Cayman is the global standard for crypto funds and regulated VASPs. Phase 2 licensing came into force on 1 April 2025: custody providers and trading platforms are now required to obtain a full license. Sandbox, DAO foundations, tokenized funds — separate tracks.
The VASP Act 2024 (Revision) and the 2025 amendments set out clear categories. The level of risk determines: registration or full license, capital requirements, directors and compliance.
Registration as a Registered Person with CIMA for virtual asset activities: token issuance and transfers. Without custody of client assets or operating a trading platform — a simplified regime with AML/CFT requirements.
Low riskCIMA license for virtual asset custody services and operating a trading platform. Mandatory from 01.04.2025. Requirements: minimum 3 directors (1 independent), $100,000 capital, AML officer in the islands, enhanced compliance procedures.
Custody · ExchangeA temporary regime of up to 12 months for innovative business models in the virtual asset space. Afterwards — transition to a permanent license or registration. Direct supervision by CIMA.
InnovationA Foundation Company as a legal wrapper for a DAO. Can exist without members or owners. Protection of members from personal liability, treasury management, token issuance. More than 1,700 structures registered.
DeFi · DAOA fund under the MFA or PFA regime with tokenized interests. Exempt from the VASP regime where crypto-asset operations are incidental to the fund's activity.
Web3-fundsA fund that invests in crypto assets. Regulated under the MFA or PFA, not itself within the VASP regime. The Cayman Islands are #1 for crypto funds worldwide: 58% of the market is registered here.
Investment fundsUntil 2025, virtual asset service providers could operate under a simplified registration. With the introduction of licensing, the rules were tightened for the two riskiest categories: custody of client assets and trading platforms.
Any services for storing third-party crypto assets: hot and cold wallets, multi-signature custody, private key management.
Exchanges, OTC desks with order matching, marketplaces, any infrastructure for P2P trading of crypto assets.
Including one independent director, not affiliated with the business. All undergo CIMA fit & proper vetting.
Paid-up share capital must be contributed at the time of application. Confirmed by an auditor in writing.
AML/CFT, cybersecurity, business continuity plan, customer protection, segregation of client assets.
The actual time to obtain a VASP license is 6–10 months. The main bottlenecks: preparing cybersecurity policies, agreeing the business continuity plan and vetting of directors.
Analysis of the business model, classification (registration or license), incorporation of an Exempted Company, vetting of directors (KYC).
Business plan, risk assessment, AML/CFT manual, cybersecurity policy, business continuity plan, customer protection.
Submission via the CIMA REEFS portal. Fit & proper review for all directors. Confirmation of capital. Responses to CIMA requests (RFI).
Annual reporting, Travel Rule compliance, audited financial statements, direct CIMA inspections, opening bank accounts.
The regulator takes a broad approach: everything related to the movement, storage or exchange of virtual assets on a commercial basis. Simply minting NFTs without secondary trading is not regulated.
Spot and derivatives exchanges, P2P marketplaces. Matching orders in an order book, holding client funds, brokerage and dealing functions.
Custodial wallets (hot/cold), private key storage or multi-signature. Institutional custodians, mass-market wallet providers.
Over-the-counter crypto trading between clients or with a principal. Regulated as a trading platform where order matching takes place.
Issuance of utility and security tokens via ICO/IDO. Only for public issuance — private placement to accredited investors follows a separate regime.
Payment processors converting crypto ↔ fiat. A VASP license is required, plus alignment with traditional banking partners.
Advising on the purchase and sale of virtual assets. Registration is required.
Yes, in three cases. First — if you do not provide VASP services (for example, you are developing a non-custodial wallet or a smart contract where the user manages the keys themselves). Second — a crypto fund under the MFA or PFA, where crypto-asset operations are incidental to the fund's activity. Third — a DAO Foundation without commercial activity (just a legal wrapper for governance). Custody, exchange and public token issuance must be licensed.
The Cayman VASP is an institutionally recognized Tier-1 license. Large banks (Goldman Sachs, JP Morgan, BNY Mellon) and prime brokers work with licensed Cayman VASPs. For retail operations in the EU you need a separate MiCA CASP license (Cyprus, Malta, Lithuania, Germany are the most popular jurisdictions). For the US — separate state money transmitter licenses plus potentially a BitLicense (New York). The Cayman + Cyprus MiCA combination is a common parallel structure for institutional players.
CARF (Crypto-Asset Reporting Framework) is a new OECD standard for the automatic exchange of information on crypto assets between tax authorities. The crypto equivalent of CRS. The Cayman Islands implemented CARF from 1 January 2026. VASP service providers are required to determine clients' tax residence and report transactions annually. This significantly changes the landscape for privacy coins and anonymous VASPs.
Yes, as a Foundation Company under the Foundation Companies Act 2017. This is the most popular legal wrapper for DAOs in the world — more than 1,700 structures registered. A Foundation Company can manage a treasury, issue governance tokens, and enter into contracts. A VASP license is NOT required if the DAO does not provide paid custody or exchange services to third parties. If the DAO operates as a protocol with its own automated market maker (AMM), analysis under the specific scenario is needed.
Describe your business model — we'll determine whether registration, a License or a sandbox is needed. Free session, under NDA, no obligations.