Why Operators Consider the Cayman Islands
The Cayman Islands offers institutional-grade crypto regulation under the Virtual Asset (Service Providers) Act, paired with zero direct taxation, English common-law courts with final appeal to the Judicial Committee of the Privy Council, and the world’s deepest hedge fund domicile. For crypto exchanges, custodians, token issuers and fund managers raising institutional capital, that combination of a credible regulator and a mature professional-services ecosystem is the main draw.
Institutional credibility commands a dual cost: applicants must absorb six-figure first-year compliance spend, and should expect 12–18 months before operationalising, as banking onboarding (two to six months) stacks sequentially behind CIMA licensing (six to twelve months) for well-prepared applicants. If your business model requires faster time-to-market or you lack institutional banking relationships, consider faster offshore peers like Bermuda or Panama instead.
Four factors drive the choice. First, regulatory credibility: CIMA holds IOSCO and Group of International Finance Centre Supervisors memberships, supervises VASPs on the same Statements of Guidance, Rules and on-site inspection regime that governs its banking and funds industries, and sets a substantive bar (capital adequacy, governance, cybersecurity, AML/CFT, sanctions screening) materially higher than light-touch offshore peers. Second, zero direct tax backed by a statutory undertaking: no corporate, capital gains, withholding or personal income tax, and exempted entities can obtain a Tax Concessions Undertaking locking in that position for 20 years, with a 10-year extension, and up to 50 years for LLCs and limited partnerships.
Third, the post-FATF and post-EU AML reset: Cayman left the FATF grey list on 27 October 2023 and the EU AML high-risk list on 7 February 2024, which materially improved correspondent banking, prime brokerage and institutional counterparty access and placed Cayman in the same band as established financial centres. Fourth, a deep fund-adjacent ecosystem: as the world’s leading hedge fund domicile, Cayman gives crypto operators access to CIMA-approved auditors, fund administrators and offshore counsel with no learning curve, a practical edge over offshore alternatives where every provider starts from a thinner base.
Regulatory Framework
The Cayman Islands regulates Virtual Asset Service Providers under the Virtual Asset (Service Providers) Act (2024 Revision), administered by the Cayman Islands Monetary Authority. The Act commenced on 31 October 2020 with the Registration phase; Phase 2, the Licensing regime for custody and trading platforms, came into force on 1 April 2025.
Definition: Virtual Asset Service Provider
A Virtual Asset Service Provider is, under section 3 of the VASP Act, a company or entity providing one or more of: exchange between virtual assets and fiat currencies; exchange between virtual assets; transfer of virtual assets; virtual asset custody service; or participation in and provision of financial services related to a virtual asset issuance or sale. The same section captures the issuance of virtual assets directly.
CIMA’s Virtual Assets and Fintech Innovation Unit administers the regime alongside its banking, securities, insurance and funds supervision, and acts as the AML supervisor under the Anti-Money Laundering Regulations, with the Financial Reporting Authority operating as the jurisdiction’s FIU. The common mistake is treating the VASP Act in isolation. The Act is the entry point; substantive compliance lives in CIMA’s supporting instruments: the Regulatory Policy on Registration or Licensing of VASPs; the Rule and Statement of Guidance on obligations for custodians and trading platforms (effective 1 April 2025); the Cybersecurity, Internal Controls, Corporate Governance and Market Conduct rules; and the Anti-Money Laundering Regulations with their Guidance Notes on AML/CFT/CPF.
Regulatory Overlap
Three overlap regimes are worth naming. Tokenised funds regulated under the Mutual Funds Act or Private Funds Act are generally exempt from additional VASP registration where the virtual-asset activity does not extend beyond fund operations. Where a virtual asset has securities characteristics, the activity may trigger the Securities Investment Business Act (SIBA). Custody activity resembling fiduciary banking may interact with the Banks and Trust Companies Act and the Trust Companies Act.
Licence Types and Activities Covered
The Cayman VASP regime runs on two parallel tracks under one statute. Exchange between virtual assets and fiat, transfer of virtual assets, and participation in financial services related to virtual asset issuance trigger Registration. Virtual asset custody services and operating a virtual asset trading platform trigger a Licence.
Covered Activities: Registration
Registration covers the Phase 1 activities: operating a fiat on/off-ramp (exchange between virtual assets and fiat), crypto-to-crypto swap services, transfer of virtual assets on behalf of customers including OTC brokerage, virtual asset issuance subject to the private-sale carve-outs, and advisory or arranging activities tied to an issuance or sale.
Covered Activities: Licence (Phase 2)
A VASP Licence has been mandatory since 1 April 2025 for the two Phase 2 activities:
- Virtual Asset Custody Service. Holding client virtual assets, managing private keys, or providing custodial wallets.
- Virtual Asset Trading Platform. Operating a centralised matching engine, order book or marketplace where customer orders for virtual assets are matched.
Where a single VASP performs both Registration-class and Licence-class activities, only a Licence is required and the prior Registration falls away. A hybrid CeFi/DeFi platform with an internal order book is a VATP; a non-custodial routing service may sit within Registration.
What Does NOT Require Registration
Several activities fall outside the regime: private-sale issuers below the regulatory thresholds; tokenised funds under the Mutual Funds Act or Private Funds Act where the virtual-asset activity is incidental; entities already holding CIMA authorisation under another law where a waiver applies; and pure software providers that do not custody assets, match orders or transfer on behalf of customers. Foundation companies acting as ownerless stewardship vehicles for decentralised protocols also sit outside it where any VASP-triggering activity is conducted by separate licensed entities, a structure increasingly preferred for DAO and DeFi architecture from Cayman.
Tokenised Securities and Real-World Assets
Cayman runs a mixed regime, so tokenisation does not by itself move an asset into the VASP Act. Only non-security virtual assets sit under that Act. Tokenised funds route to the Mutual Funds Act or Private Funds Act, and security tokens (a tokenised share, bond or note) route to SIBA, all supervised by CIMA. A VASP registration or licence therefore does not cover tokenised funds or security tokens; those legs run through the funds legislation and SIBA, paired with VASP custody or trading-platform permissions only where the operating model genuinely needs them.
Requirements
CIMA assesses VASP applicants against governance, capital, fit-and-proper, AML/CFT, cybersecurity and operational-resilience standards calibrated to the activity profile. The VASP Act imposes no fixed statutory minimum capital; CIMA reviews adequacy case-by-case based on business model, risk profile, scale and complexity, with deeper scrutiny for Licence applicants.
| Requirement | Standard |
|---|---|
| Entity type | Exempted Company, Exempted LLC, Foundation Company, ELP, SPC, or registered foreign company |
| Min. directors | Three, including at least one independent director, in force since 1 April 2025 |
| Foreign ownership | 100% permitted |
| Beneficial ownership disclosure | 10% (VASP application); 25% (central BO register) |
| Local presence | Registered office in Cayman; in practice, Cayman-resident MLRO, Deputy MLRO and AMLCO |
| Min. capital | No fixed statutory minimum; risk-based net worth and reserves expected for Licence applicants |
| Insurance | Professional indemnity and cyber cover effectively expected for custody and VATP applicants |
| Senior officer pre-approval | All senior officers and ≥10% holders require prior CIMA approval (VASP Act s.9) |
| Cybersecurity policy | Required under the Cybersecurity Rule and SOG |
| AML/CFT/CPF manual | Cayman-specific procedures referencing the AMLRs, Guidance Notes and Travel Rule |
Fit-and-Proper Standard
CIMA assesses fitness and propriety across four dimensions: integrity, competence, financial soundness and regulatory history. Each senior officer and ≥10% shareholder submits a Personal Questionnaire, CV, police clearance certificate, regulatory references and qualifications. Submitting incomplete background documentation is a common trigger for a request-for-information cycle that adds four to eight weeks per round.
Beneficial Ownership and Privacy
Cayman’s Beneficial Ownership Transparency Act 2023 entered into force in 2024, with enforcement from 1 January 2025. Access regulations calibrate public disclosure: competent authorities have full access, while restricted access is available to journalists, AML-focused civil society organisations and counterparties in actual or potential business relationships, on payment of a modest fee.
Application Process
VASP applications are submitted through CIMA’s Regulatory Enhanced Electronic Forms Submission portal (REEFS), typically via a Cayman-based corporate services provider or law firm with portal access. CIMA strongly encourages a pre-application meeting with its Virtual Assets and Fintech Innovation Unit before formal submission, particularly for Licence-track applicants.
Stage 1 2–4 weeks
Entity Formation and Pre-Application
Forming a Cayman exempted company (or LLC, foundation, ELP or SPC) is the first step. In parallel, schedule the CIMA pre-application meeting.
Stage 2 4–8 weeks
Documentation Assembly
Business plan, AML/CFT manual, cybersecurity policy, fit-and-proper packs, financial projections, and custody/VATP-specific policies. The Schedule 1A documentation must be complete on first submission.
Stage 3 2–4 weeks
REEFS Submission and Completeness Review
Application forms filed via REEFS with all annexes. CIMA confirms completeness or returns the application.
Stage 4 8–16 weeks (Registration); 16–32 weeks (Licence)
Substantive Review and RFI Cycles
CIMA examines business plan, governance, capital, AML, IT, and custody/VATP-specific arrangements. One to three request-for-information rounds is normal.
Stage 5 2–3 weeks
Approval and Conditions
The CIMA Management Committee considers applications weekly; conditional approval is issued in writing and conditions must be satisfied before unconditional registration or grant of licence.
The biggest single lever on overall timeline is getting the first submission right. CIMA examines activity classification and documentation completeness at the front gate, so the substantive review should open against a fully assembled file rather than a moving target. Experienced applicants begin banking conversations in parallel with the REEFS submission rather than after, because a two-to-six month banking onboarding stacked on top of a six-to-twelve month Licence review is operationally unworkable for most institutional projects.
Taxation
The Cayman Islands has no direct taxation: no corporate income tax, no capital gains tax, no withholding tax, no personal income tax, no inheritance or estate duty and no payroll tax. Indirect taxes are limited to customs duties, stamp duty on Cayman-situs documents and real estate, and tourism accommodation tax.
Tax Concessions Undertaking
Exempted companies, exempted LLCs and exempted limited partnerships can apply to the Cabinet for a written undertaking confirming that no Cayman tax law enacted during the undertaking period will apply to the entity. The statutory ceiling is 30 years for companies and 50 years for LLCs and ELPs; in practice exempted companies receive 20-year undertakings with a 10-year extension available. The undertaking does not create new exemptions; it locks in the existing zero-tax position against future legislation.
Reporting and Home-Country Tax
Cayman participates in the OECD Common Reporting Standard and operates a Model 1B agreement with the United States for FATCA. CRS 2.0 and the Crypto-Asset Reporting Framework (CARF) both take effect from 1 January 2026 with first reporting in 2027, and explicitly bring crypto-assets into scope for Cayman VASPs.
Entity-level tax neutrality does not eliminate home-country exposure for owners. UK persons may face CFC charges; EU shareholders may be exposed to anti-hybrid and ATAD rules and to Pillar Two minimum-tax where consolidated group revenue exceeds EUR 750 million. The common mistake is treating Cayman zero-tax as a free option without modelling the position at the shareholder level. US persons are excluded from our client base, and US tax treatment of Cayman structures is outside what we advise on.
Ongoing Compliance
The compliance load on a Cayman VASP sits materially closer to a licensed bank than to a light-touch offshore registrant. The recurring obligations are a VASP annual fee (due 15 January), an annual return to the General Registry including Economic Substance Notification where applicable, an AML/CFT annual return and audited financial statements where CIMA requires them, monthly beneficial ownership filings via the corporate services provider, a quarterly VASP Financial Returns Form via REEFS, and a quarterly Travel Rule return for transfers at or above the EUR 1,000 / USD 1,000 threshold.
Under VASP Act section 9, prior CIMA approval is needed before appointing any senior officer, issuing shares totalling 10% or more, transferring any issued share, changing the business plan to add new VASP services, or changing the registered office. Material cybersecurity incidents must be notified within 72 hours and litigation within 30 days. CIMA runs on-site inspections and thematic reviews, and its enforcement posture is remediation-led rather than headline-led.
Pure VASP activity is not one of the nine relevant activities under the International Tax Co-operation (Economic Substance) Act, but particular crypto models can trigger economic substance through related activities: crypto fund management, crypto lending and staking-as-a-service (potentially finance and leasing), and IP licensing of crypto IP. Run the economic substance analysis at structuring time, not at first filing; entities tax-resident outside Cayman can disapply the test by providing evidence to the Department for International Tax Cooperation.
Banking
Banking access for Cayman-licensed VASPs has improved materially since the October 2023 FATF delisting and the February 2024 EU AML delisting, but it remains selective. Most operators run a multi-provider stack rather than relying on a single relationship, and CIMA expects custody licensees to evidence fiat-custody arrangements meeting specific regulatory standards.
A practical banking stack for Cayman VASPs typically combines a primary European EMI for SEPA and SWIFT rails, a specialist Swiss or Liechtenstein institution for higher-touch institutional flow, selective Caribbean private banks for local operational accounts, and Asian banking partners for APAC client flows. CIMA’s custody rule requires client fiat to sit in a bank regulated by CIMA or another regulator in a non-high-risk jurisdiction, segregated from VASP proprietary funds. Cayman has no statutory client-asset compensation scheme, so protection rests on those segregation requirements and the disclosure regime around custody insurance; institutional counterparties will probe these arrangements in detail.
FATF Standing and EU Market Access
The Cayman Islands is FATF-clear as of 2026, having exited the FATF Jurisdictions under Increased Monitoring list on 27 October 2023 after satisfying all 63 Recommended Actions, and was removed from the EU AML high-risk third-country list on 7 February 2024. The reset materially improved correspondent banking, prime brokerage and institutional counterparty access.
A Cayman VASP authorisation confers no EU passporting rights. The Markets in Crypto-Assets Regulation contains no third-country equivalence regime, so there is no mechanism for the European Commission to recognise a Cayman licence as equivalent to a MiCA CASP authorisation. MiCA Article 61 permits third-country firms to serve EU clients only when the client initiates contact entirely on their own initiative. ESMA’s Guidelines on reverse solicitation under MiCA, applicable from 27 April 2025, interpret this restrictively: EU-targeted marketing, EU-language website content, geo-targeted advertising, app-store availability, or the use of EU-based influencers all constitute solicitation that voids the exemption. The exemption is designed for isolated contacts, not systematic EU market access. For detail, see Reverse Solicitation Under MiCA →.
How Cayman Islands Compares
The most useful comparison set for the Cayman Islands is Bermuda (a premium offshore peer with the Digital Asset Business Act), the British Virgin Islands (a Caribbean peer with the VASP Act 2022), and Panama (a LatAm peer with comparable tax neutrality). Malta sits as the natural cross-tier EU reference for operators weighing offshore credibility against MiCA passporting access.
| Factor | Cayman Islands | Bermuda | British Virgin Islands | Panama |
|---|---|---|---|---|
| Licence Type | VASP Registration / Licence (CIMA) | DABA Class F/M/T (BMA) | VASP Registration (FSC) | VASP Reg. (Superintendencia) |
| Timeline | 3–6 months (Reg.); 6–12 months (Licence) | 6–12 months | 4–8 months | 4–8 months |
| Min. Capital | No fixed minimum | Risk-based per class | No fixed minimum | No fixed minimum |
| Corporate Tax | 0% | 0% (15% Pillar Two from 2025) | 0% | 0% (territorial) |
| EU Passporting | No | No | No | No |
| FATF Status | Clear (Oct 2023) | Clear | Grey-listed (June 2025) | Clear (2024) |
| Best For | Institutional exchanges, custodians, fund managers | Premium offshore with formal Class structure | Cost-efficient offshore with EU/UK proximity | LatAm and Latin client base |
Cayman and Bermuda occupy the premium offshore band, with Bermuda’s DABA delivering a slightly more bespoke per-applicant calibration and Cayman delivering deeper ecosystem leverage from its fund-administration base. BVI is the cost-efficient offshore peer; Panama anchors the lower-cost LatAm cluster with a more limited regulatory toolkit. Against Malta as the cross-tier EU reference, Cayman trades MiCA passporting access for institutional offshore credibility, zero direct taxation and the foundation-company toolkit. Operators planning material EU client revenue should pair a Cayman entity with an EU CASP entity rather than rely on reverse solicitation as a market-access strategy.
When Cayman Islands Is the Right Choice
Cayman tends to fit if you operate or plan institutional-scale activity (custody, exchange, prime brokerage, regulated fund management); you target US, UK, Asian or institutional global counterparties where Cayman’s reputation accelerates onboarding; you need a foundation company or SPC structure that other offshore peers do not provide; and you can absorb a substantial first-year compliance investment.
Consider alternatives if your primary client base is EU retail (consider Malta or another EU CASP jurisdiction), you are early-stage and pre-revenue, you are LatAm-focused, or you need a faster time-to-licence.
Frequently Asked Questions
Who needs a Cayman VASP authorisation?
Any company providing virtual asset services in or from the Cayman Islands needs either Registration or a Licence under the Virtual Asset (Service Providers) Act. Registration covers exchange, transfer, issuance, and participation in financial services related to virtual asset issuance. A Licence is required for virtual asset custody services and virtual asset trading platforms since 1 April 2025. Tokenised funds regulated under the Mutual Funds Act or Private Funds Act are generally exempt. Pure software providers that do not custody, match or transfer on behalf of customers fall outside the regime.
Can a Cayman VASP be 100% foreign-owned?
Yes. There is no foreign ownership restriction on Cayman VASPs. Foreign-controlled entities pay the standard CIMA fee schedule. The 10% beneficial ownership disclosure threshold applies to the VASP application; the 25% threshold applies to the central beneficial ownership register under the Beneficial Ownership Transparency Act 2023.
Does the Cayman VASP Act cover tokenised funds or securities?
No. Cayman runs a mixed regime: only non-security virtual assets sit under the VASP Act. Tokenised funds stay under the Mutual Funds Act or Private Funds Act, and security tokens stay under the Securities Investment Business Act (SIBA), all supervised by CIMA. A VASP registration or licence does not cover tokenised funds or security tokens; those legs run through the funds legislation and SIBA.
How long does Cayman VASP authorisation take?
Registration typically takes 3–6 months from a complete first submission. A Licence (custody or trading platform) typically takes 6–12 months for well-prepared applicants. CIMA does not publish formal service-level agreements, and repeated requests for information extend timelines materially. Complex institutional applications can run substantially longer.
What is the minimum capital for a Cayman VASP?
The Virtual Asset (Service Providers) Act does not impose a fixed statutory minimum capital. CIMA assesses adequacy case-by-case based on business model, risk profile, scale and complexity. For Licence applicants, CIMA expects net worth, capital reserves and financial stability appropriate to the risk profile, and may require professional indemnity insurance, cyber insurance and a documented wind-down arrangement.
Is the Cayman Islands on the FATF grey list?
No. The Cayman Islands was removed from the FATF Jurisdictions under Increased Monitoring list on 27 October 2023 after satisfying all 63 FATF Recommended Actions. The EU removed Cayman from its AML high-risk third-country list on 7 February 2024, and the UK AML list removed Cayman on 5 December 2023.
Can a Cayman VASP serve EU clients?
Only on a reverse-solicitation basis under MiCA Article 61. A Cayman licence does not confer EU passporting rights. ESMA’s Guidelines on reverse solicitation under MiCA, applicable from 27 April 2025, interpret the exemption restrictively: targeted advertising into the EU, EU-language websites, EU-targeted influencer engagement, sponsorship of EU events, or affiliate programmes directing EU traffic all void the exemption. Operators with material EU client revenue should pair the Cayman entity with a separate EU CASP authorisation in an EU member state. See the full reverse solicitation guide for detail.
Deciding where to licence?
We help you choose the right home for your crypto business and deliver the licensing in the jurisdictions we serve. Talk it through with us first.
Banking & Payments
A company and a licence still need a bank account
Banking is one of our three core services. We help high-risk and regulated businesses open the bank and payment accounts that others refuse: we work directly with EU EMIs, payment institutions and crypto-aware banks, confirm appetite before you apply, and make the introduction. Take it with your company and licence, or on its own.
Related Reading
- Crypto Licensing Overview: the VASP / CASP / MiCA jurisdictional landscape
- Malta Crypto Licensing: an EU CASP route with MiCA passporting
- Reverse Solicitation Under MiCA: serving EU clients from a non-EU jurisdiction
- Offshore Company Formation: entity structures for offshore operators