Game changer! Introducing the Cayman Islands virtual asset regulation, part 1

13 November 2020

On 25 May 2020 the Government of the Cayman Islands passed the Virtual Asset (Service Providers) Act, 2020 (the "VASP Act"), which provides a legal framework for conducting virtual asset business in the Cayman Islands and for the registration and licensing of persons providing virtual asset services. The VASP Act aims to give the Cayman Islands a cutting-edge, robust framework that conforms to global regulatory standards, protects consumers and meets the requirements of the Financial Action Task Force recommendations on virtual assets. In this two-part series, part 1 looks at the new VASP law and its registration requirements. Part 2 will examine the licensing requirements.

1. What is a virtual asset?

The VASP Act defines a "virtual asset" as "a digital representation of value that can be digitally traded or transferred and can be used for payment or investment purposes, but does not include a digital representation of fiat currencies".

The VASP Act distinguishes the "virtual asset" that is to be regulated, as above, from a "virtual service token", which is defined as "a digital representation of value that is not transferable or exchangeable with a third party at any time, including a digital token the sole function of which is to provide access to an application or service, or to provide a service or function directly to its owner".

The distinction is drawn to deal with the familiar question whether a digital token or coin is a security token or a utility token. A virtual service token will be treated as a utility token and so falls outside the registration and licensing regimes of the VASP Act.1

2. What is a virtual asset service?

The VASP Act provides that a "virtual asset service" means the business of providing one or more of the following services or operations for, or on behalf of, a natural or legal person or legal arrangement, or of issuing virtual assets:

(a) exchange between virtual assets and fiat currencies;

(b) exchange between one or more forms of convertible virtual assets;

(c) transfer of virtual assets;

(d) virtual asset custody service; or

(e) participation in, and provision of, financial services related to an offer or sale of virtual assets.

3. Who is a virtual asset service provider?

Under the VASP Act a person is a "virtual asset service provider" (a "VASP") if it is (1) a company, general partnership, limited partnership, limited liability company or foreign company registered in the Cayman Islands, and (2) carries on virtual asset services as a business in or from within the Cayman Islands, and is registered or licensed under the VASP Act, or is an existing licensee exempted under the VASP Act.

A natural person cannot carry on, or hold himself or herself out as carrying on, virtual asset services as a business in or from within the Cayman Islands.

The VASP Act requires a VASP to register with, or be licensed by, the Cayman Islands Monetary Authority ("CIMA"). Whether a VASP must register or be licensed depends on the activities it carries out. Broadly, however, a VASP must hold a virtual asset service licence where it provides virtual asset custody services or operates a virtual asset trading platform. It appears that in most cases a VASP that carries on business as a VASP without providing custody services or operating a trading platform will be required to register with CIMA.

4. Registration of VASPs

A person that was carrying on business as a VASP on the date the VASP Act came into force, or that wishes to provide virtual asset services for which no licence is required under the VASP Act, must apply to CIMA in order to become a "registered person" under the VASP Act.

5. CIMA's considerations: licence or registration

In deciding whether to grant a virtual asset licence or a sandbox licence, to register an applicant as a "registered person" or to waive the requirement to be licensed or registered under the VASP Act, CIMA will have regard to the following:

a) the scale, scope and complexity of the virtual asset services, the underlying technology, the manner in which the services are delivered and the use made of virtual assets;

b) the applicant's knowledge, expertise and experience;

c) the AML procedures the applicant has implemented;

d) the internal safeguards and data protection systems the applicant uses;

e) the similarity between the virtual asset services and securities investment business or any other regulated activity under any other regulatory law of the Cayman Islands;

f) the risks involved;

g) whether the virtual asset services business involves providing virtual asset custody services or operating a virtual asset trading platform;

h) the applicant's net worth, capital reserves and financial

stability;

i) the likelihood that the services will promote innovation, competition and benefit to consumers; and

j) whether the applicant's senior officers, trustees and beneficial owners are fit and proper persons.

6. General requirements applying to VASPs after registration

The VASP Act sets out continuing obligations that apply to a VASP after registration, including:

(a) to prepare accounts, including unaudited reports, for inspection by CIMA on request each year (note that the Auditors and Audit Act makes no specific provision requiring accounts to be audited);

(b) to ensure that its senior officers and trustees are fit and proper persons to hold their respective positions;

(c) to ensure that beneficial owners are fit and proper persons to hold that control or ownership;

(d) to take the steps necessary to protect its clients' personal data and virtual assets;

(e) to ensure that all communications relating to virtual asset services are accurate;

(f) to comply with the Cayman Islands Anti-Money Laundering Regulations (2020 revision) as amended, which includes appointing an anti-money-laundering officer and implementing anti-money-laundering systems and procedures;

(g) when carrying out transfers of virtual assets, to collect and maintain information on the beneficiary and originator of the transfer as required by the Anti-Money Laundering Regulations, which must be provided within 48 hours of a request from CIMA;

(h) to notify CIMA within 15 days of any change to the information in the application form submitted to CIMA;

(i) to pay the annual renewal fee before 15 January each year; and

(j) save for certain exceptions, to obtain CIMA's prior approval for the issue, voluntary transfer or disposal of 10% or more of the total shares or interests in a VASP, the new shareholder or partner also needing to be a "fit" person.

In addition, a VASP must not engage in securities investment business, as defined in the Securities Investment Business Act (2020 revision) as amended ("SIBL"), which is likely to be the case where the VASP is an investment manager or adviser or provides brokerage services, unless it is a licensee or registered person under SIBL, and it may not appoint a senior officer or trustee who is an AMLCO without CIMA's prior approval.

Given that CIMA applies the "four eyes" principle to other registered persons and licensees, a VASP may be required to have at least two directors, members or partners, as applicable.

7. Issuing virtual assets

(a) Issue directly by a VASP. In order to issue a newly created virtual asset directly to the public in or from within the Cayman Islands above the "prescribed threshold", a registered person, that is a VASP registered with CIMA, must first submit an "issuance request" to CIMA and obtain CIMA's approval. The VASP Act is silent on the value of the "prescribed threshold", which is essentially the amount in fiat currency or equivalent that an issuer may offer to the public within a prescribed period, and this will most likely be confirmed by a further amendment of the regulations.

(b) Issue by a VATP on behalf of a VASP. A registered person may, however, use one or more virtual asset trading platforms ("VATPs") in order to issue virtual assets above the prescribed threshold on a VATP. This requires the VATP either to be (i) licensed under the VASP Act, or (ii) licensed or registered and supervised as a virtual asset business by a government regulator in another non-high-risk jurisdiction. Before using a VATP to issue a newly created virtual asset, the registered person must submit a virtual asset issuance request to CIMA and obtain its approval.

(c) Issue directly by a VATP. A licensee operating a VATP may issue virtual assets directly to the public on its own behalf within the prescribed threshold, where the terms of its licence permit, by submitting an issuance application to CIMA for approval.

(d) Issue by a VATP on behalf of a VASP. A VATP licensed under the VASP Act may issue virtual assets directly to the public within the prescribed threshold on behalf of a VASP, where the terms of its licence permit and the VASP creating the virtual asset has obtained CIMA's approval to issue.

(e) Obligations of issuers below the prescribed threshold. Where an issue of virtual assets is within the prescribed threshold, or involves the transfer or exchange of other virtual assets or fiat currency, a registered person must keep records containing all the information CIMA requires on each transaction of the issue, and must make those records available to CIMA on request.

(f) CIMA's conditions. In approving an issue above the prescribed threshold, CIMA may impose requirements as to (i) the manner in which the issuer may invite the public to participate in the issue, (ii) the information provided to the public

or the disclosure of risk, (iii) the information the licensee is required to collect from members of the public participating in the issue, and (iv) reporting requirements to CIMA.

(g) Reporting obligation of licensees. Where a licensee operating a VATP facilitates the issue of a newly created virtual asset on behalf of a VASP and knows or has reasonable grounds to believe that the issue does not meet the applicable requirements, the licensee must promptly give CIMA written notice of its knowledge or belief, with its reasons.

(h) CIMA's response time. CIMA shall notify the licensee or virtual asset issuer that submitted an issuance request within 21 days of receiving it.

8. CIMA's considerations: approving an issue of virtual assets

The VASP Act sets out a number of factors CIMA will take into account in deciding whether to approve an issuance request by a VASP or a registered person. They include the following:

(a) the nature of the virtual asset, including whether it has the character of a "security" as defined in SIBL;

(b) the function and purpose of the virtual asset and, where applicable, the character of the underlying asset it may represent;

(c) the accuracy and completeness of the disclosure made to the public about the issue;

(d) whether the VASP wishes to solicit the public directly to purchase the virtual asset;

(e) the total number of virtual assets available for purchase and the amount to be raised;

(f) the period of the issue;

(g) the platform on which the virtual asset is to be issued; and

(h) the AML processes of the virtual asset issuer.

9. CIMA's enforcement powers

By way of general note, under the VASP Act CIMA has broad discretionary supervisory powers over registered persons and licensees, including but not limited to:

(a) examination of affairs. CIMA may examine the affairs of any VASP whenever it considers it necessary, whether by periodic filings, on-site inspections, audit reports or any other means CIMA determines under the VASP Act.

(b) cessation and desistance. Where CIMA considers that a VASP is committing, pursuing or is about to commit or pursue unsafe or unsound conduct in carrying on VASP business, it may direct the VASP to cease and desist from that conduct.

(c) CIMA's direction. Where CIMA considers that a VASP has failed to comply with any requirement of the VASP Act, it may direct the VASP by written notice to comply within the period and on the conditions specified in the notice.

(d) Enforcement powers. Where CIMA knows or has reasonable grounds to believe that a VASP:

is unable, or appears unable, to meet its obligations as they fall due;

is carrying on business in a fraudulent or other manner that harms the public interest, its clients' interests or its creditors' interests;

has contravened any provision of the Anti-Money Laundering Regulations;

has failed to comply with the conditions of its licence or registration;

has not directed and managed its business in an appropriate and proper manner, or has senior officers, managers or persons with ownership or control who are not "fit and proper persons";

is a "corporate services provider" that has breached applicable law; or

has failed to comply with any lawful direction of CIMA;

CIMA may take certain measures, including but not limited to:

i. revoking the virtual asset licence or sandbox licence, or cancelling the registration;

ii. imposing conditions on the licence, or amending or revoking those conditions;

iii. applying to the court for any order necessary to protect the interests of the clients or creditors of the licensee or registered person;

iv. requiring the licensee or registered person, at the VASP's expense, to obtain an audit report for submission to CIMA on its anti-money-laundering systems and its procedures for complying with the Anti-Money Laundering Regulations;

v. requiring the replacement of any senior officer or trustee appointed by the VASP, or the relinquishment of ownership or control;

(vi) appointing a person to advise the licensee on the proper conduct of its affairs and to report on those affairs to CIMA;

vii. requiring the VASP to take such action as CIMA reasonably considers necessary.

Where a registered person or licensee has ceased, or wishes to cease, carrying on virtual asset services, or has not commenced business within one year of the date of its registration or licence, CIMA may revoke the virtual asset service licence or sandbox licence, or cancel the registration.

1 Article 3(2) of the VASP Act makes this explicit: "For the purposes of this Law, a virtual service token is not a virtual asset, and a person or legal arrangement that provides only services involving virtual service tokens does not require a licence or registration under this Law."