Operating a digital-asset business without proper authorisation in Bermuda exposes the enterprise to enforcement action, banking termination and reputational damage that is difficult to reverse. The jurisdiction has built a structured, activity-based regime for virtual asset service providers (VASPs) – businesses that exchange, transfer, safeguard or facilitate dealings in virtual assets – and regulators there have demonstrated a willingness to act against non-compliant operators. Getting the licence right before committing capital is not optional; it is the foundation on which every downstream banking, tax and operational decision rests.
Bermuda's VASP licensing regime sits under the Bermuda Monetary Authority (BMA) and is governed by the Digital Asset Business Act (DABA). Any business conducting regulated digital asset activities from or within Bermuda must hold a valid licence or registration issued by the BMA. The regime applies both to locally incorporated entities and to overseas businesses operating in or from the island, making jurisdiction of incorporation only one factor in the compliance analysis.
This page sets out the regulated perimeter, the BMA's licence structure, the application process, the cross-border banking and tax considerations that matter most to inbound operators, and the decision framework an operator should apply before committing to Bermuda as a licensing base.
What activities require a VASP licence under Bermuda law?
A business requires authorisation under the Digital Asset Business Act if it carries on, or holds itself out as carrying on, one or more specified digital asset activities from or within Bermuda. The BMA defines those activities broadly to capture the full commercial stack of a digital-asset operation.
The regulated activities include issuing, selling or redeeming virtual coins, tokens or other forms of digital assets; operating as a payment service provider where the medium of exchange is a digital asset; operating a digital asset exchange; providing custodial wallet services; and operating as a digital asset derivative exchange provider. The list is deliberately wide. A business that performs even one of these functions at any meaningful scale is within the perimeter, regardless of how it labels its product.
The Act also captures businesses that facilitate or manage digital asset activities on behalf of others – a point that matters for fund administrators, payment processors and technology providers that sit behind an exchange. In our advisory work on inbound Bermuda structures, the question of whether an ancillary service triggers the VASP perimeter on its own is one of the first we resolve. Getting that wrong means either holding a licence that is not needed or, worse, operating without one that is.
Exemptions do exist for certain intra-group activities, for regulated financial institutions already supervised by the BMA under separate legislation, and for businesses whose digital asset activity falls below a threshold the BMA may designate. Those exemptions are narrow and fact-specific. A business should not assume it qualifies without BMA confirmation.
What licence classes does the BMA issue for digital asset businesses?
The BMA operates a tiered licensing structure under the Digital Asset Business Act, calibrated to the scale and risk profile of the applicant's activity. The principal distinction is between a full Class F licence (unrestricted digital asset business) and lower-tier classes designed for businesses whose activities are more limited in scope, counterparty base or volume.
At the entry level, a registration track – sometimes referred to as a Class M or modified licence – is available to businesses that meet specified eligibility criteria and are prepared to accept conditions on the scope of their operations. This track was designed to allow earlier-stage or more narrowly scoped operators to enter the regime without the full capital, governance and operational burden of a Class F authorisation. The BMA retains discretion to require a business to upgrade its class as its activity expands.
A Class F licence permits the broadest range of digital asset business. It requires a more comprehensive application, a more developed governance structure and a higher level of demonstrated operational and technical capability. For businesses that intend to serve institutional counterparties, operate a secondary-market exchange or provide custodial services at scale, Class F is almost certainly the target authorisation.
The BMA also issues a separate class for digital asset derivative exchange providers, recognising the distinct regulatory considerations – margin, leverage, product risk – that derivatives activity introduces. Operators in that space should expect the BMA to examine product design and risk management in detail.
Choosing the right class from the outset matters. Applying for a class that is too narrow forces a variation application when the business grows. Applying for Class F prematurely may extend the review timeline and require governance infrastructure the applicant cannot yet demonstrate. We help clients map their intended activity to the correct class before the application is filed.
How does the VASP licence application process work in Bermuda?
A Bermuda VASP licence application is a structured submission to the BMA that covers corporate identity, ownership and control, business plan, governance, risk management, AML/CFT policies and technical capability. The BMA is an active, responsive regulator; it engages with applicants during the review and will raise detailed queries on any element it considers insufficiently developed.
The typical application process proceeds through several stages. First, the applicant incorporates or registers a Bermuda entity – the licensed business must be resident and, for higher licence classes, locally incorporated. Second, the applicant prepares the application dossier: this includes a detailed business plan, a source-of-funds and beneficial-ownership disclosure, draft governance documents, a financial crime compliance manual, and evidence of the technical systems the business will use.
Third, the application is submitted to the BMA with the prescribed fee. The BMA then conducts a fit-and-proper assessment of the proposed directors, senior managers and significant owners – typically defined as holders of ten percent or more of the equity or voting rights, though the BMA may look through to ultimate beneficial owners at lower thresholds. Every proposed controller is subject to background and competence review.
Fourth, the BMA may issue a request for further information or schedule a meeting with proposed senior management. In our experience, applications that are complete and internally consistent on first submission move through the process materially faster than those requiring multiple rounds of clarification. The BMA's published timelines are indicative; actual review duration varies by licence class, applicant complexity and BMA workload at any given time.
Fifth, conditional approval or approval in principle may be issued before full licence grant, allowing the applicant to finalise operational readiness. The BMA will confirm when the entity may begin regulated operations.
Post-authorisation, the licensee is subject to ongoing obligations: periodic financial reporting, AML/CFT programme maintenance, notification requirements for changes in control or material business changes, and annual fees. The BMA has demonstrated a willingness to impose conditions, vary licences and, where necessary, revoke authorisation. Compliance is an ongoing commitment, not a one-time exercise.
For a scoped assessment of your Bermuda application – entity structure, licence class selection and dossier readiness – contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity, the user base, the banking – change the analysis. Map your options.
What AML and Travel Rule obligations apply to Bermuda VASPs?
Bermuda VASPs are subject to a full AML/CFT compliance regime aligned with FATF Recommendation 15 and its virtual-asset guidance, administered through the BMA and implemented under Bermuda's Proceeds of Crime Act and associated regulations. The regime requires a risk-based AML programme, customer due diligence at onboarding and on an ongoing basis, transaction monitoring, suspicious-activity reporting to the Financial Intelligence Agency (FIA), and regular staff training.
The Travel Rule – the obligation to pass originator and beneficiary information with a virtual asset transfer – applies to Bermuda-licensed VASPs above the applicable de-minimis threshold. The BMA expects VASPs to have a compliant Travel Rule solution in place as a condition of authorisation. In practice, this means selecting and integrating a VASP-to-VASP messaging protocol, maintaining a counterparty VASP database and establishing procedures for transfers to or from unhosted wallets.
The BMA takes the Travel Rule seriously. We have observed that applications lacking a credible Travel Rule implementation plan are queried at the review stage. Operators should treat the AML programme – including Travel Rule – as a core deliverable in application preparation, not an afterthought once the licence is granted.
For businesses licensing in Bermuda while operating globally, the AML posture interacts with requirements in every jurisdiction where the business has customers or counterparties. A Bermuda licence does not export its AML regime to those markets. A business serving EU customers, for example, must also account for the AML expectations of the relevant EU member state regulator, and the interaction with MiCA and ESMA's growing supervisory expectations for third-country VASPs. We advise on the consolidated AML stack across all operating jurisdictions.
How do banking and tax interact for a Bermuda-licensed VASP?
Banking access is consistently the most operationally sensitive issue for Bermuda-licensed digital-asset businesses. Bermuda has a well-developed financial services sector and the BMA's active licensing programme has given local and correspondent banks a degree of familiarity with the VASP client profile. That said, banking for digital-asset businesses is never automatic, and operators should plan for a parallel banking engagement process running alongside the licence application.
Bermuda local banks conduct their own due diligence on VASP applicants that is independent of the BMA process. A BMA licence demonstrates regulatory standing but does not compel a bank to open an account. In practice, businesses that have advanced regulatory credibility – a clear business model, institutional-grade AML documentation, a named compliance officer – are better placed in the banking conversation. For businesses that require multi-currency settlement, payment rails or fiat on/off ramps beyond Bermuda's local market, correspondent banking arrangements with institutions in New York, London or Singapore are typically necessary, and those institutions apply their own VASP due diligence standards.
On tax, Bermuda is a no-income-tax jurisdiction. There is no corporate income tax, no capital gains tax and no withholding tax on dividends or interest. For a business licensing in Bermuda and earning revenue there, the tax efficiency of the structure is real. However, the tax position of a Bermuda VASP is not determined by Bermuda law alone. The residence of directors and key management, the location of servers, the jurisdiction of beneficial owners and the nature of intercompany arrangements all feed into the tax analysis under the rules of other relevant jurisdictions. Economic substance requirements – Bermuda has its own economic substance legislation applicable to certain entities – add a further layer that operators must plan for.
A Bermuda-licensed entity that is also managed from, or has customers in, the EU, UK or US will need to address the tax and regulatory requirements of those jurisdictions separately. The Bermuda licence does not create a shield from foreign regulatory reach. In our cross-border practice, we regularly advise on structures that combine a Bermuda licensing base with operating entities or branches in markets where local authorisation is also required. The economics of that stack – licensing costs, substance costs, banking costs – need to be modelled before the structure is committed.
If a prior application stalled or a banking relationship closed unexpectedly, a second read of the structure can surface the reason and the route forward. Write to OBOLUS at info@oboluslaw.com or message us at t.me/oboluslaw. Map your options.
How does a cross-border operator work through the Bermuda VASP process in practice?
The practical path from decision to authorisation is clearer when set against a real business scenario. In a recent licensing matter, a digital-asset exchange operator with a user base spread across multiple regions engaged us to assess Bermuda as a licensing base alongside an EU CASP application. The operator's primary concern was speed to market and banking access; its secondary concern was the interaction between the Bermuda substance requirements and the location of its founding team.
We conducted a parallel assessment of the operator's intended activity against the BMA's licence class criteria, identified that a Class F authorisation was required given the planned product suite (exchange and custody), and mapped the governance gap between the operator's existing structure and BMA expectations. We then prepared a staged application plan: first, entity incorporation and governance buildout; second, AML programme documentation; third, a pre-submission meeting with the BMA to confirm scope and flag any novel issues in the product design.
The application was submitted in a single, complete package. The BMA raised a small number of clarificatory queries on the Travel Rule implementation and on the identity of two indirect beneficial owners. Both were resolved without a material extension of the review period. The entity received its licence and proceeded to the banking engagement phase. That phase – which ran concurrently with the regulatory review – proved the more time-intensive element, requiring engagement with more than one institution before satisfactory account terms were agreed. The operator began regulated operations within the timeline originally modelled, though banking access remained the critical-path item throughout.
Which operator profile is best suited to a Bermuda VASP licence?
Bermuda is not the right licensing base for every digital-asset business. Understanding which operator profile fits the regime – and which does not – is the honest starting point for any structuring decision.
An exchange operator or custodian that wants a well-regarded, English-law common-law jurisdiction with a responsive regulator, no corporate income tax and access to a sophisticated professional services ecosystem will find Bermuda a credible option. The BMA has demonstrated institutional depth; it is not a box-ticking regulator. Operators who come with a serious governance infrastructure and a clear business model get a serious review.
A payments business or stablecoin issuer whose primary market is the EU should note that a Bermuda licence does not carry MiCA passporting rights. If EU customers are a core part of the commercial plan from day one, a CASP authorisation under MiCA – or a structure that combines a Bermuda entity with an EU-licensed subsidiary – needs to be part of the stack. This is a structural decision that should be made before capital is committed to Bermuda incorporation and application fees.
For a token issuer that needs a clean legal base for institutional capital raises and a recognised jurisdiction for custody of the issued asset, Bermuda's combination of regulated DABA licensing, no capital gains tax and English common-law courts makes it attractive. For a business that primarily needs rapid market access into Asia, Singapore under the Payment Services Act or Hong Kong under the SFC's VATP regime may be more operationally direct options to evaluate first.
A common assumption we encounter is that a single offshore licence is sufficient to serve clients globally. It is not. The Bermuda VASP licence authorises regulated activity from and within Bermuda. Whether a business may serve customers in a given foreign market under that licence alone turns on the regulatory regime of the customer's jurisdiction, not the licence of the operator's home base. In practice, most internationally active VASPs require a licence or registration – or at minimum a carefully constructed exemption analysis – in each key market. The Bermuda licence is typically one layer of a multi-jurisdiction stack, not the whole of it.
Related at OBOLUS
Related at OBOLUS
- Licensing & Registration for Digital Asset Businesses – end-to-end guidance on obtaining and maintaining digital-asset licences across 70+ jurisdictions.
- Licence Renewal and Variation in Hong Kong – how the SFC handles post-authorisation changes to a VASP licence under the Hong Kong regime.
- Tax Treatment of Tokens in Switzerland – FINMA's token taxonomy and the Swiss tax analysis for payment, utility and asset tokens.
FAQ
How long does a crypto licence take to obtain?
Timeline varies by jurisdiction and licence class. In Bermuda, BMA review duration depends on the complexity of the applicant's ownership structure, the completeness of the application dossier and BMA workload at the time of submission. Applications that are complete and internally consistent on first submission consistently move faster than those requiring multiple clarification rounds. An operator should budget several months from filing to authorisation, and should run the banking engagement process in parallel rather than sequentially.
Which jurisdiction is best for licensing my crypto business?
There is no single best jurisdiction for every operator. The right licensing base depends on the business model, the target customer markets, the residence of key management, banking requirements and the operator's tolerance for ongoing compliance costs. Bermuda suits operators seeking an English-law base with no income tax and a responsive regulator. EU market access requires a MiCA CASP authorisation regardless of where the parent entity is licensed. We assess the full stack – operating entity, banking, tax and regulatory reach – before recommending a primary jurisdiction.
Do I need a separate custody licence?
Under the Bermuda DABA regime, custody of digital assets is a distinct regulated activity. An operator that both exchanges and custodies digital assets must ensure its licence covers both activities. Whether that requires a separate application or a single licence covering multiple activities depends on how the BMA classifies the intended custody model and the scope of the licence class sought. Operators should not assume that an exchange licence automatically authorises custody services. We clarify scope with the BMA as part of the application preparation process.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the entirety of our practice, and we act only for businesses. We map the licence stack across operating, custody and payment layers before you commit – so that the structure you build can scale without retrofitting. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in VASP authorisation strategy and inbound licensing structures across offshore and common-law jurisdictions, including Bermuda, Cayman, BVI and the Gulf.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.