virtual assets

Who is caught

Virtual asset regulation in the Cayman Islands is built primarily on the Virtual Asset (Service Providers) Act (2024 Revision), which regulates persons who provide virtual asset services in or from within the Islands. Related instruments extend the regime into fund structures, securities investment business, anti-money laundering and international tax reporting, so a single crypto-related business can fall within several of these frameworks at once.

Virtual asset service providers

• Covered entities: The Virtual Asset (Service Providers) Act applies to legal entities (companies, partnerships, exempted limited partnerships, foreign companies, LLCs and LLPs) that carry on virtual asset services as a business from the Cayman Islands. Natural persons are prohibited from carrying on such business at all.
• Covered activities: Virtual asset service is defined to include exchange, transfer, custody, and services related to virtual asset issuances. Providers of custody services and operators of virtual asset trading platforms must hold a full licence rather than merely being registered.
• Authorisation categories: Depending on the activity, a provider must register with CIMA, obtain a virtual asset service licence, obtain a sandbox licence for innovative or limited-scale testing, or, if already licensed under another Cayman regulatory law, obtain a waiver as an existing licensee.
• Formal recognition of the regime: The Monetary Authority (Amendment) (No.2) Law, 2020 added the Virtual Asset (Service Providers) Law, 2020 to the definition of regulatory laws administered by CIMA, bringing VASPs formally within CIMA's remit.

Tokenised funds

• Tokenised mutual funds: The Mutual Funds (Amendment) Act, 2026 applies to mutual funds that represent some or all of their equity interests using digital equity tokens, and to their operators and licensed mutual fund administrators.
• Tokenised private funds: The Private Funds (Amendment) Act, 2026 applies to private funds registered (or applying to register) with CIMA whose investment interests are represented by digital investment tokens, and to the operators of such funds.

Securities, AML and tax reporting

• Securities investment business: The Securities Investment Business (Amendment) Law, 2020 brings certain virtual assets and virtual asset trading platforms within, or coordinates them with, the securities investment business framework, and the Securities Investment Business (Amendment and Validation) Act, 2024 addresses operators of virtual asset trading platforms within that regime.
• AML/CFT relevant financial business: Under the Proceeds of Crime Act (2025 Revision), providers of virtual asset services are listed in Schedule 1 as conducting relevant financial business, bringing them within the AML/CFT regime and the Anti-Money Laundering Regulations (2025 Revision).
• Crypto-asset tax reporting: The Crypto-Asset Reporting Framework Regulations, 2025 apply to Cayman Reporting Crypto-Asset Service Providers, broadly crypto-asset service providers resident in or with a branch in the Islands, including exchanges, brokers, dealers, intermediaries, trading platforms and operators of relevant crypto-asset ATMs.

Sources: Mutual Funds (Amendment) Act, 2026 (Act 5 of 2026) · Private Funds (Amendment) Act, 2026 (Act 6 of 2026) · Proceeds of Crime Act (2025 Revision) · Securities Investment Business (Amendment and Validation) Act, 2024 (Act 21 of 2024) · Securities Investment Business (Amendment) Law, 2020 (Law 16 of 2020) · Virtual Asset (Service Providers) Act (2024 Revision) · Tax Information Authority (International Tax Compliance) (Crypto-Asset Reporting Framework) Regulations, 2025 (SL 51 of 2025) · CARF Quick Guide · Monetary Authority (Amendment) (No.2) Law, 2020 (Law 15 of 2020)

Key duties

The core continuing obligations attach to authorisation under the Virtual Asset (Service Providers) Act, layered with sector rules and, where applicable, AML and tax-reporting duties. The duties below lead with authorisation and the provisions that carry express deadlines.

Authorisation and fees

• Licensing gateway: A person must not carry on virtual asset service in or from the Islands unless registered, licensed (including a sandbox licence), or granted a waiver as an existing licensee. Custody providers and trading platform operators must hold a licence.
• Fees and deadlines: Under the Virtual Asset (Service Providers) (Amendment) Act, 2024, application, registration and licence fees are non-refundable, and an approved applicant must pay the prescribed fee within thirty days of notification of approval or the approval is cancelled. A registered person who at commencement is engaged in an activity requiring a licence must apply for a licence within ninety days.
• Prescribed application forms: The Virtual Asset (Service Providers) (Amendment) Regulations, 2025 require licence applications to use the prescribed Schedule 1A form, with additional parts for custody and trading platform applicants, and a declaration signed by two senior officers. Registration applications use the form under the Virtual Asset (Service Providers) Regulations, 2020.

Governance and notifications

• Directors and fitness: VASPs must maintain at least three directors at all times, including one independent director, and satisfy CIMA that shareholders, directors, beneficial owners and senior officers are fit and proper.
• Business plan changes: VASPs must carry on services only in accordance with their approved business plan and obtain prior written CIMA approval before changing it or adding new services.
• Corporate-change notification: VASPs must notify CIMA within thirty days of specified changes, such as establishing a subsidiary, agency, branch or other physical presence, or facing penalties, enforcement actions or litigation.
• Share transfers: Shares of a licensee must not be issued or transferred without CIMA's prior approval.
• Cancellation notifications: Under CIMA's Rule on cancellation of licences, registrations or waivers, a VASP must notify CIMA in writing within 15 days of deciding to cease operations, notify at least 15 days before the one-year mark if it anticipates not commencing business, protect client data and assets, and notify material changes within 15 days.

Conduct, custody and platform requirements

• General conduct: The Rule and Statement of Guidance on Market Conduct for VASPs requires regulated entities to act honestly and in clients' best interests, manage and disclose conflicts of interest, maintain confidentiality, and disclose withdrawal and closure timeframes.
• Custodian and platform rules: CIMA's Rule for virtual asset custodians and trading platforms sets ongoing governance, conduct, outsourcing, record-keeping, prudential and reporting requirements, including regulatory capital equal to the higher of risk-based capital, six months' fixed overheads, or an amount set by CIMA, recovery planning, stress testing, insurance, and (for platforms) pricing transparency and listing due diligence.
• Incident notification: Virtual asset custodians must notify CIMA no later than 72 hours after discovery of a material incident and notify affected clients promptly. Under the Cybersecurity Rule, regulated entities more broadly must notify CIMA immediately and in any event within 72 hours of a material cybersecurity incident.
• Audit: Licensees are subject to audit requirements, and their auditors have statutory duties to report to CIMA.
• Quarterly returns: VASPs must file the VFR-051-84 Financial Quarterly Return through CIMA's REEFS portal within the timeframe prescribed by CIMA, reporting in US dollars and providing truthful attestations.

AML and tax reporting

• Virtual asset transfer records: When performing a virtual asset transfer, providers must collect and maintain originator and beneficiary information under the Anti-Money Laundering Regulations and provide those records to CIMA or a competent authority within forty-eight hours of a request. The Regulations contain a dedicated regime (Part 10A) for transfers of virtual assets.
• AML programme: VASPs, as financial service providers, must maintain an AML/CFT/CPF compliance programme, appoint an AML Compliance Officer, MLRO and DMLRO, conduct risk assessments, perform customer due diligence, keep records and file suspicious activity reports.
• CARF reporting: Cayman Reporting Crypto-Asset Service Providers must register with the Authority (pre-existing CRCASPs by 30 April 2026), collect self-certifications, submit annual returns, file change notices within thirty days, and keep records. First reporting is due 30 June 2027 for the 2026 calendar year.

Tokenised funds

• Annual records confirmation: Operators of tokenised mutual funds and tokenised private funds must confirm annually to CIMA that all records relating to issuance, creation, sale, transfer and ownership of token-represented interests have been properly kept.
• Transfer approval: Interests represented by a digital token are only transferable with the operator's approval, in accordance with the offering document.
• Risk disclosure: Offering documents must disclose token-specific risks, including cybersecurity and transferability risks, and set out how they are mitigated, and funds must comply with any characteristic restrictions and periodic reporting CIMA imposes.

Sources: Anti-Money Laundering Regulations (2025 Revision) · Mutual Funds (Amendment) Act, 2026 (Act 5 of 2026) · Private Funds (Amendment) Act, 2026 (Act 6 of 2026) · Virtual Asset (Service Providers) (Amendment) Act, 2024 (Act 22 of 2024) · Virtual Asset (Service Providers) (Amendment) Regulations, 2025 (SL 19 of 2025) · Virtual Asset (Service Providers) Act (2024 Revision) · Virtual Asset (Service Providers) Regulations, 2020 (SL 138 of 2020) · Rule - Cancellation of Licences, Registrations, or Waivers for Virtual Asset Service Providers · Rule and Statement of Guidance - Market Conduct for Virtual Asset Service Providers · Rule – Virtual Asset Custodians and Virtual Asset Trading Platforms · Tax Information Authority (International Tax Compliance) (Crypto-Asset Reporting Framework) Regulations, 2025 (SL 51 of 2025) · Rule - Cybersecurity for Regulated Entities (April 2023) · VFR-051-84 VASP Financial Quarterly Return Form - Completion Guide · Rule - Virtual Asset Custodians and Virtual Asset Trading Platforms (December 2024)

Exemptions and carve-outs

The instruments provide several carve-outs, mostly to avoid double-regulation between the VASP regime and adjacent frameworks.

• Existing licensee waiver: A person already licensed under another Cayman regulatory law may give notice to CIMA and, where required, apply for a waiver instead of separate VASP authorisation under the Virtual Asset (Service Providers) Act.
• Securities investment business: Under the Securities Investment Business (Amendment and Validation) Act, 2024, CIMA must exempt operators of virtual-asset-only trading platforms from licensing or registration under that Act, and may exempt other persons whose activities are better supervised under, or already licensed under, the Virtual Asset (Service Providers) Act. Under the Securities Investment Business (Amendment) Law, 2020, an exempted person must apply for a VASP licence.
• Tokenised fund token issuance: The Virtual Asset (Service Providers) (Amendment) Act, 2026 clarifies that issuance of digital equity tokens by a tokenised mutual fund, or digital investment tokens by a tokenised private fund, in compliance with the Mutual Funds Act and Private Funds Act, is excluded from the scope of virtual asset issuance under the VASP Act.
• Cybersecurity Rule: CIMA's Cybersecurity Rule applies to CIMA-regulated entities but expressly excludes regulated mutual funds and private funds.
• Transitional safe harbour (spent): The Virtual Asset (Service Providers) (Savings and Transitional) Regulations, 2021 gave pre-existing providers a window to continue operating and a limited safe harbour from criminal liability and administrative fines if they took specified steps before 31 January 2021. All operative dates are now past, so these provisions are spent.
• CARF exempted bodies: The Crypto-Asset Reporting Framework Regulations, 2025 refer to exempted bodies that are not required to submit the registration form otherwise due from pre-existing CRCASPs.

Sources: Securities Investment Business (Amendment and Validation) Act, 2024 (Act 21 of 2024) · Securities Investment Business (Amendment) Law, 2020 (Law 16 of 2020) · Virtual Asset (Service Providers) (Amendment) Act, 2026 (Act 4 of 2026) · Virtual Asset (Service Providers) (Savings and Transitional) Regulations, 2021 (SL 2 of 2021) · Virtual Asset (Service Providers) Act (2024 Revision) · Tax Information Authority (International Tax Compliance) (Crypto-Asset Reporting Framework) Regulations, 2025 (SL 51 of 2025) · Rule - Cybersecurity for Regulated Entities (April 2023)

Enforcement and penalties

Enforcement runs through both criminal offences in the primary statutes and CIMA's administrative fines regime, with separate penalty provisions for crypto-asset tax reporting. The summaries attribute these powers to distinct instruments, which should be kept separate.

• VASP criminal offence: Under the Virtual Asset (Service Providers) Act (2024 Revision), carrying on virtual asset service business without the required licence, registration or waiver is a criminal offence, and corporate or partnership officers can be held personally liable for offences committed by the entity.
• Obstruction and search powers: The Virtual Asset (Service Providers) (Amendment) Act, 2024 strengthens CIMA's entry, search and seizure powers and updates offences and penalties for obstruction.
• CIMA supervisory sanctions: The VASP Act empowers CIMA to supervise, investigate and discipline regulated entities, including cease-and-desist directions and licence revocation, and to wind up regulated entities.
• Administrative fines: The Monetary Authority (Administrative Fines) Regulations (2025 Revision) let CIMA impose administrative fines for breaches of prescribed provisions (which include the virtual asset service provider regime), classified as minor, serious or very serious and attracting fixed, fixed continuing or discretionary fines, following a breach-notice process with rights of review and appeal to the Grand Court.
• Cancellation Rule breaches: Breach of CIMA's Rule on cancellation of licences, registrations or waivers can lead to penalties under section 34 of the Monetary Authority Act and other enforcement action under CIMA's enforcement manual and the VASP Act.
• AML administrative fines: The Anti-Money Laundering Regulations (2025 Revision) include an administrative fines and appeals framework, with fine categories in Schedule 2 and appeal rights to the Grand Court.
• CARF penalties: The Crypto-Asset Reporting Framework Regulations, 2025 establish criminal offences (such as false self-certification, obstruction, tampering and unauthorised access) with director and officer liability, plus a civil administrative penalty regime; penalties may be imposed for failure to submit returns, declarations or required information, in some cases without first issuing a breach notice.

The specific fine amounts under these regimes are not set out in the summaries provided.

Sources: Anti-Money Laundering Regulations (2025 Revision) · Monetary Authority (Administrative Fines) Regulations (2025 Revision) · Virtual Asset (Service Providers) (Amendment) Act, 2024 (Act 22 of 2024) · Virtual Asset (Service Providers) Act (2024 Revision) · Rule - Cancellation of Licences, Registrations, or Waivers for Virtual Asset Service Providers · Tax Information Authority (International Tax Compliance) (Crypto-Asset Reporting Framework) Regulations, 2025 (SL 51 of 2025) · CARF Quick Guide