virtual assets

Who is caught

Virtual assets in the Cayman Islands are regulated through several overlapping regimes rather than a single instrument: the dedicated Virtual Asset (Service Providers) Act (VASP Act) framework, the AML/CFT framework under the Proceeds of Crime Act and Anti-Money Laundering Regulations, tax transparency rules for crypto-assets, and adaptations of the mutual funds, private funds and securities investment business regimes. Who is caught depends on which regime applies.

Virtual asset service providers

• Entities in scope: The VASP Act applies to legal entities (companies, partnerships, exempted limited partnerships, foreign companies, LLCs and LLPs) that carry on virtual asset services as a business in or from the Cayman Islands; natural persons are prohibited from carrying on such business at all.
• Regulated activities: A virtual asset service covers exchange, transfer, custody, and services related to virtual asset issuances. Providers of custody services and operators of trading platforms must hold a full licence, not merely be registered.
• Supervised persons: Entities already licensed or registered under another CIMA regulatory law that also carry on virtual asset services fall within the regime and may need a waiver.

Tokenised funds

• Tokenised mutual funds: The Mutual Funds (Amendment) Act, 2026 brings mutual funds that represent some or all of their equity interests using digital equity tokens, and their operators, within a specific regime layered on the existing mutual funds rules.
• Tokenised private funds: The Private Funds (Amendment) Act, 2026 does the same for private funds whose investment interests are represented by digital investment tokens, and their operators.

Securities and AML regimes

• Securities investment business: Amendments to the Securities Investment Business regime bring certain virtual assets that are, represent, are convertible into, or are derivatives of listed securities, and virtual asset trading platforms, within or alongside the securities framework.
• Relevant financial business: Providers of virtual asset services are listed as conducting relevant financial business under the Proceeds of Crime Act, bringing them within the AML/CFT regime and the Anti-Money Laundering Regulations.
• Crypto-asset service providers (CARF): The Crypto-Asset Reporting Framework Regulations apply to Cayman Reporting Crypto-Asset Service Providers, broadly crypto-asset service providers resident in or with a branch in the Islands, including exchanges, brokers, dealers and operators of crypto ATMs.

Sources: Anti-Money Laundering Regulations (2025 Revision) · Mutual Funds (Amendment) Act, 2026 (Act 5 of 2026) · Private Funds (Amendment) Act, 2026 (Act 6 of 2026) · Proceeds of Crime Act (2025 Revision) · Securities Investment Business (Amendment and Validation) Act, 2024 (Act 21 of 2024) · Securities Investment Business (Amendment) Law, 2020 (Law 16 of 2020) · Virtual Asset (Service Providers) (Amendment) Act, 2026 (Act 4 of 2026) · Virtual Asset (Service Providers) Act (2024 Revision) · Public Advisory - Virtual Assets and Virtual Asset Service Providers (2019-11-22) · Amendments to the Virtual Asset (Service Providers) Act in Effect 1 April 2025 (2025-04-01) · Tax Information Authority (International Tax Compliance) (Crypto-Asset Reporting Framework) Regulations, 2025 (SL 51 of 2025) · CARF Quick Guide

Key duties

The core obligations sit in the VASP Act regime, supplemented by AML/CFT duties, periodic reporting, and tax-reporting deadlines under CARF. Several duties carry fixed timeframes.

Authorisation and fees

• Authorisation gateway: A person must not carry on virtual asset service in or from the Islands unless registered, licensed (including a sandbox licence), or granted a waiver as an existing licensee.
• Licence transition: A registered person engaged, at commencement of the 2024 amending Act, in an activity for which a licence is required (custody or trading platform operation) must apply for a licence within ninety days of commencement; from 1 April 2025, custody and trading platform activities require a licence.
• Application fees: Application, registration and licence fees are non-refundable; an approved applicant must pay the prescribed registration or licence fee within thirty days of notification of approval or the approval is cancelled. Fees for applications pending immediately before commencement of the 2024 amending Act remain refundable.
• Prescribed forms: Licence applications under section 8(1) must use the form in Schedule 1A, with additional parts for custody and trading platform applicants and a declaration signed by two senior officers; registration applications use the prescribed form and fee schedule.
• Governance and fitness: Providers must maintain at least three directors including one independent director, and shareholders, directors, beneficial owners and senior officers must be fit and proper. Shares of a licensee cannot be issued or transferred without CIMA's prior approval.
• Application changes: Registered persons and licensees must disclose changes to information in their application within 15 days, and satisfy any post-approval preconditions within the prescribed time or within 6 months if none is stated.

Ongoing conduct and reporting

• Business plan approval: Providers must carry on services only in accordance with their approved application and business plan, and obtain prior written CIMA approval before changing it or adding new services.
• Change notifications: Providers must notify CIMA within thirty days of specified corporate changes, such as establishing a subsidiary, agency, branch or other physical presence, or facing penalties, enforcement actions or litigation.
• Market conduct: The Rule and Statement of Guidance on Market Conduct requires providers to act honestly and in clients' best interests, manage conflicts of interest, safeguard client assets and information, and disclose withdrawal and closure timeframes.
• Custodian and platform standards: Custodians and trading platforms must meet governance, capital (the higher of risk-based capital, six months' fixed overheads, or an amount set by CIMA), recovery planning, stress testing, insurance, client-asset segregation, and platform and listing safeguards on an ongoing basis.
• Incident notification: Virtual asset custodians must notify CIMA no later than 72 hours after discovery of a material security incident and notify affected clients promptly, and must reconcile client asset balances at least daily.
• Quarterly return: VASPs must submit the VFR-051-84 Financial Quarterly Return via CIMA's REEFS portal within the timeframe prescribed by CIMA, with truthful attestations in Schedule A.
• Audit: Licensees are subject to audit requirements and their auditors have statutory duties to report to CIMA.

AML/CFT obligations

• AML programme: As relevant financial business, VASPs must maintain an AML/CFT compliance programme, appoint an AML Compliance Officer and Money Laundering Reporting Officer, conduct risk assessments, perform customer due diligence, keep records and file suspicious activity reports.
• Travel Rule: When performing a virtual asset transfer, providers must collect and maintain originator and beneficiary information under Part 10A of the Anti-Money Laundering Regulations and provide records to CIMA or a competent authority within forty-eight hours of a request; quarterly Travel Rule returns must be submitted on time.

Tokenised fund duties

• Records confirmation: Operators of tokenised mutual funds and tokenised private funds must confirm annually to CIMA that all records of issuance, creation, sale, transfer and ownership of token-represented interests have been properly kept, and make those records available within the period CIMA specifies.
• Transfer approval: Interests represented by a digital token may only be transferred with the operator's approval, in accordance with the offering document.
• Risk disclosure: Offering documents must disclose token-specific risks, including cybersecurity and transferability risks and any others CIMA identifies, and explain how they are mitigated. Funds must comply with any characteristic restrictions and periodic reporting CIMA imposes.

CARF tax reporting

• Registration: An entity or individual that was a Cayman Reporting Crypto-Asset Service Provider before commencement must register with the Authority on or before 30 April 2026; those becoming one afterwards must register by 31 January following the relevant year, and notify changes within thirty days.
• Due diligence and self-certification: CRCASPs must apply the CARF due diligence procedures, collect self-certifications from pre-existing users within twelve months of the Regulations coming into force and from new users on or before establishing the relationship.
• Annual returns: CRCASPs must submit annual returns, nil returns or declarations via the electronic portal, with first reporting due 30 June 2027 for the 2026 calendar year.

Voluntary cancellation

• Cessation notice: A VASP intending to cease operations must notify CIMA in writing within 15 days of the decision, notify material changes during the process within 15 days, protect client data and assets, inform stakeholders, and submit the prescribed cancellation documentation including a board resolution and final audit report.

Sources: Anti-Money Laundering Regulations (2025 Revision) · Mutual Funds (Amendment) Act, 2026 (Act 5 of 2026) · Private Funds (Amendment) Act, 2026 (Act 6 of 2026) · Virtual Asset (Service Providers) (Amendment) Act, 2024 (Act 22 of 2024) · Virtual Asset (Service Providers) (Amendment) Regulations, 2025 (SL 19 of 2025) · Virtual Asset (Service Providers) Act (2024 Revision) · Virtual Asset (Service Providers) Act, 2020 (Commencement) Order, 2025 (SL 18 of 2025) · Virtual Asset (Service Providers) Regulations, 2020 (SL 138 of 2020) · Rule - Cancellation of Licences, Registrations, or Waivers for Virtual Asset Service Providers · Regulatory Procedure - Cancellation of Licences, Registrations, or Waivers for Virtual Asset Service Providers · Regulatory Policy – Registration or Licensing of Virtual Asset Service Providers (May 2025) · Rule and Statement of Guidance - Market Conduct for Virtual Asset Service Providers · Rule – Virtual Asset Custodians and Virtual Asset Trading Platforms · AML/CFT On-site and Off-site Supervision of the Virtual Asset Service Providers (2025-09-18) · Amendments to the Virtual Asset (Service Providers) Act in Effect 1 April 2025 (2025-04-01) · Tax Information Authority (International Tax Compliance) (Crypto-Asset Reporting Framework) Regulations, 2025 (SL 51 of 2025) · CARF Quick Guide · VFR-051-84 VASP Financial Quarterly Return Form - Completion Guide · Rule - Virtual Asset Custodians and Virtual Asset Trading Platforms (December 2024)

Exemptions and carve-outs

The instruments provide several carve-outs, mostly designed to avoid double regulation across the VASP, securities, funds and tax regimes.

• VASP-only platforms under SIBA: Under the securities investment business amendments, CIMA must exempt operators of virtual-asset-only trading platforms from licensing or registration under that Act, and may exempt other persons whose activities are better supervised under, or already licensed under, the VASP Act (an exempted person must apply for a VASP licence).
• Tokenised fund issuance: The 2026 VASP amending Act clarifies that issuance of digital equity tokens by a tokenised mutual fund, or digital investment tokens by a tokenised private fund, in accordance with the Mutual Funds Act and Private Funds Act, is excluded from regulated virtual asset issuance under the VASP Act.
• Waiver for existing licensees: Entities already licensed or registered under another Cayman regulatory law may apply to CIMA for a waiver as an existing or supervised person, rather than a separate licence, where the virtual asset activity does not materially change the nature of their regulated business.
• Sandbox licence: A sandbox licence is available for innovative or limited-scale testing as an alternative authorisation pathway.
• Approved stock exchanges: Being listed or publicly traded on an approved, recognised or specified stock exchange can trigger licensing, registration or share-transfer approval exemptions under several Acts, including the VASP Act; entities relying on this must ensure the exchange is on CIMA's published list.
• Outsourcing guidance: CIMA's Outsourcing Statement of Guidance expressly excludes regulated mutual funds, private trust companies and private funds from its scope.
• Exempted bodies (CARF): The CARF Regulations exempt certain bodies from the registration requirement, and the amended CRS introduces a low-value exclusion for Specified Electronic Money Products.
• Spent transitional relief: The 2021 Savings and Transitional Regulations gave a limited safe harbour for VASPs and existing licensees operating before 31 October 2020, but those provisions are now spent.

Sources: Securities Investment Business (Amendment and Validation) Act, 2024 (Act 21 of 2024) · Securities Investment Business (Amendment) Law, 2020 (Law 16 of 2020) · Virtual Asset (Service Providers) (Amendment) Act, 2026 (Act 4 of 2026) · Virtual Asset (Service Providers) (Savings and Transitional) Regulations, 2021 (SL 2 of 2021) · Virtual Asset (Service Providers) Act (2024 Revision) · Statement of Guidance - Outsourcing Regulated Entities (April 2023) · Amendments to the Virtual Asset (Service Providers) Act in Effect 1 April 2025 (2025-04-01) · Amended CRS Quick Guide (2025-12-08) · Regulatory Policy – Approved Stock Exchanges (April 2023)

Enforcement and penalties

Enforcement runs through criminal offences in the VASP Act, CIMA's administrative fines regime, and separate civil and criminal penalty regimes under the tax-transparency rules.

• Unauthorised activity: Carrying on virtual asset service business without the required registration, licence or waiver is a criminal offence under the VASP Act, and corporate or partnership officers can be held personally liable for offences committed by the entity.
• Supervisory and disciplinary powers: CIMA may supervise, investigate, discipline (including cease-and-desist directions and licence revocation) and wind up regulated entities, and has strengthened entry, search and seizure powers plus offences for obstruction. One VASP's registration was cancelled in June 2025 for governance and AML/CFT control failures.
• Administrative fines: The Monetary Authority (Administrative Fines) Regulations let CIMA impose fines for breaches of prescribed provisions (including AML, mutual funds, private funds, securities and VASP provisions), classified as minor, serious or very serious, as fixed or discretionary fines. The summaries do not state the specific fine amounts.
• Fine process and appeals: CIMA must issue a breach notice; a party may rectify a fixed-fine breach within thirty days, or reply within the stated period. Fixed fines can be reviewed by CIMA's Management Committee and discretionary fines appealed to the Grand Court. An unpaid fine is a debt to the Crown and accrues interest.
• CARF penalties: The Crypto-Asset Reporting Framework Regulations contain criminal offences (such as false self-certification, obstruction, tampering and unauthorised access), director and officer liability, and a civil administrative penalty regime with breach and penalty notices and a right of appeal; CIMA guidance notes the Authority may impose penalties for reporting failures without first issuing a breach notice.
• CRS penalties: Failure to submit the annual CRS Compliance Form by the 15 September deadline puts a financial institution in breach and results in an automatic administrative penalty.
• Rule breaches: Breaches of CIMA Rules on market conduct, cancellation, and custodians and trading platforms are addressed under CIMA's Enforcement Manual and its statutory powers, including penalties under section 34 of the Monetary Authority Act.

Sources: Monetary Authority (Administrative Fines) Regulations (2025 Revision) · Virtual Asset (Service Providers) (Amendment) Act, 2024 (Act 22 of 2024) · Virtual Asset (Service Providers) Act (2024 Revision) · Rule - Cancellation of Licences, Registrations, or Waivers for Virtual Asset Service Providers · AML/CFT On-site and Off-site Supervision of the Virtual Asset Service Providers (2025-09-18) · DITC FAQs (CRS, FATCA, CbCR, CARF) · Tax Information Authority (International Tax Compliance) (Crypto-Asset Reporting Framework) Regulations, 2025 (SL 51 of 2025) · Rule - Virtual Asset Custodians and Virtual Asset Trading Platforms (December 2024)