Regulatory overview
- Scope
- the Cayman Islands
- Authorities
- Regulatory index
- Latest regulatory change
the Cayman IslandsThe Cayman Islands distinguish VASP registration from custody and trading-platform licensing under CIMA supervision. March 2026 amendments expressly regulate tokenized funds and exclude specified fund-interest issuances from the VASP issuance regime. That exclusion does not cover additional third-party services. Conduct, custody and compliance rules require demonstrable controls, while incorporating a company or foundation does not grant financial authorisation.
A manager planning to tokenize a Cayman Islands fund must resolve two distinct questions: how fund interests are represented and transferred, and which virtual asset services each entity provides. The 2026 amendments clarify the first issue without authorising the manager or its group for every activity.
Operating arrangements must connect the offering document, transfer approvals, records and control over assets. Additional custody or trading-platform services require assessment of the relevant CIMA licence; for other services, registration or a granted waiver may be decisive.
Distinguishing the VASP regime from tokenized fund rules
The Virtual Asset (Service Providers) Act regulates virtual-asset services in or from the Cayman Islands. It covers exchange, transfer, custody, issuance and related financial services according to its definitions. Since 1 April 2025, phase two requires licensing for in-scope custody and trading platforms; other services require registration unless CIMA grants an applicable waiver.
The March 2026 VASP amendment excludes specified digital interests issued by regulated mutual funds and private funds from the issuance definition. This is a specific boundary, not an exemption for every investment token. Additional third-party services require separate classification even when supplied by a fund or another entity within its group.
What CIMA supervises and who remains accountable
The Cayman Islands Monetary Authority, CIMA, processes registrations, licences and waivers and supervises providers. Its official FAQs distinguish permissions and requirements. Analysis must identify the contracting entity and actual functions: operating a website, controlling keys, executing orders or issuing interests may involve different regulatory assessments within one business structure.
The Financial Reporting Authority, FRA, receives suspicious-activity reports under the AML framework. The 2026 compliance rule allocates responsibilities between the governing body, compliance function and reporting officers. Membership of an overseas group or outsourcing does not automatically transfer the Cayman-supervised provider's ultimate responsibility.
When licensing, registration or a waiver is required
The May 2025 registration and licensing policy requires complete applications, transparent ownership, suitable managers, competent personnel, resources and technology controls. CIMA assesses applications individually and may impose conditions or refuse them. A notification issued shortly after approval is not an overall licensing deadline: assessment starts with complete documentation.
Under the transition FAQs, previously registered providers that applied within the ninety-day period beginning on 1 April 2025 may continue pending a decision. This exception does not authorise new businesses or late applications. Entities supervised under another law may rely on a VASP waiver only when its conditions are satisfied and CIMA grants it; another authorisation alone is insufficient.
The effects of representing fund interests with tokens
The mutual-fund and private-fund amendments published on 24 March 2026 recognise digital representation of fund interests. They require issuance, creation, sale, transfer and ownership records and annual operator confirmation. Sections 22I and 19A retain operator approval for transfers under the offering document. Technical transferability does not establish unrestricted legal circulation.
Offering documents must explain token risks, cybersecurity, transfer restrictions and mitigation. CIMA may impose token characteristics and inspect technology and transactions. Walkers' analysis distinguishes licensed mutual-fund administrators' obligations from those imposed directly on private funds. A fund interest represents rights in the fund, not direct ownership of every portfolio asset.
Protecting assets and demonstrating controls
The February 2026 market-conduct rule and guidance address conflicts, advertising, agreements, complaints, cross-border transactions and asset safeguards. They distinguish binding provisions marked R from supervisory guidance. Marketing must be clear and not misleading; registration must not be represented as a guarantee of returns, absolute security or approval of every product.
For custodians, the same instrument requires identification and segregation of client assets, protection from third-party creditors, position records and reconciliation. Associated benefits, including staking rewards and voting rights, must be treated according to agreed and disclosed terms. Shared infrastructure requires evidence of operational and legal separation rather than an aggregate wallet balance alone.
The effective AML, terrorist-financing and proliferation-financing compliance programme rule applies from 18 September 2026. It requires governance, designated officers, risk assessment, training and independent effectiveness testing. The supervisory catalogue also identifies the sanctions rule applying from that date. Written policies and a technology supplier do not replace implemented and tested controls.
Preparing to issue interests or provide services
Before issuance, align the offering document, recorded ownership and transfer permissions with the operator’s powers. Infrastructure must support record retention and delivery, enforce restrictions and explain which fund interest investors acquire and how they exercise their rights.
For additional services, the file should distinguish entities, activities and permissions, and demonstrate safeguarding, reconciliation and effective compliance. A pending application, incorporated foundation or waiver request is not a final permission; check the public register and conditions applying to each provider.
To understand how this framework applies to your project, discuss your case with our team.
Key takeaways
- VASP licensing and registration cover different activities.
- Tokenized-fund interest issuance has a specific exclusion from 2026.
- Transferring tokenized fund interests requires fund-operator approval.
- Transitional continuity depends on prior registration and a timely application.
Regulatory milestones
Custody and platform licensing
VASP phase two begins on 1 April, with conditional transition for previously registered providers.
VASP market-conduct rules
CIMA publishes the market-conduct instrument and updates custodian and platform rules.
Tokenized-fund amendments
Acts 4, 5 and 6 of 2026 define issuance boundaries and add record, transfer and supervisory requirements.
Frequently asked questions
Not solely for issuing digital fund interests within the 2026 amendment’s exclusion and in accordance with fund legislation. If it provides virtual-asset services to third parties, those activities require separate VASP analysis.
The amendments require operator approval under the offering document. Smart contracts and records must support legal restrictions, investor controls and transfer conditions.
No. CIMA’s FAQs reserve that continuity for existing registered providers that applied within the ninety-day period starting on 1 April 2025, pending a decision.
No. The market-conduct rule requires those benefits to follow agreed terms, disclosure of their nature and customer consent concerning retention, application or transfer.
No. The 2026 compliance rule retains the provider’s ultimate responsibility when it uses a third party or group entity. It must satisfy itself that the function meets local requirements.
