Regulatory Policy - Registration or Licensing of Virtual Asset Service Providers

Summary

This is a CIMA regulatory policy (dated May 2024) explaining how the Cayman Islands Monetary Authority will assess applications for registration or licensing of Virtual Asset Service Providers (VASPs) under the Virtual Asset (Service Providers) Act (VASP Act) and its Regulations. It applies to persons seeking to register to carry on virtual asset service, and to persons seeking a virtual asset service licence to operate a virtual asset trading platform or provide virtual asset custody services; it does not apply to sandbox licence applicants.

The policy sets out the procedural steps for applying and the following requirement areas that CIMA will look for when deciding whether to grant registration or a licence:

• Fit and proper: Fit-and-proper requirements for applicants.
• Ownership disclosure: Ownership and beneficial ownership disclosure requirements.
• AML/CFT: AML/CFT expectations, including Part XA of the AML Regulations for entities transferring virtual assets.
• Outsourcing: Additional requirements around outsourcing arrangements.
• IT/cyber security: Additional requirements around IT and cyber security.
• Business continuity: Additional requirements around business continuity.
• Record-keeping: Additional requirements around record-keeping.

The registration regime and general policy are effective upon gazettement, but the licensing component (for trading platform operators and custodians) only takes effect once the corresponding licensing regime is formally commenced under the VASP Act and Regulations. Carrying on, marketing, or advertising virtual asset services without the applicable registration or licence is not permitted, and CIMA may reject incomplete applications, request additional information, or engage with overseas regulators as part of due diligence.

Key obligations

• Persons carrying on virtual asset service in or from the Cayman Islands must be registered, or in the case of custodial services or operating a trading platform, must hold a virtual asset service licence.
• Applicants must submit the prescribed application form(s) with all required information and pay the prescribed assessment fee to the Authority.
• A registered person who wishes to engage in activities requiring a licence (sections 10 and 11 of the VASP Act) must separately apply for that licence.
• Any changes to information provided in an application must be disclosed to the Authority within 15 days of the change and must be approved by the Authority.
• Where an approval is subject to conditions or requirements, the applicant must meet them within the prescribed time or, if none is given, within 6 months of the date of approval, or the approval becomes null and void.
• Applicants must provide a complete ownership structure chart identifying ultimate beneficial owners (UBOs) with 10% or more control, in accordance with the Beneficial Ownership and Transparency Act.
• Each UBO with 10% or more control must submit a Personal Questionnaire and supporting fit-and-proper documentation.
• Applicants whose activities involve transfer of virtual assets must demonstrate systems and controls to comply with Part XA of the Anti-Money Laundering Regulations and related VASP Act provisions, including originator/beneficiary information handling.
• Applicants must demonstrate fitness and propriety of shareholders, senior officers, AML/compliance officers and trustees, and must not carry on, market, or advertise virtual asset services without the applicable registration or licence.
• Applicants outsourcing functions must ensure outsourced service providers are adequately qualified, resourced, and fit and proper, and ideally located in non-high-risk jurisdictions.
• Applicants must demonstrate a business continuity management framework and provide details of IT/blockchain infrastructure and risk assessments.

Applies to

virtual asset service providers (VASPs), persons seeking registration under the VASP Act, persons seeking a virtual asset service licence, virtual asset trading platform operators, virtual asset custodians

Deadlines

• within 15 days of any changes: Registered persons/licensees (or applicants) must disclose to the Authority any changes to information provided in an application.
• within 6 months of the date of approval (if no other timeframe prescribed): Applicants must meet any requirements or conditions attached to an approval, or the approval becomes null and void.
• 2-3 business days: Once approval requirements are met, the Authority will issue a notification letter to the applicant within this timeframe.
• upon gazettement: The Policy (excluding the licensing component) becomes effective.
• upon commencement of the licensing regime for virtual asset trading platform operators and virtual asset custodians: The licensing component of this Policy becomes effective.