Cayman Islands: Chambers Global Practice Guide 2021: Fintech – Cayman: Law And Practice

1. Fintech Market

1.1 Evolution of the Fintech Market

Government Initiatives

The fintech market in the Cayman Islands has significantly developed its technology talent pool and its increasingly mature technology industry is developing and strengthening the financial services industry of the Cayman Islands. The Cayman Islands is the leading offshore jurisdiction for investment funds, one of the top financial centres of the world, as well as a world leader in structured finance, and its government has been positive about encouraging fintech in the financial services industry. It has been a busy year for the Cayman Islands government, which implemented various initiatives including the Virtual Assets (Services Providers) Act (the "VASP Act") on 31 October 2020 following recommendations of the Financial Action Task Force, and introduced a Global Citizens programme to encourage digital nomads to work remotely in the Cayman Islands, while continuing to encourage technology companies to move to the Cayman Islands and to develop a technology industry there. At the same time, the Cayman Islands financial services regulator (the Cayman Islands Monetary Authority, referred to as "the Authority" or CIMA) and technology regulator (the Utility Regulation and Competition Office, referred to as "OfReg") have continued to educate themselves about blockchain, smart contracts and virtual assets, with the Authority overseeing the VASP Act since its enactment.

The Special Economic Zone

The Special Economic Zone (SEZ) was introduced by the government to encourage the development of certain industries in the Cayman Islands, by granting incentives to companies – particularly technology companies – to relocate physically and work in the Cayman Islands. In addition to the incentives, the Cayman Islands' established reputation as a financial services capital, its proximity to the USA, similar time zone to the USA, and the increasing difficulty in obtaining work visas in the USA, have persuaded many technology companies to relocate their employees to the Cayman Islands. The SEZ now has over 250 companies, including approximately 60 blockchain-focused companies. 

TechCayman

In addition to the SEZ, TechCayman was established in August 2018 to encourage technology entrepreneurs to establish their businesses in the Cayman Islands and to create a hub where the technology community can come together to collaborate and build new programmes and ecosystems. 

IP rights

In August 2017, the IP legislation in the Cayman Islands was updated to strengthen and protect IP rights, and it now permits direct registration of IP rights in the Cayman Islands rather than via the United Kingdom. 

Automation of government services

The Cayman Islands government has also established an e-government unit responsible for transitioning manual and paper-based government services to an electronic and online system following the Estonia model. This process is ongoing and the unit is considering all forms of technology, from blockchain to digital ID, to automate government processes and services. 

Code Cayman

The need to increase the local talent pool to service the technology industry has come to the attention of the Cayman Islands government and it has launched a non-profit association together with the private sector called Code Cayman, to provide coding programmes for the community (targeting women and the youth, in particular). The University College of the Cayman Islands has also launched coding programmes in response to demand for such courses. 

Development of blockchain

The Cayman Islands regulators are continuing their focus on blockchain and virtual assets, particularly in light of the introduction of the VASP Act. The Authority is establishing a specialist unit to oversee the VASP Act, and OfReg is encouraging the development of blockchain projects by considering and proposing changes to the Cayman Islands Electronic Transactions Act to incorporate express recognition of blockchain and smart contracts.

Legal Services

To the extent that there are disputes relating to virtual assets, creditors, contributors, token purchasers and other interested parties will need to evaluate their options and the recourse available to them from a dispute resolution and insolvency perspective. Fortunately, the Cayman Islands has a robust and predictable legal regime that can assist such parties in enforcing rights they may have against Cayman Islands entities in the virtual assets space, although this new asset class demands service providers who truly understand the technology that underpins the operation of such assets to provide effective advice and services. 

2. Fintech Business Models and Regulation in General

2.1 Predominant Business Models

The predominant verticals that apply in the Cayman Islands relate to blockchain and virtual assets. 

The involvement of Cayman Islands vehicles in blockchain is typically in the form of investment funds investing in virtual assets, investment funds investing in blockchain projects, token issuers in the context of security token offerings (STOs), foundation companies overseeing the development of a blockchain protocol, foundation companies responsible for grants to the community to develop applications for a blockchain protocol, joint-venture vehicles developing blockchain projects, service providers such as broker-dealers and custodians, and IP holding vehicles. There are no legacy players, as such, as this is a relatively new industry. 

2.2 Regulatory Regime

The Monetary Authority Act

The financial services sector in the Cayman Islands is regulated by the Authority, which receives its supervisory powers from the Monetary Authority Act (MAA). In summary, the regulatory laws provide for a licensing process whereby entities and individuals conducting regulated activity are required to obtain a licence or be registered with the Authority. 

The Authority supervises the regulated entities and individuals through its supervisory process and powers emanating from the MAA. This supervisory oversight includes desk-based supervision and on-site inspection.

Amendments to the MAA

In light of the introduction of the VASP Act, the MAA was amended to:

• add the VASP Act to the definition of “regulatory laws”, bringing the VASP Act under the remit of the Authority;
• introduce provisions requiring the Authority to “endeavour to promote and facilitate innovation, competition, consumer benefits and the development of technology and services that encourage and promote financial inclusion in performing its regulatory functions and its cooperative functions”; and
• permit the Authority to waive, modify or impose additional requirements in respect of a sandbox licence granted pursuant to the VASP Act, with such discretion being based on the use of innovative technology or innovative methods of delivery, the nature and complexity of the activity, or the supervisory needs of the person who holds the sandbox licence.

The Authority also has supervisory oversight over the anti-money laundering (AML) practices of entities within the scope of the Cayman Islands AML Regulations, including virtual asset service providers such as exchanges and custodians. 

A number of legislative obligations need to be considered alongside the regulatory laws, including the beneficial ownership regime, the economic substance regime, the Data Protection Act and the Automatic Exchange of Information (AEOI).

The VASP Act

The Cayman Islands enacted the VASP Act on 31 October 2020, providing a short, accessible, technology-neutral and adaptable framework for the regulation of the provision of virtual asset services. The VASP Act has been implemented in a phased approach as set out below.

The VASP Act provides a registration and licensing regime for any person offering a "virtual asset service" in the course of a business using a Cayman Islands entity or otherwise from within the Cayman Islands. Such persons are called virtual asset service providers (VASPs).

Definition of a virtual asset

Clearly, the concept of "virtual asset" is key to determining if a person is offering a virtual asset service, and is therefore a VASP.  Virtual asset is defined as a digital representation of value that can be digitally traded or transferred and can be used for payment or investment purposes.  However, a digital representation of a fiat currency (essentially, legal tender) is excluded.  Similarly, "virtual service tokens" (being digital representations of value that are not transferable or exchangeable with third parties, such as digital tokens that only provide access to an application or service or that provide a service or function directly to their owner) are not treated as virtual assets.

Definition of a virtual asset service

A "virtual asset service" means the issuance of virtual assets or the business of providing one or more of the following services or operations for or on behalf of another person:

• exchange between virtual assets and fiat currencies;
• exchange between one or more other forms of convertible virtual assets;
• transfer of virtual assets;
• virtual asset custody service; or
• participation in, and provision of, financial services related to a virtual asset issuance or the sale of a virtual asset.

The sale of newly created virtual assets to the public, in exchange for some form of consideration is also included in the definition of virtual asset service.  This means that although certain kinds of non-public issuances (such as employee or intra-group issuances or private sales) should not be regulated, a person will need to be registered if they issue virtual assets to the public using a Cayman Islands vehicle.  

The effect of this is that many, if not most, security token issuers will be VASPs and will be required to register with the Authority.  

The VASP Act provides that after the issuer is registered, the issuer has to submit a "virtual asset issuance request" to the Authority for prior approval of the virtual asset issuance. However, such a virtual asset issuance approval regime is currently not in effect and is expected to come into effect in June 2021.

Definition of a VATP

A virtual asset trading platform (VATP) is defined under the VASP Act to mean a centralised or decentralised digital platform that facilitates the exchange of virtual assets for fiat or other virtual assets on behalf of third parties for some form of reward and that (i) holds custody of or controls the virtual asset on behalf of its clients to facilitate an exchange; or (ii) purchases virtual assets from a seller when transactions or bids and offers are matched, in order to sell them to a buyer. However, VATPs do not include a platform that only provides a forum where sellers and buyers may post bids and offers, and a forum where the parties trade on a separate platform or in a peer-to-peer manner.

Generally, a provider of virtual asset custody services or a VATP operator will need to be licensed under the VASP Act.  Other virtual service providers will also generally be required to be registered. However, it is for the Authority to decide whether to direct that any VASP be licensed or apply for a sandbox licence. Again, such licensing regime is currently not in effect and is expected to come into effect in June 2021.

Sandbox licence regime

Under the VASP Act, a sandbox licence is a temporary (up to one year) licence that CIMA may direct a VASP to apply for where: 

• the service being provided represents an innovative use of technology or uses an innovative method of delivery such that additional supervision and oversight is required; 
• it is in the best interests of the public, regulated persons or financial markets that the service be temporarily restricted or subject to specific requirements; 
• the service promotes technology or a method of delivery that may create a systemic risk to financial markets or the jurisdiction; or 
• the service poses a money laundering, terrorist financing or proliferation financing risk that existing AML rules do not properly mitigate.

Certain fintech service providers that are not VASPs may also apply for sandbox licences. However, they are not required to do so.

The intention here, as with regulatory sandboxes more generally, is to provide a controlled environment for innovative service providers to evolve their businesses under the Authority's supervision, while creating a forum for concurrent development and potential amendment of applicable rules. Again, such sandbox regime is currently not in effect and is expected to come into effect in June 2021.

2.3 Compensation Models

There are no restrictions in the Cayman Islands on the compensation models that industry participants are allowed to use to charge customers.

2.4 Variations between the Regulation of Fintech and Legacy Players

The Authority does not differentiate between fintech participants and legacy participants. The Authority's licensing structure applicability centres on the activities conducted by the participant. A fintech participant falls within the Authority's regulatory scope if it conducts a licensed or registered activity. 

2.5 Regulatory Sandbox

As noted in 2.2 Regulatory Regime, the Cayman Islands government has introduced a sandbox regime in the VASP Act to promote and regulate new financial technologies, including virtual assets, which is expected to come into effect in June 2021. The government has proposed an adaptable, technology-neutral, regulatory sandbox-type framework that welcomes new and existing, innovative and pioneering businesses, and that provides sufficient oversight and monitoring to ensure the activities taking place are compliant, fair and transparent. It is understood that this versatile approach is intended to allow the Authority to observe new ideas, understand them, shape them if appropriate, and generate insights to feed back into mainstream regulatory activities. 

This regulatory sandbox will encourage, foster and incubate legitimate activities while adapting the laws and regulations of the Cayman Islands on an ongoing basis as the need arises. 

This idea is inspired by the United Kingdom's Financial Conduct Authority (FCA), which introduced its own regulatory sandbox in 2015.

2.6 Jurisdiction of Regulators

The Authority regulates the financial services industry in the Cayman Islands and has four principal functions: 

• monetary – the issue and redemption of Cayman Islands currency and the management of currency reserves; 
• regulatory – the regulation and supervision of financial services, the monitoring of compliance with certain regulatory laws, the issuance of a regulatory handbook on policies and procedures, and the issuance of rules and statements of principle and guidance; 
• co-operative – the provision of assistance to overseas regulatory authorities, including the execution of memoranda of understanding to assist with consolidated supervision; and
• advisory – the provision of advice to the government on monetary, regulatory and co-operative matters. 

In carrying out its functions, the Authority is obliged to: 

• act in the best economic interests of the Cayman Islands; 
• promote and maintain a sound financial system in the Cayman Islands; 
• use its resources in the most efficient and economical way; 
• have regard to generally accepted principles of good corporate governance; 
• endeavour to promote and enhance market confidence, consumer protection and the reputation of the Cayman Islands as a financial centre; 
• reduce the possibility of financial services business being used for money laundering or other crime; 
• recognise the international character of financial services/markets and the need for consumers and suppliers to be competitive while complying with appropriate and relevant international standards; 
• recognise the principle that a burden or restriction that is imposed should be proportionate to its expected benefits; 
• recognise the desirability of facilitating innovation in financial services business; and 
• be transparent and fair.

The TIA and DITC

The Tax Information Authority (TIA) was established by the Tax Information Authority Act (TIA Act) and is the Cayman Islands' competent authority for the purposes of international assistance in tax matters. 

The overriding objective of the Department for International Tax Co-operation (DITC) is to carry out the lawful and effective implementation of the Cayman Islands' international co-operation arrangements in tax matters. With separate statutory schemes governing the TIA on the one hand and the AEOI on the other, the DITC carries out its responsibilities in a separate and distinct manner in these two areas of activity. 

The DITC operates in an open, transparent and accountable manner, while having due regard for the highly confidential nature of the detailed information that it is responsible for handling. These important principles ensure that the international obligations of the Cayman Islands are honoured and that the DITC effectively maintains its integrity in the performance of its statutory functions, engenders and preserves the confidence of the public and the financial services community in its work, and meets its obligations to foreign counterpart authorities. 

The TIA is also the relevant authority for the International Tax Co-operation (Economic Substance) Act, known as the "Economic Substance Act", in determining whether a relevant entity satisfies the economic substance test in respect of its relevant activities. The types of relevant activities that fall within the Economic Substance Act include holding company business, headquarters business, fund management business and Intellectual Property (IP) business. 

The Ombudsman 

The Office of the Ombudsman ("the Ombudsman") is the supervisory authority for data protection-related matters. The Ombudsman is empowered as an independent office of the legislature to investigate, mediate and decide complaints under the Data Protection Act, 2017 (DPA) which came into effect on 30 September 2019. 

2.7 Outsourcing of Regulated Functions

The Guidance

The Authority provides guidance to regulated entities on the establishment of outsourcing arrangements and the outsourcing of material functions or activities ("the Guidance"). The Guidance is provided on the basis that regulated entities remain ultimately responsible for all outsourced material functions or activities, regulatory requirements and any other requirements of the Authority. 

Accountability

The Guidance stipulates that a regulated entity should assess the materiality of its outsourcing arrangements, considering the impact of the outsourcing on the regulated entity, and its risk management structure and internal controls. The Guidance further requires that a regulated entity should maintain the same level of oversight and accountability with respect to the outsourcing of any material function or activity as it would apply to its non-outsourced material functions or activities. 

Net risk

The Authority requires that a regulated entity's relationship and obligations towards its clients must not be altered as a result of the outsourcing of any material function or activity. In addition, a regulated entity's level of net risk should not materially increase as a result of outsourcing, compared to if it carried out the material function or activity itself. 

Due diligence assessment

Where a regulated entity intends to outsource a function, it should perform, document and maintain as part of its records a due diligence assessment of a service provider before entering into the initial outsourcing agreement, and on a regular basis thereafter, to ensure that the service provider is fit and proper, and can effectively perform the outsourced material function or activity, and to ensure high ethical and professional standards.

Legally binding agreement

Lastly, a regulated entity should have a detailed, legally binding, written outsourcing agreement or contract in place for all material outsourcing arrangements, irrespective of whether such arrangements are with related or unrelated parties.

2.8 Gatekeeper Liability

Cayman Islands-based service providers are required to comply with Cayman Islands law. If any person who is resident in the Cayman Islands has a suspicion that a payment to a Cayman Islands entity (by way of subscription or otherwise) contains the proceeds of criminal conduct, that person is required to report their suspicion in accordance with the Proceeds of Crime Act.

In addition, a Cayman Islands-licensed mutual fund administrator has certain obligations to report to the Authority under the Mutual Funds Act (MFA) regarding the operation of a fund that it administers. If a licensed mutual fund administrator knows or has reason to believe that a mutual fund for which it provides services is, or is likely to become, unable to meet its obligations as they fall due, is carrying on business other than in accordance with any laws, or is carrying on business in a manner that is, or is likely to be, prejudicial to investors or creditors of the fund, it must immediately give the Authority written notice of its knowledge or belief, giving its reason for that knowledge or belief, and any mutual fund administrator who contravenes these requirements is liable to a fine of KYD200,000 (and the Authority also has discretion to impose an additional fine of up to KYD1,000,000 pursuant to regulations made under the MAA). 

2.9 Significant Enforcement Actions

The Authority is the regulator responsible for supervision and enforcement of VASPs, and has wide-ranging powers to supervise and enforce the provision of virtual assets services. The Authority is also obliged to take into account broader jurisdictional considerations including anti-money laundering, counter-terrorist financing and prevention of proliferation financing, the impact of an issuance on the global financial markets and the financial services industry of the Cayman Islands. 

The Authority is permitted to examine the affairs or business of any VASP by way of the receipt of regular returns, on-site inspections, auditor's reports or as the Authority may determine to (among other matters):

• assess compliance with the VASP Act;
• confirm that the AML Regulations are being complied with;
• confirm that a licensee is in a sound financial position; or
• assess whether a licensee's cybersecurity safeguard measures are sufficient to protect client information and assets.

The Authority is permitted to take enforcement action, including revoking a licence or registration, adding conditions to a licence or registration, or applying to the court for winding-up in certain circumstances.

To date, the Authority has not taken any enforcement actions in the virtual assets space.

2.10 Implications of Additional, Non-financial Services Regulations

AML Regulations

The Cayman Islands Proceeds of Crime Act requires that entities that conduct "relevant financial business", which includes providing virtual asset services, must comply with the AML Regulations. 

Data Protection Legislation

The Cayman Islands also has data protection legislation (ie, the DPA), which requires entities within the scope of the legislation to comply with the data protection principles defined in the legislation. 

The DPA requires a data controller to comply with eight data protection principles when processing personal data and to ensure that those principles are complied with in relation to personal data processed on the data controller's behalf under a written contract. The DPA also deals with data security, data breaches and the rights of individual data subjects, including providing a privacy notice. 

The DPA applies to personal data processed by “data controllers” and “data processors”. Financial sector entities established in the Cayman Islands are generally data controllers, data processors or both. The DPA applies to processing carried out by data controllers established within the Cayman Islands. In certain cases, it also applies to data controllers outside the Cayman Islands that process personal data within the Cayman Islands. 

Cybersecurity

The Authority has published their Rule and Statement of Guidance relating to Cybersecurity for Entities Regulated by the Authority. This Rule and Statement of Guidance require regulated entities to ensure that robust cybersecurity measures are in place and that they can appropriately identify, protect, detect, respond to and recover from cybersecurity-related threats, incidents and breaches. The Rule also takes into consideration the provisions of the DPA and guidance issued by the Ombudsman on data protection.

Social Media

The use of social media and similar tools is currently not regulated, apart from under legislation such as the DPA. 

2.11 Review of Industry Participants by Parties Other Than Regulators

Cayman Islands-based service providers (eg, auditors or administrators) to virtual assets entities are required to comply with Cayman Islands law. As noted in 2.8 Gatekeeper Liability, any person who is resident in the Cayman Islands has a suspicion that a transaction involving a Cayman Islands entity (by way of subscription or otherwise) contains the proceeds of criminal conduct, that person is required to report such suspicion in accordance with the Proceeds of Crime Act. 

Digital Cayman and the Blockchain Association of the Cayman Islands (BACI) have been established with the aim of facilitating collaboration in the tech industry (in the case of Digital Cayman) and the blockchain industry (in the case of BACI), creating guidelines for the tech industry, and lobbying the Cayman Islands government and the regulators to encourage the development of the tech industry. 

2.12 Conjunction of Unregulated and Regulated Products and Services

Where an entity's activities fall within the scope of regulated activities, its operations will be subject to supervision by the Authority. 

If the product is the offering of equity interests in an investment fund investing in virtual assets and permits the redemption of equity interests at the option of the investors, the investment fund is typically structured as a Cayman Islands exempted company or limited liability company. 

If the investment fund is investing in long-term blockchain projects and does not permit the redemption of equity interests at the option of the investors, the investment fund is typically structured as a Cayman Islands exempted limited partnership. 

If the product is a securities token offering, the preferred vehicle appears to be a Cayman Islands foundation company due to historical reasons of Swiss foundations being used as the token issuers. 

If it is proposed that parties engage in a joint venture to develop a blockchain product, the joint-venture vehicle is typically structured as a Cayman Islands limited liability company, due to the ease of combining the shareholder arrangements within the limited liability company agreement while having a corporate form.

3. Robo-Advisers

3.1 Requirement for Different Business Models

Cayman Islands legislation does not expressly contemplate robo-advisers. To the extent that a legal entity holds the algorithm or software that performs the function of a robo-adviser and that legal entity is a Cayman Islands entity or a non-Cayman Islands entity registered in the Cayman Islands, it will be required to be registered or licensed under the Securities Investment Business Act (SIBA). 

3.2 Legacy Players' Implementation of Solutions Introduced by Robo-Advisers

Cayman Islands service providers do not appear to have introduced robo-advisers at this stage. However, there have been instances of Cayman Islands entities being managed by entities that rely on proprietary robo-advice algorithms or licensed software. 

3.3 Issues Relating to Best Execution of Customer Trades

This is not applicable in the Cayman Islands.

4. Online Lenders

4.1 Differences in the Business or Regulation of Loans Provided to Different Entities

The business of loans to individuals is currently not regulated in the Cayman Islands. However, the provision of loans falls within the scope of the AML Regulations, which do not distinguish between the recipients of the loans. 

Lending is considered to be a financing and leasing business and therefore Cayman Islands entities engaging in the lending business will fall under the economic substance regime of the Cayman Islands.

4.2 Underwriting Processes

The underwriting process is currently not regulated in the Cayman Islands. Instead, the Authority requires lenders to be in compliance with the laws of the jurisdiction in which the underwriting is taking place (which is typically located onshore and not in the Cayman Islands). 

4.3 Sources of Funds for Loans

Retail Lending

Retail lending to Cayman Islands residents is primarily conducted by Class A-licensed Cayman Islands banks which conduct banking business that is regulated by the Authority. The source of funds for this lending stems from the deposits received from the Class A-licensed Cayman Islands banks. 

In terms of sources of funds for loans to Cayman Islands entities, the Cayman Islands is viewed by lenders as a creditor-friendly jurisdiction. Lenders are able to enforce their security without going to the Cayman Islands courts, the Cayman Islands courts have a separate financial services division that specifically deals with financial services disputes, and the Cayman Islands has an established legal system based on English common law. Accordingly, there is a healthy appetite for banks to lend to Cayman Islands entities. Borrowing by Cayman Islands entities is not currently regulated in the Cayman Islands.

Credit Funds

Credit funds are increasingly popular with investors as they present a steady income. Law firms have formed many Cayman Islands credit funds and this has been one of the most popular investment strategies for investment funds for the last few years, which still appears to be going strong. Cayman Islands credit funds are providing a much-needed source of funding as traditional banks reduce their lending. Lending by Cayman Islands entities is not currently regulated in the Cayman Islands. 

Securitisations

Securitisations are also popular and Cayman Islands vehicles, in the form of exempted companies or limited liability companies, are typically used as the issuers. Various income streams have been securitised, including real estate mortgages and aviation leasing streams. Cayman Islands securitisation vehicles are not currently regulated in the Cayman Islands. 

P2P Lending

Peer-to-peer lending is not currently regulated in the Cayman Islands. 

4.4 Syndication of Loans

The syndication of loans takes place onshore rather than in the Cayman Islands. Accordingly, to the extent that the Cayman Islands' lending vehicle is involved in a syndication, it must be in compliance with the laws of the onshore jurisdiction. 

5. Payment Processors

5.1 Payment Processors' Use of Payment Rails

Payment processors must use existing payment rails at this stage. However, with the introduction of a regulatory sandbox regime expected to come into effect in the Cayman Islands in June 2021, it is expected that new and innovative payment rails, such as payment in virtual assets, will be available. 

5.2 Regulation of Cross-Border Payments and Remittances

Money services business is a regulated activity in the Cayman Islands, and businesses providing this are required to be licensed in accordance with the Money Services Act. Money services business is defined as: 

• the business of providing any or all of the following services:
• 1. money transmission;
  2. cheque cashing;
  3. currency exchange;
  4. the issuance, sale or redemption of money orders or traveller's cheques; and
  5. such other services as the governor in the Cabinet may specify by notice published in the Gazette; or
• the business of operating as an agent or franchise holder of a business offering any or all of the services listed above. 

Entities licensed to conduct money services business are regulated and supervised by the Authority. The activity of cross-border payments is not in itself a regulated activity; however, if cross-border payments involve the transfer of funds through the bank account of a Cayman Islands-regulated bank, such activity will be regulated and supervised under the Banks and Trust Companies Act.

6. Fund Administrators

6.1 Regulation of Fund Administrators

Cayman Islands-based administrators must hold a licence in accordance with the MFA, which requires a Cayman Islands-licensed mutual fund administrator to satisfy itself as to various criteria regarding the business and operation of a mutual fund and its service providers before providing fund administration to a mutual fund. 

6.2 Contractual Terms

A number of provisions are being incorporated into fund administration documents, many of which stem from regulatory obligations and, in particular, the AML Regulations and the DPA. Essentially, fund administration agreements include provisions requiring the administrator to provide information and documentation relevant to AML requirements to the regulated fund itself or to the Authority. The AML Regulations also require the fund administrator to maintain records of AML documentation for at least five years after conclusion of the transaction. These agreements also require the administrator to report any suspicions it may have relating to money laundering potentially occurring through the fund, to the fund's money-laundering reporting officer. 

In addition to AML requirements, the fund administration agreement will often have provisions requiring the administrator to safeguard and treat personal data in accordance with prescribed standards. 

7. Marketplaces, Exchanges and Trading Platforms

7.1 Permissible Trading Platforms

The CSX

Prior to the introduction of the VASP Act, the Cayman Islands Stock Exchange (CSX) had the sole and exclusive right to operate one or more securities markets in the Cayman Islands under the Stock Exchange Company Act of the Cayman Islands (the "Stock Exchange Act"). A "securities market" is defined as a stock market or place, or facility or arrangement (situated in whole or in part in the Cayman Islands), where or by which securities are listed, or regularly offered for purchase or sale, or by reference to which transactions in securities are regularly entered into by, or on behalf of, competing buyers. In light of such a broad definition, the only trading platform for securities in the Cayman Islands was the CSX. However, with the introduction of the VASP Act, the Stock Exchange Act has been amended to provide an exception to the sole and exclusive right of the CSX to operate a securities market or markets in the Cayman Islands, by permitting VATPs to operate securities markets which trade virtual asset securities.

The New VATP Securities Markets

A VATP is defined under the VASP Act to mean a centralised or decentralised digital platform that facilitates the exchange of virtual assets for fiat or other virtual assets on behalf of third parties for some form of reward and that (i) holds custody of or controls the virtual asset on behalf of its clients to facilitate an exchange; or (ii) purchases virtual assets from a seller when transactions or bids and offers are matched, in order to sell them to a buyer. However, VATPs do not include a platform that only provides a forum where sellers and buyers may post bids and offers and a forum where the parties trade in a separate platform or in a peer-to-peer manner. A VASP is required to obtain a licence under the VASP Act for the operation of a virtual asset trading platform.

A VASP operating a VATP must carry out reasonable due diligence procedures on virtual assets and their issuers, as listed on the platform. 

Requirements of a VASP operating a VATP

The Authority may, where necessary, impose requirements on a VASP operating a VATP, including:

• the types of clients that are permitted to access the service;
• the types of virtual assets that can be traded;
• identification and management of conflicts of interest and price discovery mechanisms to prevent price manipulation and other unfair trading practices;
• disclosures to clients concerning the transparency of operations of the VATP, including disclosures to clients on custodial arrangements and insurance against theft or loss of assets;
• the technology used by the platform; and
• anti-money laundering processes and procedures. 

Restrictions on the operations of a VASP

There are also restrictions on the operations of a VASP operating a VATP, including:

• providing financing to its clients for the purchase of virtual assets, unless disclosures are made;
• engaging in trading or market-making behaviour for its own account, which could be detrimental to the interests of its clients unless these activities are necessary for the operation of the VATP; and
• fiat-to-fiat currency exchange services. 

A VASP operating a VATP must apply to the Authority, in the prescribed form, for approval prior to engaging in securities investment business which relates to virtual assets.

7.2 Regulation of Different Asset Classes

See 7.1 Permissible Trading Platforms.

7.3 Impact of the Emergence of Cryptocurrency Exchanges

See 7.1 Permissible Trading Platforms.

7.4 Listing Standards

The CSX has published listing rules that are applicable to the listing of securities on the exchange. There are no separate industry standards for listing on the CSX.

The VASP Act gives the Authority the power to impose requirements on a licensed VATP for the listing of virtual assets. 

7.5 Order Handling Rules

If the provision of virtual asset services also constitutes "securities investment business" under the SIBA, and the VASP is licensed by the Authority in respect of such activity under the SIBA, the Securities Investment Business (Conduct of Business) Regulations (the "SIB Regulations") and various Statements of Guidance (including the Authority's Statement of Guidance on Client Understanding, Suitability, Dealing and Disclosure for Securities Investment Business, known as the "Statement of Guidance") will apply to the VASP. In particular, the SIB Regulations prescribe standards for dealings with clients, which includes the requirement for client agreements to contain specified information (including in relation to how transactions will be effected) and the requirement for a contract note to be issued to the client in certain circumstances post-transaction. The Statement of Guidance supplements the SIB Regulations and also contains standards for dealing with clients and preserving client order priority (including prohibitions against activities that disadvantage client transactions and rules that require fair and timely allocation and timely and best execution). These additional requirements will only apply if the VASP is licensed by the Authority under the SIBA (and not if it is only registered with the Authority under the SIBA). 

7.6 Rise of Peer-to-Peer Trading Platforms

See 7.1 Permissible Trading Platforms. There are no peer-to-peer trading platforms in the Cayman Islands. 

7.7 Issues Relating to Best Execution of Customer Trades

If the provision of virtual asset services also constitutes "securities investment business" under the SIBA and the VASP is licensed by the Authority in respect of such activity under the SIBA, the SIB Regulations and the Statement of Guidance will apply to the VASP. In particular, the Statement of Guidance includes rules that require a licensee to provide best execution for its clients (ie, the licensee must deal at the best possible price for its clients). These additional requirements will only apply if the VASP is licensed by the Authority under the SIBA (and not if it is only registered with the Authority under the SIBA).

7.8 Rules of Payment for Order Flow

This is not applicable in the Cayman Islands.

7.9 Market Integrity Principles

If the provision of virtual asset services also constitutes "securities investment business" under the SIBA, the SIBA category of offences relating to creating a false or misleading market or insider dealing may apply. In summary, any person who creates a false or misleading appearance of active trading in any listed securities (which includes a virtual asset trading platform operating on CSX or another recognised securities exchange under the VASP Act) or a false or misleading appearance in respect of the market for, or the price of, any such securities is guilty of an offence.

In addition, subject to certain defences available under the SIBA, any individual who has information as an insider is guilty of insider dealing if:

• they deal in securities that are price-affected securities in relation to the information;
• they encourage another person to deal in listed securities that are (whether or not that other person knows it) price-affected securities in relation to the information; or
• they disclose the information to another person, other than in the proper performance and functions of their employment, office or profession.

(Listed securities – which include a virtual asset trading platform operating on CSX or another recognised securities exchange under the VASP Act – are "price-affected" securities in relation to inside information.) 

Any person who commits an offence of creating a false or misleading market or an offence of insider dealing under the SIBA is punishable by a fine of up to KYD4,000 and to a term of imprisonment of up to one year on summary conviction, and to a fine of up to KYD10,000 and to a term of imprisonment of up to seven years on conviction on indictment.

8. High-Frequency and Algorithmic Trading

8.1 Creation and Usage Regulations

There are currently no specific regulations in the Cayman Islands dealing with the creation and usage of high-frequency and algorithmic trading; however, such activities fall within the definition of financial services business and are therefore subject to supervision by the Authority. Businesses established in the Cayman Islands that are conducting high-frequency and algorithmic trading are rare, as broadband speeds are relatively slow compared to the USA. The Cayman Islands Utility Regulation and Competition Office is currently seeking expressions of interest to install new submarine cables to increase broadband speeds in the Cayman Islands, as the existing submarine cables are nearing the end of their life. 

8.2 Requirement to Register as Market Makers When Functioning in a Principal Capacity

This is not applicable in the Cayman Islands.

8.3 Regulatory Distinction between Funds and Dealers

Cayman Islands-domiciled investment funds that engage in these activities need to be registered as mutual funds under the MFA if they are open-end funds. Cayman Islands-domiciled investment managers for such funds need to be registered or licensed under the SIBA. If the Cayman Islands-domiciled investment manager is a Cayman Islands company, limited liability company or limited liability partnership engaging in fund management business (where it exercises discretion in the management of securities on behalf of the investment fund), it is subject to the economic substance regime of the Cayman Islands and it will therefore need to satisfy the Economic Substance Act requirements of the Cayman Islands. 

8.4 Regulation of Programmers and Programming

This is not applicable in the Cayman Islands.

9. Financial Research Platforms

9.1 Registration

The Cayman Islands-domiciled operators of financial research platforms are not subject to registration unless the platforms also provide investment advice, in which case, the operator of the platform will need to be registered or licensed under the SIBA. 

9.2 Regulation of Unverified Information

There are no securities laws in the Cayman Islands. Accordingly, the spreading of rumours and other unverified information is not regulated there. The Authority would require the Cayman Islands-domiciled operator of such platform to comply with the laws of the jurisdiction in which the platform is operating. 

9.3 Conversation Curation

See 9.2 Regulation of Unverified Information. 

10. Insurtech

10.1 Underwriting Processes

While insurtech has been recognised as an important part of the discussion on the development of the insurance industry in the Cayman Islands, there do not appear to be any specific and material insurtech underwriting initiatives or developments in the Cayman Islands at present. 

10.2 Treatment of Different Types of Insurance

Any person carrying on insurance business, reinsurance business or business as an insurance agent, insurance broker or insurance manager in or from the Cayman Islands is required to hold a valid licence issued for that purpose under the Insurance Act. Domestic insurers offer insurance to Cayman Islands residents and businesses under a Class A licence. The non-domestic market comprises both insurers that insure non-domestic risks under a Class B licence and insurance-linked securities structures under a Class C licence. Reinsurers offer reinsurance products for domestic or foreign risks under a Class D licence. 

11. Regtech

11.1 Regulation of Regtech Providers

Regtech providers are regulated depending on their activities. Where an entity's activities fall within the scope of regulated activities, its operations are subject to supervision by the Authority. 

11.2 Contractual Terms to Assure Performance and Accuracy

A number of provisions are being incorporated into contracts with technology providers. The key provisions generally relate to protection of IP rights and confidentiality. The contracts often have provisions requiring the technology providers to safeguard and treat personal data in accordance with certain prescribed standards under data protection laws.

12. Blockchain

12.1 Use of Blockchain in the Financial Services Industry

The Cayman Islands government enacted the VASP Act on 31 October 2020 to follow the recommendations of the Financial Action Task Force and to encourage the development of the virtual assets industry using Cayman Islands entities.

There are no legacy players in the Cayman Islands and therefore the implementation and thought leadership relating to blockchain in the financial services industry are being driven by new players and certain existing service providers. Despite the lack of legacy players, the jurisdiction is at the forefront of the fintech "revolution". It is one of the leading jurisdictions for security token offerings (STOs) based on funding volume, its foundation company vehicle is commonly used by the blockchain industry and it has seen a wide range of investment funds focusing on blockchain-related investments. These funds have been established in the hedge fund and venture capital space, using exempted company, exempted limited partnership and limited liability company vehicles. This is testament to the Cayman Islands' well-tested structures, with which managers and investors are familiar and comfortable. 

Foundation Companies

Since the introduction of the Foundation Companies Act in 2017, the blockchain world has significantly increased its use of Cayman Islands foundation companies. The vast majority of blockchain protocols, which have their own custom blockchain, are community projects; many of them with community governance at their core. As these protocols mature and seek to attract investment to fund their growth, they are required to house the protocol in something tangible which can accept this investment. Traditional corporate structures are at odds with the protocol's “community”. Foundation companies, however, can be structured in such a way that they do not require an owner and can instead be governed by a community-elected board acting in accordance with by-laws which have been established to protect and promote the protocol in question.

Such foundation companies are typically used to oversee the development of the protocol, issue tokens for fundraising purposes, provide grants to developers in the community to incentivise the growth of the protocol, and may hold reserves of virtual assets to maintain the value of stablecoins. 

The Cayman Tech Zone

The legal and regulatory framework in the Cayman Islands is designed to facilitate growth and enterprise, and to provide a flexible business environment. One example of how the Cayman Islands government is helping to facilitate the growth of fintech business in the Cayman Islands is the introduction of the Cayman Tech Zone housed within Cayman Enterprise City and TechCayman. Each of these initiatives has been established to encourage technology businesses, from start-ups through to established players, to come and do business in the Cayman Islands. Many of their current members are developing cutting-edge software, including blockchain, and they have found that having their IP offshore and operating from a tax-neutral platform has not only made them more profitable, but has also accelerated rapid growth. Both Cayman Enterprise City and TechCayman have in turn partnered with the government and the private sector to provide training and coding programmes to the community in order to increase the technology talent pool in the Cayman Islands.

12.2 Local Regulators' Approach to Blockchain

The Cayman Islands government is very receptive towards the virtual assets industry. The introduction of the VASP Act demonstrates the government's commitment to playing a role in the industry's development and continued success. The government also seeks to become a preferred jurisdiction for virtual assets and fintech companies, and continues to take proactive steps in updating the legislation in order to attract such business.

The Authority has made statements to the public via webinars and conferences that it is supportive of the virtual asset industry and has issued answers to FAQs on the VASP Act since the Act became effective in October 2020. The Authority also published its Statement of Principles of the Conduct of Virtual Asset Services and Guidance Notes on the Prevention and Detection of Money Laundering, Terrorist Financing and Proliferation Financing in the Cayman Islands (Sector Specific Guidance for Virtual Asset Service Providers) for industry consultation. 

12.3 Classification of Blockchain Assets

Under the VASP Act, a virtual asset is defined as a digital representation of value that can be digitally traded or transferred and can be used for payment or investment purposes. However, a digital representation of a fiat currency (essentially, legal tender) is excluded. Similarly, "virtual service tokens" (being digital representations of value that are not transferable or exchangeable with third parties, such as digital tokens that only provide access to an application or service or that provide a service or function directly to their owner) are not treated as virtual assets.

Accordingly, blockchain assets are likely to be treated as virtual assets under the VASP Act, and to the extent that virtual asset services are provided, the entity providing such virtual asset services must be regulated as a VASP under the VASP Act.

12.4 Regulation of “Issuers” of Blockchain Assets

The sale of newly created virtual assets to the public, in exchange for some form of consideration, is included in the definition of virtual asset service under the VASP Act. This means that, although certain kinds of non-public issuances (such as employee or intra-group issuances or private sales) should not be regulated, a person will need to be registered if they issue virtual assets to the public using a Cayman Islands vehicle. 

The effect of this is that many, if not most, security token issuers will be VASPs and will be required to register with the Authority. 

The VASP Act provides that after the issuer is registered, the issuer has to submit a "virtual asset issuance request" to the Authority for prior approval of the virtual asset issuance. However, this virtual asset issuance approval regime is currently not in effect and is expected to come into effect in June 2021.

12.5 Regulation of Blockchain Asset Trading Platforms

See 7.1 Permissible Trading Platforms. 

12.6 Regulation of Funds

The regulation of invested funds will depend upon the structure of the investment fund.

Open-End Funds

If the fund is structured as an open-end fund, usually as a Cayman Islands exempted company, it needs to be registered with the Authority as a mutual fund under the MFA. This structure is more common for those managers looking to pursue an investment strategy that focuses on trading in virtual currencies. These strategies tend to be more liquid in nature and investors are able to redeem their investment at their own initiative. These structures are therefore open-end and similar to a traditional hedge fund. To the extent that the equity interests of the fund are to be tokenised and such issuance is considered to be a virtual asset service, the fund must also be registered under the VASP Act.

Closed-End Funds

If the fund is structured as a closed-end fund, usually as a Cayman Islands exempted limited partnership, it needs to be registered with the Authority as a private fund under the Private Funds Act. This structure is more common for those managers looking to pursue an investment strategy that focuses on long-term investments in blockchain start-ups or projects. These strategies tend to be illiquid in nature and investors are unable to redeem their investment without the manager's consent. These types of funds are akin to a private equity or venture capital fund. To the extent that the equity interests of the fund are to be tokenised and such issuance is considered to be a virtual asset service, the fund must also be registered under the VASP Act.

Blockchain Privacy Regulations

In line with international data protection principles and, in particular, the EU General Data Protection Regulation (GDPR), which has extraterritorial impact on certain Cayman Islands entities, the DPA provides that a data controller must comply with eight data protection principles, which are expanded on in the DPA. 

• Lawfulness, fairness and transparency – personal data shall be processed fairly. In addition, personal data may be processed only if at least one of a number of conditions for lawful processing is met. Data subjects also have the right to be informed. 
• Purpose limitation – personal data shall be obtained only for one or more specified lawful purposes and shall not be further processed in a manner incompatible with that purpose or those purposes. 
• Data minimisation – personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which it is collected or processed. 
• Accuracy – personal data shall be accurate and, where necessary, kept up to date. 
• Storage limitation – personal data processed for any purpose shall not be kept for longer than is necessary for that purpose. 
• Data subject rights – personal data shall be processed in accordance with the rights of data subjects under the DPA. 
• Integrity, confidentiality and security – appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data. 
• Cross-border transfer – personal data shall not be transferred to a country unless that country ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data. 

The DPA's restrictions on data processing and cross-border transfer on one hand, and blockchain's claims of transparency and immutability of data on the other, create tensions that are as yet unresolved, not only in the Cayman Islands, but globally.

12.7 Virtual Currencies

See 2.2 Regulatory Regime.

12.8 Impact of Regulation on “DeFi” Platforms

See 7.1 Permissible Trading Platforms. To the extent that a DeFi platform falls within the definition of a virtual asset trading platform under the VASP Act, the operator of such DeFi platform will need to be registered and subsequently licensed under the VASP Act. However, the definition of virtual asset trading platform under the VASP Act expressly excludes a platform that only provides a forum where sellers and buyers may post bids and offers, and a forum where the parties trade in a separate platform or in a peer-to-peer manner. Accordingly, it is unlikely that DeFi platforms will fall within the definition of a virtual asset trading platform under the VASP Act.

13. Open Banking

13.1 Regulation of Open Banking

There are currently no regulations in the Cayman Islands with respect to open banking. 

13.2 Concerns Raised by Open Banking

Banks and technology providers will need to comply with the DPA once in force. There are mechanisms available under the DPA that banks and technology providers may be able to utilise to enable compliance in the context of open banking. 

Originally Published by Chambers and Partners

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.