Cayman Islands: Commencement Of Cayman Islands Virtual Asset (Service Providers) Law, 2020

The Cayman Islands government has now issued a commencement order for the Virtual Asset (Service Providers) Law, 2020 ("VASP Law") which will come into effect on 31 October, 2020 (the "Commencement Order"). The VASP Law provides a short, accessible, technology neutral and adaptable framework for the regulation of the provision of virtual asset services. Pursuant to the Commencement Order, there will be a phased approach to the implementation of the VASP Law as described below.

What the VASP Law Regulates

The VASP Law provides a registration and licensing regime for any person carrying on a "virtual asset service" in the course of a business using a Cayman Islands entity or otherwise from within the Cayman Islands. Such persons are called "virtual asset service providers" ("VASPs").

Clearly, the concept of "virtual asset" is key to determining if a person is carrying on a virtual asset service, and is therefore a VASP.  Virtual asset is defined as a digital representation of value that can be digitally traded or transferred and can be used for payment or investment purposes. However, a digital representation of a fiat currency (essentially, legal tender) is excluded. Similarly, "virtual service tokens" (being digital representations of value that are not transferrable or exchangeable with third parties, such as digital tokens that only provide access to an application or service or that provide a service or function directly to their owner) are not treated as virtual assets.

A "virtual asset service" means the issuance of virtual assets or the business of providing one or more of the following services or operations for or on behalf of another person:

1. exchange between virtual assets and fiat currencies;
2. exchange between one or more other forms of convertible virtual assets;
3. transfer of virtual assets;
4. virtual asset custody service; or
5. participation in, and provision of, financial services related to a virtual asset issuance or the sale of a virtual asset.

Under the Commencement Order, all VASPs must register under the VASP Law with the Cayman Islands Monetary Authority ("CIMA") when the VASP Law comes into effect on 31 October, 2020. CIMA will be given the ability to enforce and take action against contraventions of the VASP Law commencing from 31 January, 2021.

Regulation of Issuance of Virtual Assets

The sale of newly created virtual assets to the public, in exchange for some form of consideration is also included in the definition of virtual asset service. This means that although certain kinds of non-public issuances (such as employee or intra-group issuances or private sales) should not be regulated, a person will need to be registered if they issue virtual assets to the public using a Cayman Islands vehicle. 

The effect of this is that many, if not most, security token issuers will be VASPs and will be required to register with CIMA. 

The VASP Law provides that after the issuer is registered, the issuer has to submit a "virtual asset issuance request" to CIMA for prior approval of the virtual asset issuance. However, such virtual asset issuance approval regime is currently not in effect and we are awaiting the commencement order for this regime.

Virtual Asset Trading Platform Operators, Custodians and Other Virtual Asset Service Providers

A virtual asset trading platform ("VATP") is defined under the VASP Law to mean a centralized or decentralized digital platform that facilitates the exchange of virtual assets for fiat or other virtual assets on behalf of third parties for some form of reward and that (i) holds custody of or controls the virtual asset on behalf of its clients to facilitate an exchange; or (ii) purchases virtual assets from a seller when transactions or bids and offers are matched in order to sell them to a buyer. However, VATPs do not include a platform that only provides a forum where sellers and buyers may post bids and offers and a forum where the parties trade in a separate platform or in a peer-to-peer manner.

Generally, a provider of virtual asset custody services or a VATP operator will need to be licensed under the VASP Law. Other virtual service providers will generally be required to be registered. However, it is open to CIMA to direct that any virtual asset service provider be licensed or apply for a sandbox licence. Again, such licensing regime is currently not in effect and we are awaiting the commencement order for this regime.

Sandbox Licences

Under the VASP Law, a sandbox licence is a temporary, up to one year, licence that CIMA may direct a VASP to apply for where: 

1. the service being provided represents an innovative use of technology or uses an innovative method of delivery such that additional supervision and oversight is required;
2. it is in the best interests of the public, regulated persons or financial markets that the service be temporarily restricted or subject to specific requirements;
3. the service promotes technology or a method of delivery that may create a systemic risk to financial markets or the jurisdiction; or
4. the service poses a money laundering, terrorist financing or proliferation financing risk that existing AML rules don't properly mitigate.

Certain FinTech service providers that are not VASPs may also apply for sandbox licences.  However, they are not required to do so.

The intention here, as with regulatory sandboxes more generally, is to provide a controlled environment for innovative service providers to evolve their businesses under CIMA's supervision, whilst creating a forum for concurrent development and potentially amendment of applicable rules. Again, such sandbox regime is currently not in effect and we are awaiting the commencement order for this regime.

Compliance Requirements for VASPs

In addition to maintaining registration or a licence, VASPs will be subject to various ongoing requirements. The requirements include obligations to:

1. prepare annual accounts that are open to CIMA inspection;
2. ensure senior officers and beneficial owners are fit and proper for such positions, and obtain prior approval from CIMA in relation to the appointment of any senior officer or trustee as well as the anti-money laundering compliance officer;
3. secure data and ensure all communications are accurate;
4. comply with various other record keeping, cybersecurity, outsourcing, governance and reporting obligations to CIMA.

In addition to the above, VASPs are already required to comply with the Cayman Islands Anti-Money Laundering Regulations (2020 Revision) and other relevant anti-money laundering, terrorism and proliferation financing and sanctions laws, including to put in place systems and procedures (including the obligation to maintain information in relation to the beneficiary and originator of transfers) and designating natural persons with responsibility for compliance, as the result of previous amendments to the Proceeds of Crime Law. CIMA may order an audit of systems and procedures of the registrant or licensee.

Conclusion

To date, existing Cayman Islands legislation and regulation has been flexible enough to deal with many aspects of virtual asset related business. However, it is important that the jurisdiction continues to be a leader in demonstrating global best practices in regulating, primarily, the financial services industry, while complying with the recommendations of the Financial Action Task Force. The VASP Law provides a welcome addition to Cayman's existing, robust body of law, and will serve to further reinforce the confidence and certainty in the virtual assets regulatory environment.