Introduction
Effective as of 23 May 2025, the Cayman Islands Monetary Authority (CIMA) introduced significant updates to the Cayman Islands' regulatory framework for virtual asset service providers (VASPs), as reflected in the recently published revised regulatory policy (Regulatory Policy). These changes fall in step with the implementation of the Virtual Asset Service Providers Act (2024 Revision) (VASP Act) Phase 2 licensing regime, which came into effect on 1 April 2025. The updated framework introduces a mandatory licensing requirement for certain categories of VASPs, alongside enhanced governance, operational, and compliance standards.
These developments reflect the jurisdiction’s continued commitment to aligning with international regulatory expectations, particularly those set by the Financial Action Task Force (FATF), and to reinforcing its position as an attractive and well-regulated jurisdiction for digital asset innovation.
What are the key changes?
Mandatory licensing for custodians and trading platforms
Under the revised regime, entities that provide virtual asset custody services or operate virtual asset trading platforms are now required to obtain a licence from CIMA. This marks a departure from the previous framework, which permitted such entities to operate under a registration model.
Entities that are currently registered and fall within the scope of the new licensing requirement must submit a licence application by 29 June 2025.
Failure to do so will result in the cancellation of their registration. The application process has also been expanded to include more detailed disclosures, including a comprehensive business plan, risk assessments, and governance structures.
Governance and oversight enhancements
The updated Regulatory Policy introduces new governance requirements aimed at strengthening oversight and reducing conflicts of interest. All licensed VASPs must now appoint a minimum of three directors, including at least one independent director who is not otherwise affiliated with the business. This requirement is intended to promote independent judgment and accountability, particularly in entities with complex or high-risk operations. VASPs are encouraged to review their current board composition and make any necessary adjustments in advance of submitting their licence applications.
Operational standards for custodians
Custodians are now subject to more stringent operational requirements. These include the obligation to segregate client assets from proprietary assets and to implement robust safeguarding measures. CIMA may also require custodians to provide clients with enhanced disclosures regarding insurance arrangements, grievance procedures, third-party data sharing, cyber-security and internal custodial governance.
Financial reporting and audit requirements
While all VASPs are required to prepare annual financial statements, CIMA now has the discretion to require audited financial statements in certain circumstances. These may include situations where the size, complexity, or risk profile of the business warrants additional scrutiny, or where there are concerns about the accuracy of financial reporting. VASPs should ensure that their financial reporting systems and internal controls are capable of supporting review at the audit level.
Expanded supervisory powers
CIMA’s supervisory and enforcement powers have been significantly expanded under the revised framework. CIMA now has the ability to impose conditions on licences, issue cease-and-desist orders, revoke licences, cancel registrations, and withdraw waivers. It may also take action against entities that make misleading public statements about their regulatory status or services. These powers are intended to enhance regulatory oversight and ensure that VASPs operate in a transparent and compliant manner within the Cayman Islands.
Clarified definitions and scope
Phase 2 of the VASP Regime introduces several new definitions and refines certain existing ones to provide greater clarity regarding the scope of the regime. Notable updates include:
- “Convertible virtual asset” – a new definition designed to distinguish virtual assets that can be exchanged for fiat currency or other virtual assets.
- “Originator” – updated to include all persons, whether natural or legal, in alignment with FATF standards for identifying the party initiating virtual asset transfers.
- “Owner” or "operator" – previously just "operator"; in relation to a virtual asset trading platform, expanded to better capture all forms of control structures leading to beneficial ownership.
- "Supervised Person" – a new definition discussed in the next section.
These definitional changes are intended to reduce ambiguity and ensure consistent application of the regulatory framework.
Exemption for tokenised funds and other 'supervised persons'
Under Phase 2 of the VASP regime, tokenised funds that are already regulated under either the Mutual Funds Act (2025 Revision) or the Private Funds Act (2025 Revision) (together, the Funds Acts) are generally exempt from additional registration or licensing requirements under the VASP Act. This exemption is grounded in the principle that entities already subject to comprehensive regulatory oversight under existing financial services legislation should not be subject to duplicative regulation. As such, where a tokenised fund is structured and operated in a manner that brings it within the scope of the Funds Acts, and its virtual asset-related activities are incidental to its core fund operations, it will typically not be required to register or obtain a licence under the VASP Act, unless they engage in additional virtual asset services such as custody, exchange, or issuance to the public. The exemption is not new, but it has been clarified and reinforced in the revised framework. Specifically, Section 16 of the VASP Act introduces waivers for “Supervised Persons,” a new defined term meaning those already licensed or registered under other regulatory law. This provision will also be relevant for multi-service financial institutions and fund managers who are already subject to regulatory supervision.
Conclusion and next steps
The implementation of Phase 2 of the VASP regime, inclusive of the recently updated Regulatory Policy, represents a significant evolution in the Cayman Islands’ approach to virtual asset regulation. These changes are designed to enhance market integrity, align with international standards, and provide greater protection for consumers and investors. Existing VASPs should assess whether their services now require a licence and begin preparing their applications in advance of the 29 June 2025 deadline. Prospective entrants into the Cayman Islands virtual asset space should evaluate their business models against the updated requirements and consider engaging with legal and regulatory advisors early in the process.
