This page was updated as of 20 June, 2025.
The Cayman Islands Virtual Asset (Service Providers) Act (as amended) (the “VASP Act”) provides a short, accessible, technology neutral and adaptable framework for the regulation of the provision of virtual asset services. There is a phased approach to the implementation of the VASP Act, which came into effect on 31 October 2020 and creates a framework for the registration of virtual asset service providers. Phase two of the VASP Act came into effect on 1 April 2025, switching on the full licensing regime for virtual asset trading platforms and custodians. A third phase will be introduced in due course, focusing on issuances of virtual assets and the sandbox regime.
What the VASP Act regulates
The VASP Act provides a registration and licensing regime for any person carrying on a “virtual asset service” in the course of a business using a Cayman Islands entity or otherwise from within the Cayman Islands. Such persons are called “virtual asset service providers” (“VASPs”).
Clearly, the concept of “virtual asset” is key to determining if a person is carrying on a virtual asset service, and is therefore a VASP. A virtual asset is defined as a digital representation of value that can be digitally traded or transferred and can be used for payment or investment purposes. However, a digital representation of a fiat currency (essentially, legal tender) is excluded. Similarly, “virtual service tokens” (being digital representations of value that are not transferrable or exchangeable with third parties, such as digital tokens that only provide access to an application or service or that provide a service or function directly to their owner) are not treated as virtual assets.
A “virtual asset service” means the issuance of virtual assets or the business of providing one or more of the following services or operations for or on behalf of another person:
(a) exchange between virtual assets and fiat currencies;
(b) exchange between one or more other forms of convertible virtual assets;
(c) transfer of virtual assets;
(d) virtual asset custody service; or
(e) participation in, and provision of, financial services related to a virtual asset issuance or the sale of a virtual asset.
In phase 1 of implementation, all VASPs were required to register under the VASP Act with the Cayman Islands Monetary Authority (“CIMA”). CIMA has the ability to enforce and take action against contraventions of the VASP Act.
Applications for virtual asset service licences
As of 1 April 2025, persons wishing to provide virtual asset custody and/or virtual asset trading platform services in or from the Cayman Islands must apply to CIMA for a licence under the VASP Act ("Licensable Activities"). All other VASP activities will still require VASP registration (unless they are granted a waiver under the VASP Act). An entity performing both the activities that require a registration and a licence under the VASP Act will only require a licence. Where a licence is granted, CIMA will cancel the existing VASP registration.
Existing VASP registered persons (being VASPs registered under the VASP Act, but who are performing Licensable Activities), must submit a licence application within the 90-day period commencing 1 April 2025 and can continue to operate until a decision on the application is made by CIMA.
Supervised persons and waivers
A supervised person means a person that is licensed or registered by CIMA under any of the regulatory laws, but is not licensed or registered under the VASP Act. In such instances, a supervised person wishing to carry on Licensable Activities may apply to CIMA for a waiver. CIMA may waive the requirement for licence or registration if it determines that the virtual asset service does not materially change the nature of the activity for which the supervised person is licensed, and the supervision and oversight carried out in relation to the business of the supervised person is sufficient to include the virtual asset service.
Issuance of virtual assets
The sale of newly created virtual assets to the public, in exchange for some form of consideration, is also included in the definition of a virtual asset service. This means that although certain kinds of non-public issuances (such as employee or intra-group issuances or private sales) should not be regulated, a person must be registered if they issue virtual assets to the public using a Cayman Islands vehicle.
The VASP Act provides that after the issuer is registered, the issuer has to submit a “virtual asset issuance request” to CIMA for prior approval of the virtual asset issuance. However, such virtual asset issuance approval regime is currently not in effect and we are awaiting the commencement order for this regime in phase three.
Tokenized funds and other tokenized securities
Tokenized funds are not in-scope of the VASP Act. This position has recently been codified by the Virtual Asset (Service Providers) (Amendment) Bill 2025, which is a very positive development for the jurisdiction and confirms that tokenized funds need only be registered under the Mutual Funds Act and/or Private Funds Act in the normal course and not subject to dual regulation under the VASP Act as token issuers. This means there is a clear and predictable legal framework enabling the investment funds sector to operate with confidence in the constantly evolving digital asset economy.
The key amendments include the following:
- changes to the definition of “issuance of virtual assets” or “virtual asset issuance” to exclude the issuance of an "equity interest" as defined under the Mutual Funds Act and the Securities Investment Business Act or an "investment interest" as defined under the Private Funds Act; and
- the amendment of the words “issuance of virtual assets” or “virtual asset issuance” has effect for any tokenization of an equity interest or an investment interest that may have occurred prior to the date of the commencement of the VASP Amendment Act.
The Virtual Asset (Service Providers) Bill, 2025 has been published in the Gazette and will be brought into effect by a commencement order in due course.
While no equivalent legislative amendment had been made to date in relation to tokenized debt issuances or tokenized securities in general, we would not expect these to fall within the VASP Act. To the extent they are "securities", certain dealing, managing, arranging and advising activities undertaken in relation to them may be in scope of the Securities Investment Business Act subject to exemptions, as set out in our advisory.
For example, a Cayman entity issuing tokenized debt instruments will often benefit from an exemption for an entity issuing, redeeming or repurchasing its own equity or debt securities but still be in-scope of AML and FATCA/CRS (as is the case for traditional debt issuance vehicles).
Virtual asset trading platform operators, custodians and other virtual asset service providers
A virtual asset trading platform (“VATP”) is defined under the VASP Act to mean a centralised or decentralised digital platform — (a) which facilitates the exchange of virtual assets for fiat currency or other virtual assets on behalf of third parties for a fee, commission, spread or other benefit; and (b) which — (i) holds custody of or controls virtual assets on behalf of its clients to facilitate an exchange; or (ii) purchases virtual assets from a seller when transactions or bids and offers are matched in order to sell them to a buyer, and includes its owner or operator, but does not include a platform that only provides a forum where sellers and buyers may post bids and offers and a forum where the parties trade in a separate platform or in a peer-to-peer manner.
An “owner” or “operator”, in relation to a virtual asset trading platform, means — (a) the single entity or group which exerts management control over the platform; (b) where a single entity or group which exerts management control is not identifiable, either — (i) the entity through which the platform operates; or (ii) the entity through which the platform contracts with users of the platform; or (c) where an entity or group under paragraph (a) or (b) is not identifiable, the entity or group that provides the services offered by the platform to the users of the platform.
The VASP Act defines a virtual asset custody service ("VACS") as a business of safekeeping or administration of virtual assets or the instruments enabling the holder to exercise control over virtual assets. Generally, a provider of a VACS or a VATP operator must be licensed under the VASP Act. Other virtual service providers will generally be required to be registered. However, it is open to CIMA to direct that any virtual asset service provider be licensed or apply for a sandbox licence.
Sandbox licences
Under the VASP Act, a sandbox licence is a temporary licence of up to one year that CIMA may direct a VASP to apply for, where:
(i) the service being provided represents an innovative use of technology or uses an innovative method of delivery such that additional supervision and oversight is required;
(ii) it is in the best interests of the public, regulated persons, supervised persons, licensees or financial markets that the service be temporarily restricted or subject to specific requirements;
(iii) the service promotes technology or a method of delivery that may create a systemic risk to financial markets or the jurisdiction; or
(iv) the service poses a money laundering, terrorist financing or proliferation financing risk that existing AML rules do not properly mitigate.
Certain FinTech service providers that are not VASPs may also apply for sandbox licences. However, they are not required to do so.
The intention here, as with regulatory sandboxes more generally, is to provide a controlled environment for innovative service providers to evolve their businesses under CIMA’s supervision, whilst creating a forum for concurrent development and potentially amendment of applicable rules. Again, such sandbox regime is currently not in effect and we are awaiting the commencement order for this regime in Phase 3.
Compliance requirements for VASPs
In addition to maintaining registration or a licence, VASPs are subject to various ongoing requirements. The requirements include obligations to, amongst other things:
(a) prepare annual accounts that are open to CIMA inspection (full licensees are subject to a financial audit requirement);
(b) have no less than three directors at all times including at least one independent director without a vested interest in the virtual asset service provider;
(c) ensure senior officers, trustees and beneficial owners are fit and proper for such positions, and obtain prior approval from CIMA in relation to the appointment of any senior officer or trustee – a "senior officer is defined as "a director, managing director, president, chief executive officer, partner, managing partner, general partner, ultimate partner, manager, anti-money laundering compliance officer, money laundering reporting officer, deputy money laundering reporting officer or a person who has a similar control function";
(d) seek the prior written approval of CIMA — (i) to make a change to the approved business plan which modifies or changes the provision of the virtual asset services for which it has been granted registration or a licence; or (ii) to provide additional virtual asset services which were not included in the approved application or business plan;
(e) seek the prior written approval of CIMA to issue, transfer or dispose of shares totalling ten per cent or more of the total shares in a company which is a virtual asset service provider;
(f) protect and secure data and ensure all disclosures, advertising and communications with clients and the public are accurate; and
(g) comply with various other record keeping, cybersecurity, outsourcing, governance and reporting obligations to CIMA (N.B. virtual asset trading platform operators and virtual asset custodians are also subject to specific regulatory measures issued by CIMA).
In addition to the above, VASPs are already required to comply with the Cayman Islands Anti-Money Laundering Regulations (as amended) and other relevant anti-money laundering, counter terrorism and proliferation financing and sanctions laws, regulations and guidance, including to put in place systems and procedures, as well as Travel Rule compliance where the VASP is carrying out "transfer of virtual asset" services) and designating natural persons with responsibility for compliance, as the result of previous amendments to the Proceeds of Crime Act (as amended). CIMA may order an audit of systems and procedures of the registrant or licensee.
Conclusion
The VASP Act complements Cayman’s existing, robust body of law, and serves to further reinforce the confidence and certainty in the virtual assets regulatory environment. We have handled numerous registrations of tokenized funds and work with the majority of CIMA regulated VASPs. We also provide all aspects of regulatory compliance support.
