Rule - Virtual Asset Custodians and Virtual Asset Trading Platforms (December 2024)

Summary

This is a Rule issued by the Cayman Islands Monetary Authority (CIMA) under the Monetary Authority Act, setting out ongoing regulatory requirements for virtual asset custodians and virtual asset trading platforms licensed or registered under the Virtual Asset (Service Providers) Act. It covers governance, conduct of business, prudential matters (capital, recovery planning, insurance), risk management, IT/cybersecurity, custody-specific requirements, trading platform-specific requirements (order handling, clearing/settlement, leveraged trading, pricing, listing rules), and regulatory reporting obligations.

The Rule applies only to entities regulated by CIMA as virtual asset custodians or virtual asset trading platforms under the Act; it does not create new licensing categories but details the conduct and prudential standards such licensees/registrants must meet on an ongoing basis.

• Governance: Requires a fit-and-proper governing body and conflict-of-interest management.
• Client treatment: Requires fair treatment and clear disclosure to clients, and complaint handling.
• Operational controls: Requires outsourcing controls and record-keeping.
• Capital: Requires minimum regulatory capital equal to the higher of risk-based capital, six months' fixed overheads, or an amount set by the Authority.
• Prudential planning: Requires recovery planning, stress testing, and insurance.
• Risk management: Requires robust risk management and internal controls.
• Custody and trading safeguards: Requires custody- and trading-platform-specific safeguards such as segregation and safekeeping of client assets, platform resilience, transparent pricing, and listing due diligence.

The Rule states it will come into effect upon commencement of the relevant licensing sections of the Virtual Asset (Service Providers) Act for custodians and trading platforms, though CIMA encourages early adoption. Breaches are addressed under CIMA's Enforcement Manual and other powers under the Act and the Monetary Authority Act.

Key obligations

• Custodians and trading platforms must have a governing body of fit-and-proper, suitably qualified individuals who establish governance arrangements and assess director/senior officer performance and suitability at least annually.
• Any changes to ownership (legal or beneficial), directors or senior officers require the Authority's prior written approval and a fitness/propriety assessment.
• Custodians and trading platforms must maintain and implement policies to prevent, identify, manage and disclose conflicts of interest, with directors/senior officers disclosing conflicts to the governing body at least annually.
• Custodians and trading platforms must provide clients with fair, clear, non-misleading information, full disclosure of fees/commissions before transactions, and written confirmation of executed transactions.
• Custodians and trading platforms must establish and maintain complaint-handling policies, log complaints, and report to the Authority any complaints indicating material risk or control failure.
• Custodians and trading platforms must have a written outsourcing policy including due diligence, periodic review, contingency plans and exit strategies, and remain responsible for outsourced functions.
• Custodians and trading platforms must keep orderly, auditable records of business, transactions, client due diligence and client interactions, available to the Authority on request.
• Custodians and trading platforms must notify and/or seek prior Authority approval for matters required under the Act, including changes in business plans, share issuance/transfer and appointment of senior officers.
• Custodians and trading platforms must maintain regulatory capital equal to the higher of risk-based capital, six months' fixed overheads, or an amount set by the Authority, review capital adequacy at least annually, and notify the Authority of any capital breaches.
• Custodians and trading platforms must document a recovery plan with defined triggers addressing potential capital breach scenarios, and undertake stress testing when calculating capital.
• Custodians and trading platforms must maintain appropriate insurance (professional liability, loss of client assets, business interruption, cyber security) where appropriate.
• Custodians must maintain systems and procedures to safeguard client assets and record client acknowledgement when using third-party custody services.
• Trading platforms must publish accessible pricing policies, implement anti-market-abuse pricing procedures, and establish listing rules including due diligence and restrictions on assets with inbuilt anonymisation features unless holder/transaction identification is possible.
• Trading platforms providing financing (leveraged trading) must disclose terms and risks and implement measures to limit client losses and appropriate insurance.
• Custodians and trading platforms must establish a framework for regulatory reporting obligations and adhere to any reporting requirements prescribed by the Authority.
• When ceasing virtual asset services, a custodian or trading platform must notify the Authority and obtain approval for a wind-down plan ensuring minimal client disruption.

Applies to

virtual asset custodians, virtual asset trading platforms

Deadlines

• Upon commencement of the relevant sections of the Virtual Asset (Service Providers) Act relating to licensing of virtual asset custodians and virtual asset trading platforms: Effective date of this Rule; early adoption is encouraged by the Authority before this trigger.