Game Changer! – Licensing Requirements for Virtual Assets in the Cayman Islands – Part 2

On 25 May 2020 the Cayman Islands government passed The Virtual Asset (Service Providers) Law, 2020 (“VASP Law”), which provides a legislative framework for the conduct of virtual assets business in the Cayman Islands and for the registration and licensing of persons providing virtual asset services. The VASP Law is intended to place the Cayman Islands with a cutting edge, robust framework which is in alignment with global regulatory standards, protect consumers and meet the requirements of the Financial Action Task Force recommendations in respect of virtual assets. In this two part series (this being Part 2) we look at the new VASP Law and its requirements with respect to licensing. Part 1 looked at the requirements with respect to registration.

1.   WHAT IS A VIRTUAL ASSET?

The VASP Law defines a “virtual asset” as “a digital representation of value that can be digitally traded or transferred and can be used for payment or investment purposes but does not include a digital representation of fiat currencies”.

The VASP Law makes a distinction between a “virtual asset” as defined above which will be regulated and a “virtual service token” which is defined as “a digital representation of value which is not transferrable or exchangeable with a third party at any time and includes digital tokens whose sole function is to provide access to an application or service or to provide a service or function directly to its owner.” 

The distinction is meant to deal with the usual question as to whether or not a digital token or coin is a security or a utility token. Virtual service tokens will be treated as utility tokens and therefore will fall outside the registration regime and the licensing regime under the VASP Law.¹

2.   WHAT ARE VIRTUAL ASSET SERVICES?

The VASP Law states that “Virtual asset service” means the issuance of virtual assets or the business of providing one or more of the following services or operations for or on behalf of a natural or legal person or legal arrangement: 

1. exchange between virtual assets and fiat currencies;
2. exchange between one or more other forms of convertible virtual assets;
3. transfer of virtual assets;
4. virtual asset custody service; or
5. participation in and provision of financial services related to a virtual asset issuance or the sale of a virtual asset.

3.   WHO IS A VIRTUAL ASSET SERVICE PROVIDER?

A person is a “virtual asset service provider” (“VASP”) under the VASP Law, if it is (1) a company, or a general partnership, or a limited partnership, or a limited liability company, or a foreign company registered in the Cayman Islands, and (2) provides a virtual asset service as a business or in the course of business in or from within the Cayman Islands and is registered or licensed in accordance with the VASP Law or is an existing licensee that is granted a waiver under the VASP Law.
A natural person cannot carry on or purport to carry on a virtual asset service as a business or in the course of business in or from within the Cayman Islands.

The VASP Law requires a VASP to either register with Cayman Islands Monetary Authority (“CIMA”) or be licensed by CIMA. Whether the VASP will have to register or be licensed will be dependent on the activity carried out by the VASP. However, broadly speaking, in the case of the provision of virtual asset custodial services or the operation of a virtual asset trading platform, the VASP is required to have a virtual asset service licence. It appears that in most cases where the VASP is carrying on business as a VASP but is not providing virtual asset custodial services or the operation of a virtual asset trading platform, registration with CIMA is required.

4.   CIMA CONSIDERATIONS: LICENCE OR REGISTER

In determining whether to grant a virtual asset licence, a sandbox licence, register an applicant as a “registered person” or to waive a requirement to licence or register under the VASP Law, CIMA will take into account the following:

1. size, scope and complexity of the virtual asset service, underlying technology, method of delivery of the service and virtual asset utilised;
2. knowledge, expertise and experience of the applicant;
3. the AML procedures that the applicant has in place;
4. internal safeguards and data protection systems being utilised by the applicant;
5. the similarity of the virtual asset service to securities investment business or any other regulated activity under any of the other Cayman Islands regulatory laws;
6. the risks involved;
7. whether the virtual asset service business involves the offering of virtual asset custodial services or the operation of a virtual asset trading platform;
8. the net worth, capital reserves and financial stability of the applicant;
9. the likelihood that the service will promote innovation, competition and benefits to consumers; and
10. the applicant’s senior officers, trustees and beneficial owners are fit and proper persons.

5.   VIRTUAL ASSET SERVICE LICENCE

A person who wishes to (i) provide virtual asset custody services (i.e. the business of safekeeping or administration of virtual assets) or (ii) to operate a virtual asset trading platforms (“VATP”) or is at the commencement of the VASP Law already doing so, should apply for a virtual asset service licence. For the purposes of the VASP Law, a VATP does not include a platform that only provides a forum where buyers and sellers post bids and offers and a forum where the parties trade in a separate platform or in a peer-to-peer manner.

1. CIMA criteria – In order to determine whether to approve an application for a licence, CIMA will consider the matters set out in section 4 above, whether approval of the application is against the public interest and if the applicant has (i) personnel with the necessary skills, knowledge and experience (ii) facilities, books, records and accounting systems, and (iii) adequate capital and cybersecurity measures, as CIMA considers appropriate having regard to the size, scope and complexity of the business. When CIMA has granted a licence, it will publish notification in the Cayman Islands Gazette.
2. CIMA regulatory requirements – CIMA may impose such regulatory requirements on a virtual asset service licensee as it considers necessary, including further restriction or prohibitions on the use of technology or practices which CIMA deems may disrupt or prejudice the functions of CIMA, the interests of the public and the financial services in the Cayman Islands.
3. Event-driven notifications – In addition to an annual renewal fee which is due by 15th January each year, a licensee is required to notify CIMA within 15 days of any changes made to the information in the application form submitted to CIMA.
4. Annual Audit obligations for Licensees – A licensee is required to have its accounts audited annually and submit such accounts to CIMA within 6 months of financial year end. CIMA may grant an exemption to this requirement if CIMA determines the requirement to be unnecessary or prohibitive given the size, scope and complexity of the economic activity and the availability of auditing services to the virtual asset service.

6.   REQUIREMENTS: VIRTUAL ASSET CUSTODY SERVICES

A licensee that provides virtual asset custody services must:

1. maintain best technology practices relating to virtual assets held in custody;
2. not encumber or cause any virtual asset to be encumbered, unless specifically agreed to by the beneficial owners of the virtual assets;
3. ensure that all proceeds relating to virtual assets held in custody shall accrue for the benefit of the owner, unless otherwise agreed in writing;
4. take such steps as may be necessary to safeguard the virtual assets held;
5. have adequate safeguards against theft and loss; and
6. enter into a custodial arrangement with the owner of a virtual asset, which includes the prescribed details set out in the VASP Law (i.e. in relation to the manner in which the virtual assets are to be held, the transactions the custodian is permitted to engage in, disclosures relating to the risks and fees etc.).

CIMA may also impose requirements on a licensee that provides virtual asset custody services, including (i) net worth requirements, (ii) reporting requirements, (iii) disclosures to clients concerning the transparency of operations, (iv) requirements for the safekeeping of client assets (including the segregated of assets, insurance requirements and cybersecurity measures), and (v) any other requirement CIMA determines is in the best interest of the beneficial owners of the assets held by the licensee.

7.   REQUIREMENTS: VIRTUAL ASSET TRADING PLATFORMS

1. CIMA requirements – CIMA may impose requirements on a licensee that operates a VATP where CIMA deems it necessary, including: (i) the type of client it may market its services to, (ii) the types of virtual assets that may and may not be traded on the VATP, (iii) the clearing and settlement process for transactions between buyers and sellers of virtual assets, and (iv) net worth and reporting requirements.
2. Due diligence requirement – A licensee operating a VATP is required to carry out reasonable due diligence procedures on virtual assets and their issuers listed on the VATP.
3. Securities investment business – A licensee who is operating a VATP must apply to CIMA, in the prescribed form, for approval prior to engaging in securities investment business² (as defined under the Cayman Islands Securities Investment Business Law (“SIBL”)) which relates to virtual assets. In determining an application by a VATP, CIMA will take into account whether the VATP lists or facilitates the issuance of securities which are virtual assets in accordance with SIBL and whether any additional supervision is required under SIBL.
4. Prohibitions on a licensee – A licensee that operates a VATP shall not:

• • provide financing to clients for the purchase of virtual assets, unless disclosures are made to client regarding the terms and risk of the financing;
  • engage in trading or market making behavior for its own account which could be detrimental to the interests of its clients, unless these activities are necessary for the operation of the VATP and these activities have been disclosed to clients of the VATP;
  • allow a virtual asset to be traded on the VATP unless it has assured itself that the virtual asset is not presented in a deceiving manner or in a manner that is meant to defraud;
  • allow a client to purchase or trade in virtual assets unless the licensee has assured itself the client is aware of the risks of purchasing, holding or trading the virtual asset and has provided disclosures in a form that the client can understand; and
  • provide fiat currency to fiat currency exchange services to users of the VATP.

8.   SANDBOX LICENCE

A “sandbox licence” is a temporary licence granted for a period of up to 1 year for a person providing a virtual asset service that represents an (i) innovative use of technology or (ii) uses an innovative method of delivery that requires supervision and oversight not offered by an existing licence or registration.

1. CIMA supervision – CIMA shall assess, monitor, supervise the innovative service, technology or method of delivery of a sandbox licensee with a view to ensuring that the service, technology or delivery (i) complies with the core principles of a sandbox licence, as set out in the VASP Law, (ii) improves the provision of financial services within the Cayman Islands, (iii) complies with global standards and best AML practices, (iv) facilitates the adoption of new financial services practices and technologies within the Cayman Islands, and (v) best practices and guidance are developed for the virtual asset service sector.
2. Direction by CIMA – CIMA has the discretion to require a person applying to be a registered person or a virtual asset service licensee to apply instead for a sandbox licence.
3. CIMA powers – CIMA may take any action necessary where it is of the opinion that the action is necessary for the protection of clients or potential clients and is in the interest of the public, may extend the duration of the sandbox licence, amend any restrictions or revoke it.
4. Fintech service provider – A fintech service provider may, but is not required to, apply for a sandbox licence. For the purposes of the VASP Law, a “fintech service provider” is a person who is carrying on a service that uses innovative technology to improve, change or enhance financial services, but is not a virtual asset service.
5. Compliance requirements – Where CIMA grants a sandbox licence, CIMA may impose any of the requirements that are applicable to a virtual asset service licensee and any restrictions that it considers necessary (e.g. impose a limit of the value or amount of virtual asset service or fintech service offered to clients).

9. CIMA’S ENFORCEMENT POWERS

CIMA has broad discretionary supervisory powers in respect of a registered person or licensee under the VASP Law. These powers are set out in Part 1 of this two part series.

CIMA may revoke a virtual asset service licence, sandbox licence or cancel the registration if the licensee or registered person has ceased or wishes to cease carrying on virtual asset service or has not commenced business within 1 year of the date of grant of the licence or the registration. 

1.  Section 3(2) of the VASP Law makes this clear by stating: “For the purposes of this Law, virtual service tokens are not virtual assets and a person or legal arrangement that provides services that involve virtual service tokens only are not required to have a licence or registration under this Law.”
2.  Securities investment business (as defined under the Cayman Islands Securities Investment Business Law mainly relates to managing securities, dealing in securities, advising in respect of securities, or arranging deals in securities)

This publication is not intended to be a substitute for specific legal advice or a legal opinion. For specific advice, please contact any of:

E: gary.smith@loebsmith.com
E: elizabeth.kenny@loebsmith.com
E: santiago.carvajal@loebsmith.com