01 IntroductionVASP mode Cayman after April 1, 2025
April 1, 2025 became a watershed for the entire Cayman Islands crypto industry. Effective from this date Phase 2 Virtual Asset Service Provider Act — extended licensing regime for providers dealing with custody of client assets or operating trading platforms. Prior to this date, VASPs could operate in a simplified registration mode; now the two most risky segments of the crypto industry - custodians and exchanges - require a full CIMA license.
This is not just a bureaucratic change. Phase 2 means real institutional maturity: minimum capital requirements, mandatory independent directors, extended AML/CFT framework, mandatory cybersecurity policy, customer protection provisions. Cayman becomes a Tier-1 jurisdiction for regulated VASPs on par with Singapore (MAS), Switzerland (FINMA) and Japan (JFSA).
By February 2026 in the CIMA register - 19 active Phase 2 VASPs. This is a deliberately limited number - the regulator approves only serious players with an established track record and real capital. For emerging crypto businesses, the path is through Phase 1 registration or sandbox license followed by upgrade.
The VASP Act is not a “crypto enablement.” This is a full-fledged regulatory regime for virtual asset services, similar to banking or fund regulation. With the same compliance burdens, but also with the same legitimating advantages.
Major change for Phase 2
Until April 1, 2025, any VASP could work through registration (notification-style mode). After this date custody providers and trading platforms are required to obtain a full VASP License with capital, governance and compliance requirements. All other VASP activities (transfer, advisory, issuance) remain in the registration regime.
02 · VASP Act 2024 and regulations
The main law is the Virtual Asset (Service Providers) Act (2024 Revision). The basic edition was adopted in 2020, significantly expanded in 2024. Additionally, the following applies:
- Virtual Asset (Service Providers) Regulations 2025 — detailed Phase 2 licensing rules
- Virtual Asset (Service Providers) AML/CFT Rules - specific AML requirements
- Travel Rules 2025 — implementation of FATF Recommendation 16 for transfers over threshold
- Cybersecurity Rules for VASPs 2025 — mandatory technical requirements
Who is considered a VASP
VASP is any person providing the following services as a business:
- Exchange — exchange of virtual assets among themselves or for fiat currency
- Transfer — transfer of virtual assets from one person to another
- Custody — safekeeping or administration of virtual assets on behalf of clients (including private keys)
- Issue — public issue of virtual assets (ICO, IEO, public token sales)
- Trading platform operation — operating infrastructure for trading virtual assets
- Financial services related to virtual assets — brokering, dealing, advising, managing investments in virtual assets
What is NOT considered a VASP
- Development of software protocols without operational involvement (for example, smart contract development, open-source code maintenance)
- Personal use of cryptos (your own wallets, personal trading)
- Crypto fund under MFA/PFA, where crypto activity is incidental to fund activity
- Mining as a technical activity (problem - if you provide mining-as-a-service to others, it's a VASP)
- Pure NFT-creation without secondary trading services
- Foundation Companies without commercial provision of VASP services to third parties
03 Phase 1 vs Phase 2Two levels of regulation
Phase 1 - VASP Registration
Notification-style mode for VASP activities with a lower risk profile: transfer, advisory services, issue of non-securities tokens. Does not require a full license, but is still subject to CIMA supervision and AML/CFT requirements.
Requirements:
- Cayman entity (Exempted Company / LLC / Foundation)
- Registered office, registered agent
- Minimum 1 director (with CIMA awareness, but without mandatory registration)
- MLRO appointed
- Basic AML/CFT policies
- Annual filing
Cost: $1,000 application + $5,000-15,000 annual fees. Process - 2-4 months.
Phase 2 - Full VASP License
Mandatory from 04/01/2025 for custody providers and trading platforms. Full license with CIMA prudential supervision, capital requirements, governance standards.
Requirements:
- Cayman entity with adequate substance
- Minimum 3 directors, 1 of them independent - all with CIMA Director Registration
- Minimum $100,000 paid-up capital (documented)
- Senior management – fit & proper assessment
- Local AML-officer on the islands (full-time)
- Business Plan, Risk Framework, AML/CFT Manual, Cybersecurity Policy, Business Continuity Plan
- Customer protection: segregation of client assets, complaints procedure, disclosure requirements
- Quarterly + annual reporting at CIMA
- External audit annually
Cost: $1,000 application + $5,000-200,000 annual fees (depending on scale). Process - 6-10 months.
Sandbox License
12-month regime for innovative business models that do not fit into standard categories. Introduced in 2025 to support experimentation in Web3 - DeFi protocols, new consensus mechanisms, novel financial instruments.
Direct CIMA supervision, limited scope of operations (as agreed), pre-defined exit criteria. After 12 months - transition to permanent license or registration (or wind-down).
It is used relatively rarely - 4 sandbox licenses were issued in 2025. Suitable for truly novel concepts, where normal VASP categories are not applicable.
DAO Foundation Company
An alternative path for DeFi protocols and DAOs. Foundation Company as a legal wrapper - does not require a VASP license if the protocol does not directly provide custody/exchange services.
1700+ registered as of February 2026. The Foundation owns treasury, directors execute on-chain governance decisions, DAO members are protected from personal liability.
If the DAO operates AMM or provides custody, a VASP analysis is needed for a specific use case. The line between "protocol" and "VASP" is sometimes thin - it requires a case-by-case legal opinion.
04 · Obtaining a Full VASP License4 phases of the real process
The actual deadline for obtaining a Full VASP License is: 6-10 months from the first consultation to approval. This is a significant investment of time and resources, which pays off in institutional reputation and access to Tier-1 banking partners.
Phase 1. Scoping and structuring (weeks 1-4)
The main decisions at this stage:
- Exact business classification under the VASP Act (Phase 1 vs Phase 2 vs sandbox vs DAO Foundation)
- Cayman entity structure: Exempted Company / LLC / SPC
- Initial KYC of directors and UBO
- Capital structure and documentation source of capital
- Local AML-officer recruitment plan
- Office space planning (substance requirements)
Phase 2. Documentation (weeks 4-12)
Mandatory package of documents:
- Business Plan — description of operations, target market, revenue model, growth projections (minimum 3 years financials)
- Risk Assessment — comprehensive analysis of all risks (operational, financial, AML, cyber, market, legal)
- AML/CFT Manual — detailed procedures for customer onboarding, transaction monitoring, suspicious activity reporting, enhanced due diligence
- Cybersecurity Policy — technical infrastructure, key management (For custody), incident response, penetration testing schedule
- Business Continuity Plan — disaster recovery, data backup, alternate operations sites
- Customer Protection Framework — segregation of client assets, complaints procedure, disclosure requirements, client agreements
- Travel Rule Compliance — implementation FATF Recommendation 16, integration with industry tools (Sumsub, Notabene, ChainAlysis)
- Director questionnaires – fit & proper applications for all directors
Phase 3. CIMA submission (weeks 12-28)
Submission via REEFS-portal. Cayman Atlas Partners experience: 100% of our VASP applications pass 2-3 rounds of RFI (request for information) from CIMA. Standard areas of inquiry:
- Source of capital documentation (banking statements, SPA from investors)
- Senior management background (criminal records, professional history)
- Technical infrastructure (key management, multi-sig setup, cold storage procedures)
- Customer onboarding procedures (KYC tools, sanctions screening)
- Local substance (office, employees, decision-making)
CIMA response time: each round RFI - 4-8 weeks response time. The quality of answers is critical - insufficient answers mean decline or extended process.
Phase 4. Approval and launch (weeks 28-40)
After approval, CIMA issues a VASP License. Additional steps:
- Banking introductions (Cayman National for local, international partners for USD volume)
- Integration with custody/wallet infrastructure (if custody provider)
- Travel Rule integration with industry tools
- External audit firm engagement
- Public launch coordination
- Exact VASP classification determined
- Cayman entity created with adequate substance
- 3 directors (including 1 independent) with CIMA registration
- $100k+ capital documented
- All 7 policies are prepared and signed
- REEFS submission with complete documentation
- RFI rounds answered successfully
- License approved and operations launched
05 · Economics VASP LicenseCost to get to Phase 2
Setup costs (year 1)
- Entity setup (Exempted Company / LLC): $5 000 — 8 000
- Professional services (legal, AML consulting, cybersecurity audit): $80 000 — 150 000
- CIMA application fee: $1 000
- 3 Directors (CIMA registered): $30 000 — 60 000 first year
- MLRO local hire (full-time): $40 000 — 80 000 / year
- Office space on the islands: $24,000+ / year
- Capital documentation and transfer: $100 000+ paid-up
- Banking onboarding: $10 000 — 20 000
Total year 1 cost: $290,000 – 450,000 (including $100k capital). Excluding capital: $190 000 — 350 000 V operational expenses.
Annual operating (year 2+)
- CIMA annual license fee: $5,000 – 200,000 (depending on scale)
- Directors annual: $30 000 — 60 000
- MLRO + AMLCO + DMLRO: $80 000 — 150 000
- Office space: $24 000+
- External audit: $30 000 — 80 000
- Cybersecurity (penetration testing, monitoring): $30 000 — 80 000
- Travel Rule tooling: $24 000+
- Compliance technology (KYC, transaction monitoring): $50 000 — 200 000
- Legal annual: $40 000 — 100 000
Annual operating: $280,000 – 700,000 / year. This explains why VASP Phase 2 is only economically viable for businesses with serious revenue ($5M+ annually) or as a gateway for bigger operations.
Cost of VASP Phase 2 shouldn't be scary. This is an investment in institutional legitimacy. For our client - crypto custody provider - VASP License opened banking relationships in JP Morgan and Goldman Sachs, unavailable to unregulated competitors. It is transformative for business viability.
— Partner, specialist in VASP licensing06 · Mini caseObtaining VASP Phase 2 for exchange
Crypto exchange launches Cayman VASP License
Mid-tier crypto exchange with operations in Asia-Pacific decided to obtain a Tier-1 license to expand the institutional client base. Previously, he worked on a simplified license in one of the APAC jurisdictions. Goals: open doors for US/EU institutional flow, get banking relationships with major prime brokers.
Solution: Cayman Exempted Company applying for Full VASP License (Phase 2 - trading platform). 3 directors: 2 founders + 1 independent (former central bank regulator). Local MLRO recruited from Cayman professional services. Office space leased in Cricket Square. Capital $200k paid-up (above minimum $100k). The full package of documents is ready in 11 weeks, REEFS submission in week 13. There have been 3 rounds of RFI with CIMA - mainly on cybersecurity (key management procedures) and AML (transaction monitoring thresholds).
07 · ComparisonCayman VASP vs other jurisdictions
| Parameter | Cayman VASP Phase 2 | Singapore MAS | Switzerland FINMA | EU MiCA CASP |
|---|---|---|---|---|
| Min capital | $100k | $200k SGD | CHF 100k - 1.5M | €50k – 150k |
| Process duration | 6-10 months | 9-15 months | 12-18 months | 9-15 months |
| Total cost | $200-450k | $250-600k | $300-700k | $200-500k |
| Reputation tier | Tier-1 | Tier-1 | Tier-1 | Tier-1 (EU) |
| Tax neutrality | 0% | 17% | ~12-15% | 20-30% |
| Banking access | Excellent global | Excellent APAC | Excellent EU/Swiss | Excellent EU |
| EU passporting | No | No | No (private placement) | Yes |
| Best for | Global institutional | APAC-focused | Banking integration | EU retail + institutional |
Cayman VASP is the optimal choice for globally-focused VASPs with institutional clients. Singapore - for APAC primary market. Switzerland - for tight banking integration. EU MiCA - for retail-passporting in Europe.
Many large players have parallel structures: Cayman VASP + Cyprus MiCA CASP - combined coverage global institutional + EU retail. It is expansive but gives comprehensive market access.
08 · Risks and nuances
8.1. CARF - automatic information exchange
Since January 1, 2026, Cayman has implemented the Crypto-Asset Reporting Framework (CARF) - analog CRS for crypto. VASPs are required to identify tax residency clients and annually report transactions in DITC. This is an existential change for anonymous-style VASPs - the exchange of information with the tax authorities of clients’ countries of residence is automatic.
8.2. Travel Rule compliance
For transfers over USD 1,000 (CIMA threshold) VASPs are required to exchange originator/beneficiary information. Implementation requires integration with industry tools (Sumsub, Notabene, ChainAlysis). Standalone solutions are not acceptable - standardized protocols with counterparty VASPs are needed. This is $24-80k annual investment.
8.3. Cybersecurity rigour
CIMA requires a comprehensive cybersecurity framework, especially for custody providers. Requirements include:
- Multi-signature wallet architecture
- Cold storage minimum 95% of client funds
- Annual penetration testing
- SOC 2 Type II compliance recommended
- Key management procedures with roles separation
- Insurance coverage for custody operations
Cybersecurity costs can exceed $100k/year for serious custody operations.
8.4. Substance requirements
VASP falls under the Economic Substance Act as a “relevant activity”. Required:
- Adequate physical office on the islands
- Key decisions made by Cayman-based directors
- Local employees or contracted personnel performing CIGA
- Adequate operating expenditure on the islands
Without real substance - non-compliance with fines up to $250k and potential delisting.
8.5. Customer protection
CIMA has low tolerance for customer protection failures. VASP rules require:
- Strict segregation client assets from proprietary
- Complaints handling procedure with time limits
- Clear disclosure of all fees and risks
- Suitability assessments for retail clients
- Whistleblower protections for employees
Material breach creates regulatory action - from warning letters to license suspension.
09 FAQThe most frequently asked questions about VASP
Is it possible to launch a crypto project without a VASP license?
Yes, in several scenarios. The first is non-custodial protocols without operational involvement (DeFi smart contracts, where users control their keys). The second is a crypto fund under MFA/PFA (see separate articles), where crypto activity is incidental to fund activity. Third - DAO Foundation without commercial provision VASP services to third parties. Fourth - pure software development without operational control. Custody, exchange, public token issuance are required to be licensed.
What happens if you work without a VASP license after April 1, 2025?
Operating without a license when one is required is a serious regulatory violation. CIMA has the following powers: cease & desist orders (immediate stop operations), criminal prosecution senior management (up to 7 years in prison under the VASP Act), fines up to $1M+, asset freezing, public naming in violation lists. Banking partners immediately closing accounts upon public listing.
How is the Cayman VASP License recognized in other jurisdictions?
Cayman VASP - institutional Tier-1 recognition. Major banks (Goldman, JP Morgan, BNY Mellon), prime brokers, institutional custodians are accepted. For retail-passporting in the EU, you need a separate MiCA CASP-license. For the US - separate state money transmitter licenses + potentially BitLicense (NY). Cayman + Cyprus MiCA - frequent dual structure for comprehensive market access.
What is incidental virtual asset activity?
This is a term from the VASP Act, exempting crypto activity that is not the main business. For example, a fund investing in crypto is a crypto-activity incidental to an investment management business. SPV holding crypto on behalf of the parent company - incidental to holding business. Foundation Company managing treasury - incidental to governance functions. An accurate line requires case-by-case analysis with legal opinion.
How long does the RFI process with CIMA take?
On average 2-3 rounds of RFI after initial submission. Each round: CIMA generates questions (1-3 weeks), applicant replies (4-8 weeks), CIMA reviews (2-4 weeks). Total RFI process - 12-24 weeks. The quality of the initial submission is critical: a comprehensive, well-organized package reduces RFI rounds. Bureaus with experience in VASP applications usually reduce the process to 2 RFI rounds (vs 4-5 for firms without specialized experience).
Is it possible to upgrade Phase 1 registration to Phase 2 license?
Yes, through a formal application to CIMA. Phase 1 registration does not automatically convert - you need a new application with full Phase 2 documentation. Existing operations can continue during transition (unless the activity requires Phase 2). Multi-year customers, established compliance track record is a plus in Phase 2 application. Practical: for emerging businesses, often Phase 1 first (faster, cheaper) with Phase 2 upgrade after 1-2 years when operations are mature.
10 ConclusionWhen VASP License is the right choice
The Cayman VASP License is a significant investment in institutional legitimacy. This is not for emerging projects - this is for established businesses with real revenue and a long-term commitment to compliance.
Suitable if:
- Operating crypto custody, exchange, or trading platform with serious volumes
- Target market - institutional clients (HF, asset managers, family offices)
- Need access to Tier-1 banking partners
- Annual revenue $5M+ for economic viability
- Long-term commitment (5+ years in industry)
- Compliance budget $300k+ annually
Not suitable if:
- Pre-revenue stage or early MVP testing — sandbox or unregulated jurisdiction first
- Bootstrapped with minimal capital - Phase 1 registration or DAO Foundation cheaper
- Pure DeFi protocol without custody/exchange operations – Foundation Company sufficient
- Retail EU focus - MiCA CASP license is required anyway
VASP licensing is a complex multi-month process with many moving parts. But for serious VASP businesses this is an inevitable step towards institutional justice. We have participated in 8 successful VASP applications since 2022, including 3 Phase 2 licenses since April 2025. A lawyer partner can analyze your business model and suggest the optimal regulatory path at a free first meeting.