SoG - Virtual Asset Custodians and Virtual Asset Trading Platforms

Summary

This document is a Statement of Guidance (SoG) issued by the Cayman Islands Monetary Authority (CIMA) in December 2024, setting out CIMA's minimum supervisory expectations for virtual asset custodians and virtual asset trading platforms licensed or registered under the Virtual Asset (Service Providers) Act. It is issued under section 34(1)(a) of the Monetary Authority Act and is meant to be read alongside existing AML/CFT, governance, cybersecurity, outsourcing and other regulatory requirements applicable to these entities.

• Governance: Board composition and independent review of policies.
• Conduct of business: Conflicts of interest, treating clients fairly, disclosures, risk warnings, marketing, complaints handling, and client protection.
• Prudential expectations: Covered as part of the guidance.
• Risk management: Covered as part of the guidance.
• IT and cybersecurity: Covered as part of the guidance.
• Virtual asset custody services: Specific expectations set out for custody operations.
• Trading platform operations: Order execution, price transparency, and listing/delisting procedures.

Most provisions are framed as expectations ('should') rather than strict legal mandates, reflecting the non-prescriptive, principles-based nature typical of a Statement of Guidance, though CIMA states these represent its minimum expectations for managing VASP-related risks. Firms are expected to design and document policies and procedures addressing each of the areas covered, and CIMA may request evidence of compliance (e.g., marketing records) during supervision.

Key obligations

• Custodians and trading platforms should have the governing body undertake a formal review by an independent third party, on an annual basis, of the effectiveness of policies and procedures.
• Custodians and trading platforms should establish and maintain a register of potential and existing conflicts of interest along with mitigating measures.
• Custodians and trading platforms should disclose to clients any conflict of interest or potential conflict of interest.
• Custodians and trading platforms should provide clients with clear, accurate, non-misleading information, including the entity's name and CIMA authorised number, prior to and during transactions.
• Custodians and trading platforms should inform clients of the regulated activity performed and the authority responsible for regulating it.
• Custodians and trading platforms should acknowledge receipt of client complaints in writing within 7 days.
• Custodians and trading platforms should maintain a record of complaints received and remediation actions taken, and provide the governing body with regular complaints reports.
• Clients should be able to file complaints free of charge.
• Custodians and trading platforms should maintain records of marketing communications or promotional campaigns and make them available to the Authority if requested.
• Custodians and trading platforms should ensure clients understand and acknowledge risk warnings provided, including on volatility, custody/transfer risks, and (for trading platforms) leverage/derivative risks.
• Custodians and trading platforms should inform clients of typical withdrawal/account closure processing timeframes and any withdrawal limits.
• Trading platforms should develop procedures for listing and delisting virtual assets, including consideration by a listing committee or the governing body, and should make listing/delisting decisions public.
• Trading platforms should implement controls to reject transactions exceeding internal volume and price thresholds.
• Trading platforms should monitor listed virtual assets on an ongoing basis for continued regulatory compliance.

Applies to

virtual asset custodians, virtual asset trading platforms

Deadlines

• within 7 days: Custodians and trading platforms should acknowledge receipt of client complaints in writing within 7 days.
• annual basis: The governing body should undertake a formal independent third-party review of policies and procedures on an annual basis.