Remote VASP serving residents in Bermuda
Foreign-incorporated entity that offers exchange, custody, or transfer services to residents of a jurisdiction without establishing a local entity or office.
Remote VASP is conditionally permitted in Bermuda with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- DABA licensees must comply with the Proceeds of Crime (AML/ATF Financing) Regulations 2008, including KYC/CDD, transaction monitoring, and suspicious activity reporting.
- AML/ATF violations under POCA Regulations carry penalties of up to 2 years imprisonment and/or US$750,000 fine; BMA civil penalty up to US$10 million per failure.
- Suspicious Transaction Reports (STRs) must be filed with the BMA (as AML/ATF supervisor for DABA licensees).
- BMA requires compliance with Digital Asset Business (Client Disclosure) Rules 2018, which include disclosure obligations tied to AML/KYC processes.
Key Restrictions
- A foreign-incorporated entity cannot serve Bermuda residents cross-border without itself becoming licensed under DABA — DABA applies to entities incorporated inside or outside Bermuda that carry on digital asset business 'in or from' Bermuda.
- Licensing requires incorporation in Bermuda (Class T, M, or F licenses under DABA). Economic substance rules apply.
- Public offerings/issuances of digital assets to Bermuda residents (e.g., >35 persons) require BMA authorization under DAIA; Bermuda-incorporated entity only.
- Minimum net asset requirements apply under DABA licensing (varies by class — Class F full license has the highest requirements).
- No explicit security token carve-out; all tokens are 'digital assets' under DABA section 3.
Key Risks
- Unlicensed cross-border service to Bermuda residents carries enforcement risk: fines up to US$250,000 and/or 5 years imprisonment for unlicensed digital asset business.
- Non-compliance with BMA directions can result in fines up to US$2 million; DABA breaches up to US$10 million.
- The Bittrex Global enforcement case demonstrates active BMA supervision and willingness to appoint investigators, pursue liquidation, and sanction DABA licensees for compliance failings.
- AML/ATF non-compliance carries combined criminal and civil penalty exposure (up to US$10 million civil penalty per failure).
- Regulatory ambiguity remains around the territorial scope of 'in or from Bermuda' for purely foreign entities with incidental Bermuda user access — no safe harbor exists.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Digital Asset Business Act (DABA, 2018): Establishes licensing for "digital asset businesses" (broadly defined to include exchanges, trading, custody, issuance, stablecoins, and more) conducted in or from Bermuda; applies to entities incorporated inside or outside Bermuda.
Digital asset businesses in Bermuda (e.g., issuing, selling, redeeming tokens, exchanges, wallets, payment services) require licensing under the Digital Asset Business Act (DABA), with Class T (sandbox), Class M (modified), or Class F (full) licenses available. However, the stated minimum net assets of $100,000 and fees ($1,000 for Class T, $2,266 for Class M/F) are likely outdated; current evidence shows a Class F license has been actively issued and stablecoin/stellar blockchain initiatives are underway, indicating regulatory evolution that may have altered these specific requirements.
Supporting rules (2018): Digital Asset Business (Cybersecurity) Rules, (Client Disclosure) Rules, (Prudential Standards) (Annual Return) Rules.
Additional: Proceeds of Crime (AML/ATF Financing) Regulations 2008 for anti-money laundering.
Public offerings/issuances: ICOs or public sales (e.g., to >35 persons) need BMA authorization under DAIA; exemptions available via section 16(2) filing. Bermuda-incorporated entities only; no physical presence required, but economic substance rules apply.
No explicit "security token" carve-out: All tokens are "digital assets" under DABA section 3, including security, utility, payment, and NFT tokens.
Fines up to US$250,000 and/or 5 years imprisonment for unlicensed digital asset business.
Fines up to US$10,000,000 for DABA breaches or non-compliance with BMA directions.
AML/ATF violations (e.g., POCA Regulations): Up to 2 years imprisonment and/or US$750,000 fine; BMA civil penalty up to US$10 million per failure.
Entity targeted: Bittrex Global (Bermuda) Ltd (Class F Full DABA licensee, ceased operations in 2024). Violation type: Non-compliance with DABA requirements, including segregation of digital assets in the "Andromeda Omnibus Wallet," Digital Asset Custody Code of Practice (2019), AML/ATF, KYC, and UN Sanctions protocols (identified via 2022 onsite inspections). Penalty amount: Not specified in sources.
Unlicensed digital asset business: Fine up to US$250,000 and/or 5 years imprisonment.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a foreign-incorporated remote VASP cannot serve Bermuda residents from abroad without first becoming licensed under DABA, which requires Bermuda incorporation, a Class T/M/F license, compliance with AML/ATF obligations under the POCA Regulations, and adherence to economic substance rules; unlicensed cross-border service carries significant enforcement risk including fines up to US$250,000 and/or 5 years imprisonment.
Questions this verdict aims to answer
- May a non-resident provider serve residents from abroad?
- Does cross-border service trigger licensing, registration, or AML obligations?
- What enforcement risk exists for unlicensed remote operators?