The VASP Act provides a short, accessible, technology neutral and adaptable framework for the regulation of the provision of virtual asset services. There is a phased approach to the implementation of the VASP Act as described below.
What the VASP Act regulates
The VASP Act provides a registration and licensing regime for any person carrying on a “virtual asset service” in the course of a business using a Cayman Islands entity or otherwise from within the Cayman Islands. Such persons are called “virtual asset service providers” (“VASPs”).
Clearly, the concept of “virtual asset” is key to determining if a person is carrying on a virtual asset service, and is therefore a VASP. A virtual asset is defined as a digital representation of value that can be digitally traded or transferred and can be used for payment or investment purposes. However, a digital representation of a fiat currency (essentially, legal tender) is excluded. Similarly, “virtual service tokens” (being digital representations of value that are not transferrable or exchangeable with third parties, such as digital tokens that only provide access to an application or service or that provide a service or function directly to their owner) are not treated as virtual assets.
A “virtual asset service” means the issuance of virtual assets or the business of providing one or more of the following services or operations for or on behalf of another person:
(a) exchange between virtual assets and fiat currencies;
(b) exchange between one or more other forms of convertible virtual assets;
(c) transfer of virtual assets;
(d) virtual asset custody service; or
(e) participation in, and provision of, financial services related to a virtual asset issuance or the sale of a virtual asset.
All VASPs must register under the VASP Act with the Cayman Islands Monetary Authority (“CIMA”). CIMA was given the ability to enforce and take action against contraventions of the VASP Act from 31 January 2021.
Regulation of issuance of virtual assets
The sale of newly created virtual assets to the public, in exchange for some form of consideration, is also included in the definition of a virtual asset service. This means that although certain kinds of non-public issuances (such as employee or intra-group issuances or private sales) should not be regulated, a person must be registered if they issue virtual assets to the public using a Cayman Islands vehicle.
The effect of this is that many, if not most, security token issuers will be VASPs and are required to register with CIMA.
The VASP Act provides that after the issuer is registered, the issuer has to submit a “virtual asset issuance request” to CIMA for prior approval of the virtual asset issuance. However, such virtual asset issuance approval regime is currently not in effect and we are awaiting the commencement order for this regime.
Virtual asset trading platform operators, custodians and other virtual asset service providers
A virtual asset trading platform (“VATP”) is defined under the VASP Act to mean a centralised or decentralised digital platform that facilitates the exchange of virtual assets for fiat or other virtual assets on behalf of third parties for some form of reward and that (i) holds custody of or controls the virtual asset on behalf of its clients to facilitate an exchange; or (ii) purchases virtual assets from a seller when transactions or bids and offers are matched in order to sell them to a buyer. However, VATPs do not include a platform that only provides a forum where sellers and buyers may post bids and offers and a forum where the parties trade in a separate platform or in a peer-to-peer manner.
Generally, a provider of virtual asset custody services or a VATP operator must be licensed under the VASP Act. Other virtual service providers will generally be required to be registered. However, it is open to CIMA to direct that any virtual asset service provider be licensed or apply for a sandbox licence. Again, such licensing regime is currently not in effect and we are awaiting the commencement order for this regime.
Sandbox licences
Under the VASP Act, a sandbox licence is a temporary licence of up to one year that CIMA may direct a VASP to apply for, where:
(i) the service being provided represents an innovative use of technology or uses an innovative method of delivery such that additional supervision
and oversight is required;
(ii) it is in the best interests of the public, regulated persons or financial markets that the service be temporarily restricted or subject to specific
requirements;
(iii) the service promotes technology or a method of delivery that may create a systemic risk to financial markets or the jurisdiction; or
(iv) the service poses a money laundering, terrorist financing or proliferation financing risk that existing AML rules don’t properly mitigate.
Certain FinTech service providers that are not VASPs may also apply for sandbox licences. However, they are not required to do so.
The intention here, as with regulatory sandboxes more generally, is to provide a controlled environment for innovative service providers to evolve their businesses under CIMA’s supervision, whilst creating a forum for concurrent development and potentially amendment of applicable rules. Again, such sandbox regime is currently not in effect and we are awaiting the commencement order for this regime.
Compliance requirements for VASPs
In addition to maintaining registration or a licence, VASPs are subject to various ongoing requirements. The requirements include obligations to:
(a) prepare annual accounts that are open to CIMA inspection;
(b) ensure senior officers and beneficial owners are fit and proper for such positions, and obtain prior approval from CIMA in relation to the
appointment of any senior officer or trustee as well as the anti-money laundering compliance officer;
(c) secure data and ensure all communications are accurate; and
(d) comply with various other record keeping, cybersecurity, outsourcing, governance and reporting obligations to CIMA.
In addition to the above, VASPs are already required to comply with the Cayman Islands Anti-Money Laundering Regulations (as amended) and other relevant anti-money laundering, terrorism and proliferation financing and sanctions laws, including to put in place systems and procedures (including the obligation to maintain information in relation to the beneficiary and originator of transfers) and designating natural persons with responsibility for compliance, as the result of previous amendments to the Proceeds of Crime Act (as amended). CIMA may order an audit of systems and procedures of the registrant or licensee.
Conclusion
Existing Cayman Islands legislation and regulation was flexible enough to deal with many aspects of virtual asset related business. However, it is important that the jurisdiction continues to be a leader in demonstrating global best practices in regulating, primarily, the financial services industry, while complying with the recommendations of the Financial Action Task Force. The VASP Act provides a welcome addition to Cayman’s existing, robust body of law, and serves to further reinforce the confidence and certainty in the virtual assets regulatory environment.
