Lucy Frew
Partner
Cayman Islands
The Cayman Islands has long been a leading offshore jurisdiction for investment funds, as well as a significant global financial centre overall. It is therefore not surprising that, reflecting global trends, the FinTech market has been developing rapidly in the Cayman Islands, as the Government has sought to attract new business. The Government introduced virtual asset legislation to comply with global standards set out by the Financial Action Task Force (“FATF”), and was ahead of a number of other jurisdictions (e.g. the UK, Dubai, Singapore) in doing so.
The Cayman Islands has introduced a coherent and relatively bespoke virtual asset regime, through the Virtual Asset (Service Providers) Act (2024 Revision) (the “VASP Act”). As at the end of 2023, there were nineteen (19) virtual asset service providers (“VASPs”) registered with the Cayman Islands Monetary Authority (“CIMA”), including trading platforms, custodians, broker-dealers, lenders, crypto payment providers, and a number of applications are currently under review.
Furthermore, with the growing global interest in tokenised products – including tokenised investment funds, debt issuances, and real assets – there is significant potential for growth in the Cayman Islands. This potential is bolstered by the Cayman Islands’ status as the premier offshore fund jurisdiction and by far the leading jurisdiction for digital asset funds. In addition, we have also seen strong demand to establish foundation companies in the Cayman Islands, primarily acting as legal wrappers for decentralised autonomous organisations, and we expect this trend to continue.
We also note that the Cayman Islands has now been removed from the FATF’s “grey list” of jurisdictions under increased monitoring in relation to anti-money laundering, terrorist financing, and proliferation financing, as well as the European Union’s associated “black list”. The Cayman Islands’ regime for anti-money laundering, terrorist financing, and proliferation financing has been assessed by the FATF as largely or wholly compliant with all of the FATF’s 40 Recommendations, which is a level of compliance that almost none of the EU Member States and no G20 members reach. This further cements the Cayman Islands as a key offshore justification in the FinTech space.
The Government has also introduced a number of other incentives to encourage FinTech firms to set up on Cayman. These include:
There has been no great demand for “robo-advice”, given the limited retail investment offering. Cayman Islands legislation does not expressly contemplate robo-advisers. To the extent that a legal entity holds the algorithm or software that performs the function of a robo-adviser and that legal entity is a Cayman Islands entity or a non-Cayman Islands entity registered in the Cayman Islands, it will be required to be registered or licensed under the Securities Investment Business Act (2023 Revision) (the “SIB Act”).
The VASP Act provides a registration and licensing regime for any person offering a “virtual asset service” in the course of a business using a Cayman Islands entity or otherwise from within the Cayman Islands. Such persons are referred to as VASPs. The licensing regime under the VASP Act applies specifically to virtual asset custodians and operators of virtual asset trading platforms; however, this licensing regime is not yet in force. There is currently a consultation taking place with a view to making amendments to the VASP Act to “switch on” the licensing regime, so we expect it to come into force over the course of the year.
The Cayman Islands regulators are continuing their focus on blockchain and virtual assets, particularly in light of the introduction of the VASP Act. CIMA has established a specialist unit to oversee the VASP Act, and the Utility Regulation and Competition Office is encouraging the development of blockchain projects by considering and proposing changes to the Cayman Islands Electronic Transactions Act (2003 Revision) to incorporate express recognition of blockchain and smart contracts.
CIMA has recently made certain amendments to the Guidance Notes on the Prevention and Detection of Money Laundering, Terrorist Financing and Proliferation Financing (“AML Guidance Notes”), including to clarify its position on electronic Know Your Customer (“e-KYC”) and remote Customer Due Diligence. In particular, CIMA has now acknowledged that, subject to certain caveats, it is possible to rely on virtual means of verification, including e-KYC technology and digital verification, which is a very useful development, especially for businesses in the FinTech space. Further, the AML Guidance Notes were recently amended to update the sector-specific guidance for VASPs, including to provide additional guidance on “Travel Rule” compliance for VASPs carrying out transfers of virtual assets.
At the time of writing (July 2024), we are not aware of any specific or material “InsurTech” initiatives or developments in the Cayman Islands.
The principal financial services regulator in the Cayman Islands is CIMA, which is responsible for the regulation, supervision and monitoring of financial services laws (including the VASP Act – as detailed below), as well as the monitoring of compliance with anti-money laundering/counter-financing of terrorism and counter-proliferation financing (“AML/CFT/CPF”) legislation. Regulated and unregulated entities in the FinTech sector may also be subject to: ancillary regulation, including in relation to economic substance and automatic exchange of information, which is supervised by the Department for International Tax Cooperation (“DITC”); beneficial ownership, which is supervised by the Cayman Islands Registrar; data protection, which is supervised by the Cayman Islands Data Protection Ombudsman; and sanctions, which are supervised by the Cayman Islands Financial Reporting Agency (“FRA”).
The VASP Act provides a short, accessible, technology-neutral and adaptable framework for the regulation of the provision of virtual asset services. The VASP Act has been implemented in a phased approach as set out below.
The VASP Act is being implemented in phases. The first phase came into effect on 31 October 2020 and implemented a registration regime for all VASPs, which focuses on anti-money laundering (“AML”), counter-financing of terrorism and counter-proliferation financing compliance, supervision and enforcement. As noted above, we expect the licensing regime for virtual asset custodians and operators of virtual asset trading platforms to come into force during the course of this year.
Definition of a virtual asset
Clearly, the concept of “virtual asset” is key to determining whether a person is offering a virtual asset service, and is therefore considered a VASP. A virtual asset is defined as a digital representation of value that can be digitally traded or transferred and can be used for payment or investment purposes. However, a digital representation of a fiat currency (essentially, legal tender) is excluded. Similarly, “virtual service tokens” (being digital representations of value that are not transferable or exchangeable with third parties, such as digital tokens that only provide access to an application or service or that provide a service or function directly to their owner) are not treated as virtual assets.
Definition of a virtual asset service
A “virtual asset service” means the issuance of virtual assets or the business of providing one or more of the following services or operations for or on behalf of another person:
The sale of newly created virtual assets to the public, in exchange for some form of consideration, is also included in the definition of virtual asset service. This means that although certain kinds of non-public issuances should not be regulated, a person will need to be registered if they issue virtual assets to the public using a Cayman Islands vehicle. Non-public issuances include employee, intra-group and, in particular, private sales. A private sale is defined as a sale, or offer for sale, which is (i) not advertised, and (ii) is made available to a limited number of persons or entities who are selected prior to the sale by way of a private agreement.
The effect of this is that some, but not all, token issuers will be VASPs and will be required to register with CIMA.
The VASP Act provides that after the issuer is registered, the issuer must submit a “virtual asset issuance request” to CIMA for prior approval of the virtual asset issuance. This virtual asset issuance approval regime is currently not in effect, although, as for the VASP licensing regime discussed above, we expect this to come into force during the course of 2024.
Licensing of virtual asset trading platforms and custodians
A virtual asset trading platform (“VATP”) is defined under the VASP Act to mean a centralised or decentralised digital platform that facilitates the exchange of virtual assets for fiat or other virtual assets on behalf of third parties for some form of reward and that: (i) holds custody of or controls the virtual asset on behalf of its clients to facilitate an exchange; or (ii) purchases virtual assets from a seller when transactions or bids and offers are matched, in order to sell them to a buyer. However, VATPs do not include a platform that only provides a forum where sellers and buyers may post bids and offers, or a forum where the parties trade on a separate platform or in a peer-to-peer manner.
Generally, a provider of virtual asset custody services or a VATP operator will need to be licensed under the VASP Act, once the licensing regime comes into force. Other virtual service providers will also generally be required to be registered. However, it is for CIMA to decide whether to direct that any VASP be licensed, or apply for a sandbox licence (as described below).
Enforcement
Under the VASP Act, a person that contravenes the registration requirement commits an offence and is liable on summary conviction to a fine of CI$25,000 and to imprisonment for one year and, in the case of a continuing offence after conviction, to a fine of CI$10,000 for each day during which the offence continues. An entity that contravenes the licensing requirement commits an offence and is liable on summary conviction to a fine of CI$100,000 and to imprisonment for one year and, in the case of a continuing offence, to a fine of CI$10,000 for each day during which the offence continues. In addition, CIMA has the power to impose additional fines for a breach of the VASP Act under an administrative fining regime, which includes imposing a fine of up to CI$1,000,000 on a corporate body in breach. CIMA’s Administrative Fines Regime contains detailed provisions on the fines regime and appeals processes.
Sandbox licence regime
Under the VASP Act there is the potential for the future introduction of a sandbox licence. A sandbox licence is a temporary (up to one year) licence that CIMA may direct a VASP to apply for where:
Certain FinTech service providers that are not VASPs may also apply for sandbox licences. However, they are not required to do so. The intention here, as with regulatory sandboxes more generally, is to provide a controlled environment for innovative service providers to evolve their businesses under CIMA’s supervision, while creating a forum for concurrent development and potential amendment of applicable rules. Although the sandbox regime is not in effect; it is currently under consultation
Anti-money laundering laws
The Cayman Islands Proceeds of Crime Act (2024 Revision) requires that entities that conduct “relevant financial business”, which includes providing a “virtual asset service”, must comply with the Cayman Islands Anti-Money Laundering Regulations (“AML Regulations”). As a result, persons carrying on “relevant financial business” are subject to the AML Regulations, whether or not they are registered with or licensed by CIMA (so this can include FinTech companies that are regulated and unregulated). The AML Regulations set out ongoing and detailed compliance requirements with respect to anti-money laundering, counter-terrorist and proliferation financing, and compliance with targeted financial sanctions. The AML Regulations also include specific requirements for entities undertaking “transfers of virtual assets” (i.e., the Travel Rule provisions related to cryptocurrency transfers). CIMA is responsible for supervising compliance with the AML Regulations and has helpfully published “Sector-Specific Guidance for Virtual Asset Service Providers”, to assist with the interpretation of these requirements in a virtual assets context.
Securities investment business
The SIB Act provides for the registration and licensing of entities carrying on “securities investment business” including, among other entities: (a) any company or partnership that is incorporated, established or registered in the Cayman Islands that carries on “securities investment business”; or (b) any entity that has established a place of business in the Cayman Islands through which “securities investment business” is carried on.
The term “securities investment business” is specifically defined in the SIB Act as including a number of “regulated activities”, such as “dealing in securities”, “arranging deals in securities”, “management of securities” and “advising on securities” in the course of business (subject to exclusions for certain persons and certain activities). The term “securities” is further defined widely in the SIB Act and includes, in summary, shares, partnership interests, trust units, debt instruments, warrants, options, futures, contracts for differences (for example, cash-settled derivatives such as interest rate/stock index futures, forward rate agreements and swaps) and certain virtual assets.
For the purposes of the SIB Act, a “virtual asset” means a digital representation of value that can be digitally traded or transferred and can be used for payment or investment purposes but does not include a digital representation of fiat currencies. However, the SIB Act only applies to transferable virtual assets that can be converted into any of the traditional securities within the scope of the SIB Act or represent a derivative of any of those securities.
Under the SIB Act, entities are prohibited from conducting securities investment business unless, in respect of such activity, the entity is either: (a) registered with, or licensed by, CIMA under the SIB Act; or (b) able to benefit from a specific exclusion in the SIB Act. Aside from the specific exclusions provided for in the SIB Act, there are no other exclusions (for example, reverse solicitation) available under Cayman Islands law for entities carrying on securities investment business.
Economic substance regime
The Cayman Islands operates an economic substance regime. The International Tax Co-operation (Economic Substance) Act (2020 Revision) (“the “Economic Substance Act”), is key to determining whether a relevant entity satisfies the economic substance test in respect of its relevant activities. A VASP may fall within the scope of the Economic Substance Act if it is carrying out one or more of the relevant activities. All applicable entities are required to submit an economic substance notification. A VASP will be required to satisfy the economic substance test set out in the Economic Substance Act if it is carrying out one or more of the relevant activities (unless an exemption applies). If so, the VASP is required to submit an annual report to the Tax Information Authority (and must submit an annual notification regardless of whether it is carrying out any relevant activity).
Data protection
The Cayman Islands also has data protection legislation, the Cayman Islands Data Protection Act (2019 Revision) (the “DPA”) which requires entities within the scope of the legislation to comply with the data protection principles defined in the legislation.
The DPA applies to personal data processed by “data controllers” and “data processors”. The DPA requires a data controller to comply with eight data protection principles when processing personal data and to ensure that those principles are complied with in relation to personal data processed on the data controller’s behalf under a written contract. The DPA also deals with data security, data breaches and the rights of individual data subjects, including providing a privacy notice.
The DPA applies to processing carried out by data controllers established within the Cayman Islands. In certain cases, it also applies to data controllers outside the Cayman Islands that process personal data within the Cayman Islands.
It will be a question of fact in each case whether a VASP is within the scope of the DPA.
As noted above, there are now nineteen (19) VASPs registered with CIMA under the VASP Act, with a number of applications pending. CIMA has recently indicated that its intention is to process applications under the VASP Act within ten (10) weeks of submission. The Cayman Islands continues to be a leading offshore hub for FinTech. The VASP Act offers a clear and robust framework, which is already proving attractive to many international firms in the cryptoasset market.
CIMA, the DITC and the FRA also regularly collaborate and co-operate with other international authorities in exchanging information, formulating global standards and attending regulatory forums, such as FATF.
This chapter was originally published in Global Legal Insights FinTech 2024.
Authors
Partner/Cayman Islands
Partner/Cayman Islands
Associate/Cayman Islands
Key contacts