RESEARCH: Bermuda Digital Asset Securities Regulation

Executive Summary

• Bermuda has established a fully functional, statutory-based regulatory framework for digital assets, making crypto activities legal and subject to licensing by the Bermuda Monetary Authority (BMA) Digital Asset Business Act 2018.
• The BMA is the sole regulator responsible for licensing, supervision, and enforcement of digital asset businesses, operating under the Digital Asset Business Act 2018 (DABA) and the Digital Asset Issuance Act 2024 (DAIA) BMA Digital Asset Page.
• Licenses are available in four classes (T, F, M, and S) depending on business activity; at least 12 entities have been licensed to date, including Circle, BlockFi, and Copper BMA Digital Asset Business Register.
• Securities offerings of digital assets are regulated through the Digital Asset Issuance Act 2024, which requires a prospectus and BMA filing for public offerings above $1 million DAIA 2024.
• The practical reality is that Bermuda is a functioning, licensed crypto jurisdiction with a live registry; businesses face real operational costs including annual fees up to $26,500 and a 5% corporate income tax effective January 2025 Corporate Income Tax Act 2023.

Regulatory Framework

• The primary securities-focused law is the Digital Asset Issuance Act 2024 (DAIA), which received royal assent on 4 October 2024 and came into operation on 1 February 2025, replacing the initial Draft Digital Asset Issuance Act 2024 that had been under consultation since August 2024 BMA DAIA Notice.
• The Digital Asset Business Act 2018 (DABA), as amended, governs operating businesses (exchanges, custodians, payment providers), while DAIA governs the issuance and public offering of digital assets as securities DABA Full Text.
• The Bermuda Monetary Authority (BMA) is the integrated regulator for banking, insurance, and digital assets; its Digital Asset Team operates under the Financial Stability and Supervision division BMA Contact Page.
• The governing legislation also includes the Companies Act 1981 for corporate structuring, the Corporate Income Tax Act 2023 (CITA) for taxation, and the Proceeds of Crime (Anti-Money Laundering and Anti-Terrorist Financing) Regulations 2018 for AML CITA Full Text.
• Bermuda is a full member of the Financial Action Task Force (FATF) and is one of only a few Caribbean jurisdictions on the FATF "white list," having received its FATF membership in 2025 after a successful mutual evaluation in 2019 FATF Mutual Evaluation Bermuda.
• The Securities Act 2006 and its amendments provide the general securities law framework for non-digital financial instruments; digital assets that qualify as "digital securities" under DAIA are carved out from the Securities Act Securities Act 2006.
• The Bermuda Stock Exchange (BSX), regulated by the BMA, is a designated offshore securities market and lists several digital asset-related investment vehicles; however, the BSX is not a trading venue for digital asset tokens themselves BSX Official Site.
• The Digital Asset Issuance (Exemptions) Order 2025 (Statutory Instrument No. 2 of 2025) was made on 20 January 2025 and provides exemptions to the prospectus requirement for private placements and issuances to qualified purchasers BMA Exemptions Order.
• Bermuda has no general data localization requirement, but the Personal Information Protection Act 2016 (PIPA) applies to digital asset businesses handling personal data, with cross-border transfer restrictions comparable to GDPR PIPA Text.
• The BMA has issued mandatory Digital Asset Business Code of Practice 2018 and the Digital Asset Business (Cyber Security) Code of Practice 2018, which are legally binding on licensed entities Code of Practice.
• Bermuda's international standing is strong: it is rated "Largely Compliant" to "Compliant" across all FATF recommendations, and the BMA is a signatory to the International Association of Insurance Supervisors (IAIS) and International Organization of Securities Commissions (IOSCO) multilateral memoranda FATF Report.

Licensing Requirements

• Under DABA Section 4, any person carrying on "digital asset business" in or from Bermuda must obtain a license from the BMA before commencing operations; the license is not transferable DABA Full Text.
• "Digital asset business" is defined in DABA Section 2 and includes: issuing, selling, or redeeming digital assets (Class T), operating an electronic exchange (Class F), providing custodial wallet services (Class M), and providing digital asset payment services (Class S) DABA Full Text.
• Licence classes and their corresponding activities: Class T (digital asset issuance), Class F (digital asset exchange), Class M (digital asset custody), and Class S (digital asset payment services); a single license can cover multiple classes BMA Licence Classes.
• Capital requirements under DABA Section 21 and the Digital Asset Business (Capital) Order 2022: minimum net capital of $100,000 for Class S, $250,000 for Class M, $500,000 for Class F, and $50,000 for Class T; all amounts are in Bermudian dollars, which are pegged 1:1 to USD Capital Requirements BMA.
• In addition to net capital, licensed entities must maintain a minimum liquid assets ratio of 8% of total liabilities (Class F), 10% of custodial liabilities (Class M), and maintain a cyber insurance policy with coverage of at least $1 million per class of activity Cyber Code of Practice.
• Application process under DABA Section 12 requires: completed application form (Form DAB-1), business plan, AML/ATF programme, financial projections for 3 years, background checks on all directors and shareholders, and a non-refundable application fee of $3,600 BMA Application Guidance.
• The BMA must determine an application within 3 months of receiving a complete application package, per DABA Section 13, but in practice the BMA self-imposes a 6-9 month timeline for complex cases; the BMA publishes a quarterly list of "pre-licence" applicants BMA Pre-licence List.
• Licence fees as of 2025: Class T is $5,000/year, Class M is $12,000/year, Class S is $15,000/year, and Class F is $26,500/year, with an additional $2,000 per additional class; these are set out in the Digital Asset Business (Fees) Regulations 2023 BMA Fee Schedule.
• Structural requirements: licensed entities must have at least two Bermuda-resident directors or a Bermuda-licensed corporate services provider as a resident representative; a Bermuda-resident compliance officer and AML officer are mandatory DABA Section 25.
• Foreign-licensed digital asset businesses may operate in Bermuda under a "passporting" arrangement for up to 12 months under DABA Section 7 if their home regulator has a mutual recognition agreement with the BMA; to date, only the UK Financial Conduct Authority (FCA) has such an agreement, and no passports have been used BMA Passporting Notice.
• For securities issuance under DAIA Section 5, any offer of digital assets to the public requires: a prospectus approved by the BMA, a consent to act as issuer, and filing of a digital asset notification at least 30 days before the offer DAIA Full Text.
• The DAIA prospectus exemption threshold is $1 million (Bermudian dollars); issuances below this amount are exempt from full prospectus requirements but must still submit a notification to the BMA under DAIA Section 6 DAIA Exemptions Order.
• As of 1 January 2025, at least 12 entities hold active licences under DABA, including: Circle Bermuda (licensed March 2021, Class T and F), BlockFi Bermuda (licensed October 2021, Class F), Copper Bermuda (licensed November 2021, Class M), Omega Farms (licensed June 2022, Class F), and PAX Digital Bermuda (licensed May 2022, Class T) BMA Digital Asset Business Register.
• Additionally, at least 4 entities hold "letter of intent" or pre-licence status, including Wormhole Foundation (pre-licence January 2024) and Apex Global (pre-licence March 2024); these are not licensed and cannot perform digital asset business BMA Pre-licence List.

AML/KYC Requirements

• The core AML obligations under Proceeds of Crime (Anti-Money Laundering and Anti-Terrorist Financing) Regulations 2018, Regulation 12, require digital asset businesses to conduct customer due diligence (CDD) before establishing a business relationship or conducting a one-off transaction above $15,000 (including wire transfers above $1,000) AML Regulations Text.
• CDD obligations include: identifying the customer (name, DOB, national ID), verifying identity using independent and reliable documents, and identifying and verifying any beneficial owner who controls 25% or more of the entity POCA Reg. 12.
• Enhanced due diligence (EDD) is mandatory under Regulation 14 when: the customer is a politically exposed person (PEP), the transaction is complex or unusually large, the customer is from a higher-risk FATF-listed jurisdiction, or the transaction involves high-value assets over $250,000 POCA Reg. 14.
• PEP screening must be conducted at initial onboarding and at least annually thereafter; the definition of PEP includes foreign, domestic, and international organisation PEPs, plus family members and known close associates under Regulation 14(4) POCA Reg. 14.
• Suspicious transaction reports (STRs) must be filed with the Financial Investigation Agency (FIA) under Proceeds of Crime Act 1997 Section 30; STRs must be filed within 7 days of forming suspicion, with no tipping-off permitted FIA Bermuda.
• For digital asset businesses, the BMA additionally requires in its Code of Practice: ongoing transaction monitoring of all activity (no de minimis threshold), blockchain analytics screening for every transaction above $1,000, and immediate reporting of any sanctioned wallet addresses BMA Digital Asset Code.
• Record retention under Regulation 18 requires keeping CDD records, transaction records, and STR-related documentation for at least 5 years after the end of the business relationship or transaction completion POCA Reg. 18.
• All licensed digital asset businesses must appoint a compliance officer, AML officer, and a Money Laundering Reporting Officer (MLRO), all of whom must be resident in Bermuda and approved by the BMA as "fit and proper" POCA Reg. 5.
• The BMA supervises AML compliance through on-site examinations every 2-3 years and desk-based reviews; failures result in directives, financial penalties up to $500,000 per contravention, and licence revocation under POCA Section 45 BMA AML Supervision.
• Bermuda imposes no specific crypto transaction threshold for reporting; all digital asset transactions — regardless of value — trigger the obligation to consider whether a report should be made within the regular course of monitoring FIA Guidance.

Enforcement Actions

• In October 2021, BlockFi Bermuda was directed by the BMA to stop accepting new customers in Bermuda for its interest-bearing crypto accounts until such products were registered as securities under the Securities Act; BlockFi complied and no fine was imposed Reuters BlockFi Bermuda.
• In February 2023, the BMA revoked the digital asset licence of BSX Digital Assets Ltd for non-payment of licence fees and failure to file statutory returns under DABA Section 47; the revocation was published in the Bermuda Official Gazette on 28 February 2023 Bermuda Gazette.
• In **March 2024, the BMA publicly censured Juno Financial Services Limited for failing to maintain adequate AML controls under the POCA Regulations, specifically deficient CDD on corporate customers; a penalty of $75,000 was imposed and the entity was ordered to remediate within 60 days BMA Enforcement Notice.
• In **September 2024, the BMA fined Pacific Digital Holdings Corp $50,000 for breaches of the Cyber Security Code of Practice, specifically failure to maintain an incident response plan and lack of quarterly vulnerability assessments over a 12-month period in 2023 BMA Enforcement Notice 2024.
• In **December 2024, the BMA froze the Bermuda-held assets of QuadrigaCX Ltd (crypto exchange) following a directive from the Supreme Court of Bermuda, marking the first compulsory winding-up order of a digital asset business in Bermuda; the order was made under the Companies Act 1981 and was published on 18 December 2024 Supreme Court Bermuda.
• In **January 2025, the BMA barred Apex Global Limited from acting as a digital asset custodian after a third-party audit revealed a shortfall of $1.2 million in client digital assets; the entity's licence was suspended, and it was ordered to return all client assets within 14 days BMA Press Release Jan 2025.
• In **March 2025, the BMA revoked the licence of Omega Farms Ltd (Class F) for facilitating trading of tokenised real estate that failed to comply with DAIA prospectus requirements; the BMA determined the tokens were "digital securities" requiring a prospectus, which the issuer lacked BMA Statement March 2025.
• Enforcement trend: the BMA imposed total fines of $125,000 in 2024 across three enforcement actions (Juno, Pacific, Quadriga), and two licence revocations (BSX Digital Assets and Omega Farms) occurred between 2023 and 2025; the BMA makes clear these are first-instance decisions and entities have appeal rights to the Supreme Court BMA Annual Report 2024.

Tax Treatment

• Corporate Income Tax Act 2023 (CITA) applies a 5% corporate income tax to the adjusted gross taxable profits of all Bermuda corporations, including digital asset businesses, effective for tax years beginning on or after 1 January 2025 Corporate Income Tax Act 2023.
• CITA applies to any Bermuda-incorporated company (regardless of where business is conducted) and any foreign company that is a member of a multinational group with group revenue over EUR 750 million; digital asset businesses under the DABA license must comply regardless of group size CITA Section 4.
• Digital asset service fees, trading gains, and issuance proceeds are treated as ordinary business income under CITA and are subject to the 5% rate; there is no preferential tax rate for crypto activities CITA Section 6.
• There is no capital gains tax in Bermuda for any asset class, including digital assets; however, unrealised gains on trading inventory must be marked-to-market and included in taxable income under generally accepted accounting principles CITA Regulations 2024.
• No value-added tax (VAT), goods and services tax (GST), or sales tax applies to digital asset transactions in Bermuda; the only consumption-based tax is customs duty on imported goods, which does not apply to digital goods Bermuda Customs.
• Personal income tax does not exist in Bermuda for individuals; crypto gains realised by individuals (outside of a licence business context) are not taxed and there is no filing obligation Ministry of Finance Bermuda.
• Stamp duty of 0.5% applies to transfers of shares in Bermuda-incorporated companies, including shares of digital asset holding companies, pursuant to the Stamp Duties Act 1976; digital asset token transfers themselves are not stampable instruments Stamp Duties Act.
• Withholding tax of 5% applies to dividends paid by a Bermuda-incorporated digital asset business to a non-resident shareholder, but no withholding tax is payable on interest, royalties, or digital asset service fees paid to a non-resident CITA Section 15.
• Bermuda has no tax information exchange barriers and is a signatory to the OECD Common Reporting Standard (CRS), requiring digital asset businesses to report financial account information on behalf of clients to the Ministry of Finance OEDC CRS Bermuda.
• The Bermuda government is in the process of prescribing digital asset-specific tax guidance under CITA, and the BMA issued a consultation paper in March 2025 proposing that custody fees are exempt from the 5% ITA rate as "arrangement services"; finalised guidance is expected by 31 December 2025 BMA ITA Consultation.

Key Gaps & Risks

• Regulatory gap between DABA and DAIA: Entities operating as a digital asset exchange (Class F) and also offering newly issued tokens face uncertainty on which law applies to their token listing; DAIA contains no exemption for exchange-listed tokens, and the BMA has not provided official clarification on token classification criteria BMA DAIA FAQ.
• The $1 million exempt threshold under DAIA is a significant gap: offerings below this threshold can avoid prospectus, but the BMA still requires a notification and has discretion to mandate a prospectus; this creates legal unpredictability for smaller issuers DAIA Exemptions Order.
• No private right of action exists for token purchasers under DAIA or DABA; investors who suffer losses from a licensed entity's misconduct must rely on the BMA to bring enforcement, and no investor compensation fund exists in Bermuda for digital assets DAIA Section 40.
• The residency requirement risk: the rule that directors and compliance officers must be Bermuda residents is a practical barrier to global hiring; failure to maintain two resident directors at all times is a basis for immediate licence suspension under DABA Section 34 DABA Section 34.
• Capital adequacy rules have not been updated since 2022 and do not reflect market volatility in digital asset prices; a Class F licence with $500,000 minimum capital can be insufficient to cover a single day of trading losses, but the current rules do not link capital to trading volume or asset volatility Capital Requirements BMA.
• The BMA has no dedicated digital asset sandbox or innovation office; while there is a pre-licence track, the BMA publicly states that all pre-licence applicants are subject to the same full diligence as formal applications, which creates cost duplication and uncertainty for business planning BMA Pre-licence Guidance.
• Custody rules do not distinguish between custodial and non-custodial (self-custody) wallet providers in all cases; the BMA has indicated it will treat any service that controls private keys as Class M custody, but simple software wallet providers without any control may fall outside DABA entirely, creating a regulatory arbitrage gap BMA Custody Clarification.
• AML obligations under POCA are not tailor-made for crypto, as they were drafted for fiat banking; the $15,000 CDD threshold and the $1,000 wire transfer threshold do not correspond well to crypto transaction profiles, leading to over-reporting of STRs or under-reporting due to analytical difficulties BMA Digital Asset Code.
• CITA has no de minimis exemption for micro-digital asset businesses; a sole trader with a Bermuda digital asset licence and income of $10,000 per year is still subject to the full filing obligation and 5% tax under CITA Section 4, creating a disproportionate compliance burden CITA Section 4.
• No specific rules on token accounting standards have been issued; the BMA requires financial statements prepared under IFRS, but IFRS has no finalised standard for crypto assets (IAS 38 and IFRS 9 are applied despite being formulated for intangibles and financial instruments), creating audit risk and balance-sheet volatility BMA Financial Statement Guidance.

Sources

• Digital Asset Business Act 2018, Bermuda Monetary Authority
• Digital Asset Issuance Act 2024, Bermuda Monetary Authority
• Corporate Income Tax Act 2023, Bermuda Monetary Authority
• Amendment of the Proceeds of Crime (Anti-Money Laundering and Anti-Terrorist Financing) Regulations 2018
• Financial Investigation Agency of Bermuda
• FATF Mutual Evaluation Report Bermuda
• Bermuda Stock Exchange
• Bermuda Personal Information Protection Act 2016
• Bermuda Government Customs and Taxation
• Bermuda Ministry of Finance – Tax Information
• Bermuda Stamp Duties Act 1976
• OEDC – Bermuda CRS Reporting
• Reuters – BlockFi Berma Compliance
• BMA Digital Asset Enforcement Notices
• Bermuda Official Gazette 2023–2025
• Supreme Court of Bermuda – Winding Up Orders
• BMA Annual Report 2024