020 · Digital Asset Issuance Rules 2020 · Guidance Notes - Guidance for DAB Conducting Investment Business in an Ancillary Manner - October 2022 (Revised) · Operational Resilience and Outsourcing Code (September 2025) · Digital Asset Business Act 2018 - Head Office Guidance (April 2021)

Enforcement and penalties

The BMA holds broad supervisory and disciplinary powers under each Act, and AML/ATF breaches carry both criminal and substantial civil exposure.

Supervisory and disciplinary powers

• DABA: The Authority may impose civil penalties, issue public censures, prohibition orders, warning and decision notices, restrict or revoke licences, and conduct investigations, with rights of appeal for licensees.
• DAIA: The Authority may restrict, revoke or attach conditions to authorisations, object to shareholder controllers, impose civil penalties, issue public censures and prohibition orders, obtain information and conduct investigations, subject to appeal to a tribunal. Misstatements in an issuance document attract offence and civil liability provisions.
• VCBA: The Authority may impose civil penalties, issue public censures, make prohibition orders, restrict or revoke licences, and conduct investigations, with rights of appeal to tribunals. Failure to file audited financial statements, accounts or required returns within the four-month deadline attracts a civil penalty of up to $5,000 per week or part-week of default.

AML/ATF enforcement

• Criminal offences: Breach of specified requirements under Parts 3 and 4 of the Proceeds of Crime (AML/ATF) Regulations 2008 is an offence; the digital asset sector guidance states fines of up to $50,000 on summary conviction and up to $750,000 and/or two years' imprisonment on indictment.
• Civil penalties: The sector guidance notes the BMA may impose civil penalties of up to $10,000,000 per breach under the Supervision and Enforcement Act 2008.

Codes of practice

Non-compliance with the Codes of Practice is not a standalone offence but is treated as a factor when the Authority assesses whether a licensee is conducting business in a sound and prudent manner.

Sources: Proceeds of Crime (Anti-Money Laundering and Anti-Terrorist Financing) Regulations 2008 · Digital Asset Business Act 2018 · Digital Asset Issuance Act 2020 · Digital Asset Business - Operational Cyber Risk Management Code of Practice (January 2024) · Digital Asset Business - Code of Practice (February 2024) · Annex VIII - Sector-Specific Guidance Notes for Digital Asset Business (DAB) · Annex VIII - Sector-Specific Guidance Notes for Digital Asset Business · Virtual Currency Business Act 2018