The Virtual Asset (Service Providers) Act, 2020 (VASP Act) was enacted on 31 October, following consultation with the Financial Action Task Force. The VASP Act is being introduced in a phased approach (as detailed below) and it provides a framework for the regulation and oversight of virtual asset service providers (VASPs).
Cayman, as a leading jurisdiction for the establishment of offshore funds and a top global financial centre, has always been an attractive jurisdiction for the establishment of VASPs. The enacting of the VASP Act is evidence that Cayman is a technology-driven jurisdiction, making it even easier for VASPs to operate here within a clear and workable framework.
The VASP Act provides a technology-friendly, straightforward and adaptable legal framework for the establishment of VASPs. It provides certainty and it ensures compliance with internationally recognised standards. The VASP Act enables an exchange of information between VASPs and the Cayman Islands Monetary Authority (CIMA) which enables CIMA to stay abreast of industry practice and to support and drive forward technological development.
The VASP Act is being introduced in two phases. The first phase was enacted on 31 October 2020 and requires that Cayman entities which engage in, wish to engage in or purport to engage in virtual asset services to become registered with CIMA under the VASP Act by 31 January 2021.
When the second phases commences, entities which are engaged in, wish to engage in or purport to engage in (1) virtual asset custody services or (2) the operation of virtual asset trading platforms will be required to apply to CIMA for a licence under the VASP Act. The second phase is expected to commence in June 2021.
Under the VASP Act, entities which are engaged in, wishing to engage in or purporting to engage in virtual asset services and are currently holding a licence granted by CIMA under another regulatory regime must notify CIMA under the VASP Act.
In order to determine whether an entity is within scope of the VASP Act, it must determine:
- is it providing a virtual asset service (or holding itself out as doing so)?;
- what type of virtual asset service is it providing?; and
- is a registration or a licence required under the VASP Act in order to provide that virtual asset service?
What are virtual assets?
In order to determine if it is providing a virtual asset service, an entity will need to first understand the definition of "virtual assets" under the VASP Act.
A virtual asset is defined as "a digital representation of value that can be digitally traded or transferred and can be used for payment or investment purposes but does not include a digital representation of fiat currencies".
The definition is wide and adopts the definition used by FATF. The definition covers all cryptocurrencies, security tokens, utility tokens and commodity or fiat-backed stablecoins. We do not yet have clear guidance on the definition of "digital representation of fiat currencies" which are excluded but this is likely to apply to government-issued virtual currencies and not stablecoins (which are backed by fiat but which do not directly represent fiat and which would fall within the definition of "virtual asset")`.
"Virtual service tokens" are specifically excluded from the definition of virtual assets. A virtual service token is a "digital representation of value which is not transferrable or exchangeable with a third party at any time and includes digital tokens whose sole function is to provide access to an application or service or to provide a service or function directly to its owner." This definition is intended to cover things like loyalty programme reward points which are non transferable.
What is a virtual asset service?
A virtual asset service is:
- the issuance of a virtual asset; or
- the business of conducting one or more of the following activities or operations for or on behalf of another person:
- exchanging between virtual assets and fiat currencies;
- exchanging between one or more other forms of convertible virtual assets;
- transferring virtual assets;
- safekeeping or administrating virtual assets or instruments enabling control over virtual assets; and
- participating in and providing financial services related to an issuers offer or sale of a virtual asset.
Investment funds will not fall within the VASP regime if they accept in kind subscriptions or redemptions, as long as they use an external trading platform in order to exchange the virtual asset into fiat or vice versa.
What do virtual asset service providers need to do?
The VASP Act requires all VASPs carrying on, or purporting to carry on, virtual asset service in or from within the Cayman Islands to:
- register with CIMA;
- obtain a virtual asset service licence;
- if an existing licensee, be granted an exemption by CIMA from the obligation to be licenced under the VASP Act; or
- obtain a sandbox licence.
Registration
VASPs which intend to issue virtual assets will be required to be registered. The requirement only applies if virtual assets are issued to the public. Although there is no definition of this, issues to directors, shareholders and employees are likely to be excluded. Following registration, a VASP which issues virtual assets must submit a request to CIMA for approval of the issuance which will be subject to a threshold of fiat that may be raised through such issuance. Issues over the threshold will need to be conducted through a licensed exchange. The threshold has not yet been determined.
Licence
VASPs which provide virtual asset custody services or operate a virtual asset trading platform are required to apply for a virtual asset service licence. VASP licensees are subject to requirements over and above those applicable to registered VASPs. For example, a custodian must meet certain capital adequacy, transparent reporting and safekeeping standards. Trading platforms must meet disclosure, onboarding, trading supervision, operational, clearance and settlement standards. Further details in respect of the applicable standards have yet to be released.
Existing CIMA Licensees
An entity wishing to provide virtual asset services which is already licensed by CIMA under a regulatory regime other than the VASP Act must notify CIMA in advance. CIMA may then, at their discretion, require the entity to obtain a licence or to register under the VASP Act, or they may grant the entity a waiver from having to register or be licenced under the Act.
Sandbox Licence
CIMA may require a VASP to apply for a sandbox licence, instead of a standard registration or licence. CIMA will do this in circumstances where it is of the view that the proposed virtual asset service represents an innovative use of technology which requires an extra degree of oversight. CIMA may also insist on a sandbox licence application if this would be in the public interest or if there is an inherent risk involved in the proposed technology.
A sandbox licence may be granted for up to one year and it allows CIMA to potentially impose additional restrictions, limitation and supervisory rules onto the VASP.
Ongoing obligations
VASPs are required to:
- prepare accounts annually and make them available for inspection by CIMA;
- ensure that its senior officers, trustees and beneficial owners are fit and proper;
- take steps to protect and secure personal data of clients;
- ensure communications relating to virtual assets are accurate;
- comply with the Anti-money Laundering Regulations (2020 Revision) (AML Regs) and other laws relating to anti-money laundering, proliferation financing and countering the financing of terrorism (AML/CFT);
- put in place anti-money laundering systems and procedures;
- designate employees to fulfil the roles of AMLCO, MLRO and DMLRO that have the responsibility for procedures for combating money laundering, terrorist financing, proliferation financing and targeted financial sanctions;
- have a registered office in the Cayman Islands;
- provide documents and information required by CIMA; and
- notify CIMA of:
- any licence or registration in another jurisdiction;
- the opening of an office or establishing a physical presence in another jurisdiction;
- penalties imposed or enforcement actions taken against it in another jurisdiction; or
- the holding of or the acquisition of a controlling interest in another person or legal arrangement engaged in virtual asset service.
VASPs are subject to Cayman's anti-money laundering, proliferation financing counter terrorist financing and targeted financial sanctions. Tailored guidance has been issued by CIMA in relation to the compliance of VASPs with the AML/CFT regime.
VASP licensees are also subject to additional obligations including capital adequacy requirements, as mentioned above.
Audit Obligations
VASP licensees must appoint a CIMA approved auditor and they must prepare and file audited accounts with CIMA annually, within six months of their year end.
VASP registered entities are not obligated to appoint an auditor but CIMA does have the power to require the VASP to provide an auditor’s report, if it deems this to be necessary.
Phased Approach
The VASP framework is being implemented in phases.
Phase one commenced on the 31st October 2020, and is focused on AML and CFT supervision and enforcement.
- Persons engaged in or wishing to engage in virtual asset services must have been registered by CIMA under the VASP Act, by 31 January 2021.
- Persons engaged in or wishing to engage in virtual asset services currently holding a licence granted by CIMA under another regulatory authority must have notified CIMA under the VASP Act, by 31 January 2021.
Persons who have not registered or notified CIMA by the authorities application deadline, but who are engaging in or wishing to engage in virtual asset services after 31 January 2021 will be subject to penalties and other enforcement measures.
Registration and/or notification is through CIMA REEFs online platform.
Phase two is expected to begin in June 2021 and it will bring into force the remaining provisions of the VASP Act, including the licensing requirement for virtual asset custodians and trading platform operators, the sandbox licensing regime and other elements of the VASP Act.
If you require any assistance with determining whether your entity is in scope of these regulatory amendments, please contact regulatory@collascrill.com.
Not only can Collas Crill Corporate Services assist with the classification and registration, we also provide AML/CFT services such as AML Officers, AML/CFT Policy and Procedure development and AML Audits.
