Crypto License in the Cayman Islands

According to the Virtual Asset Service Providers Act (VASP Act, 2024 Revision and the 2025 amendments) and CIMA guidelines, a license or registration is required for companies that manage digital assets, provide exchange services, store client funds, or provide services that affect the movement of virtual assets. In 2025, the regime became stricter: since April 1, 2025, custodial providers and trading platforms are required to obtain a full VASP license.

1. Main categories (mandatory license since April 1, 2025)

Custodial Services

This includes companies that store digital assets, manage private keys, or have actual access to client funds. CIMA considers such models to be high-risk and therefore requires a full VASP license.

Examples: custodial wallets, storage providers, infrastructure operators with access to seed phrases or multi-signatures.

Trading platform operators (Virtual Asset Trading Platforms)

Regulation covers exchanges, marketplaces, and hybrid platforms that organize transactions between third parties, manage order books, hold client assets, or perform brokerage/dealer functions. Such companies must comply with listing, KYC/AML, asset segregation, and IT control requirements.

2. Additional regulated categories

Payment and transfer services (Money Transfer Services)

Services that transfer virtual assets, perform settlements, process transactions, manage wallets, or route payments are subject to regulation. The regulator considers such services to be analogous to money transfers if the company actually manages the movement of funds.

Services with digital assets classified as securities (Securities VASP)

If a token functions as an investment instrument (yield, share, corporate rights, profit sharing), it may fall under the SIB Act. In this case, licensing is required not only under the VASP Act, but also under securities market regulations.
Projects conducting ICOs/STOs, managing investment tokens, or advising on them are subject to regulation.

3. Models subject to regulation depending on structure

Investment funds and management structures

Funds that work with digital assets, manage portfolios, execute transactions, or have access to client assets may be recognized as VASP providers. The regulator assesses not the form, but the actual content of the activity: asset management, access to funds, and influence on investment operations.

DeFi projects with centralized elements

If the team controls the interface, smart contracts, commissions, protocol updates, or user access, the project may fall under the VASP regime. Fully autonomous protocols without an operator are not usually licensed.

NFT and GameFi platforms operating as marketplaces

Licensing is required if the platform creates a secondary market, conducts transactions between users, holds funds, or transfers assets on behalf of customers. Simple NFT generation without trading functionality is not regulated.

• Obtaining a VASP license in the Cayman Islands takes an average of 4 to 10 months, depending on the company structure, the completeness of the dossier, and the chosen business model. The procedure is regulated by CIMA based on the VASP Act (2024 Revision) and the 2025 amendments, which strengthened the requirements for risk management, IT security, and AML procedures. Annual regulatory fees range from KYD 5,000 to KYD 200,000, with a base application fee of KYD 1,000.
• Since April 1, 2025, custodial service providers and trading platform operators are required to obtain a full VASP license rather than registration. For such models, CIMA requires an expanded corporate structure: several directors (usually at least three, including one independent), enhanced cybersecurity policies, segregation of client assets, and a documented internal control system.
• There is no fixed minimum capital requirement, but the regulator expects the applicant to have resources commensurate with the scale of operations and risk profile. CIMA may request an audit or in-depth review, especially for high-risk services (custody, trading platforms).
• Thanks to flexible corporate rules and no corporate tax, the Cayman Islands remain an attractive jurisdiction for crypto companies that want to operate in line with international standards of transparency and oversight.

The advantages of obtaining a Cayman Islands crypto exchange are largely determined by the VASP Act, regulatory oversight, and the jurisdiction’s status as an international financial center. The Caymans provide companies with the conditions to operate in accordance with FATF standards and transparent AML/CFT rules, combining flexible economic policies and a stable legal environment for digital assets.

• A stable and balanced financial and political environment. The authorities have created clear and understandable conditions, predictability, and certainty for blockchain operators to work, specifying the necessary standards.
• Optimal economic conditions. For foreign businesses working with innovative products, it is advantageous to take advantage of the local tax system and implement their projects without paying corporate income tax, as well as capital gains, gifts, and inheritance taxes.
• Legitimacy and security of the business environment. The Cayman Islands are part of the Caribbean Financial Action Task Force (CFATF) and have proven compliance with all FATF standards regarding AML/CFT rules.
• Global market, access to traditional banking services. The Cayman Islands digital asset license allows businesses to engage with a multi-million-dollar audience from many countries, gain access to the financial sector, including institutions such as Cayman Crypto Bank and Butterfield Bank. Giants such as Deutsche Bank, CIBC Bank and Trust Company, and Bank of America also operate here.
• High level of confidentiality. Data on beneficial owners (BOI) – 25% or more of shares are available only to authorized persons. With the help of the CIMA online portal, you can find out the name, status, type, and date of registration of the company.

Companies intending to work with virtual assets in the Cayman Islands are vetted not only for formal legal requirements, but also for how thoroughly they have built corporate governance, risk controls, and customer protection mechanisms. The CIMA regulator views the applicant as a financial service rather than an IT project, so attention is paid to the quality of processes, the sustainability of the operating model, and the company’s ability to comply with the VASP Act on an ongoing basis.

Before issuing a license, CIMA analyzes the business plan, management competence, AML system readiness, capitalization level, and reliability of the technological infrastructure. The regulator’s goal is to ensure that the company can safely provide services, maintain transparency, and operate in accordance with international standards for virtual asset supervision.

Company registration and basic structure

The first step is to establish a legal entity in the Cayman Islands and obtain a registered office. CIMA expects the company to have a clear corporate structure, transparent ownership scheme, and documentation confirming the origin of the funds of the main shareholders.

Business plan and description of activities

The application must be accompanied by a detailed business plan describing the virtual asset services, operational processes, target markets, risk management mechanisms, financial projections, and infrastructure. CIMA requires to see the actual logic of the service, monetization models, and risk assessment.

Corporate governance requirements

All directors, officers, and beneficial owners are subject to CIMA’s Fit & Proper criteria review — integrity, competence, professional experience, and reputation.
For high-risk activities (custody/trading), there are usually at least three directors, including one independent director, but this is formally assessed on a case-by-case basis depending on the size of the company.

AML/CFT and operational compliance team

Each licensed VASP must appoint:

• Compliance Officer,
• MLRO (Money Laundering Reporting Officer),
• DMLRO (Deputy MLRO).

The company is required to have comprehensive AML/KYC policies, CDD procedures, sanctions screening, transaction monitoring, Travel Rule, and internal control documents.

Operational, IT, and risk management requirements

The applicant must demonstrate the existence of robust internal control systems, risk management, cybersecurity measures, and protection of client assets. Custody and trading platforms are subject to additional requirements: IT environment architecture, asset segregation processes, access control, and transaction flow schemes.

Financial stability and capital

Although the VASP Act does not set a fixed minimum capital requirement, CIMA requires capital commensurate with the risk profile. The market benchmark is USD 100,000 and above.
The applicant must also have a liquid reserve to cover 6-12 months of expenses. Cyber risk or professional liability insurance may be required, depending on the type of services provided.

Application and subsequent obligations

The company submits a complete set of documents to CIMA: a business plan, AML/CFT policies, transaction flow charts, information about key persons, proof of capital, and data on customers and service providers.

After receiving the license, the VASP is required to submit the following annually:

• audited financial statements,
• an AML audit,
• updates on ownership structure and management.

In certain cases, CIMA may apply extended regulatory requirements if the company’s activities go beyond standard VASP services or overlap with other regulated sectors. These conditions are not mandatory for all applicants, but become relevant depending on the business model.

1. Securities requirements

If the virtual assets in your model have the characteristics of an investment instrument—yield, profit participation rights, corporate rights, or tokenized share functionality—CIMA may recognize them as securities within the meaning of the Securities Investment Business Act (SIB Act).

In such cases, companies must not only comply with the VASP Act, but also meet the requirements of the securities market:

• additional registration or licensing under the SIB Act,
• compliance with investor protection standards,
• disclosure of information,
• enhanced operational control requirements.

2. Sandbox License

For innovative models that do not fully fall under the VASP Act — such as new forms of tokenization, experimental protocols, or hybrid financial services — a temporary 12-month Sandbox License is available.

This regime allows companies to operate under CIMA supervision in a limited format, test their product, and refine their operational processes until they obtain a full license. The sandbox is suitable for projects that require flexibility at an early stage but still need to comply with basic AML/CFT and corporate governance requirements.

3. Additional requirements for high-risk models

Depending on the type of services, CIMA may request:

• extended cybersecurity documentation;
• details of the data storage architecture;
• plans for the segregation of client assets;
• an assessment of infrastructure resilience;
• separate insurance (cyber risks, professional liability);
• confirmation of economic substance if key decisions are made in the Cayman Islands.

This list is not fixed and is formed individually after analysis of the business model.

The main regulator, CIMA, in cooperation with Cayman Finance and the Cayman Islands Blockchain Foundation, is making every effort to maintain a balance between creating an attractive environment for new digital projects and preserving international standards of transparency in the financial activities of all market participants.
The CIMA crypto license in the Cayman Islands means the ability to provide the following types of services and operations:

• For crypto exchanges, to exchange and trade between several types of currencies, such as fiat/crypto and crypto/crypto.
• For platforms, to provide custodial services.
• For innovative projects, to issue virtual assets and conduct ICOs.
• For fintech companies, to conduct transfers in digital currencies.

Among the innovations in the legislation is the requirement for fintech companies to indicate the type of currency they plan to use for transactions, the volume of assets stored, and to prove that they have sufficient cybersecurity measures in place to protect users’ money, implement risk management, and disclose information about the location of technical equipment.

• Company incorporation documents (Certificate of Incorporation, Articles of Association).
• Register of directors and shareholders.
• Documents of beneficiaries and directors: passport, proof of address, resume, proof of source of funds.
• Fit & Proper forms for directors, beneficiaries, and key officers.
• Appointments and confirmation of qualifications of Compliance Officer, MLRO, and Deputy MLRO.
• AML/CFT policy and KYC/CDD procedures.
• Sanctions screening policy and Travel Rule.
• Internal rules and procedures (Policies & Procedures Manual).
• Description of the business model and services (Business Plan).
• Financial forecasts and confirmation of financial stability.
• Description of operational processes and risk management.
• Cybersecurity policy and data protection documentation.
• Description of technological infrastructure and asset storage.
• Flow of Funds diagram.
• Confirmation of the existence of a registered office in the Cayman Islands.
• Receipt for payment of government fees.

The Cayman Islands regulate crypto businesses under the Virtual Asset Service Providers (VASP) Act, providing transparent and predictable conditions for companies operating in the digital asset sector. Supervision is carried out by the Cayman Islands Monetary Authority (CIMA), which is responsible for registering, licensing, and monitoring the activities of VASPs. The regulator sets strict standards for AML/CFT, cybersecurity, and corporate governance.

Companies operating in the field of digital assets must comply with several regulatory standards.

Basic Cayman crypto regulations include:

• The VASP Act of 2020 (amended 2025) specifies the operating norms for operators and the provision of digital currency exchange and storage services.
• The Monetary Authority Act (as amended in 2024 S8) specifies the main amounts of government fees.
• Money Laundering Regulations 2023, which must be complied with by all registered entities in the jurisdiction.
• Beneficial Ownership Transparency Law (2025 version), describing who has access and in what cases to information on beneficiaries.
• The Companies Act (2025 version) prescribes certain procedures when registering a legal entity.
• Money Services Act (amended 2024) specifies that money transfers and provision of financial services should be carried out only with the authorization of CIMA.

Some digital assets in the Cayman Islands are subject not only to the VASP Act, but also to the more stringent Securities Investment Business Act (SIB Act). This occurs when a token is closer in nature to a traditional investment security. In such cases, companies are required to obtain separate registration or a license from CIMA in addition to their VASP status.

When is a crypto asset considered a “security”?

The regulator classifies an asset as a security if it:

• can be sold or exchanged as an investment instrument;
• represents a share, right to income, debt, or can be converted into equity or debt instruments;
• is a derivative instrument (derivative on shares, bonds, or other assets);
• is used in structures similar to traditional financial products.

What does this mean for crypto projects?

If a project issues or manages tokens that grant investment rights or returns, provides advice, asset management, or brokerage services, the activity automatically falls under the SIB Act. In this case:

• a separate license or registration under the SIB Act is required;
• stricter management, reporting, and control requirements apply;
• the project undergoes an in-depth review for compliance with financial regulations.

The SIB Act operates in parallel with the VASP Act and covers crypto assets that are essentially financial instruments. This distinction is important for choosing the right type of license and minimizing regulatory risks.

The island government has imposed zero rates on capital gains, corporation tax, gift/dividend tax, issuance, and transfer of digital assets for cryptocurrency companies. There is stamp duty, but it is negligible.

Penalties for non-compliance with requirements for cryptocurrency companies

The option to obtain a 20-50-year tax exemption certificate is available.

Crypto service providers are subject to financial record-keeping requirements based on the 2023 Regulations and Statement on Internal Control Guidance:

• Companies are required to keep financial records, records of all transactions, and submit the books of account annually to CIMA for inspection. All records must be maintained at the company’s registered office.
• File suspicious transaction reports with the Regulator.
• Submit AML/KYC compliance reports every quarter.
• Conduct audits as requested by government agencies.

The VASP Act (Sec 4, 24) introduced sanctions for violators who conduct crypto-businesses without obtaining official approval from the Regulator:

• $10,000 and 1 year imprisonment, with repeated violations – $1000 for each day of unauthorized activity.
• For authorized persons (managing directors, managers) in case of violation of the rules of conducting business, a fine – $2000 and 3 months in prison.

Reporting requirements effective 2026

Starting in 2025, the Cayman Islands has strengthened its VASP regime to comply with FATF requirements and the growing volume of crypto transactions. CIMA has introduced new mandatory reporting forms, tightened audit rules, and increased the responsibility of crypto service providers.

What has changed:

• Quarterly reporting has become mandatory: companies submit a Quarterly Regulatory Return with data on transactions and client assets.
• Cyber incidents must be reported to CIMA within 72 hours.
• Segregation of client assets is now documented in the reports.
• The format of financial statements has been updated and must now comply with IFRS and the Virtual Asset Reporting Annex.

The cost depends on whether the company is registering as a VASP or obtaining a full license. CIMA charges separate fees for application and annual supervision, and the level of costs is determined by the type of services provided.

Main government fees

1. Application fees:

• VASP registration: KYD 1,000 (≈ USD 1,200);
• VASP license: KYD 5,000 (≈ USD 6,000).

2. Grant of License Fee (one-time payment):

• Custody providers: KYD 30,000 (≈ USD 36,000);
• Trading platform: 100,000 KYD (≈ 120,000 USD).

3. Annual renewal fees. The amount depends on the company’s income and type of services:

• Registered VASP with income up to KYD 500,000: KYD 5,000/year;
• Licensed trading platform with income up to KYD 5 million: KYD 50,000/year;
• Large platforms with high turnover may pay up to KYD 200,000/year.

These amounts may vary for companies with high turnover or an expanded range of services, as CIMA calculates supervisory fees in proportion to the level of risk and scale of the business.

The timing also depends on the complexity of the project: for companies with a well-designed AML/KYC architecture, a clear business model, and sufficient reserves, licensing takes approximately 4-10 months. If the business involves asset storage or trading platforms, CIMA may request additional information, which increases the time frame to 11-12 months.

Ultimately, the cost and duration of the process are determined by the scope of services, the level of risk, the maturity of operational processes, and the extent to which the company complies with the VASP Act and AML Regulations (2023 Revision).