On-shore VASP in Bermuda
Locally-incorporated VASP that operates under full local jurisdiction, holding all required licenses and registrations.
On-shore VASP is conditionally permitted in Bermuda with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- AML/ATF compliance under Proceeds of Crime (AML/ATF Financing) Regulations 2008
- KYC/CDD obligations on all customers
- Suspicious activity reporting to BMA
- Ongoing transaction monitoring
- Compliance with UN sanctions and targeted financial sanctions
- BMA oversight and examination for AML/ATF program adequacy
- Civil penalties up to US$10 million per AML failure; criminal penalties up to 2 years imprisonment and/or US$750,000 fine
Key Restrictions
- Must be incorporated in Bermuda (local entity required)
- Must obtain a DABA license from BMA — Class T (sandbox), Class M (modified), or Class F (full) depending on business scale and risk
- Must comply with Digital Asset Business (Cybersecurity) Rules, (Client Disclosure) Rules, and (Prudential Standards) (Annual Return) Rules 2018
- Client digital assets must be segregated in compliance with Digital Asset Custody Code of Practice (2019)
- Public offerings/issuances of digital assets (>35 persons) require separate BMA authorization under DAIA
- Economic substance rules apply even without physical presence
- Minimum net assets requirements apply per license class
- If issuing securities via digital assets, prior BMA approval plus extra policies required
- Must maintain bond/insurance for client asset protection
Key Risks
- Bittrex Global enforcement demonstrates aggressive BMA oversight — non-compliance (including omnibus wallet segregation issues) led to investigation, liquidation, and ongoing court proceedings
- Fines up to US$10,000,000 for DABA breaches; unlicensed operation carries up to US$250,000 fine and/or 5 years imprisonment
- Regulatory environment rapidly evolving — proposed Payment Services Act may create overlapping regimes
- AML/ATF compliance gaps can result in separate civil penalties up to US$10 million per failure plus criminal liability
- Court of Appeal proceedings regarding customer crypto assets in Bittrex liquidation create legal uncertainty for custodial models
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Digital Asset Business Act 2018 (DABA): Core licensing framework.
Digital Asset Issuance Act (DAIA): Issuer-specific regime.
Supporting rules (2018): Digital Asset Business (Cybersecurity) Rules, (Client Disclosure) Rules, (Prudential Standards) (Annual Return) Rules.
Digital asset businesses in Bermuda (e.g., issuing, selling, redeeming tokens, exchanges, wallets, payment services) require licensing under the Digital Asset Business Act (DABA), with Class T (sandbox), Class M (modified), or Class F (full) licenses available. However, the stated minimum net assets of $100,000 and fees ($1,000 for Class T, $2,266 for Class M/F) are likely outdated; current evidence shows a Class F license has been actively issued and stablecoin/stellar blockchain initiatives are underway, indicating regulatory evolution that may have altered these specific requirements.
Public offerings/issuances: ICOs or public sales (e.g., to >35 persons) need BMA authorization under DAIA; exemptions available via section 16(2) filing. Bermuda-incorporated entities only; no physical presence required, but economic substance rules apply.
Additional: Proceeds of Crime (AML/ATF Financing) Regulations 2008 for anti-money laundering.
No explicit "security token" carve-out: All tokens are "digital assets" under DABA section 3, including security, utility, payment, and NFT tokens.
If issuing securities via digital assets, prior BMA approval is required, plus additional policies compliant with BMA securities issuance rules.
Digital Asset Business Act (DAB Act, 2018): Requires licensing from the Bermuda Monetary Authority (BMA) for activities like issuing/selling digital assets, operating exchanges, custodial wallets, or payment services using digital assets. Licensed entities must segregate client assets, maintain bonds/insurance, and comply with cybersecurity/prudential rules.
Companies and Limited Liability Company (Initial Coin Offering) Amendment Act 2018 (ICO Act): Mandates company registration with the Registrar of Companies for ICOs conducted in or from Bermuda.
Regulator: Bermuda Monetary Authority (BMA).
Entity targeted: Bittrex Global (Bermuda) Ltd (Class F Full DABA licensee, ceased operations in 2024). Violation type: Non-compliance with DABA requirements, including segregation of digital assets in the "Andromeda Omnibus Wallet," Digital Asset Custody Code of Practice (2019), AML/ATF, KYC, and UN Sanctions protocols (identified via 2022 onsite inspections). Penalty amount: Not specified in sources.
Fines up to US$10,000,000 for DABA breaches or non-compliance with BMA directions.
Fines up to US$250,000 and/or 5 years imprisonment for unlicensed digital asset business.
Unlicensed digital asset business: Fine up to US$250,000 and/or 5 years imprisonment.
AML/ATF violations (e.g., POCA Regulations): Up to 2 years imprisonment and/or US$750,000 fine; BMA civil penalty up to US$10 million per failure.
Non-compliance with BMA directions: Fine up to US$2 million.
Bittrex Global Limited (in liquidation) is a Bermuda entity currently subject to Bermuda Court of Appeal proceedings regarding customer crypto assets.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — an on-shore VASP is permitted in Bermuda but must be locally incorporated, obtain a Class T/M/F DABA license from the BMA, comply with prudential, cybersecurity, client disclosure, and custody segregation rules, and obtain separate DAIA authorization for public token offerings.
Questions this verdict aims to answer
- What license(s) are required to operate locally?
- What capital, governance, and reporting obligations apply?
- What is the application process and timeline?