Why Operators Look at Bermuda
Bermuda offers the world’s first prudential and AML framework for digital asset businesses, administered by an established financial-services regulator with reinsurance-market credibility, and a tax-neutral environment for sub-threshold operators. Its Digital Asset Business Act 2018 carries more institutional weight than most offshore VASP regimes, and that difference shows up directly in banking conversations with US correspondents and European counterparties. Choosing between a Bermuda Class F licence and a lighter Caribbean registration is a choice between credibility and speed, not between two equivalent products.
The BMA’s pre-application engagement is not optional: the 4 to 12 weeks of supervisor dialogue before submission fixes the licence class, governance scope, and compliance posture, and skipping this stage routinely adds four to eight weeks to timelines and doubles rejection risk. Most operators treat this as a courtesy; treating it as load-bearing reduces the total timeline and improves approval odds materially.
A mature supervisor with first-mover credibility
The Bermuda Monetary Authority is Bermuda’s sole financial-services regulator, known internationally as the supervisor of one of the world’s largest reinsurance markets. When the Digital Asset Business Act 2018 entered force on 10 September 2018, it became the first comprehensive prudential plus AML framework for digital asset businesses anywhere, and the BMA has since built years of supervisory experience across all three licence classes. Unlike newer offshore VASP regimes that pair registration with light-touch oversight, the BMA runs a supervisor-led model: pre-application engagement, an Assessment and Licensing Committee that reviews every file, on-site inspections, and continuous off-site monitoring.
CFATF-leading AML standing and tax neutrality
The CFATF Mutual Evaluation Report of Bermuda, published 17 January 2020, rated Bermuda compliant or largely compliant on 39 of 40 FATF Recommendations, ranking first globally on technical compliance at publication and among the top six on effectiveness. Bermuda is not on the FATF Grey List, not on the European Union Anti-Money Laundering high-risk third-country list, and not on the United Kingdom anti-money laundering high-risk list. That clear standing gives Bermuda licensees the lowest counterparty due-diligence friction in the premium offshore tier, and it widens the gap to neighbours such as the British Virgin Islands, which entered the FATF grey list in June 2025. Bermuda is also tax-neutral for sub-threshold operators (the Taxation section below sets out the detail), and its deep reinsurance market supports custody insurance and bankruptcy-remote segregated-account structures for stablecoin reserves that newer offshore jurisdictions cannot offer.
Regulatory Framework
Bermuda regulates digital asset business under the Digital Asset Business Act 2018 (DABA), operative from 10 September 2018. The BMA administers DABA as Bermuda’s sole financial-services regulator, supported by subsidiary instruments including the Digital Asset Business Code of Practice, the Digital Asset Business (Cyber Risk) Rules 2023, and the Digital Asset Business (Custody of Client Assets) Rules 2025. DABA has been amended three times: in 2019 (derivative exchange and benchmark administrator additions), 2020 (the Class T sandbox licence), and 2023 (digital asset lending and repurchase service providers). A parallel Digital Asset Issuance Act 2020 covers public token offerings as a separate regime.
Definition: DABA Licence
A Bermuda DABA licence is an authorisation issued by the Bermuda Monetary Authority under the Digital Asset Business Act 2018 (2018:28). It permits the holder to carry on one or more defined digital asset business activities: issuing or redeeming digital assets, operating a digital asset payment service, operating a centralised or decentralised digital asset exchange, providing custodial wallet services, operating a digital asset derivative exchange, acting as a digital asset services vendor, market-making, or providing digital asset lending or repurchase services. Bermuda taxes these activities at 0% for sub-threshold operators and 15% for in-scope multinational enterprise groups under the Corporate Income Tax Act 2023.
Regulatory overlap
A single product can engage more than one Bermuda regime. Deposit-taking pulls in the Banks and Deposit Companies Act; tokens that qualify as investments engage the Investment Business Act 2003; public token issuance to retail engages the Digital Asset Issuance Act 2020; and cross-border fiat remittance distinct from digital asset payment engages the Money Service Business Act 2016. A tokenised security or real-world asset frequently needs two or three authorisations at once. The BMA is actively narrowing this overlap through consultation, for example by proposing to exempt tokenised fund units from the Digital Asset Issuance Act 2020, but those proposals are not yet settled law. Bermuda’s courts have also built a body of digital-asset insolvency precedent, and the DABA Tribunal under Part 6 of the Act is the confirmed appeal route for licensees challenging BMA decisions.
The Three Licence Classes
DABA establishes three licence classes calibrated to scale, business-model maturity, and operational complexity. All three cover the same defined digital asset business activities, differentiated by conditions, term, and capital expectations.
Class T (test) is for pilot and proof-of-concept testing: minimum net assets fall to USD 10,000, the BMA may waive the Bermuda head-office and resident Senior Representative requirements, and the licence runs for a specified period (typically 12 months, extendable once) with the expectation of graduating up. Class M (modified) is BMA-conditional and time-bound, granted with operational conditions (geographic or customer-type restrictions, volume caps, or capital phasing); a Bermuda head office and a BMA-approved Senior Representative are mandatory, with USD 100,000 baseline minimum net assets. Class F (full) is the full authorisation without specified term, carrying the broadest activity scope, the highest institutional credibility, and the full compliance load: on-island head office and Senior Representative, the USD 100,000 baseline (materially higher for custodians, exchanges, and stablecoin issuers), an annual cyber risk return, and a mandatory annual external audit.
All three classes cover the same defined activities: issuing or redeeming digital assets, digital asset payment services, operating a centralised or decentralised exchange, custodial and non-custodial wallet services, derivative exchanges, acting as a digital asset services vendor or market-maker, and digital asset lending or repurchase services (the last added by the 2023 amendment). Mining is not a digital asset business activity under DABA, and investment funds with recognised managers may obtain exemption under the Digital Asset Business Exemption Order 2023.
Requirements
DABA imposes a layered fit-and-proper, governance, capital, custody, and cybersecurity framework. Minimum net assets are USD 100,000 for Class M and Class F as a baseline, with BMA discretion to require materially higher amounts based on activity, scale, and risk; custodians and stablecoin issuers routinely hold multiples of that. A genuine Bermuda head office and a BMA-approved Bermuda-based Senior Representative are mandatory for Class M and Class F.
| Requirement | Class T | Class M | Class F |
|---|---|---|---|
| Minimum net assets | USD 10,000 | USD 100,000 baseline (BMA may direct higher) | USD 100,000 baseline (BMA may direct higher) |
| Bermuda head office | Not required (BMA discretion) | Required | Required |
| Bermuda-based Senior Representative | BMA may approve non-resident | Required; BMA-approved | Required; BMA-approved |
| Directors | Minimum 2 effective | Minimum 2 effective; typically ≥1 non-executive | Minimum 2 effective; ≥1 non-executive expected |
| MLRO, Compliance Officer, CISO | Required (proportional) | Required | Required |
| Annual external audit | Required (BMA-approved auditor) | Required (BMA-approved auditor) | Required (BMA-approved auditor) |
| Cyber Risk Annual Return | As directed by BMA | As directed by BMA | Within 4 months of fiscal year-end |
| Foreign ownership | 100% permitted | 100% permitted | 100% permitted |
Fit-and-proper, substance, and compliance documentation
The BMA assesses every controller at the 10%, 20%, 33%, and 50% thresholds, every director, and the senior officers, including the Compliance Officer, MLRO, and CISO, on integrity, competence, financial soundness, and time commitment. For Class M and Class F it also requires a genuine Bermuda head office rather than a registered-office address: strategic direction, risk, finance, and compliance must be exercised on-island, and while operational delivery can be outsourced with documented oversight, the decision-making itself cannot. The compliance package is the most heavily scrutinised part of any application, and the BMA expects it to be Bermuda-specific: an AML and counter-financing-of-terrorism programme, an enterprise-wide risk assessment with quantified residual-risk scoring, sanctions screening across UN, UK, US and EU lists, a Travel Rule implementation at the USD/EUR 1,000 threshold, transaction-monitoring and suspicious-activity-report frameworks, and KYC and KYB onboarding. Generic manuals adapted from other jurisdictions are routinely rejected.
Application Process
The BMA acknowledges receipt within two business days and completes a formal completeness check within three business days. The Assessment and Licensing Committee then considers a complete file (typically within 20 business days of the first Friday following completeness) and issues an initial decision roughly four weeks later. In practice that timeline holds only when the package is genuinely complete on first submission; most files go through two to four rounds of further-information requests before a decision.
- Entity formation and pre-engagement (4–12 weeks, parallel). Incorporate the Bermuda exempted company, complete the Beneficial Ownership Registry filing, appoint the resident representative, and book pre-application meetings with the BMA Fintech Department to confirm licence class early.
- Document drafting (8–16 weeks). The business plan plus the full compliance suite, all Bermuda-specific, runs to several hundred pages.
- Submission and completeness check (1–2 weeks). The BMA acknowledges within two business days and runs the completeness check within three; incomplete files are returned with a list of gaps.
- Further-information rounds (4–12 weeks). Typically two to four rounds covering governance, AML, custody, cybersecurity, projections, and operational substance. Response quality drives the timeline more than speed.
- Committee review and decision (4–8 weeks). The Assessment and Licensing Committee reviews the final file, decides, and sets any conditions for grant.
- Conditional approval to final grant (4–12 weeks). Capital injection, insurance, final hires, and operational readiness are completed before the licence issues.
Taxation
Bermuda is tax-neutral for the vast majority of digital asset businesses, with no VAT, no GST, no capital gains tax, and no withholding tax. The exception is the Corporate Income Tax Act 2023, which applies a 15% rate only to Bermuda Constituent Entities of multinational enterprise groups above the EUR 750 million consolidated-revenue threshold. Bermuda has implemented only the Qualified Domestic Minimum Top-Up Tax component of the OECD global minimum tax; it has not enacted the Income Inclusion Rule or the Undertaxed Profits Rule.
| Tax | Rate | Application |
|---|---|---|
| Corporate income tax | 0% (sub-threshold) / 15% (in-scope MNE groups) | 15% applies only to Bermuda Constituent Entities of MNE groups with consolidated revenue ≥ EUR 750m in two of four prior fiscal years |
| Capital gains tax | 0% | No capital gains tax in Bermuda |
| VAT / GST | 0% | No VAT in Bermuda |
| Withholding tax | 0% | No withholding tax on dividends, interest, or royalties |
| Payroll tax (employer) | ~9.75%–10.25% (international business) | The operational tax most digital asset businesses with Bermuda staff actually feel |
Tax Assurance Certificates protect sub-threshold operators against future Bermuda taxes on profits, income, capital gains, or appreciation until 31 March 2035, overridden only for in-scope Bermuda Constituent Entities. Bermuda is also committed to the OECD Crypto-Asset Reporting Framework, with first exchanges of information expected in 2027.
Ongoing Compliance
A DABA licence creates a permanent compliance obligation. The BMA supervises continuously, with periodic on-site examinations for Class F and regular off-site review for all classes, plus thematic reviews that can trigger entity-specific follow-up. The recurring obligations are an Annual Prudential Return and Cyber Risk Annual Return for Class F (each within four months of fiscal year-end), a mandatory annual audit by a BMA-approved auditor with no waiver available, and change-of-control approval at the 10%, 20%, 33%, and 50% thresholds, where failure to notify is a criminal offence.
Enforcement has teeth: operating without DABA authorisation carries fines up to USD 250,000 and imprisonment up to five years, and licensee breaches can attract civil penalties of up to USD 10 million. Cybersecurity sits in its own regime under the DAB (Cyber Risk) Rules 2023 and the Operational Cyber Risk Management Code of Practice, which require a Three Lines of Defence model, a board-level CISO mandate, and documented business continuity and custody key-management arrangements.
Banking
Banking is the hard part of any Bermuda digital asset operation, and it is a supporting consideration rather than the headline. Bermuda’s domestic banks are selective in onboarding digital asset businesses: an institutional-scale Class F licensee with audited financials and a substantive on-island team can secure a domestic account, while early-stage operators routinely cannot. Most licensees run a multi-rail, multi-jurisdiction stack instead.
International Standing
Bermuda is not on the FATF Grey List, not on the EU Anti-Money Laundering high-risk third-country list, and not on the UK anti-money laundering high-risk list. The 2020 CFATF Mutual Evaluation Report rated Bermuda compliant or largely compliant on 39 of 40 FATF Recommendations, the highest technical-compliance ranking globally at publication, and among the top six on effectiveness. That clear standing materially supports correspondent banking access and counterparty onboarding.
EU market access
MiCA contains no third-country equivalence regime, so there is no mechanism for the European Commission to recognise a Bermuda licence as equivalent. MiCA Article 61 permits third-country firms to serve EU clients only when the client initiates contact entirely on their own initiative, and ESMA’s guidelines (published 26 February 2025, applicable from 27 April 2025) read this narrowly: EU-targeted marketing, EU-language website content, geo-targeted advertising, app store availability, or EU-based influencers all void the exemption. Operators who want systematic EU access should obtain a CASP authorisation in an EU member state such as Lithuania, Cyprus, or Malta. For a detailed treatment, see Reverse Solicitation Under MiCA →.
Advantages and Limitations
Bermuda is the strongest premium-offshore option for institutional-grade digital asset businesses that prioritise credibility, regulatory maturity, and tax neutrality. The trade-offs are cost, timeline, and the absence of EU market access. Operators who need a fast, low-cost authorisation or systematic EU passporting will choose elsewhere.
- World’s first prudential DAB framework, with supervisory practice across Class T, M, and F that newer offshore VASP regimes cannot match.
- CFATF #1 on technical compliance, so counterparty due-diligence friction is materially lower than for grey-listed peers.
- Tax-neutral for sub-threshold operators, with assurance-certificate protection until 2035, and a three-class structure that scales from sandbox to full licence.
- × High first-year cost and a 6 to 12 month Class F timeline, materially slower and dearer than registration-based offshore regimes. A Class M or Class T entry validates the model at lower cost first.
- × Genuine Bermuda head-office substance is required for Class M and Class F, with ongoing payroll and office costs.
- × No EU passporting and selective domestic banking. Operators targeting EU clients should obtain a separate CASP authorisation in an EU member state, and most licensees rely on multi-rail banking stacks.
How Bermuda Compares
Bermuda sits in the premium offshore tier alongside the Cayman Islands and the British Virgin Islands, with Gibraltar as the regulated-upgrade reference outside the MiCA perimeter. Cayman and the BVI beat Bermuda on cost and timeline; the comparison Bermuda wins is institutional, on supervision model, counterparty credibility, and regime depth. The BVI’s 2025 FATF grey-listing has reshaped its banking position, and Gibraltar trades higher cost for UK-adjacent regulatory pedigree without a MiCA CASP licence.
| Factor | Bermuda | Cayman Islands | British Virgin Islands | Gibraltar |
|---|---|---|---|---|
| Licence Type | DABA Class T / M / F | VASP Registration (CIMA) | VASP Registration (FSC) | DLT Provider Licence (GFSC) |
| Regulator | Bermuda Monetary Authority | Cayman Islands Monetary Authority | BVI Financial Services Commission | Gibraltar Financial Services Commission |
| Supervision Model | Full prudential licensing; three classes | Dual-track registration plus licence | Registration regime | Full licensing |
| Timeline (full) | 6–12 months | 3–12 months | 4–6 months | 6–9 months |
| Min. Capital | USD 100,000 baseline net assets | No fixed statutory minimum | No fixed statutory minimum | Risk-based |
| Corporate Tax | 0% (sub-threshold) / 15% (in-scope MNE) | 0% | 0% | 15% (Gibraltar-source profits) |
| EU Passporting | No | No | No | No |
| FATF Status | Clear (CFATF #1 technical compliance) | Clear | Grey-listed (June 2025) | Clear |
| Institutional Credibility | High; first prudential DAB framework | High; deep hedge-fund domicile | Reduced by grey-listing | High; bespoke DLT regime |
| Best For | Premium institutional operators buying regulatory weight and tax neutrality | Funds-adjacent crypto and large-scale exchanges | Speed and cost (pre-grey-listing) | UK-adjacent regulated environment |
The common mistake is treating these four jurisdictions as a single offshore basket: a Bermuda Class F licence and a Cayman VASP registration are different products with different counterparty-acceptance profiles. Choose Bermuda if you need institutional credibility for US, UK, and EU counterparty acceptance, tax-neutral structuring for sub-threshold operations, or a mature judicial framework for digital asset disputes. Consider alternatives if you need to launch in three to four months (the Cayman Islands VASP route is faster), if you want systematic EU market access (choose an EU member state with a MiCA CASP licence), or if you want a UK-adjacent regulated environment (Gibraltar’s DLT Provider Licence).
Frequently Asked Questions
What is a Bermuda DABA licence and who needs one?
A Bermuda DABA licence is an authorisation issued by the Bermuda Monetary Authority under the Digital Asset Business Act 2018 (2018:28) to carry on one or more defined digital asset business activities: issuing or redeeming digital assets, operating a digital asset payment service, operating a centralised or decentralised digital asset exchange, providing custodial or non-custodial wallet services, operating a digital asset derivative exchange, acting as a digital asset services vendor or market-maker, or providing digital asset lending or repurchase services. Any person carrying on these activities in or from Bermuda needs a DABA licence. Mining is not a digital asset business activity under DABA.
Which DABA licence class is right for my business?
Class T (test) is for pilot, beta, and proof-of-concept operators with bounded scope, lower capital, and a 12-month time horizon. Class M (modified) is for operators with a clear product but BMA-imposed conditions: geographic, customer-type, or volume-based. Class F (full) is for institutional-scale operators with broad activity scope, no specified term, and the highest credibility. Most early-stage operators start with Class T or Class M and graduate to Class F as the business matures.
How long does Bermuda DABA licensing take?
Class T runs roughly 3 to 5 months end-to-end. Class M runs 4 to 7 months. Class F runs 6 to 12 months with a median of 6 to 9 months for well-prepared applications. The BMA acknowledges receipt within two business days, completes a formal completeness check within three business days, and the Assessment and Licensing Committee considers complete files within 20 business days of the first Friday following completeness, with an initial decision approximately four weeks after complete submission. Pre-application engagement of 4 to 12 weeks runs in parallel with document drafting and is effectively mandatory.
What is the minimum capital requirement for a Bermuda DABA licence?
The DABA baseline minimum net assets is USD 100,000 for Class M and Class F, and USD 10,000 for Class T. This is a baseline: the BMA exercises discretion under DABA Schedule 1 to direct higher amounts based on the nature, scale, complexity, and risk of the proposed activity. Custodians of client private keys, digital asset exchanges, and single-currency-pegged stablecoin issuers routinely hold multiples of the baseline. The capital adequacy framework is principles-based: the regime asks whether the business is conducted in a prudent manner, not whether a fixed paid-up share capital threshold has been met.
Is Bermuda on the FATF Grey List?
No. Bermuda is not on the FATF Grey List, not on the EU Anti-Money Laundering high-risk third-country list, and not on the UK anti-money laundering high-risk list. The CFATF Mutual Evaluation Report of Bermuda, published 17 January 2020, rated Bermuda compliant or largely compliant on 39 of 40 FATF Recommendations (first globally on technical compliance at publication) and among the top six on effectiveness. Bermuda is in regular CFATF follow-up.
Does Bermuda’s Corporate Income Tax Act 2023 affect a DABA-licensed business?
Only if the business is a Bermuda Constituent Entity of a multinational enterprise group with consolidated revenue of at least EUR 750 million in two of the four prior fiscal years. The Corporate Income Tax Act 2023 applies a 15% rate for fiscal years beginning on or after 1 January 2025, structured as a Qualified Domestic Minimum Top-Up Tax under OECD Pillar Two. Sub-threshold entities continue to pay 0% corporate tax on profits, capital gains, dividends, and withholdings. Tax Assurance Certificates protect sub-threshold operators against future Bermuda taxes until 31 March 2035.
Can a Bermuda DABA licensee serve EU clients?
A Bermuda licence does not grant EU market access or passporting rights. MiCA Article 61 permits third-country firms to serve EU clients only when the client initiates contact entirely on their own initiative; but ESMA’s guidelines (published 26 February 2025, applicable from 27 April 2025) interpret this exemption very narrowly, and any form of EU-targeted marketing, EU-language website content, geo-targeted advertising, app store availability, or use of EU-based influencers voids it. Operators seeking systematic EU market access should obtain a separate CASP authorisation in an EU member state. For full detail see the Reverse Solicitation Under MiCA guide.
Deciding where to licence?
We deliver crypto licensing in the jurisdictions we serve, including Lithuania, Cyprus, Gibraltar, Malta, Poland and Switzerland, and we file the work and stand behind the outcome. Tell us about your business and we will give you a straight answer on whether Bermuda or one of those routes fits.
Banking & Payments
A company and a licence still need a bank account
Banking is one of our three core services. We help high-risk and regulated businesses open the bank and payment accounts that others refuse: we work directly with EU EMIs, payment institutions and crypto-aware banks, confirm appetite before you apply, and make the introduction. Take it with your company and licence, or on its own.
Related Reading
- Crypto Licensing (VASP / CASP / MiCA): the jurisdictions we deliver in, side by side
- Cayman Islands VASP Registration: premium-offshore peer at lower cost and faster timeline
- Gibraltar DLT Provider Licence: a regulated jurisdiction we serve
- Reverse Solicitation Under MiCA: EU market-access analysis for non-EU licensees
- Bermuda Company Formation: exempted-company incorporation reference