Crypto License in the Cayman Islands

The Cayman Islands Monetary Authority issues two sorts of Virtual Assets Service Providers permits, each with specific licensing requirements and an application process. There are nuances to note:

Registration: This pathway is for entities only providing services such as exchanges (crypto-to-fiat or crypto-to-crypto), transfers, or virtual asset issuances. It authorises the following activities:

• Exchange between virtual assets and fiat currencies or between one or more forms of convertible virtual assets or other virtual assets;

• Transfer of virtual assets;

• Virtual asset issuances (e.g., ICOs), which include the creation and sale of newly created virtual assets to the public or through private sales, subject to regulatory requirements and exceptions, such as airdrops.

License: This is a more stringent pathway required for entities that provide virtual asset custodial services or operate a virtual asset trading platform. The license permits the following services:

• Providing virtual asset custody services, with a requirement to exercise control over client assets and segregate them from proprietary assets;

• Operating a virtual asset trading platform, which refers to trading platforms that facilitate trades and control virtual assets. These platforms may purchase virtual assets from sellers to provide liquidity. Platforms operating in a peer-to-peer manner, where users trade directly without the platform exercising control, may be excluded from this definition. A separate platform that only hosts bids and offers without facilitating trades or custody is also not considered a virtual asset trading platform under the regulation.

Issuing cryptocurrencies and organising an ICO is permitted in the Cayman Islands, provided that the issuing entity has first obtained prior approval for the issuance of the virtual assets from CIMA. Prior approval is also required for certain activities, such as changes in ownership or issuing shares.

It stands noting as well that issuing security tokens is not permitted without proper authorisation. A Cayman VASP willing to issue security tokens can do so by requesting approval from the CIMA and by applying and obtaining a Securities Investment Business license from the CIMA, in accordance with the Securities Investment Business Act.

It is possible to apply for a sandbox license when the planned business activity isn’t described by the different possibilities laid out in the Virtual Assets Service Providers law. This license lasts for 12 months and allows for innovative services under the direct supervision of the CIMA. After 12 months, a definitive license can be issued.

Entities and persons carrying out relevant financial business, including the provision of financial services related to digital assets for payment or investment purposes, must comply with the Crime Act (Proceeds of Crime Act) and anti-money laundering regulations. VASPs are classified as relevant financial businesses and must ensure that fit and proper persons are appointed to key roles.

The VASP Act also covers investment funds and private funds that issue digital assets, with relevant requirements under the Mutual Funds Act, Private Funds Act, and Securities Investment Business Act.

Regarding cryptocurrency companies and companies in general, the Cayman Islands do not levy a corporate tax on the income generated by the company’s activity.

Dividend payments aren’t taxed as well. A crypto business based in the Cayman Islands will not have to pay taxes on payments made to its shareholders.

Capital gains aren’t subject to taxation either. This means that interest generated by holding cryptocurrency and selling it at a higher value with a plus-value will not be taxed.

No, the Cayman Islands aren’t an unregulated jurisdiction for crypto. It used to be the case, as the majority of famous offshore jurisdictions did allow (or more precisely, did not explicitly forbid) the conduct of crypto activities with a simple International Business Company (IBC). The CIMA, the regulatory authority in the Cayman Islands, have since then developed and enforced a full-fledged regulation.

No, the Caymans do not have an absence of complex reporting obligations. The VASP regime has significant and complex obligations, including mandatory annual audited financial statements for Licensees, extensive client asset protection rules, and a new rule requiring prior CIMA approval to change a business plan.

To receive the VASP license in the Cayman Islands, a crypto project should prepare itself to respond to numerous requirements. The Cayman Islands Monetary Authority has issued clear guidelines, in addition to the content of the Virtual Asset Services Providers law, in order to lead crypto companies into structuring a proper application file.

A legal entity should be formed in the Cayman Islands, with a registered office. This is the compulsory step number one to the Cayman Islands crypto license.

On the corporate level, the applicant for the VASP license in the Caymans should disclose information about the organisation and the structure of the company. The CIMA expects at least the following three pieces of information from candidates:

• A chart detailing the group’s companies and ultimate beneficial owners;
• Among the entities composing the group, a detail of the regulated entities and their regulated activities;
• All the services provided, group-wise, by any entity related to the VASP.

The CIMA will pay close attention to the people involved in the VASP company. The board, the team members and the managers will be required to pass a fit & proper check. In addition, the applying company should prepare, at least:

• Resume, diplomas and other certificates demonstrating professional qualification;
• Certificates of non-criminal record;
• Professional and financial references;
• A notarised document of identity with a photo;
• Declaration of source of funds and source of wealth with supporting evidence for major shareholders;
• Details of every shareholder holding 10% or more of the company;
• A personal questionnaire issued by the CIMA.

Next comes the business activity and the virtual assets services to be provided by the new licensed company. The CIMA suggests presenting a single document in the form of a business plan, which should include at the very least the following information:

• A description of the business activity;
• A description of the products and services being offered or to be offered in the future;
• Financial projections and statements on a 2-year sight;
• Description of the physical place of business (can be outside the Cayman Islands);
• Information about the customers (targeted markets, number of customers, location, etc.);
• Information regarding third parties (affiliates, service providers and outsourcing companies), including their location and regulatory framework.

Finally, the application should include forms, policies and any supporting documents on the matter of compliance with Cayman and international laws. The goal for the CIMA is to get a clear overview of the risks and how they are mitigated by the company:

• AML-CFT policies;
• Cybersecurity policies (must be compliant with the CIMA’s cybersecurity guidelines);
• Information on the Chief Information Officer or Chief Information Security Officer, responsible for ensuring the safety and security of customers’ personal data and virtual assets;
• Appointment of an approved officer with responsibility for the procedures for combating money laundering, terrorist financing and proliferation financing;
• Implementation and demonstration of compliance with the Travel Rule (can be included in the AML policies);
• Transaction flow charts;
• The application fee and license fee, if applicable.