Custodial wallet / SaaS in Bermuda
Hosted wallet provider that holds keys on behalf of end users, often white-labeled to businesses (custody as a service).
Custodial SaaS is conditionally permitted in Bermuda with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- Custodial wallet/SaaS providers (as digital asset businesses under DABA) must comply with the Proceeds of Crime (AML/ATF Financing) Regulations 2008, including customer due diligence (CDD), ongoing monitoring, record-keeping, and suspicious transaction reporting.
- AML/ATF violations carry up to 2 years imprisonment and/or US$750,000 fine; BMA civil penalty up to US$10 million per failure (bm.enforcement.amlatf-violations-eg-poca-regulations).
- KYC obligations apply at the licensed entity level; white-label clients may be treated as customers of the licensed SaaS provider, who carries ultimate AML responsibility under DABA.
- Reporting obligations to the BMA as AML/ATF supervisor, including filing of suspicious activity reports (SARs) with the Financial Intelligence Authority.
- BMA Guidance Note (May 2024) for stablecoin issuers also applies to custodial wallet operators that handle single-currency pegged stablecoins (bm.licensing.recent-bma-guidance-note-may).
Key Restrictions
- Must be licensed under DABA (Class T, M, or F license) — the custodial wallet/SaaS model is a 'digital asset business' as it involves holding and controlling digital assets on behalf of customers (bm.licensing.digital-asset-business-act-daba).
- Minimum net assets apply based on license class (Class T sandbox, Class M modified, Class F full) (bm.licensing.digital-asset-business-eg-issuingsellingredeeming).
- Digital assets must be segregated from the operator's own assets — the Bittrex enforcement shows that failure to segregate (using an 'omnibus wallet') is a critical violation (bm.enforcement.entity-targeted-bittrex-global-bermuda, bm.enforcement.violation-non-compliance-with-daba-requirements).
- Must comply with the Digital Asset Business (Cybersecurity) Rules 2018, (Client Disclosure) Rules 2018, and (Prudential Standards) (Annual Return) Rules 2018 (bm.licensing.supporting-rules-2018-digital-asset).
- Must comply with the Digital Asset Custody Code of Practice (2019) — the Bittrex case shows this is actively enforced (bm.enforcement.violation-non-compliance-with-daba-requirements).
- Economic substance rules apply — a physical presence is not strictly required, but economic substance must be demonstrated (bm.licensing.icos-are-restricted-activities-needing).
- White-label clients may need their own assessment — if the SaaS provider's client is also conducting digital asset business, it may separately need DABA licensing or be subject to the provider's licensed framework.
Key Risks
- Enforcement precedent: The Bittrex Global case (winding up, court proceedings, asset segregation failures) demonstrates aggressive BMA enforcement on custody segregation and AML/ATF compliance (bm.enforcement.entity-targeted-bittrex-global-bermuda).
- Fines up to US$10,000,000 for DABA breaches and up to US$250,000 and/or 5 years imprisonment for unlicensed digital asset business (bm.enforcement.fines-up-to-us10000000-for, bm.enforcement.fines-up-to-us250000-andor).
- Regulatory ambiguity around allocation of AML duties between the SaaS provider and the white-label client — ultimate responsibility likely falls on the licensed entity (SaaS provider).
- Liquidation risk: The Bittrex and Custodian Life cases show that customer assets in non-compliant custodial arrangements may be tied up in lengthy court proceedings (bm.enforcement.entity-bittrex-global-limited-in).
- Proposed Payment Services Act (PSA) may introduce overlapping or conflicting requirements for digital wallet operators (bm.licensing.proposed-payment-services-act-psa).
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Digital Asset Business Act (DABA, 2018): Establishes licensing for "digital asset businesses" (broadly defined to include exchanges, trading, custody, issuance, stablecoins, and more) conducted in or from Bermuda; applies to entities incorporated inside or outside Bermuda.
Digital asset businesses in Bermuda (e.g., issuing, selling, redeeming tokens, exchanges, wallets, payment services) require licensing under the Digital Asset Business Act (DABA), with Class T (sandbox), Class M (modified), or Class F (full) licenses available. However, the stated minimum net assets of $100,000 and fees ($1,000 for Class T, $2,266 for Class M/F) are likely outdated; current evidence shows a Class F license has been actively issued and stablecoin/stellar blockchain initiatives are underway, indicating regulatory evolution that may have altered these specific requirements.
Supporting rules (2018): Digital Asset Business (Cybersecurity) Rules, (Client Disclosure) Rules, (Prudential Standards) (Annual Return) Rules.
Additional: Proceeds of Crime (AML/ATF Financing) Regulations 2008 for anti-money laundering.
Recent: BMA Guidance Note (May 2024) for Single Currency Pegged Stablecoin Issuers (SCPSIs).
ICOs are restricted activities needing BMA approval; no physical presence required, but economic substance rules apply.
Entity targeted: Bittrex Global (Bermuda) Ltd (Class F Full DABA licensee, ceased operations in 2024). Violation type: Non-compliance with DABA requirements, including segregation of digital assets in the "Andromeda Omnibus Wallet," Digital Asset Custody Code of Practice (2019), AML/ATF, KYC, and UN Sanctions protocols (identified via 2022 onsite inspections). Penalty amount: Not specified in sources.
Violation: Non-compliance with DABA requirements and Bermuda Monetary Authority Digital Asset Custody Code of Practice (2019), including segregation of digital assets in the "Andromeda Omnibus Wallet"; also AML/ATF and KYC issues.
Fines up to US$10,000,000 for DABA breaches or non-compliance with BMA directions.
Fines up to US$250,000 and/or 5 years imprisonment for unlicensed digital asset business.
AML/ATF violations (e.g., POCA Regulations): Up to 2 years imprisonment and/or US$750,000 fine; BMA civil penalty up to US$10 million per failure.
Bittrex Global Limited (in liquidation) is a Bermuda entity currently subject to Bermuda Court of Appeal proceedings regarding customer crypto assets.
Evidence fact bm.enforcement.date-bma-concerns-post-2022 not found (may have been renamed).
Proposed Payment Services Act (PSA): Regulates payments/digital wallets, with DABA exemptions and stablecoin options
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — custodial wallet/SaaS providers are permitted in Bermuda but must obtain a DABA license (Class T/M/F), comply with the Digital Asset Custody Code of Practice and segregation rules, meet AML/ATF obligations under the Proceeds of Crime Regulations 2008 (supervised by BMA), and adhere to prudential/cybersecurity/disclosure rules; the Bittrex enforcement demonstrates active and aggressive BMA oversight on custody compliance.
Questions this verdict aims to answer
- What custody license / qualified-custodian status applies?
- What segregation, insurance, and proof-of-reserves rules apply?
- What AML obligations attach to the SaaS vs the white-label client?