Last updated: 17 April 2026 | Published on: 05 February 2026By Aaron Richards
Are you thinking of starting a crypto-related business in the Cayman Islands? If yes, then understanding the Virtual Asset Service Provider (VASP) Act is essential to operate legally and sustainably in the jurisdiction.
In this article, we learn what the VASP Act is, the activities it regulates, applicable registration and licensing requirements, and other key compliance obligations.
What is the Cayman VASP Act?
The Cayman Islands Virtual Asset Service Provider (VASP) Act is a legal framework that governs virtual asset-related businesses in this self-governing British Overseas Territory. It overlooks the public offering of new assets, exchange and trading platforms, custody services, wallet platforms, transfers, and payments. Additionally, the act outlines registration and licensing requirements, including eligibility details, license revocation, penalties, and more. The Cayman Islands Money Authority (CIMA) oversees the Cayman VASP-related activities.
The act is being rolled out in three phases. While Phase 1 was implemented in 2020, Phase 2 of the Act came into force in 2025 with major amendments, with Phase 3 yet to be rolled out. Phase 1 provided a foundation to govern Cayman Islands VASPs, while Phase 2 outlined stricter measures to regulate the virtual business landscape.
Here are the major updates of both phases:
Category
Phase 1
Phase 2
Licensing Status
Most VASPs only required registration.
A mandatory license is required for custodians and trading platforms (exchanges).
Board Structure
Minimum 2 directors.
Minimum 3 directors; one of them must be an independent director.
Financial Reporting
Annual accounts required
Audited accounts may be mandated by CIMA based on risk, size, or complexity.
Client Assets
General requirement to protect assets.
Mandatory policies for safeguarding and separating client funds from company assets.
CIMA Powers
Focused on AML/CFT compliance.
Power to issue cease-and-desist orders, revoke licenses, and access physical/digital assets.
Disclosures
Basic reporting requirements.
Mandatory disclosure of insurance, grievance procedures, and data-sharing policies.
Ready to take the first step in your business journey?
We'll walk you through every step – no guesswork needed.
The primary focus was to regulate crypto-related businesses and counter illicit activities. The top reasons for the introduction of the Act include:
Compliance with ‘Travel Rule’
As it was difficult to trace cryptocurrency trades earlier given the absence of strict identification requirements like no traceable email IDs and Know-Your-Customer (KYC) compliance, illicit financing found its way. To address it and make the trading process transparent, the Financial Action Task Force (FATF) introduced the ‘Travel Rule’.
It mandates VASPs around the world, especially exchange platforms and custodians, to share user details with concerned stakeholders along the trade route. For example, every Bitcoin transaction is publicly declared and stored in a blockchain, so the trading platform through which the transaction occurred stores and shares the personal details, which can be accessed by relevant authorities when required.
Maintain International Credibility
FATF’s Recommendation 15 for combating money laundering required countries to regulate new and innovative technologies, especially in the fintech sector, such as cryptocurrency. The Cayman Islands implemented the VASP Act to satisfy this requirement and to avoid getting grey or black listed by the international authorities.
Who are Virtual Asset Service Providers, according to the Cayman VASP Act?
The Cayman Islands VASP Act clearly defines the identity of a virtual asset service provider. Given this, it specifically prohibits a natural person from engaging in virtual asset-related services. Thus, only companies (legal persons) registered under relevant acts, such as the Companies Act, 2023, the Partnership Act, 2024, and the Limited Liability Companies Act, 2023, among others, can be a Cayman VASP.
Licensing Requirements Under the Cayman VASP Act
As we discussed earlier, some virtual asset businesses only need to register themselves, while others must obtain a license. Here’s a quick glance at what differentiates the two:
Feature
VASP Registration
VASP Registration + Licensing
Who needs it?
Issuers of Initial Coin Offerings (ICOs), Brokers, and those offering Transfer services.
Custodians (Wallets) and Trading Platforms (Exchanges).
Primary Focus
AML/CFT compliance (Know Your Customer).
Financial stability, security, and asset protection.
Regulatory Intensity
Moderate oversight from CIMA.
High oversight; requires supervision.
Key Requirement
Compliance policies and AML officers.
Cybersecurity audits and asset segregation.
Obligations for a License Holder Under the Cayman VASP Act
As the VASP Act governs numerous activities, each must follow a different set of guidelines. Sections 9, 10, 11, and 12 define these guidelines, let us take a look at them:
Section 9 governs the responsibilities of a virtual asset service provider. As part of that, the VASP must:
Notify CIMA about any VASP licence or registration in another jurisdiction
Notify CIMA about physical presence in another jurisdiction
Notify CIMA about controlling interest in another company that provides similar services
Maintain information on the beneficial owner
Section 10 dictates the guidelines for virtual asset custody services. So, the service provider must:
Provide information on the firm’s net worth and submit audited financial reports as and when required by authorities
Be transparent with clients and disclose information about associated risks
With Section 11 governing virtual asset trading platforms, it must:
Disclose information about the type of clients they cater to
Inform authorities about the types of virtual assets available on the platform
Disclose the net worth of the firm
Provide adequate information to the clients about associated risks
Have a clearing and settlement process for successful trades
As trading platforms can issue virtual assets to the public they must follow the guidelines under Section 12 for a successful public offering. Thus, a virtual asset trading platform must:
Seek approval from the CIMA
Have a clear directive from a virtual asset’s originator to act on their behalf
Avoid false claims, misleading statements, or engaging in fraudulent activities
Grounds for License Cancellation Under the Cayman Islands VASP Act
Section 27 of the VASP Act governs licence revocation. A license is revoked when the licensee:
Fails to comply with the obligation of the Act
Conducts a business that is not permitted by the license
Provides false, misleading, or inaccurate information
Threatens the interest of clients/potential clients
Non-compliance with anti-money laundering regulations
Note: The authorities will publish a notice in the official gazette once the licence is revoked.
What are the Penalties for Non-Compliance Under the Cayman VASP Act?
The applicable penalties are defined under Sections 35-37 of the Cayman Islands VASP Act.
Operating a virtual asset service without registration can result in a KYD25,000 penalty and 1 year of imprisonment. Moreover, the firm is also liable to a fine of KYD10,000 for each day it isn’t registered.
Operating a trading or custody service without a valid license also attracts a penalty of KYD100,000 and a one-year imprisonment. The firm may additionally be fined KYD10,000 for each day of non-compliance.
How Can BSW Help?
The Cayman Islands VASP requirements are continually evolving to reflect international regulatory standards, making compliance both critical and complex. For new and existing virtual asset businesses, meeting these obligations can be time-consuming as well as operationally demanding. That’s where we, at Business Setup Worldwide, can help. We provide assistance and legal guidance with company formation in the Cayman Islands in the virtual asset and other industries. Our experts are well-versed with all the formalities and requirements. Contact us today to get started!
Aaron Richards is a seasoned expert with over six years of
experience who specializes in offshore company formation, trust
and foundation setup, and corporate services. Through his blogs,
Aaron shares valuable insights to guide clients in making informed
decisions about their global business needs.
Frequently Asked Questions
1. What is a sandbox licence?
It is a temporary VASP license granted for a period of 1 year to firms that use innovative services or technologies, which are not covered by the traditional VASP license.
2. What is the eligibility of VASP license waiver?
Your business must be registered under other relevant Acts, such as the Banks and Trust Companies Act or the Securities Investment Business Act, to obtain a waiver under the VASP Act.
3. Can a Cayman VASP operate globally while being regulated only in the Cayman Islands?
Yes, it can offer services internationally, but it must comply with the Cayman VASP Act and any local regulations in the countries where its users are based.
4. Can an existing crypto business move to the Cayman Islands?
Yes. Existing crypto businesses can restructure or redomicile to the Cayman Islands, provided they meet the VASP registration or licensing requirements.
5. Is VASP compliance a one-time requirement?
No. Compliance is ongoing and includes continuous monitoring, reporting, and regulatory updates.
