Cayman Islands VASP License

The Cayman Islands has been the premier institutional offshore jurisdiction for financial services — hedge funds, private equity, structured finance — for over four decades. It is a British Overseas Territory with English common law, a statutory guarantee of zero corporate tax enshrined in legislation, a mature professional services ecosystem, and a regulatory authority — the Cayman Islands Monetary Authority (CIMA) — whose standards and reputation are recognised by Tier 1 banks, prime brokers, and institutional investors globally. When CIMA introduced a mandatory VASP registration framework in 2020 and expanded it to a full licensing regime in 2025, it brought that institutional infrastructure to bear on crypto regulation — with predictable consequences for the quality of oversight and the credibility of a Cayman VASP registration in the eyes of institutional counterparties.

As of early 2026, 19 VASPs are registered with CIMA— a deliberately selective register that reflects CIMA's thorough assessment approach rather than market disinterest. CIMA does not issue registrations or licenses to operators who cannot demonstrate genuine operational readiness, properly structured governance, and a substantive AML/CFT compliance framework. The number is small because CIMA is selective. That selectivity is precisely what makes a Cayman VASP registration commercially valuable.

The Phased VASP Regime — From Registration to Licensing

The Cayman Islands VASP regime has been implemented in stages. Phase 1, which came into effect on 31 October 2020 under the original Virtual Asset (Service Providers) Law 2020, required all VASPs to register with CIMA and established AML/CFT, targeted financial sanctions, and cybersecurity compliance as the core supervisory framework. Phase 1 covered all virtual asset activities — registration was required for entities providing exchange, transfer, issuance, and financial services related to virtual asset issuances.

Phase 2, which came into force on 1 April 2025 under the Virtual Asset (Service Providers) (Amendment) Act 2024, introduced a mandatory licensing regime for the two highest-risk VASP activities: virtual asset custody services and virtual asset trading platform operations. Entities providing these services must now hold a CIMA license, not merely a registration. Existing registered VASPs providing custody or trading platform services had 90 days from 1 April 2025 — until 30 June 2025 — to submit a licence application or have their registration cancelled. Once licensed, the previous registration is superseded.

A Phase 3 is expected in due course, which will bring into force provisions relating to the issuance of newly created virtual assets directly to the public and a sandbox licensing regime for novel services.

Registration vs Licence — Which Does Your Business Require?

Registration is requiredfor entities providing any of the following virtual asset services in or from the Cayman Islands: exchange between virtual assets and fiat currencies; exchange between one or more forms of convertible virtual assets; transfer of virtual assets; participation in and provision of financial services related to an issuer's offer or sale of a virtual asset. The application fee is USD 6,098 (non-refundable). Annual fees are determined by revenue under the VASP Regulations.

Licensing is required for entities providing virtual asset custody services (safekeeping and administration of virtual assets or instruments enabling control of virtual assets) or operating virtual asset trading platforms. Licensing carries enhanced governance, prudential, and cybersecurity requirements above those applicable to mere registrants. Licensees must appoint a minimum of three directors, at least one of whom must be independent and meet CIMA's fit and proper standards. This three-director requirement — introduced under the Phase 2 amendments — is higher than the two-director minimum applicable in most other Cayman financial services sectors. The application fee for licensing is also USD 6,098, with an additional fee payable on licence grant and annual renewal fees thereafter, both calculated by reference to the nature of services and actual or projected revenue.

An entity performing both activities requiring registration and activities requiring licensing need only apply for a licence — the licence encompasses all regulated activities and the separate registration is not required.

Tokenised Funds Exemption — 2026 Legislative Bills

In early 2026, the Cayman Islands government published the Virtual Asset (Service Providers) (Amendment) Bill 2026 alongside the Mutual Funds (Amendment) Bill 2026 and the Private Funds (Amendment) Bill 2026. Together, these Bills clarify that the issuance, creation, sale, transfer, or disposal of tokenised equity or investment interests by regulated mutual funds and private funds will not constitute an issuance of virtual assets under the VASP Act. Regulated tokenised funds structured and operated under the Mutual Funds Act or Private Funds Act — whose virtual asset activities are incidental to core fund operations — are generally exempt from VASP Act registration or licensing requirements unless they additionally engage in custody, exchange, or public issuance services.

This legislative clarification is significant for the growing market in tokenised alternative investments. Fund managers structuring tokenised fund vehicles through Cayman entities now have statutory clarity that the VASP regime does not impose duplicative regulation where comprehensive fund regulation under the Funds Acts already applies. Operators of tokenised funds should nonetheless confirm their specific structure falls within the exemption with qualified Cayman legal counsel.

CIMA's 2025 Supervisory Programme — What the Thematic Review Found

CIMA conducted a Thematic Desk-based Review of 11 regulated VASPs between September 2024 and February 2025, covering a mixture of virtual asset exchanges and custody service providers. The findings were published in November 2025and represent the most detailed public disclosure of CIMA's supervisory expectations for VASPs to date. The findings are directly relevant to any new applicant because they define what CIMA will assess during the licensing process and in ongoing supervision.

The November 2025 thematic review identified the following key deficiency areas across the 11 VASPs reviewed:

• •<strong>Cybersecurity — 82% of VASPs reviewed had no cybersecurity insurance.</strong> CIMA found widespread deficiencies in cybersecurity governance, inadequate Data Loss Prevention (DLP) tools, absent real-time threat monitoring, and insufficient oversight of outsourced technology arrangements. CIMA's supervisory focus has shifted from the existence of policies to evidence of implementation and testing
• •<strong>Virtual asset custody policies — 40% of VASPs had inadequate custody policies.</strong> While CIMA acknowledged the Rule and Statement of Guidance for Virtual Asset Custodians was only published in December 2024, it identified significant gaps in custody policies, periodic independent custody audits, and client asset segregation documentation
• •<strong>Business continuity planning</strong> — multiple BCPs were found not compliant with the applicable Statement of Guidance, lacked board approval, and had not been tested or independently reviewed
• •<strong>Corporate governance</strong> — gaps in board composition, lack of director independence, and absence of succession planning for directors and senior management
• •<strong>AML/CFT deficiencies</strong> — weak or outdated Business Risk Assessments, inadequate Enhanced Due Diligence for high-risk customers and PEPs, incomplete sanctions screening procedures, and insufficient Travel Rule compliance documentation
• •<strong>Failure to notify CIMA of key changes</strong> — instances where changes to key personnel, regulatory actions in other jurisdictions, or material cybersecurity incidents had not been reported to CIMA within the required 30-day window

CIMA also published a separate AML/CFT Supervisory Circular on 18 September 2025, disclosing findings from on-site and off-site VASP inspections conducted since 2023 and reiterating expectations for remediation. On 5 June 2025, CIMA cancelled the registration of AC Holding Limitedfor multiple deficiencies — failure to provide documents to CIMA, failure to implement AML systems and procedures, and breaches of CIMA's Rules on Corporate Governance and Internal Controls. This enforcement action confirmed that CIMA is fully prepared to take decisive action where non-compliance is not remedied. There is no room for treating a Cayman VASP registration as a one-and-done compliance exercise.

December 2025: Quarterly Financial Returns Introduced

On 1 December 2025, CIMA released the VASP Financial Returns Form, introducing a quarterly financial reporting obligationfor all registered and licensed VASPs. This is a significant additional ongoing obligation that was not present under the original Phase 1 framework. VASPs must now submit quarterly financial data to CIMA through the REEFS portal, in addition to the existing annual audited accounts requirement. The December 2025 return introduction, combined with CIMA's use of the Strix SupTech system — which automates data collection and generates live AML risk ratings from Travel Rule Returns submitted by VASPs — signals that CIMA is building a data-driven, continuous supervisory model for VASPs rather than a periodic inspection-only approach.

Governance Requirements Under Phase 2

The Phase 2 amendments introduced materially enhanced governance requirements for CIMA-licensed VASPs, reflecting CIMA's updated Regulatory Policy published in May 2025. Key requirements for licensees include:

• •<strong>Minimum three directors</strong> — including at least one independent director not otherwise affiliated with the business, meeting CIMA's fit and proper standards. Prior CIMA approval required for all director appointments
• •<strong>Fit and proper assessment</strong> — all directors, senior officers, trustees, and beneficial owners are assessed for integrity, competence, and financial soundness. Prior CIMA approval is required for any new senior officer or director appointment after registration
• •<strong>Client asset segregation</strong> — licensed VASPs must maintain segregation of client and proprietary virtual assets, supported by detailed custodial records and appropriate insurance or indemnity cover
• •<strong>Prior CIMA approval for share issuances and transfers</strong> — any issuance or voluntary transfer of 10% or more of total shares requires CIMA prior approval; dual licensing applies where the VASP activity also requires authorization under a separate regulatory regime
• •<strong>Audited financial statements</strong> — annual audited accounts from a CIMA-approved Cayman auditor must be filed with CIMA. The auditor must be appointed and CIMA notified within 14 days of registration or licence grant
• •<strong>Cybersecurity insurance</strong> — required for licensees, with CIMA reviewing evidence of implementation (not just the existence of a policy) as part of licensing assessment and ongoing supervision
• •<strong>Incident and change reporting</strong> — regulatory actions or litigation in other jurisdictions must be reported to CIMA within 30 days; material cybersecurity incidents must be reported within 30 days; VASPs deciding to cease operations must notify CIMA within 15 days

AML/CFT, Travel Rule, and CIMA Supervision Technology

All Cayman VASPs are regulated under the Anti-Money Laundering Regulations (AMLRs) and the AML Guidance Notes (2020 Revision, as amended), aligned with FATF Recommendation 15. The Travel Rule applies to VASP-to-VASP transfers, and VASPs must submit VASP Travel Rule Returns to CIMA through REEFS on an ongoing basis. CIMA uses these returns — alongside the new quarterly financial returns — as live data inputs into its Strix SupTech system, which generates automated risk ratings for each VASP and directs supervisory resource allocation accordingly. A VASP with weak Travel Rule return data is more likely to trigger a targeted inspection than one with clean, complete submissions.

The September 2025 AML/CFT Circular specifically highlighted deficiencies in on-chain transaction monitoring: several VASPs lacked adequate procedures for handling on-chain transaction alerts, failed to define who can approve transactions with higher-risk exposure, and had inadequate procedures for dealing with sanctioned entities and sanctioned jurisdictions. These are now explicit supervisory priorities for CIMA's ongoing inspection programme.

Regulatory Sandbox — For Novel and Innovative Services

CIMA may direct an applicant to apply for a Sandbox Licence rather than a standard registration or licence where the proposed service is novel or technologically innovative, where the applicant cannot yet demonstrate full compliance with all standard requirements, or where CIMA requires additional time to assess the service model. A Sandbox Licence allows CIMA to exempt the holder from certain obligations that would otherwise apply, or to impose tailored additional requirements specific to the novel activity. Phase 3 of the VASP Act, expected in due course, will formally introduce a standalone sandbox licensing framework for innovative services.

Tax Position — Statutory Zero-Tax Guarantee

The Cayman Islands' tax-neutral status is not merely a policy preference — it is a statutory guarantee. Cayman law provides that no corporate income tax, capital gains tax, or withholding tax will be imposed on Cayman companies for a guaranteed period (historically 20 years, now renewed). This statutory guarantee is a meaningful distinction from jurisdictions where zero-tax status is a policy that could be changed by a future government. For institutional counterparties, the statutory tax guarantee combined with CIMA's regulatory credibility makes the Cayman VASP the strongest institutional offshore crypto credential available.

Cayman VASP vs BVI, Seychelles, and Mauritius

The Cayman VASP is the most institutionally credible of the four major offshore VASP jurisdictions — Cayman, BVI, Seychelles, and Mauritius. CIMA's standing with Tier 1 banks, prime brokers, and institutional asset managers exceeds that of the BVI FSC, Seychelles FSA, and Mauritius FSC in terms of counterparty familiarity and risk assessment frameworks. For an operator whose primary constraint is opening institutional banking or prime brokerage relationships, Cayman is the right structure.

The trade-off is cost and governance burden. The BVI VASP requires no minimum capital, no physical office, and fewer governance requirements — it is structurally more accessible for smaller operators and holding companies. Seychelles offers a 1.5% beneficial tax rate, broader permitted activities including explicit ICO/NFT frameworks, and strong Asian/African market positioning. Mauritius offers 46 double taxation agreements and deep African banking relationships that Cayman cannot match for Africa-focused operations. The Cayman VASP is optimal for institutional-grade crypto businesses whose primary competitive advantage is regulatory credibility with sophisticated counterparties — not tax minimisation or African market access.

For operators that need EU retail passporting, no offshore structure substitutes for a Cyprus MiCA CASP authorization. Cayman VASP and Cyprus MiCA CASP are often held in parallel by institutional operators — Cayman for the institutional offshore vehicle, Cyprus for EU retail-facing operations.

How Zitadelle AG Assists with Cayman VASP Registration and Licensing

Zitadelle AG provides end-to-end support for Cayman Islands VASP registration and Phase 2 licensing — covering regulatory scoping and Phase 1 vs Phase 2 classification, Cayman exempted company formation, CIMA-approved auditor coordination, AML/CFT compliance framework preparation aligned with CIMA's September 2025 Circular findings, cybersecurity policy and business continuity plan preparation, fit and proper documentation for all directors and key persons, REEFS application preparation and submission management, and ongoing post-registration compliance including quarterly financial returns and Travel Rule return management. For operators building multi-jurisdictional structures, we coordinate Cayman registration alongside BVI, Seychelles, Mauritius, and Cyprus MiCA CASP authorizations across our Cyprus, Labuan, and Mauritius offices.