Welcome to the latest edition of our Regulatory & Risk Advisory Review. In this issue, we explore key regulatory updates and emerging trends to help you stay informed and ahead in today's dynamic compliance environment.
The following topics are covered in this issue:
- Cayman Islands Legislation Update
- CIMA Rules, Statements of Guidance and General Industry Notices
- General Licences
- CRS Reportable Jurisdictions
- Financial Action Task Force (FATF) Updates
- Conyers Website Articles & Alerts
Cayman Islands Legislation Update
Empty heading
1.1. Virtual Asset (Service Providers) Act, 2020 (Commencement) Order, 2025
The Commencement Order was gazetted on 27 February 2025 and brings sections of the Virtual Asset (Service Providers) Act, 2020 relating to VASP Licensing into force (often referred to as 'phase two' of the VASP regime) from 1 April 2025. This is relevant to providers of virtual asset custody services and operators of virtual asset trading platforms.
1.2. Virtual Asset (Service Providers) (Amendment) Act, 2024 (partially in force)
Certain sections of the Virtual Asset (Service Providers) (Amendment) Act, 2024, which was gazetted on 19 December 2024, came into effect on 1 April 2025 and introduced targeted changes to the Virtual Asset (Services Providers) Act (2024 Revision) (VASP Act). Among other changes, the Amendment Act requires any VASP Registrants engaging in licensable activities to apply for an uplift to a VASP Licence within 90 days of commencement; requires VASPs to appoint three directors (one of whom must be independent); introduces requirements regarding segregation of client assets and expands the Cayman Islands Monetary Authority's (CIMA) supervisory powers.
1.3. Virtual Asset (Service Providers) (Amendment) Regulations, 2025
The Virtual Asset (Service Providers) (Amendment) Regulations, 2025 came into force on 1 April 2025. The Amendment Regulations expand the existing Regulations to include requirements for applications for a VASP Licence, now that licensing under the VASP Act has commenced. The requirements for obtaining a licence to provide virtual asset services are set out in a newly inserted Schedule 1A. Applicants wishing to obtain a VASP Licence are required to submit, among other items, comprehensive information regarding their business activities, management structure, financial projections, cybersecurity and risk management measures.
Additionally, the Amendment Regulations include a revised fee structure for application processing fees, registration fees, licensing fees, and annual renewal fees for VASPs. Fees are tiered based on the type of service provided, the scale of operations and location of operations.
1.4. Virtual Asset (Service Providers) (Amendment) Bill, 2025
On 28 May 2025 the Virtual Asset (Service Providers) (Amendment) Bill, 2025 (the "Bill") was gazetted which proposes amendments to the VASP Act with the aim of clarifying the position regarding tokenised investment funds.
The principal amendment proposed by the Bill is a revised definition of "issuance of virtual assets" or "virtual asset issuance" to expressly exclude the issuance of an equity interest (as defined under the Mutual Funds Act and the Securities Investment Business Act) or an investment interest (as defined under the Private Funds Act), subject to a statement of guidance or rule that may be issued by CIMA. Any new regulatory measures will add further details and guidance, and as regulatory measures can be revised without further legislative amendments, will allow for evolving market practices to be addressed as needed.
The Bill proposes that the revised definition would apply to any tokenisation of an equity interest or investment interest that may have occurred prior to the commencement date of the amending Act, providing legal certainty for past tokenisation transactions.
The Bill is not yet in force and will need to go through the normal legislative process prior to enactment. *As there is no language in the Bill which sets a commencement date, it is anticipated that the amendment Act would come into effect immediately after enactment.
* Note: the Bill was passed on the 27 June.
CIMA Rules, Statements of Guidance and General Industry Notices
2.1. CIMA Regulatory Policy – Registration or licensing of Virtual Asset Service Providers (May 2025)
CIMA issued an updated Regulatory Policy on the registration and licensing of VASPs, effective May 2025. The Policy outlines the criteria and procedures for approving VASP registrations, licences, or waivers under the VASP Act and related regulations. It applies to entities seeking to provide virtual asset services, including custody services and trading platforms, in or from within the Cayman Islands but excludes those applying for a sandbox licence. The Policy emphasizes the need for applicants to demonstrate robust compliance with Anti-Money Laundering (AML) and counter-terrorist financing requirements, sound corporate governance, risk management, and cybersecurity measures. Applicants are encouraged to seek independent legal advice and engage with CIMA early in the process to ensure readiness and compliance with all regulatory obligations.
CIMA's assessment process focuses on the fitness and propriety of shareholders, directors, and senior officers, as well as the adequacy of business plans, internal controls, and ownership structures. The Policy details the documentation required for applications, the evaluation of business continuity and outsourcing arrangements, and transitional provisions for entities moving between registration and licensing statuses. It also provides for waivers in exceptional cases and cautions that operating without the necessary registration or licence is a contravention of the VASP Act, subject to enforcement action. The Policy reinforces CIMA's commitment to maintaining the Cayman Islands' reputation as a leading, well-regulated financial centre by ensuring that VASPs meet international standards of transparency, consumer protection and market integrity.
2.2. CIMA Supervisory Information Circular – Amendments to the Virtual Asset (Service Providers) Act in Effect 1 April 2025
CIMA issued a Supervisory Information Circular advising that Phase Two of the VASPs legislative framework came into effect in the Cayman Islands. The supervisory circular provides practical information to VASPs with respect to their obligations upon commencement, process for licence, registration or waiver application and future expectations.
2.3. CIMA Regulatory Policy – Domestic Systemically Important Deposit Taking Institutions (D-SIDTIs)
CIMA has issued a new Regulatory Policy outlining the framework for identifying and supervising Domestic Systemically Important Deposit Taking Institutions (D-SIDTIs) within the jurisdiction. The policy aligns with international standards set by the Basel Committee on Banking Supervision and establishes a methodology based on five key factors: size, interconnectedness, substitutability, complexity, and households' dependency. Institutions designated as D-SIDTIs are those whose distress or failure could significantly disrupt the Cayman Islands' financial system and economy. The assessment is conducted using an indicator-based approach, with equal weighting given to each factor, and includes both quantitative analysis and supervisory judgment. The policy applies to all locally incorporated banks, credit unions, building societies, and the development bank supervised by CIMA, but not to foreign branches, which are primarily overseen by their home regulators.
Designated D-SIDTIs are subject to enhanced regulatory requirements, most notably a Higher Loss Absorbency (HLA) capital buffer ranging from 1% to 3% above the minimum capital requirement, depending on their systemic importance score. These institutions must also engage in recovery and resolution planning to ensure their resilience and facilitate orderly resolution in the event of distress. While no additional routine reporting is currently required beyond existing obligations, CIMA may request further information as needed and will maintain a more intensive supervisory approach, including enhanced inspections and ongoing engagement with senior management. The policy underscores CIMA's commitment to safeguarding the stability of the domestic financial system and protecting the interests of depositors and the broader economy.
2.4. CIMA Supervisory Information Circular – Key Findings from Onsite Inspections of Registered Persons
This Circular sets out the findings by the Authority from Inspections conducted on Registered Persons (RPs) for the period 1 January 2022 to 31 March 2024. RPs are defined under Schedule 4 and Section 5(4) of the Securities Investment Business Act (SIBA). RPs carry out securities investment business in or from the Cayman Islands, including dealing in securities, arranging deals, investment management, and providing investment advice. The SIBA provides for the regulation of the RPs engaged in these activities in or from the Cayman Islands, including market makers, broker-dealers, securities arrangers, securities advisors, and securities managers.
In 2020, CIMA commenced its risk-based approach to supervision of RPs to assess their AML, countering the financing of terrorism, countering proliferation financing and targeted financial sanctions, policies, procedures, systems, and controls. The Authority conducted on-site inspections to determine whether RPs met the requirements of the Anti-Money Laundering Regulations (AMLRs), the Guidance Notes on the Prevention and Detection of Money Laundering, Terrorist Financing and Proliferation Financing in the Cayman Islands, as well as other applicable legislations, rules, and accepted standards of best practice.
CIMA noted an improvement in compliance by RPs since the prior period's results but found there is still room for improvement in the effectiveness of the policies and procedures, particularly around CDD, ongoing monitoring and maintenance of an appropriate effective independent audit function. CIMA issued requirements to the inspected RPs and expects that they will address identified deficiencies in a timely and thorough manner. CIMA is also taking enforcement action where appropriate and proportionate.
CIMA continues to expect that all RPs will take note of these findings and act to ensure that their own AML/CFT compliance frameworks meet the standards prescribed and periodically assess their AML/CFT compliance programmes to ensure that they are appropriate for the nature, size and complexity of their business. CIMA will continue to promote its supervisory mandate through both offsite monitoring and onsite inspection processes. Any breach of a law, regulation or rule or non-compliance with a statement of guidance may result in an enforcement action. This may also include or be in addition to the imposition of an administrative fine for any breach of the AMLRs.
2.5. List of Approved Stock Exchanges
The updated List of Approved Stock Exchanges was published by CIMA in April 2025. The list details all stock exchanges approved for purposes of the Regulatory Acts pursuant to CIMA's Regulatory Policy – Approved Stock Exchanges.
General Licences
3.1. New General Licence
On 7 May 2025, the Governor issued a new General Licence GL/2025/0001 following the expiry of Legal Services General Licence GL/2024/002. The new General Licence took effect from 7 May 2025 and expires on 28 October 2025. GL/2025/0001 allows attorneys or law firms who have provided legal advice to designated persons under the Russia or Belarus sanctions regimes to receive payments without a specific licence, provided certain conditions are met.
There are a number of changes from the prior General Licences, so any persons wishing to rely on the new General Licence should closely review the details, definitions, permissions and usage requirements.
3.2. Expired General Licence
As noted above, GL/2024/002 expired on 28 April 2025.
CRS Reportable Jurisdictions
The Cayman Islands Department for International Tax Cooperation (DITC) published the Common Reporting Standard (CRS) lists of participating jurisdictions and reportable jurisdictions in the Official Gazette on 31 March 2025, the update includes the addition of Armenia, Georgia, Kazakhstan, Moldova and Ukraine have been added as Participating Jurisdictions.
Armenia, Morocco, Saint Kitts and Nevis, Senegal, Rwanda and Uganda to the list of Reportable Jurisdictions for reports due from 2025 onwards.
Financial Action Task Force (FATF) Updates
5.1. Jurisdictions Under Increased Monitoring
Jurisdictions under increased monitoring are actively working with the FATF to address strategic deficiencies in their regimes to counter money laundering, terrorist financing, and proliferation financing. When the FATF places a jurisdiction under increased monitoring, it means the country has committed to resolve swiftly the identified strategic deficiencies within agreed timeframes and is subject to increased monitoring. This list is often externally referred to as the "grey list". The FATF and FATF-style regional bodies (FSRBs) continue to work with these jurisdictions as they report on the progress achieved in addressing their strategic deficiencies.
The following countries had their progress reviewed by the FATF since February 2025: Angola, Bulgaria; Burkina Faso, Cameroon, Côte d'Ivoire, Croatia, Democratic Republic of the Congo, Haiti, Kenya, Mali, Monaco, Mozambique, Namibia; Nigeria, South Africa, South Sudan, Tanzania, Venezuela, and Vietnam.
The FATF identified Lao PDR, Nepal, Bolivia and the Virgin Islands (UK) (i.e. the BVI) as being jurisdictions under increased monitoring.
The Philippines, Croatia, Mali and Tanzania are no longer subject to FATF increased monitoring.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.