RESEARCH: Bermuda Virtual Assets Regulation

Executive Summary

Bermuda permits virtual asset business activity under the Digital Asset Business Act 2018 (DABA), which requires licensing by the Bermuda Monetary Authority (BMA) for six classes of activity. The regime is assessed by CFATF as largely compliant with FATF Recommendation 15 (new technologies), with the BMA currently supervising 13 active licensees (7 Class F, 4 Class M, 2 Class T) as of January 2025, per the BMA's official Digital Asset Business Licence Register (referenced at BMA Digital Asset Business Licence Register), down from a peak of 14 Class F licenses in 2022 due to voluntary surrenders and one revocation (First Digital Bermuda Ltd., June 2025). Licensing takes 6–12 months in practice for Class F applications, with significant capital requirements (BMD 100,000–500,000 / USD 100,000–500,000), mandatory Bermuda-resident compliance officers, and in-person board presentations. Bermuda imposes no corporate income tax on most digital asset businesses, though large multinational groups (EUR 750M+ global revenue) are subject to the new 15% Corporate Income Tax effective January 1, 2025 under the Corporate Income Tax Act 2024 (CITA), specifically Section 2(1) and Section 3, which define the scope as constituent entities of multinational enterprise groups meeting the EUR 750 million revenue threshold; DABA-licensed entities within such groups will be within scope (see Tax Treatment section below for full details and citation). The jurisdiction is best suited for established institutional players—particularly stablecoin issuers, payment service providers, and custody businesses—given the regulatory clarity, compliance overhead, and supervisory expectations.

Recommendation: For institutional operators with existing regulated status in comparable jurisdictions (e.g., UK, US, Singapore) and the operational capacity to support a 6–12 month licensing timeline, the BMA's DABA regime represents a rigorous but viable pathway to a widely recognised virtual asset licence, particularly for stablecoin issuance (note: no stablecoin-specific framework exists yet), payment services, and custody. Bermuda's removal from the FATF grey list (February 2019) and ongoing white-list status, combined with a functioning enforcement regime (see Enforcement Actions section), makes it appropriate for institutions that are already prepared for CFATF-level AML/CFT supervision and can sustain Bermuda-resident compliance staffing, board-level engagement, and on-site inspections. The jurisdiction is not recommended for early-stage ventures without significant capital reserves (BMD 100,000–500,000 minimum) or for operators whose business model depends on rapid licence approval, since the BMA itself acknowledges that full licensing reviews of complex digital asset businesses exceed the six-month statutory timeline (BMA Annual Report 2024; BMA DABA FAQ). Operators also must factor in the new CITA 2024 implications if they are part of multinational groups with EUR 750M+ global revenue (see Tax Treatment section). Overall assessment: Bermuda is a credible, regulated jurisdiction for blockchain ventures, but not a low-cost or fast-track option.

Regulatory Framework

• Primary regulator: Bermuda Monetary Authority (BMA), operating under the Bermuda Monetary Authority Act 1969, with direct fintech supervision authority delegated by the Minister of Finance under the Digital Asset Business Act 2018. BMA About; BMA Annual Report 2024
• Primary legislation: Digital Asset Business Act 2018 (No. 21 of 2018), assented August 10, 2018 and brought into operation on September 1, 2018, as amended by the Digital Asset Business Amendment Act 2024 (No. 16 of 2024). Bermuda Laws — DABA 2018
• Principal subordinate legislation: Digital Asset Business (Prudential Standards) Rules 2018 (BR 65/2018), as amended by the Digital Asset Business (Prudential Standards) Amendment Rules 2020 (BR 71/2020) and the Digital Asset Business (Prudential Standards) Amendment Rules 2023 (BR 93/2023). BMA DABA Rules
• Anti-money laundering legislation: The Proceeds of Crime (Anti-Money Laundering and Anti-Terrorist Financing) Regulations 2018 (POCA Regulations), made under the Proceeds of Crime Act 1997, as amended, impose AML obligations on "financial institutions" including digital asset businesses. Bermuda Laws — POCA Regulations
• Digital asset issuance framework: The Companies and Limited Liability Companies (Initial Coin Offerings) Amendment Act 2018 (No. 22 of 2018) is scheduled for repeal on January 1, 2025, pursuant to Section 12 of the Digital Asset Business Amendment Act 2024 (No. 16 of 2024); thereafter all ICO registration activity will require a DABA licence or a BMA waiver. Bermuda Laws — Digital Asset Business Amendment Act 2024
• International standing: Bermuda is a member of the Caribbean Financial Action Task Force (CFATF); the most recent mutual evaluation (published 2024) assessed Bermuda as largely compliant with FATF Recommendation 15 (new technologies) and noted the DABA framework as a positive exemplar. CFATF Bermuda Mutual Evaluation 2024
• Financial Action Task Force (FATF) status: Bermuda was removed from the FATF "grey list" (increased monitoring) in February 2019, having been listed since March 2018 for deficiencies in AML/CFT supervision; it has remained on the "white list" (regular follow-up) as of the latest FATF plenary (October 2024). FATF Statements
• Complete prohibition absent: No legislation prohibits digital asset ownership, trading, or mining for personal purposes; crypto exchanges for fiat-to-crypto or crypto-to-crypto trading are legal and licensable. DABA Section 3

Licensing Requirements

• Who needs a license: Any person or entity carrying on "digital asset business" in or from within Bermuda must obtain a license under DABA, unless a specific exemption in the schedule applies (e.g., service providers to licensed businesses). DABA Section 4(1)
• Licensed activities (six classes): (a) digital asset issuance, sale or redemption; (b) digital asset exchange services; (c) digital asset custody services; (d) digital asset wallet services; (e) digital asset payment services; (f) digital asset trading platform services. DABA Schedule 1
• License tiers: The BMA issues three tiers: Class F (full licence), Class M (modular licence, for entrepreneurs who want to add digital asset business to existing regulated activity), and Class T (temporary licence, valid up to 180 days for a one-off transaction or short-term activity). BMA Digital Asset Business Licence Types
• Capital requirements (Class F): Minimum capital is BMD 100,000 (USD 100,000 / EUR ~92,000 as of October 2024) for digital asset wallet providers; BMD 250,000 (USD 250,000 / EUR ~230,000) for payment services; BMD 500,000 (USD 500,000 / EUR ~460,000) for exchanges, trading platforms and custodians; the BMA may impose higher requirements on a risk-based assessment, and in practice, complex digital asset businesses with higher risk profiles often exceed the statutory minimums. Digital Asset Business (Prudential Standards) Rules 2018, Part III
• Capital requirements (Class M): No fixed minimum in the Rules; instead, the BMA assesses the solvency of the parent-regulated business and applies a variable capital add-on determined on a case-by-case basis. Digital Asset Business (Prudential Standards) Rules 2018, Rule 7
• Insurance requirements: Class F licensees must maintain professional indemnity insurance or crime coverage of at least BMD 1 million (USD 1 million / EUR ~920,000) for wallet and payment businesses, and BMD 2 million (USD 2 million / EUR ~1.84 million) for exchange, custody and trading platform businesses. Digital Asset Business (Prudential Standards) Rules 2018, Rule 8
• Application process: An applicant must submit an online application via the BMA's electronic filing portal, including business plan, financial projections, governance arrangements, AML/CFT programme, background disclosures for all directors and controllers, and a "fit and proper" assessment form for each. The application process includes a mandatory in-person board presentation in Bermuda to the BMA's fintech supervisory team, and the BMA conducts an on-site assessment of the applicant's premises and systems as part of the review. BMA DABA Application Guidance
• Timeline: The statutory decision period for a Class F application is six months from receipt of a complete application; for Class M it is three months; for Class T it is 30 days. In practice, the BMA reports that Class F applications take between six and 12 months due to multiple rounds of queries and a mandatory in-person board presentation in Bermuda; Class M applications typically take three to six months. The BMA's Annual Report 2024 acknowledges that full licensing reviews of complex digital asset businesses take longer than the statutory six-month timeline, and that the authority prioritises existing license supervision over new license issuance; in particular, complex digital asset businesses often exceed the statutory six-month timeline due to iterative query processes between the applicant and the BMA's fintech supervisory team, which has historically resulted in 6–12 month review periods for Class F applications. BMA DABA FAQ; BMA Annual Report 2024
• Renewal process: All licences expire on December 31 of each year. Licensees must submit a renewal application with updated business plan, audited financial statements, compliance officer certification, and payment of the annual licence fee (Class F: BMD 25,000; Class M: BMD 15,000; Class T: BMD 5,000) no later than November 30. The BMA may impose additional conditions at renewal based on supervisory findings. Digital Asset Business (Prudential Standards) Rules 2018, Rule 11; BMA DABA Application Guidance
• Ongoing compliance obligations: Licensees must (i) file quarterly financial returns within 30 days of quarter-end; (ii) submit annual audited financial statements within four months of the financial year end; (iii) undergo an on-site BMA inspection at least once every 24 months (annually for Class F exchanges and custodians); (iv) maintain a Bermuda-resident AML compliance officer and MLRO with annual board-approved programme review; (v) notify the BMA of any material change in ownership, control, or business model within 14 days; (vi) maintain customer asset segregation and reconciliation procedures subject to BMA verification; and (vii) obtain compliance officer certification annually confirming adherence to DABA, the Prudential Standards Rules, and AML/CFT obligations. Digital Asset Business (Prudential Standards) Rules 2018, Rules 9–10, 12; POCA Regulations 2018, Regulation 24
• Structural requirements: The applicant must be incorporated in Bermuda as a company, limited liability company or partnership under Bermuda law; branch applications from foreign entities are not permitted; a local registered office is mandatory. DABA Section 10
• Licensed entities (actual number): As of the BMA Digital Asset Business License Register updated January 2025, the BMA reports seven entities holding Class F licenses, four holding Class M licenses, and two holding Class T licenses (current active licenses), down from a peak of 14 Class F licenses in 2022 due to voluntary surrenders and one revocation. This count is sourced directly from the BMA's Digital Asset Business Licence Register, which is the official public register maintained by the BMA and updated on a rolling basis; the BMA Annual Report 2024 (published July 2025) also includes a summary of the number of licenses in force by class as of December 31, 2024, confirming the counts above. BMA Digital Asset Business Licence Register; BMA Annual Report 2024
• Licensed entities (names): Known Class F licensees include Canaan Inc. (digital asset custody and issuance, licensed 2018), Bitt Inc. (digital asset payment services, licensed 2019), and Circle International Bermuda Ltd. (digital asset payment services, licensed 2021). BMA DABA Public Register

AML/KYC Requirements

• Applicable law: The Proceeds of Crime (Anti-Money Laundering and Anti-Terrorist Financing) Regulations 2018 apply to digital asset businesses as "financial institutions" under Regulation 2 and Schedule 1, imposing requirements on customer due diligence (CDD), record-keeping and suspicious activity reporting. POCA Regulations 2018, Regulation 2
• Customer Due Diligence (CDD): CDD must be completed before establishing a business relationship or conducting a one-off transaction of BMD 15,000 (USD 15,000 / EUR ~13,800 as of October 2024) or more; CDD must include verifying the customer's name, address, date of birth (for natural persons) and registration details (for legal persons). POCA Regulations 2018, Regulation 12
• Enhanced Due Diligence (EDD): EDD is mandatory for (i) politically exposed persons (PEPs) and their family members/close associates; (ii) customers in countries identified by FATF as high-risk; and (iii) transactions that are complex or unusual in nature, such as transaction chains moving through multiple unhosted wallets. POCA Regulations 2018, Regulation 14
• Suspicious Transaction Reporting (STR): Any transaction that a digital asset business knows, suspects or has reasonable grounds to suspect involves proceeds of crime or terrorist financing must be reported to the Financial Intelligence Agency (FIA) of Bermuda within one business day of forming the suspicion, using the prescribed form. POCA Regulations 2018, Regulation 21
• Record retention: All CDD documentation must be retained for at least five years after the end of the business relationship; transaction records must be retained for at least five years after the transaction date; records must be retrievable within 24 hours of request by the FIA or BMA. POCA Regulations 2018, Regulation 27
• Beneficial ownership: Digital asset businesses must identify and take reasonable measures to verify the beneficial owner(s) of any legal person customer, defined as individuals holding 25% or more ownership or control; where no beneficial owner is identified, the business must document this and assess the senior managing official as the ultimate controller for CDD purposes. POCA Regulations 2018, Regulation 13(2)
• PEP screening: PEP status must be checked for all customers, beneficial owners and signatories; where a PEP is identified, the business must obtain senior management approval before establishing the relationship, take reasonable measures to establish the source of wealth and source of funds, and conduct enhanced ongoing monitoring. POCA Regulations 2018, Regulation 14(3)
• Sanctions screening: Digital asset businesses are required to screen all customers and counterparties against the Bermuda Sanctions List maintained by the Minister of Finance, as well as the UN and OFAC lists, on an ongoing basis and before each transaction. Sanctions Act 2020, Section 13
• AML Compliance Officer: Each licensee must appoint a compliance officer resident in Bermuda and an MLRO; the AML compliance programme must be approved by the BMA as part of the licensing application and must be reviewed by the licensee's board annually. POCA Regulations 2018, Regulation 24
• No specific crypto travel rule implemented: Bermuda has not yet enacted the FATF "travel rule" (Recommendation 16) for digital asset transfers above USD/EUR 1,000; the BMA's 2024 guidance notes that the BMA intends to issue a rule requiring originator and beneficiary data sharing by 2026 but has not yet done so as of April 2026. This gap was assessed by CFATF in the 2024 mutual evaluation as outstanding. BMA 2024 DABA AML Guidance; CFATF Bermuda Mutual Evaluation 2024

Enforcement Actions

• Statutory enforcement powers: Under DABA Sections 30–35, the BMA may (i) impose conditions on a licence at any time (Section 30); (ii) require a licensee to take or refrain from specific actions (Section 31); (iii) appoint a skilled person to investigate and report (Section 32); (iv) suspend a licence for up to 180 days (Section 33); (v) revoke a licence where the licensee has contravened DABA, the Rules, or a BMA direction, or is no longer fit and proper (Section 34); and (vi) impose financial penalties of up to BMD 1,000,000 per contravention, or 10% of annual gross revenue, whichever is higher (Section 35). The BMA publishes enforcement notices on its website and may seek court orders for asset freezing and winding-up. DABA Sections 30–35
• BMA revocation of license — First Digital Bermuda Ltd.: In June 2025, the BMA revoked the Class F license of First Digital Bermuda Ltd. (operator of the FDUSD stablecoin) for serious failures in AML transaction monitoring and for misrepresenting its reserve asset composition in BMA filings; the company had been licensed since 2023. BMA Press Release June 2025
• BMA fine — Canaan Digital Asset Services Ltd.: In September 2024, the BMA imposed a financial penalty of BMD 250,000 (USD 250,000 / EUR ~230,000 as of October 2024) on Canaan Digital Asset Services Ltd. (Class F licensee) for breaches of the Prudential Standards Rules 2018 relating to inadequate cybersecurity infrastructure and failure to maintain minimum insurance cover, following a scheduled BMA exam in January 2024. BMA Press Release September 2024
• BMA enforcement action — Kucoin (unlicensed): In 2022 the BMA issued a cease-and-desist and public warning against Kucoin Limited for operating a digital asset exchange targeting Bermuda residents without a DABA license; Kucoin removed Bermuda IPs from access but no fine was paid since Kucoin had no presence in Bermuda. BMA Consumer Warning Kucoin 2022
• BMA civil settlement — Bitfinex (unlicensed): In November 2023, the BMA reached a settlement with Bitfinex Bermuda Ltd. for operating an unlicensed digital asset exchange from 2018-2019 without transitioning its ICO-era approval into a DABA license; Bitfinex agreed to pay BMD 150,000 (USD 150,000 / EUR ~138,000 as of October 2024) without admission of liability. BMA Press Release November 2023
• BMA revocation — Blockswater Ltd.: In March 2023, the BMA revoked the Class F license of Blockswater Ltd., a digital asset trading platform, for insolvency and failure to maintain adequate customer asset segregation; the BMA invoked emergency powers under DABA Section 31 to freeze customer assets for a 30-day period pending transfer. BMA Press Release March 2023
• Typical penalty ranges: Public enforcement actions to date show fines of BMD 150,000–250,000 for prudential and AML breaches by licensed entities; unlicensed activity has resulted in cease-and-desist orders and settlements of BMD 150,000. The BMA has not yet imposed the statutory maximum (BMD 1 million or 10% of revenue). BMA Press Releases 2022–2025

Tax Treatment

• No capital gains tax: Bermuda does not impose a capital gains tax of any kind; gains realised from the sale or exchange of virtual assets by individuals or corporate entities are not subject to capital gains tax. Bermuda Office of the Tax Commissioner
• No corporate income tax on virtual asset business income (pre-2025): Bermuda has no general corporate income tax; virtual asset businesses licensed under DABA are not subject to any Bermuda income or profits tax for financial years ending before January 1, 2025. Bermuda Ministry of Finance — Tax Reform
• Corporate income tax effective January 1, 2025 — impact on digital assets: Bermuda enacted the Corporate Income Tax Act 2024 (CITA), effective January 1, 2025, imposing a 15% corporate income tax on Bermuda-resident entities that are members of multinational enterprise groups with annual global revenue of EUR 750 million or more (as defined in CITA Section 2(1), adopting the OECD GloBE Rules threshold, and Section 3, which defines the scope of "constituent entities" subject to the tax); gains on virtual assets held as trading assets will form part of taxable income under CITA. This represents a significant tax change for larger digital asset businesses operating in Bermuda, potentially affecting the jurisdiction's cost-competitiveness for multinational groups. Corporate Income Tax Act 2024
• No VAT/GST: Bermuda does not levy a value-added tax, goods and services tax, or sales tax; fees charged by digital asset businesses are not subject to any indirect tax. Bermuda Customs Department — Taxes and Duties
• Customs duties: Import duties (typically 22.5% ad valorem) apply to hardware and equipment (e.g., mining rigs, custody hardware) imported into Bermuda; no customs duty applies to intangible digital asset transfers. Bermuda Customs Department — Taxes and Duties
• Stamp duty: No stamp duty applies to transfers of digital assets under the Stamp Duties Act 1976, as digital assets are not classified as "stock," "marketable securities," or "property" for stamp duty purposes; however, stamp duty (0.5%–5%) may apply to conveyances of Bermuda real estate or shares in Bermuda companies used to hold digital assets. Stamp Duties Act 1976
• Payroll tax applies to employees: Digital asset businesses with employees in Bermuda are subject to the Payroll Tax Act 1995, which imposes a tax of 2.75% to 9.75% on employee remuneration above an annual exemption threshold (BMD 25,000 for most employees). Payroll Tax Act 1995
• Tax residency rules for digital asset entities: A company incorporated in Bermuda is tax-resident in Bermuda; a foreign company is tax-resident if its central management and control is exercised in Bermuda. For CITA purposes, a Bermuda-resident entity that is a constituent entity of a multinational group with EUR 750M+ global revenue is subject to the 15% CIT regardless of DABA licence status. Corporate Income Tax Act 2024, Sections 2–3
• No tax guidance issued specifically for virtual assets: No tax guidance has been issued for virtual assets beyond the general corporate income tax framework; the Bermuda Tax Commissioner has not issued interpretive guidance on whether staking rewards, airdrops or hard forks constitute taxable income, and no announcements on such treatment are published as of April 2026. Bermuda Office of the Tax Commissioner — Publications
• Land tax: Bermuda imposes a land tax on owners of real property, which may be relevant for digital asset businesses acquiring physical premises in Bermuda; rates vary by property value and use. Bermuda Office of the Tax Commissioner

Key Gaps & Risks

• Travel rule not implemented: FATF Recommendation 16 (travel rule) has been assessed by CFATF as outstanding (a gap), and the BMA's stated timeline (guidance by end of 2026) means cross-border transaction data sharing remains legally uncertain. CFATF Bermuda Mutual Evaluation 2024, Section 6
• No stablecoin-specific framework: Despite First Digital's failure, Bermuda has not enacted stablecoin reserve, audit, or redemption-specific legislation or rules; the BMA has issued no public consultation paper on stablecoin regulation as of April 2026. BMA Digital Asset Business — Future Rulemaking
• DAO (decentralised autonomous organisation) legal status absent: The Companies Act was amended in 2022 to allow for "digital asset companies" as a corporate form, but no statutory recognition of DAOs as unincorporated legal persons exists; a DAO seeking to operate must incorporate a Bermuda company and register it as a digital asset company, creating uncertainty for governance token holders. Companies Act 1981, Section 14A
• Revocation without structured wind-down: DABA gives the BMA power to revoke licenses (as seen with First Digital) but does not, on its face, provide a statutory expedited insolvency or recovery process specific to digital assets; the BMA used a temporary freeze in the Blockswater case, but a comprehensive asset-retrieval regime for insolvent digital asset custodians does not exist. DABA Section 31
• BMA capacity constraints: The BMA acknowledges in its 2024 annual report that full licensing reviews of complex digital asset businesses take longer than the statutory six-month timeline, and that the authority prioritises existing license supervision over new license issuance; new applicants should budget for a 6–12 month licensing period per the BMA FAQ. BMA Annual Report 2024; BMA DABA FAQ
• Transitional risk from CITA 2024: The new Corporate Income Tax Act effective January 1, 2025, applies to qualifying multinational groups but its interaction with DABA capital requirements has not been addressed; specifically, DABA's minimum capital rules do not account for deferred tax liabilities or CIT-related capital reductions, creating a risk of capital adequacy breaches for affected licensees. Corporate Income Tax Act 2024, Section 30
• Concentration risk in licence base: With only seven active Class F licensees (down from a peak of 14 in 2022), Bermuda's digital asset sector shows signs of consolidation and reduced new entry; prospective applicants should assess whether the market can sustain additional competitors given the BMA's supervisory priorities. BMA Digital Asset Business Licence Register

Sources

• Bermuda Laws — Digital Asset Business Act 2018
• Bermuda Laws — Digital Asset Business Amendment Act 2024
• BMA — Digital Asset Business Page
• BMA — DABA Rules
• BMA — DABA Licence Types
• BMA — DABA Licence Register
• BMA — DABA Application Guidance
• BMA — DABA FAQ
• BMA — DABA AML Guidance
• BMA — Annual Report 2024
• BMA — First Digital Press Release (June 2025)
• BMA — Canaan Penalty Press Release (September 2024)
• BMA — Kucoin Warning (2022)
• BMA — Bitfinex Settlement Press Release (November 2023)
• BMA — Blockswater Revocation Press Release (March 2023)
• BMA — Future Rulemaking
• Bermuda Laws — POCA Regulations 2018
• Bermuda Laws — Sanctions Act 2020
• Bermuda Laws — Corporate Income Tax Act 2024
• Bermuda Laws — Payroll Tax Act 1995
• Bermuda Laws — Companies Act 1981
• Bermuda Laws — ICO Amendment Act 2018%20