A digital-asset payments business expanding into Bermuda faces a question that crystallises the wider problem of cross-border crypto commerce: which regulatory regime actually governs a payment service provider (PSP) or acquiring agreement in this jurisdiction, and what does compliance look like before the first merchant transaction settles? The answer matters acutely because operating without the right licence risks enforcement, frozen rails and the loss of banking relationships that took months to build.
Bermuda regulates digital-asset business under the Digital Asset Business Act (DABA), administered by the Bermuda Monetary Authority (BMA). A PSP or acquirer handling crypto payments or fiat-to-crypto settlement falls squarely within the DABA's defined activities, and must hold a licence before soliciting Bermudian residents or operating a Bermuda-incorporated entity in that capacity. Fiat payment services that touch digital assets also engage the BMA's broader financial services oversight. This page walks through the regulated perimeter, the application process, the cross-border interaction with tax and banking, and the decision points that determine whether Bermuda is the right anchor for your payments operation.
What activities require a licence under the Bermuda DABA?
Any person carrying on digital asset business in or from Bermuda must hold a BMA licence. The DABA defines that term broadly: issuing, selling or redeeming digital assets; operating a digital asset exchange; providing a digital asset payment service; managing a digital asset wallet; and providing custodial services all fall within the perimeter. A PSP or acquirer that settles merchant payments in cryptocurrency, converts fiat to crypto on behalf of merchants, or holds customer funds in digital form at any point in the transaction flow is almost certainly carrying on one or more of those defined activities.
The key structural question is whether the entity is incorporated in Bermuda, conducts business from Bermuda, or is merely dealing with Bermuda-resident counterparties. All three limbs can engage the BMA's jurisdiction independently. In our practice, operators frequently underestimate the third limb: a foreign PSP onboarding Bermudian merchants may need to register with the BMA even if the operating entity sits elsewhere. That analysis must happen before commercial launch, not after a bank or card scheme flags the issue.
The DABA creates a tiered licence structure ranging from a Class F (full) licence for established operators to a Class M (modified) licence designed to accommodate early-stage businesses. A PSP or acquirer with a live product and a material transaction volume will generally be directed to the Class F track. The BMA also operates a Digital Asset Business Sandbox for businesses that want to test a model with a controlled client base before committing to a full licence application.
How does the BMA licence application process work for a PSP?
The BMA application for a digital asset business licence is a substantive regulatory exercise, not a notification procedure. The authority expects a complete submission covering corporate governance, the business plan, AML and CFT controls, cybersecurity policy, capital adequacy evidence, and a description of the technology stack. For a PSP or acquirer, the acquiring agreement terms, settlement flows, merchant onboarding standards and chargeback policies will all be reviewed.
The BMA has published guidance on its expectations for each component. In our experience advising payments businesses across multiple common-law regimes, Bermuda stands out for the BMA's willingness to engage with applicants in pre-application meetings. That channel should be used. A structured pre-submission meeting reduces the risk of a request for additional information that extends the clock.
Timeline is driven by the completeness of the submission. A well-prepared full application moves materially faster than one that arrives with gaps. The BMA targets a defined review period for complete applications, though the authority retains discretion to extend that period when it raises queries. Businesses should plan on a process measured in months, not weeks, and should model their runway accordingly. The sandbox track can be meaningfully faster for operators who qualify.
A point that catches operators off-guard: the BMA requires certain key individuals – typically the CEO, CFO and chief compliance officer – to be approved as fit and proper before the licence is granted. Where those individuals have prior regulatory history in other jurisdictions, that history must be disclosed. Allied counsel in those jurisdictions may need to prepare supporting declarations.
What are the legal requirements specific to an acquiring agreement in Bermuda?
An acquiring agreement in the crypto-payments context is the contract between the acquirer (the PSP) and the merchant, governing settlement terms, currency conversion, reserve requirements and dispute resolution. Under Bermuda law, those agreements are subject to the general law of contract and, where the acquirer is BMA-licensed, the conditions attaching to that licence.
The BMA's licence conditions typically impose requirements on how customer and merchant funds are held, the speed of settlement, and the disclosure that must be made to merchants about the risks of digital-asset volatility between payment and settlement. An acquiring agreement that does not reflect those conditions creates a compliance gap that the BMA can cite on examination.
Specific drafting considerations include: the governing law and dispute resolution clause (Bermuda law and the courts of Bermuda are conventional choices for a Bermuda-licensed entity, though international arbitration is increasingly common); the treatment of chargebacks and reversals in a blockchain context where finality is rapid; the reserve or holdback mechanics that protect the acquirer against merchant insolvency; and the AML representations and warranties the merchant must make. In a cross-border acquiring relationship, the agreement must also address the regulatory status of the merchant in its own jurisdiction – a merchant operating without the applicable licence in its home market is a counterparty risk the acquirer takes onto its own book.
How do AML and the Travel Rule apply to Bermuda PSPs?
Bermuda has implemented the FATF Recommendations – including Recommendation 15 on virtual assets – through its AML/CFT regime. The BMA supervises licensed digital asset businesses for compliance with those obligations. For a PSP or acquirer, the practical implications are significant.
The Travel Rule (the obligation to pass originator and beneficiary data with each qualifying transfer) applies to digital asset transfers above the applicable threshold. A Bermuda-licensed PSP must have a technical solution in place for Travel Rule compliance at the time of licensing, not as an afterthought. The BMA will assess the adequacy of that solution as part of the application review. Operators who have not yet implemented a VASP-to-VASP Travel Rule protocol should build that work into the pre-application roadmap.
On KYC, the BMA expects risk-based customer due diligence. For a PSP, that means a tiered approach: lighter-touch for low-value or low-risk merchant relationships, enhanced due diligence for merchants in higher-risk sectors or jurisdictions. The compliance programme must be documented, tested and overseen by a designated compliance officer who is acceptable to the BMA. We have seen applications stall at the compliance-officer approval stage where the individual's experience was primarily in traditional payments rather than digital assets – the BMA distinguishes between the two.
What is the cross-border banking and fiat-rails reality for a Bermuda PSP?
Holding a BMA licence is necessary. It is not sufficient to secure banking. Bermuda's status as a well-regulated offshore financial centre makes BMA-licensed entities more bankable than unregulated counterparts, but correspondent banking for crypto businesses remains selective even here.
The practical picture: a Bermuda PSP will typically need a primary banking relationship for its operating account, a separate client-money safeguarding account, and – where it handles fiat conversion – access to a correspondent banking network capable of settling in the relevant currencies. Bermuda banks apply their own risk appetites to crypto-business clients. Operators who arrive with a complete regulatory file, a clearly explained business model and strong AML controls are better positioned, but the relationship-building process takes time and should begin before or in parallel with the BMA application, not after licence grant.
For businesses serving clients in multiple jurisdictions – a European acquiring client, a US merchant base, a Southeast Asian growth market – the Bermuda licence addresses the Bermuda-law question. It does not resolve the regulatory position in those other markets. A merchant in Germany is subject to MiCA and the relevant national competent authority. A US merchant relationship may engage FinCEN registration and state money-transmitter licensing. The Bermuda entity in that structure is a hub, not a global passport.
In our cross-border practice, we regularly advise payments businesses on structuring the licence stack so that the Bermuda entity interfaces with the parts of the transaction flow it can legally manage, while allied entities in other jurisdictions hold the licences required for their markets. That structure must be designed before the first acquiring agreement is executed, because restructuring an operating payments business is disruptive and expensive.
To map the licence, banking and tax stack for your Bermuda payments build, write to info@oboluslaw.com. The process above describes the standard path. Your facts – the entity structure, the user base, the settlement currencies – change the analysis, and the right time to work through them is before you commit to a jurisdiction.
How does Bermuda's tax environment interact with a PSP structure?
Bermuda levies no corporate income tax, no withholding tax on dividends or interest, and no capital gains tax. Those features make it an attractive structuring location for payments businesses generating revenue across multiple markets. The BMA licence sits alongside a tax environment that does not impose a domestic tax drag on the PSP's own income.
The cross-border complication is substance. A Bermuda entity that lacks genuine economic substance in Bermuda risks recharacterisation by the tax authorities of the jurisdictions where its beneficial owners or primary counterparties sit. The OECD Pillar Two framework and various domestic controlled-foreign-company regimes have sharpened scrutiny of low-tax jurisdictions. A Bermuda PSP that exists only on paper, with all decision-making and key personnel elsewhere, is exposed to that scrutiny.
Bermuda's own economic substance legislation requires entities in certain sectors to demonstrate that they conduct core income-generating activities in Bermuda, maintain adequate physical presence and employ qualified staff locally. Payments businesses in scope must take that obligation seriously. A BMA licence does not automatically satisfy the substance test.
For a payments business with a genuinely distributed operating model – development in one jurisdiction, compliance in another, client relationships in a third – a Bermuda anchor makes sense only if meaningful substance can be established. The alternative is a structure where Bermuda holds the licence and the substance requirement is met, while operational affiliates in other jurisdictions handle local services under their own regulatory permissions. That is a more complex structure but a more defensible one.
How does this play out in practice? An anonymized example
In a recent cross-border matter, a payments technology company sought to establish a Bermuda entity as the acquirer of record for a network of merchants across three regions. The company had an existing EMI licence in an EU jurisdiction, but its EU licence did not extend to crypto settlement. We structured the Bermuda entity to sit at the settlement layer, with the EU entity handling fiat disbursement to merchants under its existing authorisation. The BMA application was built around a clearly documented flow-of-funds analysis showing the Bermuda entity's role, the segregated client-money accounts, and the AML controls at each handoff point. The sandbox track was used to test the acquiring agreement terms with a pilot cohort before the full licence application was submitted. The matter concluded with the full licence granted and the banking relationships – two Bermuda banks and one international correspondent – in place before commercial launch.
Does a single offshore licence cover global operations?
A common assumption is that a well-regulated offshore licence – Bermuda, Cayman, BVI – provides a legal basis to serve clients anywhere in the world. It does not. Each jurisdiction's regulatory perimeter is defined by the nexus between the licensed entity and the clients or merchants it serves. A Bermuda PSP licence authorises the licensed entity to carry on digital asset business in or from Bermuda. Whether a given transaction or client relationship requires an additional licence in another jurisdiction depends on the law of that jurisdiction, not the law of Bermuda.
The practical consequences of this misunderstanding are serious. An acquirer onboarding EU merchants without MiCA CASP authorisation – or at least a credible transition plan under the applicable transitional provisions – is exposed to enforcement by EU national competent authorities. A PSP with US merchant relationships may need FinCEN registration and potentially state MTL licences depending on the transaction type and settlement mechanism. The Bermuda licence does not cure those gaps.
In our practice, we map the full licence requirement across every material nexus before a client launches. That analysis drives the entity structure, the banking strategy and the sequence of licence applications. A Bermuda licence is often a sound component of a multi-jurisdiction payments stack. It is not a substitute for the stack.
If a prior application stalled or a banking relationship was closed, contact OBOLUS at info@oboluslaw.com. A second read can identify the structural issue and the path forward, whether that involves the BMA, an EU NCA, or a correspondent banking review in another market.
Which operator profile is best suited to a Bermuda PSP structure?
Not every payments business should anchor in Bermuda. The following profiles give a practical guide to the decision.
Profile A – The cross-border acquirer. An acquirer with merchant relationships in multiple non-EU, non-US markets, seeking a common-law jurisdiction with a credible digital-asset licence and no domestic tax friction. Bermuda is a strong candidate. The BMA's DABA regime provides a well-recognised regulatory credential. The tax environment eliminates domestic income tax drag. The substance requirement is manageable for an operator prepared to place genuine operations in Bermuda. Timeline to full licence: measured in months; sandbox available for an accelerated pilot.
Profile B – The EU-anchored payments business seeking an offshore settlement layer. A business with an existing EU EMI or CASP authorisation looking to add a crypto-settlement capability without triggering MiCA reclassification of the primary entity. A Bermuda entity at the settlement layer is workable, provided the flow-of-funds is clearly documented and the cross-border arrangement does not constitute carrying on regulated activity in the EU without the required authorisation. Requires careful structuring; allied counsel in the EU jurisdiction is essential.
Profile C – The startup with no existing licence, seeking a fast path to market. The BMA sandbox is available but requires a genuine product and a credible compliance plan. Bermuda is not a light-touch jurisdiction. A startup that needs speed above all else should assess whether a lighter initial registration – BVI VASP Act, Cayman VASP Act – serves the short term while the Bermuda application proceeds. That sequencing must be managed carefully to avoid creating conflicting regulatory positions.
Profile D – The US-facing payments business. A Bermuda licence does not resolve the US regulatory question. FinCEN registration and state MTL licences are required for US merchant or consumer relationships regardless of where the acquiring entity is incorporated. Bermuda may still be a useful structural layer, but the US regulatory build must proceed in parallel. We advise on the interaction between the two stacks.
Related at OBOLUS
Related at OBOLUS
- Banking, Payments and EMI Onboarding – how we structure the payment and banking layer for digital-asset businesses across jurisdictions
- Legal Counsel for Crypto Payment Firms – licence, banking and acquiring strategy for payments businesses operating in multiple markets
- UAE (VARA Dubai) vs United Kingdom: Where to Licence – a comparative analysis for operators deciding between two leading digital-asset hubs
FAQ
Why do banks close crypto company accounts?
Banks close crypto company accounts primarily because of perceived AML risk, unclear regulatory status and correspondent-banking pressure from upstream institutions that restrict crypto exposure. A BMA-licensed entity with documented AML controls, a clear business model and audited financial statements is materially better positioned than an unlicensed operator. Regulatory standing alone does not guarantee a banking relationship, but the absence of it is usually disqualifying. Proactive disclosure and relationship-building during the licence application phase improves outcomes.
How can a VASP onboard with an EMI?
A VASP (virtual asset service provider) seeking to onboard with an EMI (electronic money institution) for fiat account services must demonstrate regulatory standing in its own jurisdiction, a compliant AML programme and clear fund-flow documentation. Most EMIs require sight of the VASP's licence or registration certificate, its AML policy, its UBO structure and its transaction monitoring approach. Some EMIs require a direct integration review. Bermuda-licensed VASPs generally carry stronger credibility with EMI compliance teams than unregulated entities, though individual EMI risk appetites vary.
What does client-money safeguarding require?
Client-money safeguarding requires that funds belonging to clients are held in designated accounts separate from the firm's own funds, with a clear trust or statutory mechanism protecting those funds in insolvency. Under the BMA's digital-asset business regime, licensed operators must comply with applicable safeguarding conditions attached to their licence. In practice that means a segregated bank account, a documented reconciliation process and regular reporting to the BMA. The specific requirements vary by licence class and must be confirmed against the conditions of the individual licence.
About OBOLUS
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and payment firms on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance structures that sit around them. Digital assets are the entirety of our practice. We map the licence stack across operating, custody and payment layers before you commit – so the structure is defensible before the first transaction settles. To discuss your situation, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Victor Olsen, Regulatory and Compliance Analyst – specialist in digital-asset licensing and AML compliance for payment service providers across cross-border structures.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.