Statement of Principles – Conduct of Virtual Asset Services (February 2021)

Summary

This is a Statement of Principles issued by the Cayman Islands Monetary Authority (CIMA) in February 2021, setting out the general conduct standards expected of virtual asset service providers (VASPs) operating in or from the Cayman Islands. It is issued under section 34(1)(a) of the Monetary Authority Act, which allows CIMA to issue statements of principle concerning the conduct of licensees and other persons subject to the regulatory Acts. The document does not create new licensing or filing requirements itself, but establishes twelve conduct principles that CIMA will use as a benchmark to assess whether VASPs are operating appropriately, and contraventions may trigger enforcement action under CIMA's Enforcement Manual and other statutory powers.

The Twelve Conduct Principles

• Honesty and integrity
• Fair treatment of customers
• Protection of customer data
• Segregation and protection of customer assets
• Maintenance of cyber security systems
• Due skill, care and diligence
• AML/CFT compliance systems
• Management of conflicts of interest and unfair trading practices
• Maintenance of adequate financial and non-financial resources, including capital and insurance
• Full disclosure to customers
• Corporate governance and resilience, including wind-down planning
• General compliance with applicable regulatory Acts

It applies to all persons providing virtual asset services as defined in the Virtual Asset (Service Providers) Act, 2020, including those registered, licensed, or granted a waiver under that Act. The document should be read alongside the VASP Act, AML Regulations, and CIMA's AML/CFT Guidance Notes, and it does not specify commencement or transitional deadlines beyond its February 2021 issuance.

Key obligations

• Conduct operations and communications honestly and ethically, avoiding risk to the public or the reputation of the Cayman Islands
• Treat customers fairly, communicate accurately and understandably, and handle complaints in a timely and consistent manner
• Protect customer personal data through adequate storage, data protection, maintenance and record-keeping measures
• Protect and segregate customer assets from proprietary assets
• Maintain appropriate systems and security access protocols to guard against cyber threats, with staff and board awareness of cyber risks
• Conduct business with due skill, care and diligence, employing forward-looking risk management practices
• Maintain systems, policies, processes and procedures to ensure compliance with Anti-Money Laundering Regulations and related financial crime laws
• Identify and manage conflicts of interest and implement mechanisms to prevent price manipulation, collusion and front-running
• Maintain adequate financial and non-financial resources, including adequate capital and insurance against theft or loss
• Provide full and proper disclosure of capacity, risks, commissions/inducements, and custodial/third-party arrangements to customers
• Maintain effective corporate governance arrangements and contingency planning, including for wind-down scenarios, to minimize customer loss and disruption
• Maintain systems, policies, processes and procedures to ensure compliance with applicable regulatory Acts

Applies to

virtual asset service providers, persons engaged in virtual asset services