Self-custodial wallet / non-custodial software in Cayman Islands
Publisher of software where users hold their own private keys. The publisher never holds, controls, or has access to user funds.
Self-custodial wallet is conditionally permitted in Cayman Islands with a local entity, subject to AML obligations and none licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- None
- Last updated
- 2026-07-13
AML Obligations
- Self-custodial wallet publishers that never hold, control, or access user funds are not VASPs under the VASP Act, so no VASP-level AML obligations attach.
- If the publisher qualifies as an 'obliged entity' under the Anti-Money Laundering Regulations by engaging in 'relevant financial business' (unlikely for pure software publishing with no custody), AML obligations would apply; but based on the facts, no custody = no VASP classification.
- The Travel Rule (Part XA of AMLR) applies to VASPs conducting virtual asset transfers; a pure non-custodial publisher does not conduct transfers on behalf of users.
Key Restrictions
- No public-facing crypto services (e.g., custody, exchange, or transfer facilitation) may be offered without a VASP license from CIMA.
- If the software includes any value-added service (e.g., swap/fiat on-ramp integration where the publisher processes funds), it may trigger VASP classification and require licensing.
- The publisher must not hold, control, or have access to user private keys or funds to remain outside VASP regulation.
- A Cayman entity with a registered office is required if the publisher operates in or from the Cayman Islands.
Key Risks
- Regulatory ambiguity: CIMA has not issued specific guidance on whether non-custodial software publishers are VASPs; the VASP Act focuses on 'custody, exchange, trading platforms' — pure software may fall outside, but this is untested.
- If CIMA reinterprets 'virtual asset service' broadly to include software provision (e.g., as 'transfer' facilitation), the publisher could face retroactive licensing exposure.
- OFAC sanctions screening expectations exist for all Cayman entities, even non-VASPs; failure to screen could create secondary sanctions risk despite no custody.
- Consumer-protection/disclosure rules are not addressed in the available facts; publishers may need to comply with general Cayman consumer laws or face PR/reputational risk.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Virtual Asset (Service Providers) Act (VASP Act): https://www.cima.ky/upimages/regulatorymeasures/RegulatoryPolicy-RegistrationorLicensingofVASPs_1716492494.pdf
Virtual Asset Regulations 2025
Exchanges/Trading Platforms: Full VASP license required if operating a virtual asset trading platform under the VASP Act; grant fee of 100,000 KYD (~120,000 USD).
Custody Providers: Full VASP license mandatory; grant fee of 30,000 KYD (~36,000 USD).
Payment Processors: Registration suffices for basic services without custody or trading (e.g., transfers); license needed if involving custody or platforms. Fees start at 1,500–15,000 KYD for registration, up to 200,000 KYD for licenses based on scale.
Local Presence: Registered office in Cayman Islands required; no physical office, local staff, or residency mandates; at least one CIMA-approved director (especially for custody).
Incorporate Cayman entity (e.g., exempted company) with registered office.
VASPs Covered: All VASPs registered or applying for registration/licensing with the Cayman Islands Monetary Authority (CIMA), including obliged entities under the 2020 VASP Act (e.g., cryptocurrency exchanges, trading platforms, custodians). Covers transfers involving VASPs, other obliged entities, or non-obliged entities.
Threshold Amounts: USD 0; applies to all virtual asset transfers, defined as any transaction on behalf of an originator to make virtual assets available to a beneficiary.
Technical Implementation Requirements: VASPs must exchange specific originator and beneficiary data (e.g., identification, verification info) during transfers, maintain records for at least 5 years, and implement policies, procedures, and technological tools. Registrants submit compliance details to CIMA via email (vaspinfo@cima.ky) or REEFS portal (APP 101-84 Schedule E). Aligns with FATF Recommendation 16 and 2021 FATF guidance on private wallets, NFTs, and DeFi.
OFAC crypto designations (e.g., SUEX exchange, Blender mixer) are not binding but recommended for screening due to secondary risks: https://ofac.treasury.gov/sanctions-programs-and-country-information and https://sanctionssearch.ofac.treas.gov.
All Cayman persons/entities (including VASPs) must screen customers, counterparties, and transactions against applicable lists: UK sanctions (mirroring pre-Brexit EU/standalone UK regimes + UN), plus Cayman autonomous terrorist lists under Terrorism Law (2018 Revision), Proliferation Financing (Prohibition) Law (2017 Revision), and Proceeds of Crime Law (2020 Revision).
CIMA advises FSPs (including VASPs) to note OFAC's extraterritorial reach due to global USD/crypto transaction risks, though not legally binding locally; no crypto-specific exemptions apply under international regimes.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a publisher of self-custodial wallet software that never holds, controls, or accesses user funds does not appear to trigger VASP classification under the VASP Act, so no license is required and AML obligations do not attach, provided no custody or transfer facilitation occurs; however, a Cayman entity with a registered office is still required if operating in/from the Cayman Islands, and the lack of clear CIMA guidance on non-custodial software creates regulatory ambiguity risk.
Questions this verdict aims to answer
- Does software publishing trigger VASP / MSB classification?
- Do AML obligations attach when no custody exists?
- What disclosure or consumer-protection rules apply?