Custodial wallet / SaaS in Cayman Islands

Custody Providers: Full VASP license mandatory; grant fee of 30,000 KYD (~36,000 USD).

Virtual Asset (Service Providers) Act (VASP Act): https://www.cima.ky/upimages/regulatorymeasures/RegulatoryPolicy-RegistrationorLicensingofVASPs_1716492494.pdf

Virtual Asset Regulations 2025

Issuers providing virtual asset services (e.g., issuance, sale) in or from the Cayman Islands must register or obtain a VASP license from CIMA; since April 1, 2025, custody services and trading platforms require a full "virtual assets service licence" (previously registration).

Incorporate Cayman entity (e.g., exempted company) with registered office.

Local Presence: Registered office in Cayman Islands required; no physical office, local staff, or residency mandates; at least one CIMA-approved director (especially for custody).

Capital: No fixed minimum share capital generally required, though CIMA may demand proof of adequate net assets; one source notes 100,000 USD minimum paid-up capital.

AML/KYC: Mandatory local AML compliance officer; annual AML audits; fit-and-proper checks on owners/directors/shareholders (KYC docs, non-criminal records, references).

Other: Client asset protection, risk/cybersecurity management, insurance; business plan, financial projections (2 years), org chart; annual audited statements if requested.

Prepare package: Business description, products/services, financials/projections, customer info, KYC on directors/shareholders (passports, CVs, references), compliance plans (AML, risk, cybersecurity), org chart.

Pay application fee (5,000 KYD); submit to CIMA.

Pay grant fee upon approval; demonstrate ongoing compliance (e.g., AML officer, CISO).

CIMA review by Management Committee (weekly meetings); respond to queries.

Receive authorization; annual fees/filings follow.

Stablecoins are classified as virtual assets under the VASP Act, as they represent digital value not as fiat currency but pegged to assets like fiat or securities; they are not explicitly e-money or payment tokens.

If conferring specific rights (e.g., redemption or conversion), or pegged to securities, they may be classified as securities under the Securities Investment Business Act (SIBA), requiring dual VASP and SIBA authorization from CIMA.

No specific reserve requirements for stablecoins are mentioned; regulation focuses on general VASP compliance rather than stablecoin-specific backing mandates.

No explicit rules on redemption rights; however, if a stablecoin structure includes redemption or conversion rights, it may trigger securities classification under SIBA.

VASPs Covered: All VASPs registered or applying for registration/licensing with the Cayman Islands Monetary Authority (CIMA), including obliged entities under the 2020 VASP Act (e.g., cryptocurrency exchanges, trading platforms, custodians). Covers transfers involving VASPs, other obliged entities, or non-obliged entities.

Threshold Amounts: USD 0; applies to all virtual asset transfers, defined as any transaction on behalf of an originator to make virtual assets available to a beneficiary.

Technical Implementation Requirements: VASPs must exchange specific originator and beneficiary data (e.g., identification, verification info) during transfers, maintain records for at least 5 years, and implement policies, procedures, and technological tools. Registrants submit compliance details to CIMA via email (vaspinfo@cima.ky) or REEFS portal (APP 101-84 Schedule E). Aligns with FATF Recommendation 16 and 2021 FATF guidance on private wallets, NFTs, and DeFi.

CIMA Guidance: Travel Rule Requirements notice (Feb 22, 2022); Sector Specific Guidance on VASPs (Sept 2023 revision); Guidance Notes on Prevention of Money Laundering/ Terrorist Financing (amendments).

Adopted and Effective Date: Adopted via the Anti-Money Laundering (Amendment) (No. 2) Regulations, 2020, with Part XA commencing on July 1, 2022. CIMA issued guidance requiring VASPs to submit compliance plans by March 31, 2022.

Court-supervised liquidations (April 3, 2025): Cayman Grand Court ordered supervised liquidations of AXIA Network Foundation (ANF) and ANF MergeCo Ltd (crypto entities in the failed Axia Group) for efficacy in stakeholder interests; no regulatory penalty specified.

General CIMA fines trend: Increase in administrative fines post-2022 amendments, e.g., September 2025 fines on Blacktower entities for AMLR breaches (non-crypto), and a prior KYD4M+ fine in 2021 (pre-2023).

Freezing assets and reporting relationships or transactions involving designated persons/entities to the Cayman Islands Financial Reporting Authority (FRA), per the Terrorism Act (2018 Revision) and Proliferation Financing (Prohibition) Act (2017 Revision).

Implementing sanctions screening policies under the Anti-Money Laundering Regulations (2020 Revision) for entities conducting "relevant financial business," including checks against UK/Cayman lists (not just EU/UN/OFAC).

CIMA advises FSPs (including VASPs) to note OFAC's extraterritorial reach due to global USD/crypto transaction risks, though not legally binding locally; no crypto-specific exemptions apply under international regimes.

All Cayman persons/entities (including VASPs) must screen customers, counterparties, and transactions against applicable lists: UK sanctions (mirroring pre-Brexit EU/standalone UK regimes + UN), plus Cayman autonomous terrorist lists under Terrorism Law (2018 Revision), Proliferation Financing (Prohibition) Law (2017 Revision), and Proceeds of Crime Law (2020 Revision).

OFAC crypto designations (e.g., SUEX exchange, Blender mixer) are not binding but recommended for screening due to secondary risks: https://ofac.treasury.gov/sanctions-programs-and-country-information and https://sanctionssearch.ofac.treas.gov.