Cayman Islands

The Cayman Islands Virtual Asset (Service Providers) Act (as revised) (the “VASP Act”) implements the Financial Action Task Force (FATF) guidance definition of a “virtual asset” into Cayman Islands law as “a digital representation of value that can be digitally traded or transferred and can be used for payment or investment purposes but does not include a digital representation of fiat currencies”.

This definition is broad and primarily focuses on transferability and exchangeability. According to the FATF guidance, the definitions of virtual asset and VASP are intended to capture specific financial activities and functions (i.e. transfer, exchange, safekeeping and administration, issuance, etc.) and assets that are fungible, whether virtual-to-virtual or virtual-to-fiat.

Any token technically capable of transfer or exchange is a virtual asset under the Cayman VASP Act, regardless of programmed properties or intended use. No distinction is currently made between what are commonly known as utility tokens, security tokens and stablecoins (such as USDC).

Subject to any further guidance from the Cayman Islands Monetary Authority (CIMA), the term “digital representations of fiat currencies” is likely only intended to cover central bank digital currencies. For example, in our view, the Tether token is a virtual asset under the Cayman VASP Act because it is backed by redeemable U.S. dollar reserves held by the Tether company, rather than being a digital representation of the U.S. dollar itself.

A “virtual asset” is contrasted in the Cayman VASP Act with the definition of a “virtual service token”, which is defined as “a digital representation of value which is not transferrable or exchangeable with a third party at any time and includes digital tokens whose sole function is to provide access to an application or service or to provide a service or function directly to its owner”.

The primary statutory framework is the VASP Act and its supporting regulations and regulatory rules and guidance issued by CIMA. Depending on structure and activity of an entity’s activities, other key frameworks include:

• the Securities Investment Business Act (SIBA) for securities and investment business;
• the Mutual Funds Act and the Private Funds Act for open‑ended and closed‑ended investment funds, including certain tokenised funds;
• the Anti‑Money Laundering Regulations and related guidance;
• sanctions and financial crime legislation; and
• general companies, partnerships and insolvency legislation.

CIMA is the principal regulator for virtual asset service providers (VASPs) and other regulated financial services. Sanctions compliance follows UK sanctions extended to the Cayman Islands.

Regulation follows the activity and the legal character of the token and entity’s activities. Payment and exchange tokens typically fall within the “virtual asset” definition and businesses providing exchange, transfer, custody or similar services in or from the Cayman Islands must register or be licensed under the VASP Act depending on the exact nature of the proposed activities. “Security tokens” that confer equity, debt or profit‑sharing rights may constitute “securities” under SIBA and dealing, arranging or advising in relation to such tokens may require SIBA licensing or registration, in addition to, or instead of, VASP registration or licensing. Stablecoins are generally treated as virtual assets and fiat‑backed models do not themselves constitute fiat currency under Cayman law. NFTs used solely as digital collectibles may fall outside financial regulation but may be “virtual assets” if used as a means of payment/investment. Utility tokens used purely to access a network feature may be unregulated, but if they are traded for investment or used in the course of broader financial services offerings they can trigger registration or licensing under the VASP Act. The analysis is fact‑specific and may engage more than one Cayman Islands statutory regime.

Yes, the VASP Act establishes a registration and licensing regime for entities providing “virtual asset services” in or from the Cayman Islands, including:

• operating a virtual asset exchange;
• transferring virtual assets on behalf of another person;
• custody or safekeeping services; and
• participating in or providing financial services related to an issuer’s sale of a virtual asset (including certain initial offerings).

Depending on the activity, a VASP must register or obtain a licence from CIMA. Applicants must typically demonstrate fitness and propriety of controllers and senior personnel, robust anti-money laundering and counter-terrorist financing (AML/CFT) systems, governance and risk management, technology and cybersecurity controls, client asset arrangements, and, where relevant, market conduct and disclosures. Issuers conducting a virtual asset issuance to the public from the Cayman Islands may need to register that issuance with CIMA and comply with disclosure and conduct standards. Timeframes and process depend on the complexity of the business and CIMA’s review, and CIMA may impose bespoke conditions.

There is no stand‑alone “financial promotions” regime equivalent to certain onshore markets, but promotions by Cayman VASPs are subject to the VASP Act’s market conduct requirements and CIMA’s rules and guidance on disclosures, fair, clear and not misleading communications, and suitability where relevant. If the cryptoasset constitutes a security or a fund interest, securities and funds laws apply to marketing, including offering document standards and investor qualification where required. Anti‑fraud, AML/CFT and sanctions laws also apply to promotional activity. Cayman law does not prescribe influencer‑specific rules, but VASPs are responsible for their agents’ communications and must ensure compliance with applicable standards.

Providing virtual asset custody or safekeeping services in or from the Cayman Islands is a regulated “virtual asset service” and requires registration and potentially licensing (depending on the exact nature and characteristics of the activity) under the VASP Act. CIMA’s framework addresses governance, operational resilience, cybersecurity, wallet management, key/seed management, segregation of client assets and record‑keeping. Client assets must be appropriately segregated from the custodian’s own assets with clear books and records and reconciliations. Prudential and insurance expectations may apply based on the risk profile, and CIMA may set bespoke conditions. Where the custodied asset is a security token, SIBA requirements may be triggered in parallel. Contractual terms should clearly address title, control, loss allocation, forks/airdrops and staking/use of assets.

VASPs and other financial services providers are “relevant financial businesses” under the Cayman Islands Anti‑Money Laundering Regulations and must implement risk‑based AML/CFT/CPF (countering proliferation financing) programs, including customer due diligence (CDD/Know Your Customer (KYC)), beneficial ownership verification, ongoing monitoring, transaction screening, suspicious activity reporting, record‑keeping and independent audit. Cayman has implemented the FATF “travel rule” expectations for virtual asset transfers and VASPs must obtain, hold and transmit required originator and beneficiary information when transferring virtual assets above applicable thresholds, and adopt risk‑based measures for counterparty due diligence, unhosted wallets and cross‑border transfers. VASPs must maintain sanctions screening processes aligned with UK/Cayman sanctions. Outsourcing is generally permitted subject to oversight and access requirements.

Cayman courts and authorities treat cryptoassets, as a matter of principle consistent with common law, as a form of property capable of being owned, assigned and held on trust. Title and control are typically evidenced by control over the relevant private keys or contractual rights against a custodian. Distinctions between legal and beneficial ownership can arise in custodial and trust arrangements, and segregation and trust language are important to preserve client entitlements. Security interests may be taken over cryptoassets by contract and perfected by control and notice, though structuring and governing law require careful analysis. Transferability, pledges and set‑off are largely questions of contract and property law applied to the digital context. Operators of a virtual asset trading platform (VATP) must now hold a VASP licence before commencing business. Over-the-counter (OTC) brokers and other intermediaries that facilitate exchanges or transfers but do not take custody may, subject to an analysis of the exact nature of the relevant control and funds flow mechanics, be able to operate on a registration-only basis. Likewise, providers of virtual asset custody services (including wallet providers that hold or can exercise control over clients’ private keys) require a VASP licence.

DAO-adjacent Cayman vehicles are often used to support a DAO’s objects and purposes. Most frequently, a memberless Cayman Islands foundation company or a Cayman exempted company is used to achieve these supportive purposes. A Cayman entity can assist in separating governance from the DAO’s economic and commercial interests and can support protocol-level governance in certain scenarios. Cayman Islands legislation does not, at present, provide a framework for limiting DAO member liability, however as the Cayman entity’s legal personality, governance and oversight is distinct from the DAO and its members, including often by appointing an independent board and supervisor(s), DAO members are afforded a level of protection from liabilities incurred by the Cayman entity itself. DAO members and tokenholders should be mindful of the Cayman Islands Beneficial Ownership Transparency Act, which requires any individual or entity with the right to exercise effective control over a Cayman entity’s affairs to be identified and recorded on the entity’s register of beneficial owners. In this context, DAOs and projects should take particular care when assessing and structuring any level of DAO control, governance, or influence over the Cayman entity’s activities. Absent a DAO-adjacent legal entity, a DAO risks being characterised as an unincorporated association or partnership, with potential member liability. If a DAO-adjacent Cayman entity conducts virtual asset services in or from the Cayman Islands, VASP registration or licensing may be required, as noted above.

There is no crypto-specific insolvency regime in the Cayman Islands. Insolvency and restructuring are governed primarily by the Companies Act (as revised) and the Companies Winding Up Rules (as revised). Cryptoassets are generally treated as property (a form of asset) of the relevant person — either the company or its clients — depending on the legal and custodial arrangements and the contractual terms. Where client assets are held on trust or properly segregated, they will typically be excluded from the insolvent estate; otherwise, entitlement may depend on tracing and proprietary claims and the construction of the relevant governing terms. Liquidators may seek freezing (Mareva) and proprietary injunctions, and disclosure orders (including Norwich Pharmacal and Bankers Trust relief), and may apply for recognition/assistance in relevant foreign courts. They may dispose of cryptoassets to realise value, subject to appropriate safeguards, valuation, market conduct considerations and, where appropriate, directions from the Cayman court. The appointment of a restructuring officer under the Companies Act creates a moratorium that can protect a company while a restructuring is pursued; this is not a liquidation but may be relevant for distressed crypto businesses. Secured creditors’ rights are generally unaffected by the commencement of a Cayman liquidation; enforcement turns on proper creation and perfection of the relevant security interests and the terms governing custody/control of the assets. Set off, netting and close out under financial contracts are recognised under Cayman law when properly documented.

Whether a smart contract is an enforceable contract will depend on an analysis of the ordinary elements of contract formation including offer, acceptance, consideration, intention to create legal relations, and certainty. The Electronic Transactions Act confirms that contracts, records and signatures are not denied legal effect merely because they are in electronic form, and “writing” and “signature” formalities can generally be satisfied electronically. There is no Cayman case law directly on smart contract enforceability, however any English common law authorities are likely to be persuasive on a Cayman court. To the extent there is any ambiguity, best practice is for a written agreement to be entered into by the relevant parties.

Victims can pursue civil claims for deceit, unlawful means conspiracy, unjust enrichment, knowing receipt, dishonest assistance, proprietary and tracing claims (including constructive trust), and seek interim relief such as worldwide freezing orders (Mareva, including Chabra relief), proprietary injunctions and disclosure orders (including Norwich Pharmacal and Bankers Trust orders) against exchanges, custodians and other third parties to identify wrongdoers and trace assets. Cayman courts have shown willingness, consistent with common law, to treat crypto as property, to order service by alternative means (including electronic means) and to grant urgent interim relief (including in support of foreign proceedings under statutory powers). Claims may be served out with permission where a service out gateway is satisfied, and the Cayman Islands are the proper forum. Final judgments of the Cayman courts can be enforced against assets within the jurisdiction. Foreign judgments are generally enforced at common law by bringing an action on the judgment (there is no general statutory registration regime currently in force), typically where the judgment is final and conclusive, for a definite sum, from a court of competent jurisdiction, and no common law defences apply.

The Cayman Islands does not impose income, corporation, capital gains or withholding taxes. Accordingly, gains or income from cryptoassets are not taxed in Cayman. Stamp duty may apply to transfers of Cayman real property and certain instruments, but not generally to crypto transactions. Import duties can apply to physical goods (e.g. hardware). Cayman entities often obtain tax exemption undertakings for certainty. Reporting and taxation in other jurisdictions relevant to investors, managers or users may apply independently and should be considered on a cross‑border basis.

The Cayman Islands Data Protection Act establishes a comprehensive, General Data Protection Regulation (GDPR)‑inspired regime governing personal data processing by controllers and processors established in the Cayman Islands. VASPs and financial services entities must comply with data protection principles, fair processing, purpose limitation, data minimisation, security, data subject rights, cross‑border transfer restrictions and breach notification to the Ombudsman and, where appropriate, to affected individuals. CIMA has issued rules and statements of guidance on cybersecurity and operational resilience for regulated entities, covering governance, risk assessment, access controls, incident response, business continuity, third‑party risk, testing and reporting. VASPs should align technology controls with these expectations and record compliance.

There is no DeFi‑specific statute under Cayman Islands laws and regulations. Staking and yield products are analysed under existing Cayman regimes noted above. A provider offering staking‑as‑a‑service, liquidity provision, or yield products in or from the Cayman Islands may be carrying on a “virtual asset service” (e.g. transfer, custody or financial services related to an issuer’s sale) and require VASP registration or licensing. Where products involve pooling of assets with discretionary management for return, licensing and registration under Cayman funds laws and regulations (i.e. Mutual Funds Act/Private Funds Act) should be considered. Where rights resemble debt, profit participation or derivatives, SIBA may apply. Self-custody or purely protocol‑level activities without a Cayman nexus generally fall outside Cayman regulation, but marketing, governance and developer involvement can create a nexus and should be assessed on a case-by-case basis.

CIMA continues to refine the VASP framework, including supervisory rules, travel rule expectations and sectoral guidance. Market participants should monitor CIMA publications, amendments to the VASP Act and regulations, evolving AML guidance, and any cross‑regime updates affecting tokenised funds, custody and market conduct. Broader initiatives on cybersecurity and operational resilience for regulated entities are also relevant to VASPs. Cayman policy remains aligned with FATF standards and international supervisory developments.