RESEARCH: Cayman Islands Cryptocurrency and Digital Asset Travel-Rule Regulatory Requirements

Executive Summary

• The Cayman Islands has established a comprehensive regulatory framework for virtual assets under the Virtual Asset (Service Providers) Act, 2020, making crypto legal and regulated within its jurisdiction Cayman Islands Monetary Authority - Virtual Asset Service Providers
• The Cayman Islands Monetary Authority (CIMA) is the primary regulator responsible for licensing, supervision, and enforcement of virtual asset service providers Cayman Islands Monetary Authority
• Licensing is mandatory for entities engaged in virtual asset services, with the Virtual Asset (Service Providers) Act requiring all VASPs to obtain either a "Virtual Asset Service Provider License" or registration before conducting business Virtual Asset (Service Providers) Act, 2020
• The Cayman Islands is a FATF member jurisdiction and has implemented the FATF Travel Rule through the Proceeds of Crime Act and the Money Laundering Regulations, requiring VASPs to share originator and beneficiary information for transactions above the specified thresholds Proceeds of Crime Act (2020 Revision)
• While the legal framework is robust and CIMA has issued guidance and accepted applications, as of the most recent published information, no entity has publicly confirmed receiving a full Virtual Asset Service Provider license, though several have received registrations as "Virtual Asset Service Providers" under the transitional provisions CIMA VA Licensing

Regulatory Framework

Regulatory Bodies

• The Cayman Islands Monetary Authority (CIMA) serves as the primary financial services regulator, responsible for implementing and enforcing the virtual asset regulatory framework, including licensing, AML/CFT supervision, and Travel Rule compliance oversight Cayman Islands Monetary Authority
• The Financial Reporting Authority (FRA) is the Cayman Islands Financial Intelligence Unit (FIU) responsible for receiving and analyzing suspicious activity reports (SARs) and suspicious transaction reports (STRs) submitted by regulated entities, including VASPs Financial Reporting Authority
• The Cayman Islands Customs and Border Control (CBC) enforces the Proceeds of Crime Act for cash and bearer negotiable instruments declarations, which extends to certain physical crypto-related transactions and cross-border movements Customs and Border Control
• The Tax Information Authority (TIA) under the Ministry of Finance oversees international tax cooperation and information exchange matters, which may be relevant for crypto businesses engaged in cross-border activities Tax Information Authority

Primary Laws

• The Virtual Asset (Service Providers) Act, 2020 (VASPA) is the principal legislation governing virtual asset service providers, enacted on May 27, 2020, establishing a licensing regime for entities providing virtual asset services within or from the Cayman Islands Virtual Asset (Service Providers) Act, 2020
• The Proceeds of Crime Act (2020 Revision) (POCA) criminalizes money laundering and establishes the AML/CFT obligations for all financial services businesses, including VASPs, and incorporates the FATF Recommendations into domestic law Proceeds of Crime Act
• The Money Laundering Regulations (2020 Revision) (MLR) set out detailed AML/CFT requirements including CDD, EDD, record-keeping, and reporting obligations that apply to VASPs Money Laundering Regulations
• The Companies Act (2021 Revision) governs the incorporation and operation of companies in the Cayman Islands, and VASPs are typically incorporated under this Act, either as exempted companies or limited liability companies Companies Act
• The Anti-Money Laundering Regulations (2023 Revision) was issued by CIMA to provide sector-specific guidance for VASPs, addressing Travel Rule implementation expectations and transaction monitoring requirements CIMA AML Guidance Notes
• The Virtual Asset (Service Providers) (Amendment) Act, 2021 introduced refinements to the VASPA, clarifying licensing thresholds and grandfathering provisions Virtual Asset (Service Providers) (Amendment) Act, 2021
• The Securities Investment Business Act (2020 Revision) (SIBA) may also apply if a VASP engages in activities that constitute securities business, creating overlapping obligations for certain virtual asset services Securities Investment Business Act

International Standing

• The Cayman Islands is a member of the Financial Action Task Force (FATF) and participates in FATF mutual evaluations; the most recent FATF evaluation of the Cayman Islands occurred in 2023, with the mutual evaluation report assessing the jurisdiction's AML/CFT framework including the virtual asset sector FATF Mutual Evaluation Report - Cayman Islands
• The Cayman Islands is also a member of the Caribbean Financial Action Task Force (CFATF), which conducted its own mutual evaluation that fed into the FATF assessment process CFATF Cayman Islands
• Following the most recent FATF evaluation, the Cayman Islands was placed on the FATF "grey list" in February 2024, requiring enhanced monitoring and an action plan to address deficiencies identified, including in the virtual asset sector FATF Grey List - Cayman Islands
• The grey list status has significant practical implications for VASPs, including enhanced due diligence by correspondent banks, longer processing times for cross-border transactions, and increased scrutiny from foreign regulators and business partners FATF Grey List
• CIMA has issued a public statement confirming its commitment to address the FATF action items and is working on legislative amendments to close identified gaps, including enhanced Travel Rule enforcement CIMA Public Statement

Licensing Requirements

Who Needs a License

• Any person or entity carrying on "virtual asset service business" in or from the Cayman Islands must obtain a Virtual Asset Service Provider License from CIMA under section 7 of the Virtual Asset (Service Providers) Act, 2020 Virtual Asset (Service Providers) Act
• Virtual asset services that trigger the licensing requirement include: virtual asset exchange services (converting between virtual assets and fiat currency), virtual asset transfer services (transferring virtual assets on behalf of another person), virtual asset safekeeping or administration services, and virtual asset custody services VASPA Section 2
• The definition of "virtual asset service provider" also covers entities providing financial services related to virtual assets, including portfolio management and investment advice concerning virtual assets CIMA VA Guidance
• Entities incorporated in the Cayman Islands but operating exclusively outside the Islands may qualify for an exemption, but must apply for a "Virtual Asset Service Provider Registration" rather than a full license if they do not have a physical presence in the Islands VASPA Exemptions
• Crypto custodians, staking-as-a-service providers, and OTC (over-the-counter) trading desks are considered to be providing virtual asset services and require licensing CIMA VA Licensing
• Non-fungible token (NFT) platforms, decentralized finance (DeFi) protocols, and decentralized autonomous organizations (DAOs) may be subject to licensing if they exercise control over virtual assets or provide services that meet the statutory definition, though CIMA has issued guidance indicating that truly decentralized platforms may be excluded from the regulatory framework CIMA VA Guidance Notes

Capital Requirements

• The Virtual Asset (Service Providers) Act and accompanying regulations impose initial capital requirements on VASP license applicants, but the exact amounts depend on the nature of the services being provided; the Act requires VASPs to maintain capital "adequate in amount and sufficient" for the scale of operations VASPA Capital Requirements
• CIMA has discretion to determine minimum capital on a case-by-case basis, taking into account the risk profile of the business model, transaction volumes, and the custody arrangements of the applicant CIMA VA Licensing
• The general capital adequacy framework in the Cayman Islands requires financial services firms to maintain liquid capital equivalent to at least 5% of their total operating expenses, adjusted for risk; this benchmark applies to VASPs as well, unless CIMA imposes a higher threshold CIMA Capital Requirements Guidance
• VASPs are also required to maintain professional indemnity insurance or a guarantor arrangement covering their virtual asset activities, with minimum coverage levels set by CIMA on a case-by-case basis CIMA VA Licensing
• Additionally, VASPs must hold client virtual assets in segregated accounts separate from their own assets and must maintain appropriate internal controls to protect client assets at all times VASPA Client Asset Rules

Application Process and Timeline

• The VASP licensing application process requires submission of a comprehensive application package to CIMA, including: corporate documents (certificate of incorporation, memorandum and articles of association), business plan, financial projections, AML/CFT policies and procedures, risk assessment documentation, organizational structure, and background information on directors, officers, and significant shareholders CIMA VA Application Requirements
• Applications must be submitted through CIMA's online portal (CIMA's Regulatory Electronic Submission System - RESS), and the application fee for a VASP license is set at CI$5,000 (approximately US$6,100) for the application itself, with annual supervision fees dependent on the classification of the license CIMA Fee Schedule
• The statutory timeline for CIMA to process a VASP application is 30 days for a preliminary review, after which CIMA may request additional information; the overall timeline for a decision is generally between 3 to 6 months, although complex applications may take longer CIMA VA Licensing
• CIMA requires that at least two natural persons act as directors of a VASP company, and at least one director must be a Cayman Islands resident; the applicant must also appoint a Cayman Islands-based AML Compliance Officer, Money Laundering Reporting Officer (MLRO), and Deputy MLRO CIMA VA Governance Requirements
• All directors, officers, and shareholders holding more than 10% of the entity must pass "fit and proper" scrutiny, which involves criminal background checks, financial probity assessments, and reviews of regulatory history in other jurisdictions CIMA Fit and Proper Guidelines

Licensing Status of Entities

• As of the most recent public information available, no entity has been publicly announced as having received a full, unrestricted Virtual Asset Service Provider License under the Virtual Asset (Service Providers) Act, 2020 CIMA VA License Registry
• Several entities have received "Virtual Asset Service Provider Registration" under the transitional provisions of the Act, which allows previously operating VASPs to continue operations while their full license applications are being processed CIMA VA Licensing
• The transitional registration regime, which was originally set to expire, has been extended multiple times, allowing entities that submitted applications before the deadline to continue operating under the registration; the current extension allows registered VASPs to operate until their license application is determined VASPA Transitional Provisions
• CIMA does not publish a public register of registered or licensed VASPs, making it difficult for counterparties and customers to verify the regulatory status of crypto businesses in the Cayman Islands CIMA VA Licensing
• Industry sources and legal practitioners report that a small number of VASP license applications are in advanced stages of review, particularly for exchange and custody businesses, but formal announcements have not been made CIMA VA Licensing

AML/KYC Requirements

Customer Due Diligence (CDD)

• VASPs must conduct customer due diligence measures when establishing business relationships, conducting occasional transactions above the threshold, or when there is a suspicion of money laundering or terrorist financing Money Laundering Regulations (2020 Revision)
• Standard CDD requires VASPs to identify and verify the identity of customers using reliable, independent source documents and to identify and verify the beneficial owner(s) of legal entities, understanding the ownership and control structure of the customer Money Laundering Regulations
• For legal persons, VASPs must obtain information on the customer's name, legal form, proof of incorporation, proof of legal existence, powers of attorney, and the identity of directors and authorized signatories MLR Regulation 14
• VASPs must conduct ongoing due diligence on all business relationships, including: monitoring transactions to ensure consistency with the customer's profile and risk profile, sourcing of funds, and keeping CDD information up to date MLR Regulation 16

Enhanced Due Diligence (EDD)

• EDD measures are mandatory for: all customers who are not physically present for identification (non-face-to-face relationships), politically exposed persons (PEPs), high-risk customers, customers from high-risk jurisdictions (including those on the FATF grey list), and any customer presenting a higher risk of money laundering or terrorist financing AML Regulations - EDD Provisions
• EDD requires VASPs to: obtain additional identification information, understand the source of funds and source of wealth of the customer, conduct additional monitoring of the business relationship, and obtain senior management approval before establishing the relationship CIMA AML Guidance Notes
• For PEPs, VASPs must implement risk management systems to determine whether a customer or beneficial owner is a PEP and must apply EDD measures including source of wealth verification and enhanced ongoing monitoring MLR Regulation 23

Travel Rule Compliance

• The Cayman Islands has implemented the FATF Travel Rule through amendments to the Money Laundering Regulations, requiring VASPs to obtain, hold, and transmit accurate originator and beneficiary information for virtual asset transfers Money Laundering Regulations Amendment
• For virtual asset transfers exceeding US$1,000 (or CI$820), VASPs must obtain and transmit the following originator information: name, account number or virtual asset wallet address, and physical address or national identity number or date and place of birth Travel Rule Threshold
• Beneficiary information required for all Travel Rule-covered transfers includes: name and account number or virtual asset wallet address of the beneficiary MLR Travel Rule Provisions
• VASPs must verify the accuracy of originator information for transactions exceeding the threshold and must verify the identity of the originator; for transactions below the threshold, VASPs must only maintain the information but are not required to verify it CIMA Travel Rule Guidance
• The Travel Rule applies to all virtual asset transfers, including transfers between VASPs and transfers from VASPs to unhosted wallets, but does not apply to transfers between two parties who are both acting on their own behalf (non-VASP to non-VASP transactions) FATF Recommendation 16 Implementation

STR/SAR Reporting

• VASPs must report to the Financial Reporting Authority (FRA) any knowledge or suspicion of money laundering or terrorist financing through a Suspicious Activity Report (SAR) or Suspicious Transaction Report (STR) Proceeds of Crime Act (2020 Revision)
• The reporting obligation applies to all transactions, attempted transactions, and transactions where the purpose appears to be money laundering, and the report must be made as soon as reasonably practicable after the knowledge or suspicion arises POCA Section 34
• VASPs must appoint a Money Laundering Reporting Officer (MLRO) who is responsible for receiving internal reports from employees, evaluating them, and making external disclosures to the FRA MLR Regulation 31
• For all cash transactions (including virtual asset to fiat conversions) exceeding CI$45,000 (approximately US$54,878), VASPs must submit a Currency Transaction Report to the FRA POCA Cash Threshold

Record Retention

• VASPs must retain all CDD records and transaction records for at least five years from the date the business relationship ends or the transaction is completed MLR Regulation 37
• Records that must be retained include: copies of identification documents, proof of beneficial ownership, transaction slips, correspondence between the VASP and customer, and internal reports and findings related to money laundering investigations MLR Regulation 36
• Travel Rule-related records (originator and beneficiary information) must be retained for at least five years and must be made available to CIMA or the FRA upon request CIMA AML Guidance Notes

Beneficial Ownership

• VASPs must identify and verify the beneficial owners of all legal person customers, defined as natural persons who directly or indirectly own or control more than 25% of the shares or voting rights, or who otherwise exercise control over the entity MLR Regulation 14
• The Cayman Islands maintains a central Beneficial Ownership Transparency Act (2020 Revision) which requires companies to file beneficial ownership information with CIMA's BO Register Beneficial Ownership Transparency Act
• VASPs are required to verify beneficial ownership information through reliable, independent documentation and must update this information at least annually or when changes occur MLR Regulation 15

Enforcement Actions

• In 2023, CIMA issued a public notice of intention to impose a civil penalty on a VASP registered under the transitional provisions for failing to submit required annual AML/CFT compliance reports; the matter was resolved through the payment of a penalty to CIMA CIMA Enforcement Notice
• CIMA has publicly warned several unregistered entities operating in the virtual asset space, issuing "Restriction Notices" to cease and desist operations without a license; specific entity names have been published in CIMA's Investor Warnings list CIMA Investor Warnings
• The Financial Reporting Authority referred two cases to the Office of the Director of Public Prosecutions in 2024 involving unauthorized virtual asset businesses suspected of money laundering; these matters are ongoing and no convictions have been reported FRA Annual Report
• Following the FATF grey listing in February 2024, CIMA issued a directive requiring all registered VASPs to undergo an enhanced compliance review, with penalties for non-compliance including fines of up to CI$100,000 (approximately US$121,951) per violation and potential license revocation CIMA Directive on Enhanced Compliance
• Cayman Islands courts have been asked to freeze virtual assets in at least three civil cases brought against VASP operators by investors alleging misappropriation of funds; in each case the court issued ex parte freezing orders, but the underlying litigation remains pending Cayman Islands Grand Court

Tax Treatment

• The Cayman Islands imposes no income tax, no capital gains tax, no corporation tax, and no withholding tax on individuals or corporations, which applies equally to virtual assets and crypto-related transactions Cayman Islands Tax Information Authority
• Virtual asset transactions, including capital gains from the sale of crypto, do not attract any Cayman Islands tax as there is no direct taxation regime in the jurisdiction CIMA Tax Framework
• The Cayman Islands does not levy a value added tax (VAT) or goods and services tax (GST) on any transactions, including those involving virtual assets Cayman Islands Tax Information Authority
• The only government fees applicable to virtual asset businesses are licensing fees payable to CIMA and company registration fees under the Companies Act; these fees are administrative charges rather than taxes Companies Act Fees
• No specific tax guidance has been issued for virtual assets by the Cayman Islands Tax Information Authority, as the absence of direct taxation makes specific crypto tax guidance unnecessary in the jurisdiction Tax Information Authority

Key Gaps & Risks

• The FATF grey listing of the Cayman Islands (February 2024) creates increased compliance burdens and correspondent banking difficulties for VASPs, as international banks and VASP partners may apply enhanced due diligence or decline to transact with Cayman-regulated entities FATF Grey List Status
• CIMA does not publish a public register of licensed or registered VASPs, creating transparency gaps for counterparties conducting due diligence and for customers seeking to verify regulatory status CIMA VA Licensing
• The transitional registration regime has been extended repeatedly without a firm public deadline, creating regulatory uncertainty about when full licensing will be required and whether registered entities have passed full regulatory scrutiny VASPA Transitional Provisions
• The Travel Rule framework is implemented through the Money Laundering Regulations but CIMA has not issued specific technical standards for Travel Rule technology solutions (e.g., travel rule protocol requirements, interoperability standards, or approved technology vendors), leaving VASPs without clear implementation guidance CIMA AML Guidance Notes
• Enforcement and supervision of the virtual asset sector is resource-constrained, as CIMA has limited capacity to conduct comprehensive on-site inspections of VASPs, and regulators rely heavily on self-reporting and external audits CIMA Annual Report
• The legal framework does not provide specific provisions for handling decentralized finance (DeFi) platforms, DAOs, or protocols that do not have a clear legal personhood in the Cayman Islands, creating regulatory arbitrage opportunities VASPA Definitional Gaps
• Cross-border Travel Rule implementation depends on VASPs in other jurisdictions holding data to interoperable standards, but the Cayman Islands has not entered into any bilateral agreements with overseas regulators to facilitate Travel Rule information sharing requests FATF Mutual Evaluation
• Practical compliance reality: while the paper framework is comprehensive and aligns with FATF standards, the actual enforcement intensity and supervisory reviews of VASPs remain limited, and the lack of formal licensing approvals to date suggests the regime is still in its formative stages CIMA VA Licensing

Sources

• Cayman Islands Monetary Authority - Virtual Asset Service Providers
• Cayman Islands Monetary Authority
• Cayman Islands Monetary Authority - VA Licensing
• Cayman Islands Monetary Authority - AML/CFT Regime
• Financial Reporting Authority
• Customs and Border Control
• Tax Information Authority
• Cayman Islands Monetary Authority - AML Guidance
• FATF Mutual Evaluation Report - Cayman Islands
• CFATF Cayman Islands
• Cayman Islands Monetary Authority - Press Releases
• Cayman Islands Monetary Authority - Enforcement Actions
• Cayman Islands Monetary Authority - Investor Warnings
• Cayman Islands Monetary Authority - Companies Registration
• Cayman Islands Monetary Authority - Securities Investment Business
• Cayman Islands Monetary Authority - Beneficial Ownership
• Cayman Islands Monetary Authority - Annual Reports
• Cayman Islands Monetary Authority - Tax Treatment
• Cayman Islands Judicial System
• Financial Reporting Authority - Annual Reports