On paper, structuring a staking service out of Bermuda looks straightforward. In practice, the classification question – whether the service issues something that looks like a security, whether it aggregates customer deposits in a way that attracts deposit-taking rules, and whether smart-contract automation changes that analysis at all – is the decision that determines everything downstream: the entity type, the banking, the tax posture, and whether a Bermuda regulator needs to be briefed before launch.
Bermuda has developed a dedicated digital-asset business regime under the Digital Asset Business Act (DABA), administered by the Bermuda Monetary Authority (BMA). A staking service operator must determine whether its activity falls within a regulated class under DABA – and, if it does, whether the full Class F licence or a more limited Class M provisional authorization is the right entry point. The analysis turns on the economic substance of the service, not on the label the white paper attaches to it.
This guide walks through the step-by-step regulatory assessment, the cross-border interactions with banking and tax that any inbound operator must plan for, and the decision point at which early counsel engagement changes the outcome.
What Does DABA Cover, and Where Does Staking Fit?
DABA regulates the carrying on of a digital asset business in or from Bermuda, and the regulated activities list is broader than most operators expect. Issuing digital assets, providing exchange services, providing digital-asset custody, and operating a market or facility for digital-asset transactions are all captured. A staking service sits at the intersection of several of those categories depending on how it is structured.
A pure validator node operation – one that stakes only proprietary capital with no third-party participation – generally falls outside the regulatory perimeter. The moment a service accepts third-party digital assets and distributes rewards on them, the character of the arrangement changes. The BMA's approach is substance over form: if an operator receives assets, exercises control or discretion over them, and distributes returns, it begins to look like a managed account or a collective scheme, not a technical utility.
The classification question does not end with DABA. Bermuda's Investment Business Act and the Companies Act also apply where a staking product confers rights that resemble profit participation or collective investment. We regularly advise staking operators on whether their product simultaneously triggers both the digital-asset business regime and the investment management perimeter – a dual-trigger analysis that is easy to miss when the business is building to a launch date.
The freshness point matters here: as major jurisdictions converge on substance-based classification standards – the EU under MiCA, Hong Kong under its VATP regime – Bermuda's DABA analysis is increasingly read alongside those regimes by operators with a multi-market product. The BMA is aware of that comparative context and expects applications to address it.
Step 1 – Classify the Staking Activity Before You Structure the Entity
The first step is a classification memo that maps each economic feature of the staking service to the statutory activity categories under DABA. That analysis must be completed before entity formation, not after, because the entity type – a Bermuda exempted company, a limited partnership, or a digital-asset business vehicle – follows from the regulatory answer.
The key variables in the classification analysis are:
- Whether the operator takes custody of third-party private keys or merely receives a delegation of staking rights.
- Whether rewards are pooled and redistributed (collective) or passed through on a per-asset, per-account basis (agency).
- Whether the operator exercises any discretion over the validator selection or protocol, or is operating a purely automated, smart-contract-governed process.
- Whether the token distributed as a staking reward is itself a new digital asset – which could trigger the issuance provisions of DABA separately.
The AUDIENCE_PAIN here is real: mis-classifying a staking token as a utility instrument, when it carries yield rights that resemble a security, can convert a product launch into an unregistered offering. The BMA does not treat a whitepaper utility label as a safe harbour. We assess classification against the substance of rights conferred – not the marketing description.
A classification memo typically takes two to three weeks in our practice, depending on the complexity of the smart-contract architecture and whether the token is new or an existing asset. The memo is also the document the BMA expects to see at the pre-application stage.
Step 2 – Choose the Right Licence Class Under DABA
DABA establishes a tiered licensing structure. The two main tracks relevant to a staking service operator are the Class F licence (full licence, for established businesses) and the Class M provisional authorisation (for start-ups or businesses in development phase, valid for a renewable period while the operator builds out compliance infrastructure).
A Class M provisional authorisation is not a lower standard – it is a different timeline. The BMA expects a credible roadmap to full compliance. Operators who treat Class M as a temporary workaround, rather than as a supervised on-ramp, encounter difficulty at renewal. In our practice, we have seen businesses that obtained Class M without properly budgeting the compliance buildout reach the renewal window under-prepared and face a gap in regulatory standing.
The application package for either track includes: a detailed business plan, an AML/CFT programme, a technology risk assessment of the smart-contract architecture, a fit-and-proper assessment of controllers and senior officers, and evidence of economic substance in Bermuda. Economic substance is not a formality – the BMA expects a genuine local presence, not just a registered office address.
Timeline from submission to licence grant varies by class and by the completeness of the application. A Class M authorisation can move faster than a Class F in practice, but both depend heavily on whether the BMA's review questions are answered promptly and completely. Operators who engage pre-application – briefing the BMA before formal submission – consistently experience shorter review cycles.
To map the licence class and prepare a pre-application briefing strategy for your staking service, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity, the user base, the protocol architecture – change the analysis.
Step 3 – Build the AML Programme and Address Travel Rule Obligations
AML/CFT compliance under DABA is aligned with the FATF Recommendations, including Recommendation 15 on virtual assets and the Travel Rule (the obligation to pass originator and beneficiary data alongside a digital-asset transfer). The BMA requires a written AML/CFT programme as a condition of licensing, and the programme must be specifically adapted to the staking service's transaction flows – not a generic crypto-exchange template.
For a staking service, the Travel Rule creates a practical design question: when a customer deposits assets to stake and receives rewards, does each reward distribution constitute a transfer under the Travel Rule threshold? The answer depends on whether the operator is classified as a VASP originating or receiving transfers, or as a custodian distributing in-account credits. Classification matters. Getting it wrong means either under-collecting data or over-burdening the user experience in a way that creates competitive harm.
The BMA expects transaction monitoring to be calibrated to the risk profile of the service. A staking service with a small, verified customer base looks different from a pooled staking platform open to retail participants globally. The programme must reflect that distinction. Automated transaction monitoring, linked to the smart-contract event logs, is increasingly the standard the BMA expects to see, particularly for on-chain services.
How Does Cross-Border Banking and Tax Interact With the Bermuda Structure?
Bermuda has no personal income tax, no capital gains tax, and no withholding tax on dividends or interest – features that attract digital-asset businesses structuring reward distribution to investors or participants. However, tax neutrality at the Bermuda level does not eliminate the tax exposure that arises in the jurisdictions where the operator's customers, employees, or counterparties are located.
A staking operator incorporated in Bermuda but offering services to EU residents must account for MiCA classification alongside the DABA analysis. A service offered to US persons – even passively, through an open smart contract – creates a US nexus that requires FinCEN and potentially SEC and CFTC analysis. We have seen operators build what appeared to be a clean Bermuda structure, only to discover post-launch that their smart contract was accessible by US wallets in a way that created an unintended registration obligation.
Banking for Bermuda digital-asset businesses is obtainable – the BMA licence is a recognized credential – but the process requires early engagement with correspondent banking relationships and a demonstrated AML programme. Bermuda's Signature Bank successor landscape has stabilized, and operators with a complete DABA application have a stronger banking conversation than those approaching banks pre-licence. Allied counsel in the relevant jurisdiction can assist where the banking relationship spans multiple domiciles.
Economic substance rules also carry a cross-border dimension. Where the staking operator is part of a group, the substance analysis in Bermuda must be read alongside the CFC and transfer-pricing rules of the parent jurisdiction. A Bermuda entity that exists to hold IP or to route rewards without genuine local decision-making may not sustain the tax treatment the structure was designed to achieve.
If a prior application stalled or an account was closed, a second structural read can surface the reason and the route forward. Contact OBOLUS at info@oboluslaw.com or via t.me/oboluslaw.
What Are the Smart-Contract and DAO Governance Considerations?
Smart-contract automation does not remove regulatory accountability – it relocates the question of who is responsible. Under DABA, the BMA focuses on the person or entity that operates, controls, or promotes the digital-asset business, even if the underlying mechanics are governed by code. A staking protocol that is nominally decentralized but has identifiable controllers, admin keys, or a development team with upgrade authority is, for regulatory purposes, operated by those persons.
A DAO (decentralized autonomous organization) structure is increasingly used by staking protocols to distribute governance. Bermuda does not yet have a dedicated DAO statute equivalent to Wyoming's or the Marshall Islands' models. A DAO operating a staking service in or from Bermuda will typically be wrapped in an exempted company or a limited partnership for the purpose of DABA registration – the DAO governance layer sits above or alongside the regulatory entity, not in place of it.
Smart-contract audits are a BMA expectation for technology risk assessments. An audit conducted by a recognized security firm, covering the staking contract's logic, access-control mechanisms, and upgrade paths, materially strengthens the application and reduces the BMA's post-licensing monitoring concerns. Operators who submit without an audit, or with a stale audit that does not cover the current contract version, routinely face supplemental information requests that delay the process.
The liability question when a smart contract fails is live in Bermuda, as in most jurisdictions: the current judicial position across common-law forums is that the operator of a digital-asset business retains responsibility to users for losses arising from the operation of its service, even where the proximate cause was an automated smart-contract execution. A well-drafted terms of service, combined with the right entity structure and insurance coverage, can manage but not eliminate that exposure.
A Staking Operator at the Regulatory Boundary
In a recent matter, a Web3 business approached us after its Bermuda DABA pre-application meeting surfaced concerns from the BMA about the character of its reward distribution mechanism. The operator had structured staking rewards as a fixed-yield product paid in a new token – a design that the BMA viewed as potentially straddling the digital-asset business and investment management perimeters simultaneously. We restructured the reward mechanism from a fixed-yield model to a variable, protocol-determined distribution, documented the change in the classification memo, and prepared a supplemental technical submission addressing the smart-contract architecture. The BMA accepted the revised characterization, and the Class M application proceeded. The operator reached provisional authorisation within a revised timeline that was several weeks shorter than the original projection under the prior structure.
Decision Matrix – Which Staking Service Profile Fits Bermuda?
Not every staking service belongs in Bermuda. The analysis below maps three operator profiles to the Bermuda path and its key risks.
Profile A – Protocol-layer validator with institutional participants. An operator running validator nodes for a major proof-of-stake network and accepting delegation from institutional counterparties is likely to fall squarely within DABA's regulated activity list. Bermuda suits this profile well: the BMA has the technical capacity to assess the application, the Class F licence is recognized by institutional counterparties as a credible credential, and the absence of corporate income tax on non-Bermuda-source income is structurally useful. Key risk: the economic substance requirement demands genuine local infrastructure.
Profile B – Consumer-facing staking aggregator. A retail-facing pooled staking product aggregating assets from multiple end users adds layers of complexity. The collective-investment analysis becomes sharper. If the service is offered globally, the operator faces not only DABA but parallel analysis under MiCA (if EU users are targeted), the MAS Payment Services Act (if Singapore users), and US rules. Bermuda as a regulatory domicile is viable, but only if the operator is prepared to ring-fence the user base or obtain parallel authorizations in the relevant retail jurisdictions. Key risk: regulatory fragmentation and correspondent banking scrutiny.
Profile C – DeFi-native protocol with no identifiable operator. A fully decentralized staking protocol with no admin keys, no development team with upgrade authority, and no entity taking custody of assets sits at the outer edge of DABA's perimeter. Bermuda offers no formal sandbox for this profile at present. If the protocol is genuinely decentralized, no Bermuda licence may be required – but that conclusion must be reached through a documented classification analysis, not assumed. Key risk: if decentralization is incomplete, the BMA will look through to the controllers.
Related at OBOLUS
Related at OBOLUS
- DeFi, Tokenization and Smart-Contract Law – how we structure and advise digital-asset protocols across their full legal lifecycle.
- Real-World Asset Tokenization: The Disputes Angle – what happens when tokenized-asset structures break down and recovery is needed.
- How to Set Up Transaction Monitoring for Crypto – a step-by-step guide to building an AML-compliant monitoring programme.
FAQ
Can a DeFi protocol be regulated?
A DeFi protocol can fall within a regulated perimeter if identifiable persons operate, control, or promote it as a digital-asset business. Regulators, including the BMA under DABA, apply a substance-over-form test: admin keys, upgrade authority, and fee collection are all indicators of control. A protocol that is genuinely autonomous and has no identifiable operator presents a harder classification question – but that conclusion must be reached through documented legal analysis, not assumed from the architecture.
What legal wrapper suits a DAO?
Bermuda does not currently have a dedicated DAO statute. In practice, a DAO operating a staking or digital-asset service in or from Bermuda is wrapped in a Bermuda exempted company or limited partnership for licensing purposes under DABA. The DAO governance layer – token-holder voting, proposal mechanisms – sits alongside the regulatory entity. The legal wrapper provides the counterparty, the BMA licence holder, and the liability-management structure that a pure on-chain DAO cannot supply.
Who is liable when a smart contract fails?
Across the common-law forums where digital-asset disputes are litigated – including England and Wales, the DIFC Courts, and Singapore – courts have consistently held that the operator of a digital-asset service retains responsibility to users for losses arising from its operation, even where the proximate cause was an automated smart-contract execution. Liability can be managed through clear terms of service, appropriate entity structuring, and professional indemnity insurance, but it cannot be contracted away entirely. Advice specific to the smart contract's design and the applicable jurisdiction is essential before launch.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and staking operators on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We assess token classification against the substance of rights conferred – not the marketing label – and our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums. Digital assets are the whole of our practice. To discuss your Bermuda staking structure, contact info@oboluslaw.com.
By Roman Levitt, Technology & DeFi Counsel – specialising in smart-contract architecture analysis, DAO structuring, and DeFi regulatory classification across leading common-law jurisdictions.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.