Detailed overview
Cayman Islands: VASP Registration, Custody / Trading Platform Licensing, and CIMA Supervision
The Cayman Islands regulates virtual asset activity under the Virtual Asset (Service Providers) Act, administered by the Cayman Islands Monetary Authority. The jurisdiction has a dedicated virtual asset service provider framework, but the route is activity-specific: most non-custody / non-trading-platform virtual asset services require CIMA registration, while virtual asset custody services and virtual asset trading platforms require a CIMA licence. The licensing regime for virtual asset custodians and virtual asset trading platforms commenced on 2025-04-01.
A person must not carry on, or purport to carry on, virtual asset services in or from the Cayman Islands unless registered, licensed for virtual asset custody service or virtual asset trading platform operation, granted a waiver, or operating under a sandbox licence. CIMA may not grant registration, a licence or a waiver to a natural person, and an unregistered / unlicensed / unwaived person, including an applicant, must not state or imply that it is CIMA-regulated or authorised to provide virtual asset services.
The statutory definition of “virtual asset service” includes issuing virtual assets; exchanging virtual assets for fiat currency; exchanging convertible virtual assets for other convertible virtual assets; transferring virtual assets; providing virtual asset custody services; and participating in, or providing financial services related to, a virtual asset issuance or sale. “Virtual asset” is defined broadly as a digital representation of value that can be digitally traded or transferred and used for payment or investment purposes, but excludes digital representations of fiat currencies.
Virtual service tokens are treated differently. A “virtual service token” is a digital representation of value that is not transferable or exchangeable with a third party and includes digital tokens whose sole function is to provide access to an application or service. Virtual service tokens are not virtual assets for the purposes of the Act, and a person carrying on activities involving only virtual service tokens does not require a VASP licence or registration.
Since Phase Two, virtual asset custody service and virtual asset trading platform operation are licensable activities. CIMA’s 2025 circular states that VASPs providing custody or trading-platform services in or from the Cayman Islands must obtain a licence, while other VASP activities continue to require registration unless a supervised person receives a waiver. Existing registered persons conducting licensable activities were required to apply for a licence within 90 days from 2025-04-01 and could continue operating while CIMA reviewed the application.
A supervised person already regulated by CIMA may apply for a VASP licence, VASP registration or a waiver. CIMA may grant or deny the requested licence / registration / waiver or direct the supervised person to apply for another regulatory licence or registration. CIMA may revoke a waiver if conditions are breached, the virtual asset service changes materially, or the size, scope, risk or complexity of the business changes so that registration or licensing is required.
Virtual asset issuance also requires specific Cayman analysis. A registered person must submit a virtual asset issuance request and obtain CIMA approval before issuing virtual assets, and the 2026 amendment refined the concept of issuance by excluding virtual service tokens and certain digital equity or digital investment tokens issued by tokenised mutual funds or tokenised private funds.
Cayman VASPs must also address AML/CFT/CPF and Travel Rule requirements. The AML Regulations apply identification and record-keeping requirements to virtual asset transfers, including originator and beneficiary information, verification, simultaneous or concurrent transmission of required information, record retention for at least five years, and risk-based rejection / request procedures where information is missing or incomplete.
Digital assets that are securities or involve securities investment business require a separate securities analysis. The VASP Act states that a VASP must not engage in securities investment business unless registered, licensed or exempted under the Securities Investment Business Act, and a licensed virtual asset trading platform must apply to CIMA for approval before engaging in securities investment business relating to virtual assets.
Regulator: Cayman Islands Monetary Authority. Core routes: CIMA registration for non-licensable virtual asset services; CIMA licence for virtual asset custody services and virtual asset trading platforms; CIMA waiver for qualifying supervised persons; sandbox licence for qualifying fintech / virtual asset models; separate Securities Investment Business Act and fund-regulatory analysis where the token or service has securities, fund, investment-management or tokenised fund features.
Question presented and assumptions
Question presented: What Cayman Islands legal/regulatory entry should be added to the Licentium jurisdiction hub for virtual asset / cryptoasset licensing and market-entry purposes?
Assumptions: The intended hub entry is for firms providing exchange, brokerage, transfer, custody, hosted wallet, virtual asset trading platform, token issuance, token listing, stablecoin, tokenised fund, staking, OTC, settlement, payments, financial services connected to virtual asset issuance, or related services in or from the Cayman Islands. No facts are supplied about Cayman incorporation, local management, customer location, private-key control, custody architecture, trading platform functionality, token classification, stablecoin redemption rights, public issuance, fund status, securities status, supervised-person status, waiver eligibility, or whether any service is already regulated under another Cayman regulatory law.
Jurisdiction profile
The Cayman Islands legislation website is maintained by the Office of the Law Revision Commissioner within the Portfolio of Legal Affairs and publishes current legislation, amending legislation, subsidiary legislation, gazettes and consolidated indexes. The official legislative materials relied on here are the Virtual Asset (Service Providers) Act, 2024 Revision; the Virtual Asset (Service Providers) (Amendment) Act, 2024; the relevant 2025 commencement orders; the Virtual Asset (Service Providers) (Amendment) Act, 2026; the Virtual Asset (Service Providers) Regulations, 2020; the Virtual Asset (Service Providers) (Amendment) Regulations, 2025; and the Anti-Money Laundering Regulations, 2025 Revision. The legislation index lists the VASP Act 2024 Revision and amendments including the 2024 Amendment Act, 2025 commencement order and 2026 Amendment Act.
CIMA is the relevant administrative authority for the VASP regime. CIMA’s official laws and regulations page lists the VASP Act 2024 Revision, the 2024 Amendment Act, the 2025 Amendment Regulations, the VASP Regulations 2020 and the 2025 commencement orders. CIMA’s regulatory measures page states that CIMA may issue rules, statements of principle and statements of guidance under section 34 of the Monetary Authority Act, and that rules create binding obligations whose breach may lead to fines or regulatory action.
Case law is not relied on in this session. The Cayman Islands Law Courts site states that judgments form part of the law of the land in relation to the principles they decide, and describes the court hierarchy as Summary Court, Grand Court, Court of Appeal and the Judicial Committee of the Privy Council. No subsequent-history or later-treatment case-law analysis was required for the conclusions below.
Hierarchy used here: Cayman Acts and Regulations are controlling law; commencement orders determine operative timing; CIMA rules are binding regulatory instruments within statutory authority; CIMA circulars, FAQs, registration pages and supervisory statements are official administrative materials and are used for CIMA’s implementation position and process but not as substitutes for statutory text.
Executive summary
- The Cayman Islands has a dedicated VASP regime, not a single generic crypto licence. A person must not carry on virtual asset services in or from the Islands unless registered, licensed for custody / trading platform activity, granted a waiver, or operating under a sandbox licence.
- “Virtual asset service” includes issuance, virtual asset / fiat exchange, exchange of convertible virtual assets, virtual asset transfer, custody, and participation in or financial services related to issuance or sale.
- Virtual service tokens are excluded from the virtual asset regime where they are not transferable or exchangeable with third parties and are used only to access an application or service.
- Phase Two commenced on 2025-04-01. Virtual asset custody services and virtual asset trading platforms now require a CIMA licence; other VASP activities generally remain registration-based unless a waiver or sandbox licence applies.
- Existing registered persons carrying on licensable custody or trading-platform activities were required to apply for a licence within 90 days from 2025-04-01 and could continue operating while CIMA reviewed the application.
- Natural persons cannot be granted VASP registration, a VASP licence or a waiver, and unregistered / unlicensed applicants must not imply CIMA authorisation.
- A VASP licence application is substantive. The 2025 Amendment Regulations require detailed information on custody, trading platform operations, business plan, governance, ownership, capital, AML/CFT/CPF controls, cybersecurity, outsourcing, client location, disclosures, listing terms, clearing / settlement and market surveillance.
- VASP custody and trading platform licensees are subject to ongoing CIMA rules on governance, fit and proper management, risk assessment, conflicts, client communications, complaints, outsourcing, data and recordkeeping, capital, custody, fiat segregation, market abuse monitoring, listing and trading controls.
- AML / Travel Rule obligations apply to virtual asset transfers, including originator / beneficiary information, verification, required information transmission, five-year record retention, and rejection or request procedures for missing or incomplete transfer information.
- Securities and fund overlays remain separate. A VASP may not engage in securities investment business unless registered, licensed or exempted under the Securities Investment Business Act; 2026 amendments also carve out certain tokenised mutual fund / private fund digital tokens from the VASP issuance definition.
Analysis by issue
Current Cayman market-entry route: registration, licence, waiver or sandbox
Conclusion: A Cayman Islands VASP entry should state that virtual asset services in or from the Cayman Islands require registration, licensing, waiver or sandbox treatment depending on the activity and regulatory status of the provider.
Rule: The VASP Act states that a person must not “carry on or purport to carry on virtual asset service in or from within the Islands” unless the person is registered, licensed to provide virtual asset custody services or operate a virtual asset trading platform, granted a waiver, or licensed under the sandbox regime. Act 22 of 2024 further provides that CIMA shall not grant registration, a licence or a waiver to a natural person, and that a person not registered, licensed or granted a waiver, including an applicant, must not state, imply or convey that the person is CIMA-regulated or authorised to provide virtual asset service.
The offence provision states that a person carrying on virtual asset service in or from the Islands for which registration is required, without being registered or holding a waiver, commits an offence punishable on summary conviction by a fine of KYD 25,000 and imprisonment for one year, with continuing daily fines after conviction. For unlicensed custody services or trading platform operation, the corresponding offence carries a KYD 100,000 fine, imprisonment for one year and continuing daily fines.
Application: A website entry should not describe the Cayman Islands route as merely “incorporate a Cayman company and operate.” The gateway is regulatory. The first classification step is whether the activity is a virtual asset service; the second is whether it is custody / trading platform activity requiring a licence; the third is whether the provider is already supervised and potentially waiver-eligible; the fourth is whether sandbox treatment is appropriate.
Limitations / counterarguments: The precise route depends on the exact activity, whether the service is provided “in or from” the Cayman Islands, whether the business is a supervised person, and whether another regulatory law is more appropriate. A non-Cayman group merely having Cayman ownership or an exempted company does not by itself answer whether virtual asset service is carried on in or from the Islands.
What counts as a virtual asset service?
Conclusion: The Cayman VASP perimeter is broad and captures issuance, exchange, transfer, custody and financial services connected to issuance or sale, but excludes pure virtual service-token activity.
Rule: The VASP Act defines “virtual asset” as a digital representation of value that can be digitally traded or transferred and used for payment or investment purposes, excluding a digital representation of fiat currency. It defines “virtual asset service” as issuing virtual assets; exchanging virtual assets for fiat currencies; exchanging one or more other forms of convertible virtual assets; transferring virtual assets; providing virtual asset custody services; or participating in, and providing financial services related to, a virtual asset issuance or sale.
The Act defines a “virtual service token” as a digital representation of value that is not transferable or exchangeable with a third party and includes a digital token whose sole function is to provide access to an application or service. It further states that a virtual service token is not a virtual asset, and a person carrying on activities involving only virtual service tokens does not need a licence or registration.
Application: Exchange, broker, OTC, custodial wallet, token-transfer, token-sale and token-issuance support models require VASP analysis. A non-transferable SaaS access token or closed internal service token may fall outside the VASP regime, but only if it truly satisfies the statutory virtual service-token concept. A transferable utility token, exchange-listed access token, investment token, stablecoin, custody token or token used for payment will require further classification.
Limitations / counterarguments: The statutory exclusion for virtual service tokens is narrow. Marketing a token as “utility” is not conclusive if it is transferable, exchangeable, used for payment or investment, or sold to the public.
Licensing for virtual asset custody services and virtual asset trading platforms
Conclusion: From 2025-04-01, virtual asset custody services and virtual asset trading platforms are licensable activities, not merely registration activities.
Rule: The 2025 commencement order brought specified provisions of the VASP Act into force on 2025-04-01, including provisions relating to licensees, licence applications, custody-service requirements and trading-platform requirements. The Act 22 of 2024 commencement order also brought specified 2024 amendment provisions into force on 2025-04-01. CIMA’s Phase Two circular states that, from 2025-04-01, VASPs providing virtual asset custody services or operating virtual asset trading platforms in or from the Cayman Islands must obtain a licence under the Act.
Act 22 of 2024 amended the virtual asset trading platform definition by removing “centralised or decentralised” wording and referring to a digital platform that provides a virtual asset service and facilitates the exchange of virtual assets for fiat currency or other virtual assets on behalf of third parties for fee, commission, spread or other benefit. The VASP Act defines “virtual asset custody service” as the business of safekeeping or administering virtual assets or instruments enabling control over virtual assets.
Application: A hosted wallet, private-key custodian, omnibus wallet, MPC custody provider, exchange custody function or platform holding assets for users should be analysed for custody licensing. A platform that facilitates trading or exchange of virtual assets for third parties for compensation should be analysed for trading-platform licensing. CIMA states that a VASP providing both licence-required and registration-only services need only apply for a licence.
Limitations / counterarguments: Non-custodial technology providers, routing interfaces, DeFi front-ends, validators, software developers and smart-contract protocols require fact-specific analysis. The outcome depends on who controls assets or keys, who facilitates exchange, who contracts with customers, whether fees or spreads are earned, and whether the activity is in or from the Cayman Islands.
Registration for other VASP activities and transition for existing registered persons
Conclusion: VASP activities not requiring a custody / trading platform licence generally remain registration-based, but existing registered persons performing custody or trading-platform activity had a specific Phase Two transition obligation.
Rule: Act 22 of 2024 substitutes a registration framework under which persons providing virtual asset services that do not require a licence must apply to CIMA for registration; CIMA may grant or deny registration, direct the applicant to apply for a licence, direct sandbox treatment or direct licensing / registration under another regulatory law. The same amendment provides that a registered person that was providing virtual asset custody services or operating a virtual asset trading platform at the commencement of that provision must apply for a licence within 90 days of commencement and may continue operating pending CIMA’s determination. CIMA’s circular confirms the 90-day period from 2025-04-01 and says CIMA will cancel a registration if a licence is granted.
Application: A transfer service, virtual asset issuance adviser, broker, exchange facilitator or token-sale participant that is not a custody provider or trading platform may be in the registration route. A registered Cayman VASP that added or already conducted custody or trading platform activity needed to move into licensing after Phase Two. New entrants after 2025-04-01 should not rely on the transitional continuation treatment.
Limitations / counterarguments: Some activities may be sufficiently similar to securities investment business, money services business, fund business, trust business or another regulated activity that CIMA may require licensing under another regulatory law instead of, or in addition to, VASP registration or licensing.
Licence application content and fit-and-proper / governance burden
Conclusion: Cayman VASP licensing is a substantive CIMA authorisation process requiring detailed operational, governance, ownership, financial, AML, custody, cybersecurity and trading-platform evidence.
Rule: The 2025 Amendment Regulations state that a licence application under section 8(1) must be made to CIMA in the Schedule 1A form. Schedule 1A requires information on the applicant’s current or intended business, licensable activity, two-year assets / liabilities / income, management and personnel, customer base, shareholder and ownership structure, organisational chart, capital and auditor. Custody applicants must provide information on assets held, cybersecurity and risk safeguards, AML/CFT/CPF risk mitigation, client agreements and disclosures, insurance, outsourcing, professional knowledge / experience, actively engaged directors and client locations. Trading platform applicants must provide information on platform revenue, hardware location, listed virtual assets, listing terms, proprietary trading, marketing and client location, risk management, internal controls, cybersecurity, governance, dominant influence arrangements, outsourcing, clearing / settlement, market surveillance, conflicts, market integrity, director experience and whether persons in the Cayman Islands can buy, sell, trade, exchange or list on the platform.
Act 22 of 2024 also inserted governance requirements: at least three directors, including at least one independent director; accurate disclosures and advertising; carrying on only approved virtual asset services and the approved business plan; and prior written CIMA approval for material business-plan changes or additional virtual asset services.
Application: A Cayman VASP licence applicant should prepare a full regulatory application, not only constitutional documents. The package should cover governance, director independence, fit and proper persons, beneficial ownership, business plan, financial projections, custody architecture, client asset treatment, fiat handling, cybersecurity, outsourcing, market surveillance, token listing, AML/CFT/CPF and sanctions, client disclosures, complaints, capital, audit and wind-down planning.
Limitations / counterarguments: The precise application burden will differ by custody model, platform model, client category, token set, outsourcing, cross-border operations, group structure and whether CIMA treats another regulatory law as more appropriate.
Ongoing obligations for custodians and trading platforms
Conclusion: CIMA’s post-licensing framework is operationally detailed, especially for governance, client asset protection, capital, outsourcing, market integrity and token listing.
Rule: CIMA’s February 2026 rule states that it establishes rules for virtual asset custodians and virtual asset trading platforms under the VASP Act as amended. It applies to virtual asset custodians and trading platforms regulated by CIMA and sets ongoing obligations. The rule requires a licensee to be led by a suitably qualified governing body that is fit and proper; to conduct periodic risk assessments covering cyber, AML/CFT, sanctions, custody, data protection and client protection; to seek CIMA prior written approval for ownership, director and senior officer changes; and to ensure client communications are fair, clear and not misleading.
The same rule includes requirements on conflicts, risk disclosures, complaints, marketing, client agreements, outsourcing, data and recordkeeping. It requires regulatory capital at the higher of a risk-based capital requirement, six months of fixed overhead, or an amount determined by CIMA, plus an additional buffer where required. For custody / client assets, it addresses fiat segregation, reconciliations, private-key management and audits. For trading platforms, it requires systems to monitor and detect market abuse and immediately report suspicious activity, plus trading controls, clearing / settlement procedures, pricing policies, listing rules and restrictions on anonymity-feature virtual assets unless ownership and transaction history can be easily identified.
Application: A licensee should be ready to operate under a mature financial-regulatory control environment. For custody, that means segregation, bankruptcy-remote or equivalent protection, key management, reconciliations, third-party custody due diligence, access controls and audit. For trading platforms, that means listing governance, market surveillance, conflicts controls, trade controls, disclosures, pricing methodology, order-book integrity, incident response and AML/sanctions monitoring.
Limitations / counterarguments: CIMA’s rule is a regulatory measure. Its detailed application will depend on licence conditions, business scale, client type, token set, custody design, outsourcing, market model and CIMA supervisory correspondence.
Virtual asset issuance and tokenised fund carve-outs
Conclusion: Cayman public virtual asset issuance is controlled through CIMA approval, and the 2026 amendment narrows / clarifies issuance by excluding virtual service tokens and certain tokenised fund instruments.
Rule: The VASP Act provides that a registered person must not issue virtual assets directly to the public above the prescribed threshold and must, before issuing virtual assets, submit an issuance request to CIMA in the prescribed form and obtain CIMA approval. The VASP Regulations state that CIMA may decide whether the sale is of newly created virtual assets to the public in or from the Islands, taking into account factors including advertising to persons in the Islands, whether persons in the Islands may participate directly or indirectly, whether the sale is from within the Islands, and whether the sale is public or private.
Act 4 of 2026 amends the definition of issuance of virtual assets. It defines issuance as the sale of newly created virtual assets to the public in or from the Islands in exchange for fiat currency, other virtual assets or other consideration, but excludes virtual service tokens and the issuance of a digital equity token by a tokenised mutual fund under the Mutual Funds Act or a digital investment token by a tokenised private fund under the Private Funds Act.
Application: A Cayman token issuer, launchpad, foundation, trading platform facilitating primary issuance or tokenised fund should not assume all token issuance follows the same VASP route. Public sales in or from Cayman require issuance analysis and CIMA approval. Tokenised fund interests may instead sit under the Mutual Funds Act, Private Funds Act, Securities Investment Business Act or other fund / securities legislation, depending on structure.
Limitations / counterarguments: A private token sale, a non-transferable service-token distribution, a tokenised fund interest, a security token and a stablecoin issuance may each fall differently. Required facts include offering location, target investors, transferability, redemption, rights attached to the token, fund status, issuer entity, marketing and whether the token is newly created.
Securities investment business and other Cayman regulatory overlays
Conclusion: Cayman VASP status does not displace other Cayman financial services laws. Securities, funds, trust, banking, money services and other regulated activity may require separate licensing, registration or exemption.
Rule: The VASP Act provides that a virtual asset service provider must not engage in securities investment business unless registered or licensed under the Securities Investment Business Act or exempted by CIMA under that Act. For virtual asset trading platforms, the Act requires a platform licensee to apply to CIMA for approval before engaging in securities investment business relating to virtual assets; CIMA must determine whether registration or an additional licence is required under the Securities Investment Business Act and assess whether the platform engages in or facilitates securities investment business, lists or facilitates issuance of securities that are virtual assets, and whether additional supervision is required. Act 22 of 2024 also provides that CIMA shall require a VASP registered or licensed under the VASP Act to apply for a licence or registration under another regulatory law where the financial services business is materially similar to activity under another licensing regime or requires additional oversight.
Application: Tokenised shares, fund interests, debt tokens, tokenised private funds, tokenised mutual funds, derivatives, investment-management products, custodial trust structures, payment / money services and banking-like products require additional Cayman perimeter analysis. A VASP registration or licence should be treated as one layer, not a full financial-services passport.
Limitations / counterarguments: Whether a token is a security, fund interest, derivative, deposit-like arrangement, trust property or payment instrument depends on rights, issuer obligations, redemption, pooling, management discretion, investor return, governance, marketing and contractual terms.
AML/CFT/CPF and Travel Rule
Conclusion: Cayman VASPs must build AML/CFT/CPF and Travel Rule compliance into onboarding, custody, exchange, transfer and issuance workflows.
Rule: The Anti-Money Laundering Regulations define VASP by reference to the VASP Act and include Part 10A requirements for virtual asset transfers. For an originating VASP, the Regulations require collection and recording of originator and beneficiary information, including names, account or unique transaction reference, originator address or official identity / customer identification / date and place of birth information; verification of originator information before conducting the transfer; simultaneous or concurrent provision of required information to the beneficiary VASP; measures against unauthorised disclosure; and record retention for at least five years. Beneficiary VASPs must collect and record required originator and beneficiary information and verify beneficiary information, with five-year record retention.
The Regulations also require procedures to detect missing or incomplete required information. An originating VASP must not execute the transfer where required information is incomplete, and a beneficiary VASP must reject the transfer or request missing information; repeated failures may require restriction or termination of the business relationship and reporting to the Financial Reporting Authority or supervisory authority. Missing or incomplete originator information is to be treated as a factor in assessing suspicion.
Application: A Cayman VASP should implement customer due diligence, beneficial ownership controls, sanctions screening, Travel Rule message creation and receipt, counterparty VASP due diligence, hosted / unhosted wallet risk assessment, transfer monitoring, suspicious activity escalation, record retention, policies and training. Custody and trading platforms should align Travel Rule operations with wallet architecture, settlement flows and client asset controls.
Limitations / counterarguments: The exact workflow depends on transfer size, hosted / unhosted wallet structure, originator / beneficiary roles, intermediary VASP involvement, omnibus wallets, third-party custodians, foreign VASP counterparties and cross-border data protection restrictions.