Game changer! Licensing requirements for virtual assets in the Cayman Islands, part 2

23 November 2020

On 25 May 2020 the Government of the Cayman Islands passed the Virtual Asset (Service Providers) Act, 2020 (the "VASP Act"), which provides a legal framework for conducting virtual asset business in the Cayman Islands and for the registration and licensing of persons providing virtual asset services. The VASP Act aims to give the Cayman Islands a cutting-edge, robust framework that conforms to global regulatory standards, protects consumers and meets the requirements of the Financial Action Task Force recommendations on virtual assets. In this two-part series, part 2 looks at the new VASP law and its licensing requirements. Part 1 considered the registration requirements.

1. What is a virtual asset?

The VASP Act defines a "virtual asset" as "a digital representation of value that can be digitally traded or transferred and can be used for payment or investment purposes, but does not include a digital representation of fiat currencies".

The VASP Act distinguishes the "virtual asset" that is to be regulated, as above, from a "virtual service token", which is defined as "a digital representation of value that is not transferable or exchangeable with a third party at any time, including a digital token the sole function of which is to provide access to an application or service, or to provide a service or function directly to its owner".

The distinction is drawn to deal with the familiar question whether a digital token or coin is a security token or a utility token. A virtual service token will be treated as a utility token and so falls outside the registration and licensing regimes of the VASP Act.1

2. What is a virtual asset service?

The VASP Act provides that a "virtual asset service" means the business of issuing virtual assets, or of providing one or more of the following services or operations, for or on behalf of a natural or legal person or legal arrangement:

(a) exchange between virtual assets and fiat currencies;

(b) exchange between one or more forms of convertible virtual assets;

(c) transfer of virtual assets;

(d) virtual asset custody service; or

(e) participation in, and provision of, financial services related to an offer or sale of virtual assets.

3. Who is a virtual asset service provider?

Under the VASP Act a person is a "virtual asset service provider" (a "VASP") if it is (1) a company, general partnership, limited partnership, limited liability company or foreign company registered in the Cayman Islands, and (2) carries on virtual asset services as a business in or from within the Cayman Islands, and is registered or licensed under the VASP Act, or is an existing licensee exempted under the VASP Act.

A natural person cannot carry on, or hold himself or herself out as carrying on, virtual asset services as a business in or from within the Cayman Islands.

The VASP Act requires a VASP to register with, or be licensed by, the Cayman Islands Monetary Authority ("CIMA"). Whether a VASP must register or be licensed depends on the activities it carries out. Broadly, however, a VASP must hold a virtual asset service licence where it provides virtual asset custody services or operates a virtual asset trading platform. It appears that in most cases a VASP that carries on business as a VASP without providing custody services or operating a trading platform will be required to register with CIMA.

4. CIMA's considerations: licence or registration

In deciding whether to grant a virtual asset licence or a sandbox licence, to register an applicant as a "registered person" or to waive the requirement to be licensed or registered under the VASP Act, CIMA will have regard to the following:

a) the scale, scope and complexity of the virtual asset services, the underlying technology, the manner in which the services are delivered and the use made of virtual assets;

b) the applicant's knowledge, expertise and experience;

c) the AML procedures the applicant has implemented;

d) the internal safeguards and data protection systems the applicant uses;

e) the similarity between the virtual asset services and securities investment business or any other regulated activity under any other regulatory law of the Cayman Islands;

f) the risks involved;

g) whether the virtual asset services business involves providing virtual asset custody services or operating a virtual asset trading platform;

h) the applicant's net worth, capital reserves and financial stability;

i) the likelihood that the services will promote innovation, competition and benefit to consumers; and

j) whether the applicant's senior officers, trustees and beneficial owners are fit and proper persons.

5. Virtual asset service licence

A person wishing (i) to provide virtual asset custody services, that is the business of safekeeping or administering virtual assets, or (ii) to operate a virtual asset trading platform ("VATP"), or who is within a phase of the VASP Act coming into force, should apply for a virtual asset service licence. For the purposes of the VASP Act, a VATP does not include a platform that merely provides a forum where buyers and sellers post bids and offers, nor a platform where the parties trade through a separate platform or on a peer-to-peer basis.

(a) CIMA's standards. In deciding whether to approve an application for a licence, CIMA will consider the matters set out in section 4 above, whether approving the application is in the public interest, and whether the applicant has (i) persons with the necessary skills, knowledge and experience, (ii) facilities, books, records and accounting systems, and (iii) adequate capital and cybersecurity measures, as CIMA considers appropriate having regard to the scale, scope and complexity of the business. Where CIMA grants a licence it will publish notice of it in the Cayman Islands Gazette.

(b) CIMA's regulatory requirements. CIMA may impose such regulatory requirements on virtual asset service licensees as it considers necessary, including further restricting or prohibiting the use of technology or practices that CIMA considers may disrupt or harm CIMA's functions, the public interest or the Cayman Islands financial services industry.

(c) Event-driven notification. Besides the annual renewal fee due on 15 January each year, a licensee must notify CIMA within 15 days of any change to the information in the application form submitted to CIMA.

(d) Annual audit obligation of licensees. A licensee must audit its accounts each year and submit them to CIMA within 6 months of the end of the year. CIMA may waive this requirement where it considers it unnecessary or burdensome, having regard to the scale, scope and complexity of the economic activity and the availability of audit services for virtual asset services.

6. Requirements: virtual asset custody services

A licensee providing virtual asset custody services must:

(a) maintain best practice in relation to the virtual assets in its custody;

(b) not guarantee, or cause any guarantee of, any virtual asset unless the beneficial owner of the virtual asset specifically agrees;

(c) ensure that all proceeds relating to virtual assets in its custody accrue for the benefit of the owner, unless otherwise agreed in writing;

(d) take the steps necessary to safeguard the virtual assets it holds;

(e) have adequate safeguards against theft and loss; and

(f) enter into a custody arrangement with the owner of the virtual assets that contains clear particulars prescribed by the VASP Act, namely how the virtual assets are to be held, the transactions the custodian is permitted to undertake, and disclosure of the risks and fees involved.

CIMA may also impose requirements on licensees providing virtual asset custody services, including (i) net worth requirements, (ii) reporting requirements, (iii) disclosure to clients of the transparency of their operations, (iv) client asset custody requirements, including asset segregation, insurance requirements and cybersecurity measures, and (v) any other requirements CIMA determines to be in the best interests of the beneficial owners of the assets held by the licensee.

7. Requirements: virtual asset trading platforms

(a) CIMA's requirements. CIMA may impose requirements on a licensee operating a VATP where it considers them necessary, including: (i) the types of client to whom its services may be sold; (ii) the types of virtual asset that may and may not be traded on the VATP; (iii) the clearing and settlement process for transactions between buyers and sellers of virtual assets; and (iv) net worth and reporting requirements.

(b) Due diligence requirements. A licensee operating a VATP must carry out reasonable due diligence procedures on the virtual assets listed on the VATP and on their issuers.

(c) Securities investment business. A licensee operating a VATP and engaging in securities investment business involving virtual assets must first apply to CIMA for approval in the prescribed form under the Securities Investment Business Act of the Cayman Islands ("SIBL"). In determining a VATP application, CIMA will consider whether the VATP proposes to list or facilitate securities issued in respect of virtual assets under SIBL, and whether SIBL requires any additional supervision.

(d) Prohibitions on licensees. A licensee operating a VATP must not:

provide financing to clients to purchase virtual assets, unless the terms and risks of the financing are disclosed to the client;

engage in trading or market conduct that may harm its clients' interests, unless those activities are necessary for the operation of the VATP and are disclosed to the VATP's clients;

allow a virtual asset to be traded on the VATP unless it is satisfied that the virtual asset is not presented in a fraudulent manner or in a manner intended to defraud;

allow a client to purchase or trade virtual assets unless the licensee assures itself that the client understands the risks of purchasing, holding or trading virtual assets, and provides disclosure in a form the client can understand; and

provide fiat currency exchange services to VATP users.

8. Sandbox licence

A "sandbox licence" is a temporary licence, valid for up to 1 year, issued to a person providing virtual asset services that represent (i) an innovative use of technology, or (ii) the use of an innovative delivery method, requiring supervision and oversight that existing licensing or registration regimes do not provide.

(a) CIMA's oversight. CIMA shall assess, monitor and supervise the sandbox licensee's innovative service, technology or delivery method to ensure that the service, technology or delivery (i) conforms to the core principles of a sandbox licence set out in the VASP Act, (ii) improves the provision of financial services within the Cayman Islands, (iii) complies with global standards and best anti-money-laundering practice, (iv) promotes the adoption of new financial services practices and technology within the Cayman Islands, and (v) develops best practice and guidance for the virtual asset services sector.

(b) CIMA's direction. CIMA has discretion to require a person applying to be a registered person or a virtual asset service licensee to apply instead for a sandbox licence.

(c) CIMA's powers. CIMA may take any action it considers necessary, where it considers the action necessary to protect clients or potential clients and in the public interest, to extend the term of a sandbox licence, to vary any restriction or to revoke a sandbox licence.

(d) Fintech service providers. A fintech service provider may apply for a sandbox licence but need not do so. For the purposes of the Financial Technology Service Providers Act, a "fintech service provider" is a person engaged in a service that uses innovative technology to improve, change or enhance financial services, but is not a virtual asset service.

(e) Compliance requirements. Where CIMA grants a sandbox licence it may impose any requirement applicable to virtual asset service licensees and any restriction it considers necessary, for example a limit on the value or amount of virtual asset services or fintech services provided to clients.

9. CIMA's enforcement powers

Under the VASP Act CIMA has broad discretionary supervisory powers over registered persons and licensees. Those powers are set out in part 1 of this series.

Where a licensee or registered person has ceased, or wishes to cease, carrying on virtual asset services, or has not commenced business within 1 year of the date of its licence or registration, CIMA may revoke the virtual asset service licence or sandbox licence, or cancel the registration.

This publication is not intended to be a substitute for specific legal advice or a legal opinion. For specific advice, please contact:

Telephone: 021-68819098