Crypto regulation in the Cayman Islands (CIMA)

Why Cayman? Because the jurisdiction now runs a fully-live, two-tier virtual asset regime that distinguishes registered VASPs from licensed providers and pairs that structure with prescriptive market-conduct rules for trading platforms and custodians. On 1 April 2025, Cayman brought “Phase 2” into force, activating licensing for Virtual Asset Trading Platforms (VATPs) and Virtual Asset Custodians – a pivotal change for any exchange, broker or prime-services business considering the Islands. 

Disclaimer (not legal advice): This article is informational and does not substitute for tailored legal counsel. Regulatory outcomes turn on facts, structure and timing.

1) The regulator & core legal instruments

• Regulator: Cayman Islands Monetary Authority (CIMA).
• Primary statute: Virtual Asset (Service Providers) Act (2024 Revision) (the “VASP Act”), as amended in 2024 and 2025, with supporting Regulations and CIMA rules/SOGs. 

Phase 2 licensing: The Commencement Order 2025 switched on the licensing regime on 1 April 2025 for VATPs and Custodians, replacing the earlier registration-only model for these activities. 

2) Who needs approval? Registration vs. licence (and what counts as a VASP)

Under section 4 VASP Act, no one may carry on a virtual asset service in or from the Cayman Islands unless: (a) registered, or (b) licensed (for custody or operating a VATP), or (c) an existing licensee with a waiver, or (d) a sandbox licensee. Natural persons cannot conduct VASP business. Applications are made under section 6 (registration) and section 8 (licences). 

“Virtual asset service” includes: exchange (fiat/VA and VA/VA), transfer, custody, and participation in/provision of financial services related to a virtual asset issuance. “Virtual service tokens” are excluded. “Issuance” is the sale of newly created VAs to the public in or from Cayman. 

Practical takeaways

1. Registration covers non-licensable activities (e.g., OTC dealing without custody, brokerage/agency flow without platform operation, certain advisory/arranging around issuances).
2. Licensing is mandatory for custodians and VATPs; CIMA may also redirect innovative models to the sandbox.

3) What activities are regulated – and what you can offer under each

Below is how Cayman maps activities to permissions and typical services (subject to CIMA’s licence/registration scope wording and any conditions).

A) Virtual Asset Trading Platform (VATP) – Licence

What it is: A centralized or decentralized digital platform that facilitates exchange for third parties and either (i) holds/controls client VAs to facilitate the exchange or (ii) acts as principal when matching bids/offers.

Services you can offer (subject to your licence terms):

• Spot trading venue (fiat/VA and VA/VA), listing/ delisting, order-book transparency, market surveillance, trading halts, clearing/settlement workflows.
• Issuer access for public VA sales above the prescribed threshold (where permitted), including listing of VA-securities subject to SIBL interaction/approval.
• Leverage/margin only under strict controls (e.g., negative balance protection, risk-based limits). 

CIMA can set net-worth, reporting, listing and market-abuse controls, and restrict who you market to/what can trade.

B) Virtual Asset Custody – Licence

What it is: Safekeeping/administration of VAs or instruments enabling control. 

Services you can offer:

• Institutional VA custody with segregation, reconciliations, incident reporting, and insurance commensurate with risks, plus wallet-governance (hot/cold, multi-sig) and third-party audits.

C) Other VASP activities – Registration

Examples: OTC brokerage/agency execution without operating a VATP; arranging or advising around VA issuances; transfer services; VA/fiat or VA/VA exchange services that do not meet VATP criteria (e.g., no custody/control of client assets and no principal dealing at match). CIMA checks whether some models still require a licence or sandbox.

4) Market-conduct & marketing crypto services in Cayman

CIMA’s Rule & Statement of Guidance (RSOG) on Market Conduct for VASPs requires you to communicate fairly, clearly and not misleadingly; tailor risk disclosures to client sophistication; maintain segregation of duties; and publish transparent fees, order-book and pricing where applicable. VATPs must run market-abuse surveillance and disclose listing policies; custodians must notify breaches and maintain adequate insurance.

Marketing do’s & don’ts (highlights):

• Put plain-language risk warnings upfront; avoid ambiguous performance claims.
• Keep a records trail for promotions and approvals; ensure claims match your licence/registration scope.
• Disclose fees and spreads clearly and before execution.

5) Paid-up capital & licensing fees

Capital/financial resources. Cayman does not set a single fixed “paid-up capital” number for all VASPs. Instead, the Act empowers CIMA to impose net-worth, financial resource and reporting requirements calibrated to your business (especially for VATPs). Expect a risk-based approach tied to overheads, custody exposure, insurance and technology resilience.

Application & ongoing fees (selected):

• Licence application (custody or VATP): KYD 5,000 (non-refundable).
• Licence grant – Custody: KYD 30,000 (Local-company concession: KYD 3,000).
• Licence grant – VATP: KYD 100,000 (Local-company concession: KYD 10,000).
• Registration and annual renewals scale with annual revenue bands (see Schedule 2).

These figures come from the Virtual Asset (Service Providers) (Amendment) Regulations, 2025 (Schedules 1A & 2).

Tip: Cayman’s fee grid differentiates between licensing (fixed grant fees) and registration/renewals (revenue-tiered). Build this into your runway and treasury plans.

6) Mandatory licensing requirements (what CIMA will test)

Across registration and licensing, CIMA assesses fitness/propriety, AML/CTF/CPF controls, cybersecurity, governance and the public-interest dimension of your model (section 22). For VATPs and custodians, CIMA also expects robust segregation, resilient technology, conflict management, due-diligence on listed tokens and client-asset protections, with elevated expectations codified in the Rule (SL 83 of 2024) and SOG.

Travel Rule (AML): Cayman embeds VA transfer obligations (originator/beneficiary info, verification, straight-through processing, handling of missing data, and SAR triggers) at Regulations 49C–49K of the Anti-Money Laundering Regulations (2023 Revision). Your technical stack must support compliant data messaging and screening across VASP-to-VASP corridors. 

7) Application procedure (registration & licence) and timelines

Where you apply: via CIMA’s REEFS portal using prescribed forms. CIMA’s Regulatory Policy (May 2025) explains processing principles and completeness checks for registration, licensing and waiver requests (sandbox is separate). There is no statutory SLA for approval, but complete, well-structured submissions move faster; CIMA can reject or return incomplete files. 

Process flow (typical):

1. Pre-filing structuring: Cayman entity setup; confirm activity mapping (registration vs licence vs sandbox).
2. Fitness & propriety packs for beneficial owners (≥10%), directors and senior officers.
3. Program design: AML/CTF/CPF, sanctions, Travel Rule solutioning, outsourcing, business continuity, governance, cyber and data protection.
4. Operational risk materials: wallet policies (hot/cold), reconciliations, insurance letters of intent (custody), market surveillance and listing policies (VATP).
5. File on REEFS with the assessment fee, respond to CIMA queries and – if VATP/custody – expect supervisory tech and market-conduct deep-dives. 

Issuances: For public VA issuances above the threshold, CIMA must be notified via an issuance request; the Authority must notify its decision within 21 days of receipt. (Private placements below threshold are handled differently but still require careful analysis.) 

8) Documents you should expect to submit

CIMA’s 2025 amendment regulations – Schedule 1A set out mandatory materials. Expect, at minimum:

• Corporate & constitutional documents, business plan, programme of operations and detailed activity description.
• Ownership and control map; personal questionnaires for controllers/owners (≥10%) and senior officers; fit & proper evidence.
• AML/CTF/CPF framework; enterprise-wide risk assessment; Travel Rule procedures and vendor documentation.
• Cybersecurity and BCP/DR; outsourcing agreements (where relevant).
• For VATPs: listing/ delisting policy, market surveillance procedures, order-book transparency, client agreement suite, conflicts and disclosure framework.
• For custody: wallet architecture, segregation and reconciliations, third-party audits, insurance confirmation/LOIs

9) How CRYPTOVERSE Legal helps you land approval – on time and with fewer surprises

1. Regulatory mapping & structuring. We benchmark your model against section 4 scope tests and the VATP definition to decide registration vs licence vs sandbox, then tailor licence conditions you can live with.
2. Documentation sprints. We build your CIMA-ready pack to Schedule 1A standards and the Regulatory Policy completeness test – business plan, governance matrix, market-conduct playbooks, Travel Rule runbooks, technical annexes and insurance terms that resonate with CIMA’s Rule/SOG expectations. 
3. Safety-by-design controls. For custody we engineer segregation, reconciliation cadence, independent audits and insurance consistent with the RSOG; for VATPs we implement listing governance, market surveillance, pricing transparency and negative-balance protections.
4. Marketing compliance. We pre-clear risk disclosures, KPI claims and fee statements under the market-conduct RSOG, and align your website/app copy to “fair, clear, not misleading” standards.
5. Execution. We lodge your file via REEFS, manage CIMA Q&As to closure, and keep your board onside with short, decision-useful updates.

10) Final checklist (quick yes/no)

• Activity correctly mapped to registration or licence? 
• AML/Travel Rule workflows tested end-to-end (49C–49K)?
• Custody: Segregation, reconciliations, insurance, incident reporting defined?
• VATP: Listing rules, surveillance, order-book/fees transparency, leverage controls?
• Fees & budget set to Schedule 2 (application, grant, renewal)? 
• Marketing content meets RSOG and scope-of-approval?

Bottom line

Cayman’s VASP regime is now fully operational for both registrations and licences. If you custody client assets or operate a platform, expect a licence, prescribed market-conduct standards and meaningful prudential expectations. If your business is non-licensable, registration remains viable – but CIMA will still test your governance, AML and technology. With the right structure and dossier, approvals are achievable – and sustainable.

Ready to proceed? CRYPTOVERSE Legal can scope your project in a week, deliver a CIMA-grade application pack, and quarterback your licensing to go-live. Let’s get you authorized.

Disclaimer: 

This article is for general information only and does not constitute legal advice. Regulatory thresholds, fees, and supervisory practices change via circulars and amendments. For tailored counsel and filings, engage CRYPTOVERSE Legal.

FAQs: