Approaches and developments
The Cayman Islands has long been a leading offshore jurisdiction for investment funds, as well as a significant global financial centre overall. It is therefore not surprising that, reflecting global trends, the FinTech market has been developing rapidly in the Cayman Islands, as the Government has sought to attract new business. The Government is very aware that other jurisdictions (e.g., the UK, Dubai, Singapore) are competing to attract FinTech business, as well as Europe with the proposed regime contained in the Markets in Crypto-Assets Regulation.
As a major response, the Cayman Islands has introduced a coherent and relatively bespoke virtual asset regime, being the Virtual Asset (Service Providers) Act (Revised) (the “VASP Act”). It is based on, and aligned with, global standards, set out by the Financial Action Task Force (“FATF”).
The Cayman Islands Government has also introduced a number of other incentives to encourage FinTech firms to set up on Cayman. These include:
- A Special Economic Zone (“SEZ”), granting incentives to companies (particularly FinTechs) to relocate their businesses and employees. The SEZ has over 285 companies, including around 80 blockchain companies;
- TechCayman – in addition to the SEZ, TechCayman was established in 2018 to encourage technology entrepreneurs to establish their businesses in the Cayman Islands, and to create a tech hub for collaboration and expansion;
- IP rights – the intellectual property legislation in the Cayman Islands was updated in 2017 to strengthen and protect IP rights, and permits direct registration of IP rights in the Cayman Islands rather than indirectly via the UK; and
- Code Cayman – this Government initiative is intended to provide coding programmes for the community (targeting women and younger members of the community in particular).
There has been no great demand for “robo advice”, given the limited retail investment offering. Cayman Islands legislation does not expressly contemplate robo-advisers. To the extent that a legal entity holds the algorithm or software that performs the function of a robo-adviser and that legal entity is a Cayman Islands entity or a non-Cayman Islands entity registered in the Cayman Islands, it will be required to be registered or licensed under the Securities Investment Business Act (the “SIB Act”).
Cayman Islands Fintech offering
The VASP Act provides a registration and licensing regime for any person offering a “virtual asset service” in the course of a business using a Cayman Islands entity or otherwise from within the Cayman Islands. Such persons are called virtual asset service providers (“VASPs”).
The Cayman Islands regulators are continuing their focus on blockchain and virtual assets, particularly in light of the introduction of the VASP Act. The Cayman Islands Monetary Authority (“CIMA”) is establishing a specialist unit to oversee the VASP Act, and the Utility Regulation and Competition Office (“OfReg”) is encouraging the development of blockchain projects by considering and proposing changes to the Cayman Islands Electronic Transactions Act to incorporate express recognition of blockchain and smart contracts.
Regulatory and insurance technology
CIMA has held a private sector consultation with a view to making certain amendments to the Guidance Notes on the Prevention and Detection of Money Laundering, Terrorist Financing and Proliferation Financing to clarify its position on electronic Know Your Customer (“e-KYC”) and remote Customer Due Diligence (“CDD”). The key thrust is that CIMA has now acknowledged that, subject to certain caveats, it is possible to rely on virtual means of verification, including e-KYC technology and digital verification. These amendments are not yet in force, but we do not expect any material amendments to the draft amendments that have been circulated.
We are not aware of any specific or material “InsurTech” initiatives or developments in the
Regulatory bodies
The principal financial services regulator in the Cayman Islands is CIMA, which is responsible for the regulation, supervision and monitoring of financial services laws (including the VASP Act – as detailed below), as well as the monitoring of compliance with anti-money laundering/counter-financing of terrorism and counter-proliferation financing (“AML/CFT/CPF”) legislation. Regulated and unregulated entities in the FinTech sector may also be subject to ancillary regulation, including in relation to economic substance and automatic exchange of information, which is supervised by the Department for International Tax Cooperation (“DITC”), beneficial ownership, which is supervised by
the Cayman Islands Registrar, data protection, which is supervised by the Cayman Islands Data Protection Ombudsman and sanctions, which are supervised by the Cayman Islands Financial Reporting Agency (“FRA”).
Key regulations and regulatory approaches
The VASP Act provides a short, accessible, technology-neutral and adaptable framework for the regulation of the provision of virtual asset services. The VASP Act has been implemented in a phased approach as set out below.
The VASP Act is being implemented in phases. The first phase came into effect on 31 October 2020, and focuses on anti-money laundering (“AML”) and the counter-financing of terrorism (“CFT”) compliance, supervision and enforcement.
Definition of a virtual asset
Clearly, the concept of “virtual asset” is key to determining whether a person is offering a virtual asset service, and is therefore a VASP. A virtual asset is defined as a digital representation of value that can be digitally traded or transferred and can be used for payment or investment purposes. However, a digital representation of a fiat currency (essentially, legal tender) is excluded. Similarly, “virtual service tokens” (being digital representations of value that are not transferable or exchangeable with third parties, such as digital tokens that only provide access to an application or service or that provide a service or function directly to their owner) are not treated as virtual assets.
Definition of a virtual asset service
A “virtual asset service” means the issuance of virtual assets or the business of providing one or more of the following services or operations for or on behalf of another person:
- an exchange between virtual assets and fiat currencies;
- an exchange between one or more other forms of convertible virtual assets;
- the transfer of virtual assets;
- virtual asset custody service; or
- participation in, and provision of, financial services related to a virtual asset issuance or
the sale of a virtual asset.
The sale of newly created virtual assets to the public, in exchange for some form of consideration, is also included in the definition of virtual asset service. This means that although certain kinds of non-public issuances should not be regulated, a person will need to be registered if they issue virtual assets to the public using a Cayman Islands vehicle. Non-public issuances include employee, intra-group and, in particular, private sales. A private sale is defined as a sale, or offer for sale, which is (i) not advertised, and (ii) is made available to a limited number of persons or entities who are selected prior to the sale by way of a private agreement.
The effect of this is that some, but not all, token issuers will be VASPs and will be required to register with CIMA.
The VASP Act provides that after the issuer is registered, the issuer must submit a “virtual asset issuance request” to CIMA for prior approval of the virtual asset issuance. While such a virtual asset issuance approval regime is currently not in effect, it is expected to do so during the course of 2023.
Definition of a VATP
A virtual asset trading platform (“VATP”) is defined under the VASP Act to mean a centralised or decentralised digital platform that facilitates the exchange of virtual assets for fiat or other virtual assets on behalf of third parties for some form of reward and that: (i) holds custody of or controls the virtual asset on behalf of its clients to facilitate an exchange; or (ii) purchases virtual assets from a seller when transactions or bids and offers are matched, in order to sell them to a buyer. However, VATPs do not include a platform that only provides a forum where sellers and buyers may post bids and offers, or a forum where the parties trade on a separate platform or in a peer-to-peer manner.
Generally, a provider of virtual asset custody services or a VATP operator will need to be licensed under the VASP Act. Other virtual service providers will also generally be required to be registered. However, it is for CIMA to decide whether to direct that any VASP be licensed or apply for a sandbox licence. Again, such licensing regime is currently not in effect but is expected to do so during 2023.
Enforcement
Under the VASP Act, a person that contravenes the registration requirement commits an offence and is liable on summary conviction to a fine of CI$25,000 and to imprisonment for one year and, in the case of a continuing offence after conviction, to a fine of CI$10,000 Walkers Cayman Islands for each day during which the offence continues. An entity that contravenes the licensing requirement commits an offence and is liable on summary conviction to a fine of CI$100,000 and to imprisonment for one year and, in the case of a continuing offence, to a fine of CI$10,000 for each day during which the offence continues. In addition, CIMA has the power to impose additional fines for a breach of the VASP Act under an administrative fining regime, which includes imposing a fine of up to CI$1,000,000 on a corporate body in breach. The Administrative Fines Regime contains detailed provisions on the fines regime and appeals processes.
Sandbox licence regime
Under the VASP Act there is the potential for the future introduction of a sandbox licence. A sandbox licence is a temporary (up to one year) licence that CIMA may direct a VASP to apply for where:
- the service being provided represents an innovative use of technology or uses an innovative method of delivery such that additional supervision and oversight is required;
- it is in the best interests of the public, regulated persons or financial markets that the service be temporarily restricted or subject to specific requirements;
- the service promotes technology or a method of delivery that may create a systemic risk to financial markets or the jurisdiction; or
- the service poses an AML/CFT/CPF risk that existing AML rules do not properly mitigate.
Certain FinTech service providers that are not VASPs may also apply for sandbox licences. However, they are not required to do so. The intention here, as with regulatory sandboxes more generally, is to provide a controlled environment for innovative service providers to evolve their businesses under CIMA’s supervision, while creating a forum for concurrent development and potential amendment of applicable rules. Again, such sandbox regime is currently not in effect and CIMA has consulted with industry in relation to its introduction.
Restrictions
Anti-money laundering laws
The Cayman Islands Proceeds of Crime Act (“POCA”) requires that entities that conduct “relevant financial business”, which includes providing a “virtual asset service”, must comply with the Cayman Islands Anti-Money Laundering Regulations (“AML Regulations”). As a result, they are subject to the AML Regulations, whether or not they are registered with or licensed by CIMA under the VASP Act (so they can include FinTech companies that are regulated and unregulated). The AML Regulations set out ongoing and detailed compliance requirements with respect to anti-money laundering, counter-terrorist and proliferation financing, and compliance with targeted financial sanctions. There are
also specific requirements in the AML Regulations for entities undertaking “transfers of virtual assets” (i.e., the Travel Rule related provisions for cryptocurrency transfers). CIMA is responsible for supervising compliance with the AML Regulations and has helpfully published “Sector-Specific Guidance for Virtual Asset Service Providers”, to assist with the interpretation of these requirements in a virtual assets context.
Securities investment business
The SIB Act provides for the registration and licensing of entities carrying on “securities investment business” including, among other entities: (a) any company or partnership that is incorporated, established or registered in the Cayman Islands that carries on “securities investment business”; or (b) any entity that has established a place of business in the Cayman Islands through which “securities investment business” is carried on.
The term “securities investment business” is specifically defined in the SIB Act as including a number of “regulated activities”, such as “dealing in securities”, “arranging deals in securities”, “management of securities” and “advising on securities” in the course of business (subject to exclusions for certain persons and certain activities). The term “securities” is further defined widely in the SIB Act and includes, in summary, shares, partnership interests, trust units, debt instruments, warrants, options, futures, contracts for differences (for example, cash-settled derivatives such as interest rate/stock index futures, forward rate agreements and swaps) and certain virtual assets.
For the purposes of the SIB Act, a “virtual asset” means a digital representation of value that can be digitally traded or transferred and can be used for payment or investment purposes but does not include a digital representation of fiat currencies. However, the SIB Act specifically only applies to virtual assets that can be sold, traded or exchanged that represent or can be converted into any of the traditional securities within the scope of the SIB Act, or which represent a derivative of any of those securities.
Under the SIB Act, entities are prohibited from conducting securities investment business unless, in respect of such activity, the entity is either: (a) registered with, or licensed by, CIMA under the SIB Act; or (b) able to benefit from a specific exclusion in the SIB Act. Aside from the specific exclusions provided for in the SIB Act, there are no other exclusions (for example, reverse solicitation) available under Cayman Islands law to entities carrying
on securities investment business.
Economic substance regime
The Cayman Islands operates an economic substance regime. The International Tax Co-operation (Economic Substance) Act (“the “Economic Substance Act”), is key to determining whether a relevant entity satisfies the economic substance test in respect of its relevant activities. A VASP may fall within the scope of the Economic Substance Act if it is carrying out one or more of the relevant activities. All relevant entities are required to submit an economic substance notification. A VASP will be required to satisfy the economic substance test set out in the Economic Substance Act if it is carrying out one or more of the relevant activities (unless an exemption applies). If so, the VASP is required to submit an annual report to the Tax Information Authority (“TIA”) (and must submit an annual notification whether or not carrying out any relevant activity).
Data protection
The Cayman Islands also has data protection legislation, the Cayman Islands Data Protection Act (as amended) (the “DPA”) which requires entities within the scope of the legislation to comply with the data protection principles defined in the legislation.
The DPA requires a data controller to comply with eight data protection principles when processing personal data and to ensure that those principles are complied with in relation to personal data processed on the data controller’s behalf under a written contract. The DPA also deals with data security, data breaches and the rights of individual data subjects, including providing a privacy notice.
The DPA applies to personal data processed by “data controllers” and “data processors”. The DPA applies to processing carried out by data controllers established within the Cayman Islands. In certain cases, it also applies to data controllers outside the Cayman Islands that process personal data within the Cayman Islands.
It will be a question of fact in each case whether a VASP is within the scope of the DPA.
Cross-border business
As of January 2023, there are 18 “virtual asset service providers” registered with CIMA under the VASP Act, with a number of applications pending. CIMA has recently indicated that its intention is to process applications under the VASP Act within 10 weeks of submission. The Cayman Islands continues to be a leading offshore hub for FinTech. The VASP Act offers a clear and robust framework, which is already proving attractive to many international firms in the cryptoasset market.
CIMA, the DITC and the FRA also regularly collaborate and co-operate with other international authorities in exchanging information, formulating global standards and attending regulatory fora, such as FATF.
[View source.]
