DeFi protocol frontend in Bermuda
Operates a web frontend or aggregator that interacts with permissionless smart contracts on behalf of users. May or may not screen users / restrict regions.
DeFi frontend is conditionally permitted in Bermuda with a local entity, subject to AML obligations and medium licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- Medium
- Last updated
- 2026-07-13
AML Obligations
- AML/ATF obligations under the Proceeds of Crime (AML/ATF Financing) Regulations 2008 apply to licensed digital asset businesses
- KYC/CDD requirements on users if the frontend is deemed to be providing a regulated digital asset service (e.g., exchange, wallet, or payment service)
- Suspicious transaction reporting to the BMA under POCA regulations
- Ongoing monitoring obligations under DABA licensing conditions
- BMA civil penalty up to US$10 million per AML/ATF failure, plus up to 2 years imprisonment and/or US$750,000 fine for AML/ATF violations
Key Restrictions
- If the frontend takes fees and exercises control over user interaction (e.g., routing, quoting, blocking transactions), it likely constitutes a regulated digital asset business ('exchange' or 'payment service') under DABA and requires licensing
- A purely non-custodial, permissionless frontend with no fee-skimming and no user screening may fall outside DABA scope, but the legal boundary is untested in Bermuda
- Geofencing of US persons is a practical requirement to avoid securities and sanctions exposure, but not explicitly mandated by Bermuda law
- If the frontend conducts or facilitates a public offering of new tokens (ICO/IDO), prior BMA authorization under the Digital Asset Issuance Act (DAIA) is required, with a cap of 35 persons for unregistered offerings
- Local incorporation in Bermuda is required if licensing is triggered; economic substance rules also apply
Key Risks
- High enforcement risk if operating without a DABA license while taking fees or exercising control — fines up to US$250,000 and/or 5 years imprisonment for unlicensed activity
- Bittrex Global enforcement precedent demonstrates BMA will act on custody and AML non-compliance by licensed entities; no precedent yet for unlicensed DeFi frontends
- Regulatory ambiguity: The boundary between 'permissionless frontend' and 'regulated digital asset business' under DABA's broad definitions has not been tested in Bermuda courts
- AML/ATF obligations could attach even to non-custodial frontends if BMA interprets 'access to applications via DLT' as a regulated activity
- Liquidation risk: If the operator holds any user funds or keys, the Bittrex/Custodian Life precedent shows aggressive BMA intervention and winding-up actions
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Digital Asset Business Act (DABA, 2018): Establishes licensing for "digital asset businesses" (broadly defined to include exchanges, trading, custody, issuance, stablecoins, and more) conducted in or from Bermuda; applies to entities incorporated inside or outside Bermuda.
Digital asset businesses in Bermuda (e.g., issuing, selling, redeeming tokens, exchanges, wallets, payment services) require licensing under the Digital Asset Business Act (DABA), with Class T (sandbox), Class M (modified), or Class F (full) licenses available. However, the stated minimum net assets of $100,000 and fees ($1,000 for Class T, $2,266 for Class M/F) are likely outdated; current evidence shows a Class F license has been actively issued and stablecoin/stellar blockchain initiatives are underway, indicating regulatory evolution that may have altered these specific requirements.
Access to applications, services, or products via distributed ledger technology (excluding certain affinity/rewards programs).
Digital Asset Issuance Act (DAIA): Issuer-specific regime.
Additional: Proceeds of Crime (AML/ATF Financing) Regulations 2008 for anti-money laundering.
Fines up to US$250,000 and/or 5 years imprisonment for unlicensed digital asset business.
Fines up to US$10,000,000 for DABA breaches or non-compliance with BMA directions.
AML/ATF violations (e.g., POCA Regulations): Up to 2 years imprisonment and/or US$750,000 fine; BMA civil penalty up to US$10 million per failure.
Entity targeted: Bittrex Global (Bermuda) Ltd (Class F Full DABA licensee, ceased operations in 2024). Violation type: Non-compliance with DABA requirements, including segregation of digital assets in the "Andromeda Omnibus Wallet," Digital Asset Custody Code of Practice (2019), AML/ATF, KYC, and UN Sanctions protocols (identified via 2022 onsite inspections). Penalty amount: Not specified in sources.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a DeFi protocol frontend operating in or from Bermuda likely triggers DABA licensing (medium burden, local entity required) if it takes fees or exercises control over user transactions; a purely passive, non-fee-taking, non-custodial frontend may fall outside regulation, but the boundary is untested and carries enforcement risk.
Questions this verdict aims to answer
- Is operating the frontend a regulated activity even if the protocol is decentralized?
- What geofencing or KYC obligations apply?
- Does fee-taking change classification?