The Virtual Asset (Service Providers) Law, 2020 (the Law) was gazetted on 25 May 2020 and will come into force upon issue of a commencement order in due course. The Law represents Cayman’s first legal framework for the registration, licensing and supervision of virtual asset service providers conducting business in the Cayman Islands. This significant legislative development represents Cayman’s commitment to facilitating innovative virtual asset business whilst adopting international standards of regulation prescribed by the Financial Action Task Force.
What are virtual asset service providers?
Virtual asset service providers (VASPs) include companies, limited liability and foreign companies, and general, limited and exempted limited partnerships formed and, where required, registered or licensed, in accordance with the relevant laws of the Cayman Islands that provide virtual asset services as a business, or in the course of business, in or from within the Cayman Islands.
The Law defines “virtual assets” as digital representations of value that can be digitally traded or transferred and can be used for payment or investment purposes. Digital representations of fiat currencies or virtual service tokens are not included as virtual assets under the legislation. A “virtual asset service” is defined as the issuance of virtual assets or the business of providing one or more of the following services or operations for or on behalf of a natural or legal person or legal arrangement:
- exchange between virtual assets and fiat currencies;
- exchange between one or more other forms of convertible virtual assets;
- transfer of virtual assets;
- virtual asset custody services; or
- participation in, and provision of, financial services related to a virtual asset issuance or the sale of a virtual asset.
The Licensing and Registration Regime
VASPs must be licensed, registered, operating under a waiver granted by the Cayman Islands Monetary Authority (CIMA), or have a sandbox licence in order to carry on business as a virtual asset service provider under the Law. The nature of operations and business the VASP conducts, or wishes to carry out, will determine how the VASP is supervised under the Law. Each of the separate legal requirements are discussed below.
Virtual Asset Service Licences
A VASP must hold a virtual asset service licence (VASL) in order to provide virtual asset custodial services or operate a virtual asset trading platform, or if it currently provides or operates any of these services. In determining VASL applications, CIMA will consider whether (i) an approval is against the public interest; (ii) the applicant has adequate personnel with the necessary skills, knowledge and experience, facilities, books, records and accounting systems, and capital and cybersecurity measures with regard to its size, scope and complexity of business; and (iii) the applicant has complied with other requirements under the Law upon CIMA’s request.
CIMA may impose regulatory requirements on a VASL as it considers necessary based on a number of factors including: (i) an assessment of the virtual asset service provided; (ii) the nature of supervision required; (iii) the safety and soundness of the public offering; and (iv) licences held under other regulatory laws. Restrictions or prohibitions on the use of certain technology or practices may also be imposed if they would disrupt or prejudice CIMA’s functions, the interests of the public or the financial services in the Cayman Islands.
Where a license is not required, VASPs must register under the Law in order to carry on virtual asset services. Once registered, VASPs may only issue virtual assets directly to members of the public within a prescribed threshold and must submit an issuance request to CIMA in order to obtain its prior approval. CIMA determines such requests in accordance with certain considerations including the nature, function and purpose of the virtual asset and its likely effect on CIMA’s functions as they relate to anti-money laundering, the financial services market and the public generally. A registered VASP may also engage a virtual asset trading platform licensed under the Law in order to issue newly created virtual assets over the prescribed threshold but must obtain CIMA’s prior approval. Where a virtual asset issuance involves the transfer or exchange of other virtual assets or fiat currency, the VASP must maintain appropriate records for each transaction involving the public and make these available for CIMA’s inspection.
How to Register
A VASP who is not an existing licensee, but who is carrying on or wishes to carry on a virtual asset service for which a licence is not required, must submit a registration application along with the prescribed assessment fee to CIMA. Notification of any changes to information provided in an application must be given to CIMA within 15 days of such change – it is an offence not to comply with this requirement and renders a VASP liable on summary conviction to a $20,000 fine.
Non-refundable assessment fees are payable within 30 days of CIMA’s assessment and approval of applications for registration or licences. CIMA’s assessment of fees takes into account the nature, size, scope and complexity of the virtual asset or Fintech service and CIMA calculates the fees within a prescribed range. Annual renewal fees are due on or before 15 January and prorated surcharges are applicable for late payment. A licence or registration lapses if annual renewal fees remain unpaid for three months.
Virtual Asset Service Providers’ Obligations
Section 9 of the Law sets out the general requirements for VASPs which concern the following:
- Annual accounts;
- Audits and compliance reports in response to requests from CIMA;
- ‘Fit and proper’ senior officers, trustees and beneficial owners;
- Security and protection of clients’ personal data and virtual assets;
- Accurate communications;
- Anti-money laundering, counter-terrorist financing and counter-proliferation financing compliance;
- Registered office requirements;
- Document retention; and
- Notification requirements.
VASPs may not issue or transfer ten per cent or more of their shares or partnership interest without CIMA’s prior approval. However, subject to conditions, the Law provides that CIMA may exempt VASPs with 95 per cent or more of their shares publicly traded on a recognized stock exchange from this prohibition.
Existing licensees who wish to carry on, or are currently carrying on, virtual asset services must notify CIMA of the nature and scope of their proposed or current services. CIMA may direct an existing licensee to obtain a VASL if the provider’s services are considered to be activities requiring a licence under the Law or are materially different from business activities licensed under other regulatory laws and require specific supervision. Alternatively, CIMA may require an existing licensee to apply for a sandbox licence (discussed further below), apply for a licence under another regulatory law; cease the virtual asset service or CIMA may grant a waiver to allow the existing licensee to provide certain virtual asset services.
In certain circumstances, CIMA may require an applicant for registration or licensing to apply for a sandbox license. A sandbox licence is a temporary licence which CIMA may grant for up to one year. If CIMA requires a VASP to apply for a sandbox licence, it must apply in the manner directed by CIMA and will need to provide such information as CIMA requests. This may happen in circumstances where:
- The virtual asset service is an innovative use of technology or method of delivery requiring supervision and oversight not offered by a licence or registration under any law;
- It is in the best interests of the public, existing licensees, licensees, registered persons or financial markets for the virtual asset service to be temporarily restricted or subject to specific requirements;
- The virtual asset service uses or promotes technology or a method of delivery that may create systemic risk to financial markets or the jurisdiction; or
- The virtual asset service posts a money laundering, terrorism financing or proliferation financing risk not properly mitigated by the Anti-Money Laundering regime or the Law.
A sandbox licensee is obliged to comply with all the requirements applicable to VASPs under the Law. CIMA may impose, or exempt a sandbox licensee from any of the requirements applicable to a VASL, along with additional restrictions specific to sandbox licensees outlined in the Law. CIMA may also review a sandbox licence at any time.
Virtual Asset Custody Services
Virtual asset custody services are subject to specific requirements, the contravention of any of which is an offence and may result in a fine of $100,000. These requirements generally concern:
- Custodial arrangements in relation to which the Law prescribes minimum information requirements;
- Information technology best practices;
- The accrual of ancillary and subsidiary proceeds relating to virtual assets held in custody; and
- The safeguarding of virtual assets held on behalf of third parties and against theft and loss.
CIMA may prescribe additional requirements in relation to virtual asset custody services concerning (i) net worth; (ii) reporting, disclosures to clients; and (iii) safe keeping of client assets. CIMA may also determine that a requirement is in the best interests of the beneficial owners of the assets held by the licensee. Further, virtual asset custodians may not encumber virtual asset deposits held on behalf of clients, or have them encumbered by a third party, without the express agreement of the assets’ beneficial owners.
Virtual Asset Trading Platforms
VASP licensees that operate virtual asset trading platforms must carry out due diligence on virtual assets and their issuers listed on the platform and obtain CIMA approval prior to engaging in securities and investment business in relation to virtual assets. Licensees may not do the following: (i) provide financing to clients unless disclosures have been made regarding the terms and risks of financing; (ii) engage in trading or market making behavior for their own accounts which could be detrimental to client interests unless it is necessary for the operation of the platform or has been disclosed to the clients; (iii) allow a virtual asset to be traded unless it has ensured the virtual asset is not presented in a deceiving manner or meant to defraud holders of funds or value; (iv) allow a client to purchase or trade in virtual assets unless the licensee has assured itself that the client is aware of the associated risks; or (v) provide fiat currency exchange services to users of the trading platform.
VASPs operating virtual asset trading platforms may also be subject to particular requirements imposed by CIMA including: (i) the nature of user access; (ii) the types of clients the VASP may market to; (iii) the types of virtual assets traded; (iv) net worth, reporting and listing requirements; (v) measures to prevent unfair trading practices; (vi) client disclosures; (vii) monitoring, supervision and suspension of trading; (viii) information technology and security; (ix) settlement and clearing processes; (x) financing; and (xi) anti-money laundering and counter-terrorist and counter-proliferation financing measures.
Offences and Penalties
Where a provision of the Law is contravened for which no penalty is prescribed, a person will be liable on summary conviction to a $4,000 fine. Particular offences under the Law include the failure to notify changes to information provided in an application to CIMA within the requisite time period – this is punishable, upon summary conviction, with a $20,000 fine. The penalties for carrying on, or purporting to carry on, a virtual asset service for which registration is required without being registered or holding a waiver under the Law range from a fine of $25,000 to imprisonment for one year on summary conviction for a single offence. A cumulative fine of $10,000 applies for each day the offence continues. Carrying on, or purporting to carry on, virtual asset custody services, or operating a virtual asset trading platform, without a licence or waiver under the Law is an offence punishable on summary conviction with a fine of $100,000 and imprisonment for one year. A fine of $10,000 applies for each day that the offence continues.
CIMA’s Powers and Enforcement
Various powers are granted to CIMA to allow for the review, supervision and enforcement of the Law in respect of registered VASPs, licensees and sandbox licensees. These powers include the identification and investigation of those reasonably believed to be providing services in contravention of the Law. CIMA may also examine VASPs’ business affairs through onsite inspections, auditors’ reports and other means to ensure, amongst other things, that those activities are authorized under the Law, anti-money laundering compliance is in effect, licensees are financially sound and client information and assets are kept secure. If CIMA knows or has reasonable grounds to believe that a VASP has failed to comply with its obligations under the Law, is carrying on business fraudulently or in a manner detrimental to the public interest, has contravened any Anti-Money Laundering legislation or any requirement under the Law, there are a number of actions the authority may take. These include revocation of the particular licence or cancellation of registrations, the imposition of conditions, requiring the VASP to take certain actions to remedy breaches and the appointment of a controller by CIMA to assume control of the licensee’s affairs. If a VASP is deemed to be carrying out, or about to carry out, an act that is unsafe or an unsound practice, CIMA ay direct the VASP to cease or refrain from the course of conduct. Failure to follow such a direction could result, on summary conviction, to a fine of $50,000 or imprisonment for one year, or both; or, on conviction on indictment, a fine of $100,000 or imprisonment for five years, or both.