Understanding the updates in Bermuda's new licensing regime for digital identity service providers

• Bermuda's proposed new licensing regime for digital identity service providers (DISPs) has been further refined and updated, with five licensable activities reduced to two.

• The development of the DISP regime commenced with public consultation issued in November 2024, which sought stakeholder input on the concept and potential direction of the framework. This was followed by the publication of a stakeholder letter in April 2025 that summarised the feedback received during the initial consultation and presented key insights gained from stakeholders. 

• The regime will be brought into effect by the Digital Identity Service Provider Business Act. The provision of digital identity services in or from within Bermuda will require a licence, with a prohibition on those activities being conducted by unlicensed persons. 

Following the April 2025 Dear Stakeholder letter, we summarised the new regulatory regime being proposed for DISPs here. The Bermuda Monetary Authority (BMA) has now released Part II of its consultation paper in respect of the proposed regulation of DISPs.

Part II has refined and provided further detail in relation to the proposed regulatory framework for DISPs in Bermuda under the Digital Identity Service Provider Business Act (Act). 

The BMA is proposing that a DISP will require a license under this regulatory framework when it carries on both of the following activities:

• Identity proofing and enrolment with initial binding and credentialing. 
• Authentication and life-cycle management of those digital identities once they are issued.

This a marked, and welcome, change from the April 2025 Dear Stakeholder letter that proposed five licensable activities, with considerable overlap. Refining to the above two activities is far clearer with considerably less risk of regulatory arbitrage. 

Overview of the Proposed DISP Licensing Framework

The BMA is proposing a three-tiered licensing regime for DISPs. This three-tiered structure is designed to balance innovation with consumer protection, allowing for supervision based on the business model, operational complexity and risk profile of each DISP:

Proposed Regulatory Obligations & Enforcement Powers

The proposed regulatory obligations and enforcement powers include:

Consultation Timeline

Stakeholders are invited to submit feedback to the BMA by 2 September 2025. The BMA will refine the framework based on industry input and proceed with drafting supporting legislation.

Walkers is committed to engaging in the BMA's ongoing consultation process and working with digital identity service providers in applying for DISP licenses in future.