Crypto License in the Cayman Islands

A Cayman Islands crypto license is required for any company that provides one or more virtual asset services in or from the Cayman Islands. The Virtual Asset (Service Providers) Act (2024 Revision), as amended in 2025, defines seven main categories of regulated activity — split between full VASP license (since 1 April 2025) for the highest-risk services and VASP registration for the rest.

Crypto custody providers — full VASP license required

This category covers companies that store digital assets, manage private keys, or have actual access to client funds. CIMA treats such models as high-risk and requires a full VASP license with documented key-management procedures, hot/cold wallet separation, and client-asset segregation. Examples: custodial wallets, storage providers, infrastructure operators with access to seed phrases or multi-signatures.

Virtual asset trading platforms — full VASP license required

The license covers exchanges, marketplaces, and hybrid platforms that organize transactions between third parties, manage order books, hold client assets, or perform brokerage and dealer functions. Trading-platform operators must comply with listing, KYC/AML, asset segregation, and IT control requirements, with deeper scrutiny on operational resilience and order-matching impartiality.

Money transfer and virtual asset transfer services — VASP registration

Services that transfer virtual assets, perform settlements, process transactions, manage wallets, or route payments fall under registration. CIMA treats them as analogous to money transfers when the company actually controls movement of funds, and applies the AML and operational rules of the Money Services Act where activity overlaps.

Token issuers and Securities VASP — VASP Act + SIB Act

If a token functions as an investment instrument (yield, share, corporate rights, profit sharing), it falls under the Securities Investment Business Act (SIB Act) in addition to the VASP Act. Projects conducting ICOs, STOs, managing investment tokens, or advising on them need separate SIB Act registration or licensing alongside VASP authorization. Stablecoin issuers also typically register as VASPs and may need SIB Act authorization if the token has investment characteristics.

Crypto investment funds and management structures

Funds that work with digital assets, manage portfolios, execute transactions, or have access to client assets may be recognized as VASP providers. CIMA assesses substance — asset management, access to funds, influence on investment operations — not legal form. The Mutual Funds Act and Private Funds Act may apply in parallel.

DeFi projects with centralized control elements

A DeFi project falls under VASP regulation if the team controls the interface, smart contracts, commissions, protocol updates, or user access. Fully autonomous protocols without an operator are not usually licensed. Projects in the grey zone — partially decentralized, partially controlled by the team — should expect CIMA to apply the VASP regime.

NFT and GameFi marketplaces operating as secondary markets

Licensing applies when the platform creates a secondary market, conducts transactions between users, holds funds, or transfers assets on behalf of customers. Simple NFT generation without trading functionality is not regulated. CIMA, together with Cayman Finance and the Cayman Islands Blockchain Foundation, also expects fintech operators to disclose the type of currency used for transactions, the volume of assets stored, and proof of cybersecurity controls protecting client funds.

Not every crypto-related activity falls under the Virtual Asset (Service Providers) Act. CIMA applies a substance-over-form test — VASP authorization is triggered only when the company actually controls movement of client funds, holds private keys, or organizes transactions between third parties. The following activities typically fall outside the VASP regime in or from the Cayman Islands.

• Fully autonomous DeFi protocols. Smart-contract systems with no operator, no centralized control over commissions or upgrades, and no team-controlled access to user funds. Protocols where users retain full custody of their own keys.
• Simple NFT generation without secondary-market trading. Pure minting platforms that do not organize transactions between users, hold client funds, or transfer assets on behalf of customers. Secondary marketplaces and brokerage activity remain in scope.
• Personal peer-to-peer transactions. Individual buying, holding, or transferring virtual assets without commercial intent or third-party service provision. Personal trading is not a regulated VASP activity.
• Proprietary trading firms. Companies trading virtual assets exclusively with own capital, with no third-party client funds, no order routing for external customers, and no custodial relationships.
• Pure software providers. Technology vendors supplying non-custodial wallet software, blockchain analytics tools, or trading interfaces without holding client assets, executing transactions, or controlling private keys.
• Companies serving exclusively non-Cayman clients. Entities incorporated elsewhere with no virtual asset services provided in or from the Cayman Islands and no Cayman residents as clients. CIMA jurisdiction is triggered by service delivery from or to the Cayman Islands.

If the business model sits in a grey zone — partially decentralized but with team control, or non-custodial but with brokerage functions — CIMA applies the VASP regime by default. The Sandbox License is available for novel models that do not fit standard categories. Compare with similarly structured offshore alternatives such as the BVI VASP license.

A Cayman Islands VASP license covers seven groups of requirements: corporate structure, business plan, fit-and-proper governance, AML/CFT compliance, IT and risk management, capital, and ongoing obligations. CIMA reviews all seven before issuing authorization and on a continuing basis afterwards.

Corporate structure and local presence

Cayman VASP applicants must incorporate a Cayman Islands legal entity — typically an Exempted Company, but Limited Liability Companies (LLCs) and Exempted Limited Partnerships are also used. The entity must maintain a registered office and a registered agent in the Cayman Islands, with all company books held at the registered address. A physical office is not mandatory, but operational substance must be sufficient to meet CIMA’s prudential expectations.

Business plan and operational model

CIMA requires a detailed business plan covering virtual asset services offered, target markets, customer segments, transaction-flow architecture, technology and outsourcing arrangements, monetization model, and three-year financial projections. The plan must demonstrate the actual logic of the service — not just regulatory phrasing — and align with the categories of authorization being requested.

Fit-and-proper governance and management

All directors, senior officers, and beneficial owners holding 10% or more undergo CIMA’s fit-and-proper assessment, covering integrity, competence, professional experience, and reputation. Since 1 April 2025, all VASPs (whether registered or licensed) must appoint at least three directors, including at least one independent director without a vested interest in the VASP — a requirement introduced by the Virtual Asset (Service Providers) (Amendment) Act, 2024. CVs, criminal-record checks, professional references, and source-of-funds documentation form the core dossier.

AML/CFT compliance team and policies

Each licensed VASP must appoint a Money Laundering Reporting Officer (MLRO), a Deputy MLRO (DMLRO), and an Anti-Money Laundering Compliance Officer (AMLCO). Their qualifications and independence are confirmed during the fit-and-proper review. The compliance framework must include KYC/CDD, sanctions screening, transaction monitoring, suspicious-transaction reporting, the Travel Rule for virtual asset transfers (Part XA of the AMLRs, effective from 1 July 2022, applying to all virtual asset transfers with no de minimis threshold), and full alignment with the Anti-Money Laundering Regulations (2023 Revision, as amended) and the Rule and Statement of Guidance for VASP Custodians and Trading Platforms.

IT, cybersecurity and risk management

Applicants must demonstrate documented controls covering cybersecurity, business continuity, incident response, client-asset segregation, and access management. Custody and trading-platform applicants face additional scrutiny on IT architecture, key-management procedures, hot/cold wallet separation, and resilience testing. From 2025, CIMA expects evidence of control testing and supplier-risk management as part of the application package.

Financial stability and capital

The VASP Act does not set a fixed minimum capital figure. CIMA expects capital commensurate with the applicant’s business risk profile and a liquid reserve sufficient to cover 6–12 months of operating expenses. For high-risk categories (custody, trading), the regulator may also require professional indemnity insurance, cyber-risk cover, and evidence of recovery and wind-down arrangements.

Application and ongoing obligations

Applications are submitted through CIMA’s electronic portal REEFS (Regulatory Enhanced Electronic Forms Submission), together with the documents listed in Schedule 1A of the Virtual Asset (Service Providers) (Amendment) Regulations 2025 and payment of the application fee. Once licensed, a VASP must submit audited financial statements annually, file regulatory returns quarterly, notify CIMA of any change in directors or beneficial ownership, and pay the annual supervisory fee on or before 15 January of each year.

CIMA applies three additional regimes on top of the standard VASP framework, depending on what the company actually does: the Securities Investment Business Act (SIB Act) for tokenized investment instruments, the 12-month Sandbox License for innovative models that fall outside the VASP Act, and an extended documentation set for high-risk activities such as virtual asset custody and trading platforms.

Token issuers under the Securities Investment Business Act (SIB Act)

If the virtual assets in your model have the characteristics of an investment instrument — yield, profit-participation rights, corporate rights, or tokenized share functionality — CIMA may recognize them as securities under the Securities Investment Business Act (SIB Act). In such cases, companies must comply with both the VASP Act and the securities-market regime:

• additional registration or licensing under the SIB Act;
• investor-protection standards;
• information disclosure;
• enhanced operational control requirements.

Cayman Sandbox License — 12-month authorization for innovative VASP models

For innovative models that do not fully fall under the VASP Act — new forms of tokenization, experimental protocols, hybrid financial services — a temporary 12-month Sandbox License is available. This regime allows companies to operate under CIMA supervision in a limited format, test their product, and refine operational processes until a full license is obtained. The Sandbox has been available since the VASP regime launched in 2020 and is granted on a case-by-case basis — it is intended for genuinely novel models, not as a faster route to a full license.

Extended documentation for high-risk VASP categories (custody and trading platforms)

Depending on the type of services, CIMA may request:

• extended cybersecurity documentation;
• details of the data-storage architecture;
• plans for the segregation of client assets;
• an assessment of infrastructure resilience;
• separate insurance (cyber risks, professional liability);
• confirmation of economic substance if key decisions are made in the Cayman Islands.

This list is not fixed and is formed individually after analysis of the business model.

A complete Cayman Islands VASP application requires six groups of documents covering corporate records, fit-and-proper documentation, AML/CFT compliance, business and operational plan, IT and risk-management documentation, and proof of financial standing. The full list mirrors Schedule 1A of the Virtual Asset (Service Providers) (Amendment) Regulations 2025.

Corporate and ownership records

• Company incorporation documents (Certificate of Incorporation, Articles of Association);
• Register of directors and shareholders;
• Confirmation of registered office in the Cayman Islands.

Fit-and-proper documentation

• Documents of beneficial owners and directors: passport, proof of address, CV, proof of source of funds;
• Fit & Proper forms for directors, beneficial owners, and key officers;
• Appointments and qualification confirmation for Compliance Officer, MLRO, and Deputy MLRO.

AML/CFT compliance package

• AML/CFT policy and KYC/CDD procedures;
• Sanctions screening policy and Travel Rule procedures;
• Internal Policies & Procedures Manual.

Business and operational documentation

• Business plan with services, customer flows, and target markets;
• Description of operational processes and risk management;
• Flow of Funds diagram.

IT and security documentation

• Cybersecurity policy and data protection documentation;
• Description of technology infrastructure and asset storage architecture.

Financial documentation

• Three-year financial projections and confirmation of financial stability;
• Receipt for payment of the application fee.

Crypto activity in the Cayman Islands is regulated by the Cayman Islands Monetary Authority (CIMA) under six core statutes covering registration and licensing, AML/CFT, ownership transparency, corporate form, and money-services overlap.

• Virtual Asset (Service Providers) Act 2020 (as amended 2024 and 2025). Core licensing and registration regime for VASPs; mandatory full license for custody and trading platforms since 1 April 2025.
• Monetary Authority Act, 2024 amendments (LG47, S8). Schedule of government fees and CIMA administrative powers.
• Anti-Money Laundering Regulations (2023 Revision, as amended). AML/CFT obligations for all regulated entities, including KYC/CDD, sanctions screening, and the Travel Rule for virtual asset transfers (Part XA AMLRs, effective 1 July 2022).
• Beneficial Ownership Transparency Act 2025. Rules on access to beneficial-ownership data (25%+ shareholders) by authorized persons through CIMA’s online portal.
• Companies Act (2025 Revision). Incorporation, governance, and reporting requirements for Cayman entities, including Exempted Companies and LLCs used by most VASPs.
• Money Services Act (2024 amendments). Applies where a VASP’s activity overlaps with money-transfer services regulated by CIMA.

A crypto asset is treated as a security in the Cayman Islands when it functions as an investment instrument — a share, a debt claim, a profit-sharing right, a derivative, or a tokenized equivalent of any of these. CIMA applies a substance-over-form test: a token is classified as a security when it can be sold or exchanged as an investment instrument, represents a right to income or equity, is convertible into a financial instrument, is a derivative on shares or bonds, or is used in a structure equivalent to a traditional financial product.

Once a token meets that test, the project falls under the Securities Investment Business Act (SIB Act) in addition to the VASP Act and typically needs SIB Act registration or licensing alongside its VASP authorization.

What obligations apply when a token is classified as a security?

If a project issues or manages tokens that grant investment rights or returns, or provides advice, asset management, or brokerage services on those tokens, the activity is subject to dual regulation. In addition to its VASP authorization, the company needs an SIB Act license or registration, must meet stricter governance, reporting, and disclosure standards, and undergoes deeper regulatory review for compliance with financial-services rules. The SIB Act operates in parallel with the VASP Act and covers crypto assets that are essentially financial instruments — this distinction is important for choosing the right type of authorization and minimizing regulatory risks.

Crypto companies in the Cayman Islands pay 0% corporate income tax, 0% capital gains tax, 0% withholding tax, and 0% dividend tax. The Cayman Islands operate a tax-neutral regime — there is no general income, capital, or gains taxation on companies, including those issuing, transferring, holding, or trading virtual assets. Stamp duty applies in narrow cases (typically property and certain instrument transfers) and is negligible for crypto operations.

Cayman entities can apply for a tax-exemption undertaking — a certificate confirming the absence of taxation for 20 to 50 years, used by long-horizon institutional projects to provide investors with continuity certainty.

Conducting virtual asset services in or from the Cayman Islands without CIMA registration, license, or waiver is an offence under the Virtual Asset (Service Providers) Act. Sanctions include statutory fines, daily continuing penalties for ongoing breaches, imprisonment of up to 12 months, and administrative fines from CIMA — and the Authority may also issue cease-and-desist directions, refuse subsequent applications, and publish enforcement notices.

• Unauthorized VASP activity — registration required. Fine of KYD 25,000 (~$30,488 USD) on summary conviction and up to 12 months’ imprisonment, plus a daily continuing penalty of KYD 10,000 (~$12,195 USD) for each day the unauthorized activity continues after conviction.
• Unauthorized VASP activity — license required (custody or trading platform). Fine of KYD 100,000 (~$121,951 USD) on summary conviction and up to 12 months’ imprisonment, plus a daily continuing penalty of KYD 10,000 (~$12,195 USD) for each day the breach continues.
• False or misleading information to CIMA. Fine of KYD 10,000 (~$12,195 USD) and up to 6 months’ imprisonment for recklessly providing materially misleading information during the application or supervisory process.
• Generic VASP Act breach (no specific penalty). Fine of KYD 4,000 (~$4,878 USD) under Section 37 of the VASP Act for contraventions where no specific penalty is prescribed.
• Administrative fines from CIMA. Under the Monetary Authority (Administrative Fines) Regulations, CIMA may impose administrative fines ranging from KYD 5,000 (~$6,098 USD) to KYD 100,000 (~$121,951 USD) for individuals and up to KYD 1,000,000 (~$1,219,515 USD) for corporate bodies, depending on the seriousness of the breach.
• Administrative measures. Cease-and-desist directions, revocation of license, refusal of further applications, vicarious liability of senior officers where a corporate breach occurred with their knowledge or due to their neglect, and publication of enforcement actions on the CIMA website.

Beyond direct penalties, unauthorized activity often results in loss of banking, payment-processing, and counterparty access — and creates a permanent record that affects future applications in other jurisdictions.

Cayman VASPs face six ongoing reporting obligations under the 2025 amendments and CIMA’s expanded supervisory framework, covering quarterly returns, cyber-incident notification, client-asset segregation, audited financials, annual fee, and AML record-keeping. The annual supervisory fee must be paid on or before 15 January each year, and any change of directors, senior officers, or beneficial owners must be notified to CIMA in advance.

• Quarterly Regulatory Return. Transaction volumes, client-asset balances, suspicious-transaction summaries, and operational metrics submitted via REEFS.
• Cyber-incident notification within 72 hours. Any material breach, attack, or service disruption affecting client assets or sensitive data must be reported to CIMA inside the 72-hour window, with a follow-up incident report and remediation plan.
• Client-asset segregation reporting. Documented evidence that client virtual assets are held separately from proprietary holdings, with reconciliation procedures and access-control logs.
• Audited financial statements (IFRS + Virtual Asset Reporting Annex). Annual audit by an approved Cayman-licensed auditor; the Virtual Asset Reporting Annex covers asset classification, valuation policies, and custody disclosures specific to virtual assets.
• Annual fee and material-change notifications. Annual supervisory fee on or before 15 January; CIMA notification for changes in directors, senior officers, beneficial owners, business model, or service categories.
• Record-keeping (Anti-Money Laundering Regulations 2023 Revision and CIMA Statement of Guidance). Books and transaction records held at the registered office; suspicious-transaction reports filed with the Authority; AML/KYC compliance returns; ad-hoc audits at CIMA’s request.

Gofaizen & Sherle scopes the right Cayman VASP path for your service model — VASP registration for exchanges without custody and virtual asset transfers, full VASP license for custody and trading platforms (mandatory since 1 April 2025), Sandbox License for novel models that fall outside standard categories. Our team builds AML/CFT programs to CIMA’s risk-based standard, prepares Schedule 1A document packages for REEFS submission, and structures fit-and-proper dossiers that pass CIMA review without rework cycles that typically extend timelines by 2–3 months.

Practice focus areas:

• VASP scoping for crypto exchanges, OTC desks, virtual asset transfer services, custodial wallet providers, and payment processors with crypto rails.
• Full VASP license preparation for custody providers and trading platforms under the post-1 April 2025 mandatory licensing regime, with extended IT, cybersecurity, and client-asset segregation documentation.
• Dual-regime structuring under the VASP Act and the Securities Investment Business Act (SIB Act) for token issuers, ICOs, STOs, and stablecoin projects with investment characteristics.
• Sandbox License applications for genuinely innovative models — new tokenization formats, hybrid financial services, experimental protocols — with CIMA-supervised market testing under the 12-month authorization.
• Re-domiciliation from the British Virgin Islands, Estonia, and other tightening jurisdictions to the Cayman Islands by way of continuation, including fresh fit-and-proper review and CIMA application package.
• Travel Rule operationalization, Cayman banking onboarding support, MLRO/DMLRO/AMLCO appointments, and ongoing compliance under the Anti-Money Laundering Regulations (2023 Revision).
• Ongoing reporting infrastructure for the 2026 supervisory framework: quarterly REEFS returns, 72-hour cyber-incident notification, IFRS audit with Virtual Asset Reporting Annex, and material-change notifications to CIMA.