A crypto exchange operator reviewing offshore domicile options will find Bermuda among the most developed common-law regimes for digital asset business (DAB) authorisation in the Atlantic basin. The island enacted a dedicated statutory regime – the Digital Asset Business Act (DABA) – that creates a structured licensing pathway for exchanges, custodians and related service providers. Operating a crypto exchange in Bermuda without DABA authorisation exposes the business to enforcement, banking termination and reputational harm that is difficult to reverse once a regulator has acted.
This page sets out the legal requirements for an inbound exchange operator, the regulated scope, the application process, and the cross-border licensing and banking realities that shape the decision to domicile in Bermuda.
What activities require a licence under Bermuda's DABA regime?
Any business that issues, sells, or facilitates the exchange of digital assets in or from Bermuda must hold a Digital Asset Business Licence issued under the Digital Asset Business Act by the Bermuda Monetary Authority (BMA). The regime is activity-based: the legal test turns on what the business does, not on the label it applies to its product. An exchange that matches buyer and seller orders, operates a trading engine, or holds client assets in custody is engaging in regulated digital asset business regardless of how its terms of service characterise the activity.
The BMA administers the regime and is the sole licensing authority for DABA purposes. The authority has published a detailed regulatory framework that distinguishes between classes of licence – covering exchange operations, issuance, custody, lending, and portfolio management functions. A business providing more than one of these functions at the same time generally requires authorisation that covers each activity, or a combined authorisation where the BMA permits it.
The territorial scope of DABA extends to businesses incorporated in Bermuda and to businesses operating from Bermuda even where customers are located elsewhere. The "from Bermuda" concept is materially similar to the approach taken by VARA in Dubai and by MAS in Singapore under the Payment Services Act: the regulator focuses on where the operational substance sits, not only where contracts are concluded. An operator who incorporates locally, places technical infrastructure elsewhere, and claims the local entity is dormant is unlikely to satisfy the BMA that no licensed activity is occurring in the jurisdiction.
The process above describes the standard path. Your facts – the entity design, the user base geography, the custody model – change the analysis. For a preliminary scoping assessment of whether your intended structure triggers DABA authorisation, contact OBOLUS at Map your options.
How does Bermuda classify digital asset business licences?
Bermuda's DABA regime establishes distinct licence classes that align with the functional role a business plays in the digital asset market. An exchange operator seeking to run a multilateral trading facility – matching orders from multiple buyers and sellers – sits in the exchange or trading activity class. A business that holds client digital assets on a custodial basis requires separate or additional authorisation covering custody functions. Where a business also issues tokens to the public, the issuance activity is separately regulated and requires the operator to file an offering document that meets BMA disclosure expectations.
In our licensing practice, we regularly see operators underestimate the number of licences their intended business model actually requires. A platform that launches as a spot exchange and subsequently adds lending, staking, or portfolio management services will need to revisit its authorisation each time a new activity is added. The BMA expects operators to maintain a licence that accurately reflects their current activity scope, and operating an unlicensed ancillary activity alongside a licensed core business is itself an enforcement risk.
The classification logic in Bermuda is broadly comparable to the activity-based approach under MiCA in the European Union, where a CASP (crypto-asset service provider) authorisation covers defined service categories and expansion into a new category requires a variation of authorisation. Operators entering Bermuda after experience in an EU licensing process will find the conceptual structure familiar, though the BMA's procedural expectations and supervisory style differ from European national competent authorities.
What does the DABA application process involve?
The BMA application process for a digital asset business licence follows a structured pre-submission and formal-application sequence that typically demands several months of preparation before a file is ready to submit. The BMA expects a complete application on first submission; an incomplete file delays the clock and may prompt the authority to return the application rather than hold it open indefinitely.
Core application components include a detailed business plan, a governance and ownership structure chart, audited or reviewed financial statements for the applicant entity, a comprehensive AML/CFT compliance programme, and a technology and cybersecurity assessment covering the exchange infrastructure. The BMA also requires evidence that key controllers and beneficial owners meet the authority's fitness and propriety standards – a substance-over-form test that examines professional background, financial soundness, and the absence of relevant criminal or regulatory history.
The BMA conducts a formal review and may issue requests for further information (RFI) at any point in the review cycle. Each RFI effectively pauses the review clock. The overall timeline from submission of a complete file to a decision varies – the BMA has not published a guaranteed processing commitment – and in our cross-border practice we advise clients to treat the authorisation timeline as variable and to plan operational readiness accordingly. Building a shadow operating plan that can absorb a longer review period is standard practice for well-prepared applicants.
The BMA also requires applicants to maintain a physical presence in Bermuda commensurate with the nature and scale of the business. A mailbox entity will not satisfy the authority's substance expectations. Minimum substance requirements include local directors, operational staff, and demonstrable management and control exercised from within the jurisdiction. This mirrors the substance demand seen under the FSRA regime in ADGM and under VARA in Dubai, both of which have tightened substance expectations for licensed digital asset firms in recent years.
What are the AML and Travel Rule obligations for Bermuda-licensed exchanges?
A DABA-licensed exchange is subject to full AML/CFT obligations grounded in FATF Recommendations, including Recommendation 15, which applies the financial action task force's standards to virtual asset service providers. Bermuda has incorporated these obligations into its domestic AML regime, and the BMA assesses compliance with them as part of ongoing supervision.
The Travel Rule – the obligation to pass originator and beneficiary identification data with each digital asset transfer above the applicable threshold – applies to licensed Bermuda VASPs. The BMA expects exchanges to have operational systems in place to collect, verify, and transmit Travel Rule data before a licence is granted, not merely as a post-licensing implementation task. In practice, this means selecting and integrating a compliant Travel Rule protocol (such as a TRISA or OpenVASP-aligned solution) as part of the technical build before the application is filed.
Cross-border transfers present a layered compliance question. A Bermuda-licensed exchange serving customers in the European Union must manage Travel Rule data in a manner compatible with both the Bermuda BMA's expectations and the Transfer of Funds Regulation as applied under MiCA's VASP provisions. Similarly, transfers involving US-resident customers engage FinCEN's BSA/AML requirements and the OFAC sanctions regime, which applies globally to US-dollar transactions regardless of where the exchange is incorporated. We regularly advise operators on this multi-layer data and sanctions compliance obligation, which is one of the most consequential operational design questions for an exchange with an international customer base.
How does Bermuda's licensing interact with banking and the cross-border tax position?
Holding a DABA licence does not automatically solve the banking problem that afflicts most crypto exchange operators. Bermuda's domestic banking sector is relatively concentrated, and operators should not assume that a BMA licence will open relationships with Bermuda-domiciled banks without additional relationship work. In our practice, we have seen operators spend as much time on banking strategy as on the licence application itself.
The practical banking approach for most Bermuda-licensed exchanges is to maintain the primary regulatory relationship with the BMA while banking either offshore – in the United States, the United Kingdom, or Singapore – or through specialist crypto-friendly banking platforms that accept BMA-licensed entities. Each of those banking options creates its own regulatory touch point: a US correspondent banking relationship may require compliance with FinCEN registration and NYDFS expectations for New York-based flows; a Singapore bank relationship may require satisfying MAS's VASP due-diligence criteria even though the exchange itself is not Singapore-licensed.
On the tax side, Bermuda is a zero-corporate-income-tax jurisdiction. There is no Bermuda corporate income tax, capital gains tax, or withholding tax on dividends or interest as a matter of domestic law. This makes the jurisdiction attractive from a holding-company or licensing-entity perspective. However, the tax position of the exchange operator's ultimate beneficial owners, the residency of the management team, and the location of operational substance all feed into the cross-border tax analysis. Controlled foreign corporation rules in high-tax home jurisdictions, transfer pricing on intercompany arrangements, and pillar-two global minimum tax considerations all remain live for an operator with substance in multiple countries. A Bermuda-licensed entity is not a tax shelter by default; it is a component of a structure that requires careful design.
If a prior application stalled, a banking relationship closed without explanation, or your structure has grown beyond its original licence scope, a second read often surfaces the structural root cause. To map the licence, banking, and tax stack for your build, write to Map your options.
How a scoped re-structuring resolved a licensing mismatch
In a recent matter, a payments-and-exchange operator had incorporated a Bermuda entity and commenced business development activity before formal BMA authorisation was in place. The operator had understood its pre-launch phase – which included onboarding institutional counterparties and running test transactions – as outside the DABA perimeter. A closer read of the activity definition suggested otherwise. We mapped the activity against the statutory definition, identified the point at which licensed activity had arguably begun, and structured a voluntary disclosure and remediation plan that the operator presented to the BMA before any enforcement contact was initiated. The matter resolved without public action, and the operator's formal application proceeded on a strengthened governance and compliance footing. The episode illustrates a point we see repeatedly: the regulated perimeter in Bermuda, like that in Singapore and Dubai, attaches earlier in the business lifecycle than most founders expect.
Which operator profile suits a Bermuda domicile?
Bermuda suits a defined profile of digital asset exchange operator rather than every entrant to the market.
An institutional-grade exchange or custodian that is building for sophisticated counterparties – family offices, funds, corporate treasuries – and needs a credible common-law domicile with an established financial services regulatory tradition will find the BMA a serious supervisory authority whose licence carries weight with those counterparties. The BMA's long history regulating insurance and reinsurance companies, and its corresponding approach to risk assessment, gives the jurisdiction a supervisory credibility that newer or lighter-touch regimes cannot replicate.
A retail-facing exchange with a large consumer user base in the European Union, the United Kingdom, or the United States will face a significant additional layer of analysis. Bermuda authorisation does not substitute for MiCA CASP authorisation for EU customers, FCA registration for UK customers, or state money-transmitter licensing for US customers. Operators whose user base is primarily retail and distributed across those jurisdictions should treat Bermuda as one component of a multi-jurisdiction licensing stack, not a single solution. In that scenario, a hub-and-spoke model – a Bermuda holding or treasury entity combined with MiCA passporting from a European hub and FCA registration for the UK book – is a structure we regularly help operators design and implement.
A mid-market operator seeking a fast path to a lightweight registration with minimal substance requirements will find Bermuda less attractive than, for example, a BVI VASP Act registration or an early-stage EU member state approach. The BMA's substance expectations and governance demands are deliberately calibrated for operators of scale. Operators who are not yet at that scale should consider whether the compliance overhead is proportionate to the business they are building, and whether a different jurisdiction would better match their current stage.
Is a single offshore licence enough to serve clients globally?
A common assumption among early-stage exchange operators is that a single well-regarded offshore licence – whether from Bermuda, the BVI, or the Cayman Islands – provides a broadly sufficient legal basis to serve customers in any country. That assumption is incorrect and has produced a number of enforcement actions in major retail markets over the past several years.
The reality is that most significant consumer jurisdictions apply their licensing requirements on the basis of where customers are located or where marketing is directed, not only where the exchange is incorporated. The EU's MiCA regime, the UK's FCA registration requirement, Singapore's MAS licensing framework, and the various US state money-transmitter licensing regimes each operate on this demand-side basis. A Bermuda licence is Bermuda's authorisation for activity conducted in or from Bermuda. It is not a passport into any of those markets.
Operators we advise routinely discover this gap when a banking correspondent or an institutional counterparty requests evidence of local authorisation in the counterparty's jurisdiction. At that point, the options are to exit the market, seek the relevant authorisation (a process measured in months), or restructure the customer-facing entity. None of those outcomes is preferable to building the correct multi-jurisdiction licensing stack from the outset. The investment in a properly scoped initial structure is reliably less than the cost of the remediation that follows from an undercovered position.
Related at OBOLUS
- Digital Asset Licensing & Registration – How OBOLUS maps the full licence stack across operating, custody and payment layers for exchange operators worldwide.
- VASP Licensing in Turkey – Legal requirements and process for exchange operators seeking VASP authorisation under Turkey's crypto regime.
- Tax Regime for Digital Assets in Malta – How Malta's tax treatment of crypto-asset businesses interacts with the MiCA licensing transition.
FAQ
How long does a crypto licence take to obtain?
Timelines vary materially by jurisdiction, regulator workload, and the completeness of the application at submission. A BMA DABA application that is well-prepared and submitted complete may receive a decision within several months; an incomplete or complex file will take longer. Jurisdictions with lighter registration tracks – such as the BVI VASP Act – can process applications more quickly. The most reliable timeline projection comes from a pre-submission assessment of the specific regulator's current caseload and requirements.
Which jurisdiction is best for licensing my crypto business?
There is no single best jurisdiction. The right answer depends on the operator's customer geography, business model, target counterparties, banking strategy, and beneficial owner tax position. An institutional exchange with Atlantic counterparties may find Bermuda optimal. A business serving EU retail customers needs MiCA CASP authorisation regardless of where it also holds a licence. We map these variables as a scoped pre-structuring exercise before any jurisdiction recommendation is made.
Do I need a separate custody licence?
In most leading regimes – including Bermuda's DABA framework, MiCA, VARA, and MAS – custody is a separately regulated activity. An exchange that holds client digital assets on a proprietary basis, rather than settling to self-custody at the point of each transaction, is generally engaging in a custody function that requires its own authorisation or a combined authorisation that explicitly covers custody. The structural design of the wallet and settlement architecture is therefore a licensing question, not only a technology question.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance structures that sit around them. Digital assets are the whole of our practice. We map the licence stack across operating, custody and payment layers before you commit – and we structure licensing, banking and tax as one mandate rather than three disconnected workstreams. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in inbound exchange and custody licensing across the Atlantic and Gulf offshore hubs, including Bermuda, the BVI, Cayman, and ADGM.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.