Digital-asset custody authorisation in Cayman Islands

Operating a digital-asset custody business without the correct authorisation in the Cayman Islands exposes the enterprise to regulatory enforcement, banking termination and reputational harm that can take years to repair. Under the Cayman Islands Virtual Asset (Service Providers) Act, custody of virtual assets is a regulated activity requiring formal registration or licensing with the Cayman Islands Monetary Authority (CIMA). The path to authorisation is structured and, for a well-prepared applicant, achievable – but the detail of how a custody business is scoped, owned and operated determines which track applies and how long the process takes.

This page sets out the regulated basis for digital-asset custody authorisation in Cayman, the practical authorisation process for an inbound operator, the cross-border interactions that most affect timing and banking, and the decision point at which engaging specialist counsel changes the outcome.

What is the regulated basis for digital-asset custody in Cayman?

Digital-asset custody in the Cayman Islands is a regulated activity under the Virtual Asset (Service Providers) Act (the VASP Act), administered and supervised by CIMA. The VASP Act defines custody broadly: holding, storing or controlling virtual assets on behalf of another person brings a business within the regime. A firm that holds private keys, manages multi-signature arrangements or operates an omnibus wallet structure for clients is almost certainly within scope.

CIMA operates a two-track structure. Businesses providing a narrower set of virtual-asset services may register; those providing custody – or combining custody with exchange, issuance or lending – are generally directed toward the licensing track, which carries more rigorous governance, capital and AML requirements. The distinction is not cosmetic. A licensed VASP must demonstrate adequate corporate governance, appoint a compliance officer, maintain AML/CFT policies aligned to the FATF Recommendations (including Recommendation 15 on virtual assets), and satisfy CIMA's ongoing supervisory expectations.

The VASP Act does not sit in isolation. Cayman imposes substance requirements: a custodian relying on the jurisdiction for its authorisation must demonstrate genuine operational presence, not simply a registered office. This has direct implications for where staff, systems and decision-making are located.

Who needs a custody authorisation from CIMA?

Any entity incorporated or registered in the Cayman Islands – or any entity conducting virtual-asset custody activities that have a meaningful Cayman nexus – should assess whether the VASP Act applies before going live. The triggers are broader than many operators expect.

An exchange that self-custodies client assets alongside its trading activity is conducting custody. A fund administrator holding tokenised fund units for investors is conducting custody. A staking-as-a-service provider that retains control of validator keys on behalf of delegators warrants close analysis under the same regime. Even a technology company that holds keys "on behalf" of clients under a software licence may find that the economic and legal substance of the arrangement places it inside the regulated perimeter.

Foreign entities with Cayman-domiciled fund structures are a particular concern. A BVI or Delaware operating entity that custodies assets for a Cayman-registered fund may pull both itself and the fund within CIMA's supervisory interest. In our practice, we regularly advise on these cross-entity scoping questions before a structure is finalised, because retrofitting authorisation after launch is materially more expensive and disruptive than building it in from the start.

The VASP Act explicitly captures entities with a Cayman Islands nexus, not only those incorporated there. Any operator with a Cayman fund, Cayman management company or Cayman-based principals should treat the question of authorisation as open until properly analysed.

For a scoped authorisation analysis of your custody structure, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity, the user base, the banking – change the analysis. Map your options

How does the VASP licensing process work at CIMA?

The CIMA licensing process for a virtual-asset custody business follows a defined sequence, though the timeline varies significantly depending on the completeness of the application and the complexity of the business model. A well-organised applicant submitting a complete application typically progresses through initial review to conditional approval in a matter of weeks to a few months; a fragmented application can extend the process considerably.

The core application package includes a detailed business plan, an AML/CFT programme (policies, procedures, risk assessments), a corporate governance framework, fitness-and-propriety documentation for all controllers and senior managers, an IT and security assessment covering key management, and evidence of adequate own funds or capital. CIMA expects the programme to reflect the applicant's specific business model – a custody-only operator's risk profile differs from a combined custody-and-exchange operation, and the documentation should reflect that.

Once lodged, CIMA will typically issue queries. Speed of response to those queries is the single biggest variable within the applicant's control. We advise clients to establish a dedicated project team – an authorised contact, a compliance lead and external counsel – before submission, so that queries are answered within days rather than weeks.

The process has several formal stages worth tracking:

• Pre-application engagement with CIMA to confirm the correct track and flag any structural issues.
• Preparation and submission of the full application package.
• CIMA's initial completeness review.
• Substantive review, including potential fit-and-proper interviews of controllers.
• Conditional approval (conditions typically relate to final governance or system steps).
• Full licence issuance on satisfaction of conditions.

Post-authorisation, a licensed custodian faces ongoing obligations: annual reporting to CIMA, AML/CFT audits, material-change notifications and prompt disclosure of any adverse regulatory or legal developments in other jurisdictions. Operators we advise routinely underestimate the ongoing compliance burden relative to the initial authorisation effort.

What are the AML and Travel Rule requirements for a Cayman custodian?

A CIMA-licensed custodian must maintain an AML/CFT programme that meets the standard set by the Cayman Islands' Anti-Money Laundering Regulations and the FATF framework, including the Travel Rule – the obligation to pass originator and beneficiary data with each virtual-asset transfer. The Cayman Islands has implemented FATF-aligned Travel Rule requirements for VASPs, and CIMA expects licensed custodians to have operational solutions in place, not simply written policies.

In practice, Travel Rule compliance for a custodian means integrating with a recognised Travel Rule solution, onboarding counterparty VASPs before transferring assets to them, and maintaining records of originator and beneficiary information for each qualifying transaction. The de-minimis threshold below which Travel Rule obligations are reduced or suspended varies and should be confirmed against current CIMA guidance at the time of application.

Sanctions screening is a parallel obligation. Cayman operates within the international sanctions architecture, and a custodian holding assets on behalf of sanctioned persons or entities faces potential CIMA enforcement, banking termination and, where US-dollar rails are involved, exposure to OFAC.

Cayman's AML supervisory framework also encompasses the real beneficial-ownership register requirements. A licensed custodian is expected to maintain accurate and current UBO information and to make it available to CIMA on request. Structures that obscure beneficial ownership at the fund or management-company level will encounter problems at both the authorisation stage and during routine supervision.

How does cross-border banking and tax interact with a Cayman custody licence?

The Cayman Islands licence alone does not resolve a custody business's banking and tax position – it is one layer of a stack, not the whole structure. For most inbound operators, the cross-border analysis is at least as consequential as the authorisation itself.

On banking: Cayman-authorised VASPs have access to a defined set of banking relationships in the jurisdiction, but correspondent banking for crypto-adjacent businesses remains selective globally. A custodian holding significant USD-denominated assets will typically require a US correspondent line – which may trigger FinCEN and NYDFS scrutiny of the Cayman entity's compliance programme and AML posture, regardless of where it is licensed. We have seen banking relationships fall away precisely because the operator treated the Cayman licence as a substitute for cross-border compliance, rather than a foundation for it.

On tax: the Cayman Islands imposes no corporate income tax, capital gains tax or withholding tax at the entity level. That is a well-documented feature of the jurisdiction. What is less frequently analysed is the tax position of the custody business's clients and the entity's controllers. A Cayman custodian serving EU clients may attract DAC8 reporting obligations; one with US principals may bring FATCA filing obligations; one receiving management fees from a Cayman fund may trigger economic substance analysis under the Economic Substance Act.

The cross-border reality is that a Cayman custody structure is most durable when it is built alongside a tax and banking analysis, not after one. In our practice, we map the licence, banking and tax stack as a single integrated exercise before the client commits to the jurisdiction.

To map the licence, banking and tax stack for your custody build, write to info@oboluslaw.com. If a prior application stalled or an account was closed, a second read can surface the structural reason and the route back. Map your options

A custody authorisation in practice

In a recent authorisation matter, a digital-asset fund administrator domiciled in a common-law offshore jurisdiction sought to formalise its custody operations for a suite of Cayman-registered funds. The structure had evolved organically: the administrator had been holding private keys and executing wallet operations for the funds without a formal VASP authorisation, and a prospective institutional investor flagged the gap during due diligence. We conducted a scoping analysis, confirmed the VASP Act applied, and structured a phased engagement: a pre-application CIMA meeting to confirm the licensing track, a revised governance framework aligned to CIMA's expectations, and a compliant AML programme built around the fund-of-funds custody model. The application was submitted in a complete state and progressed to conditional approval within the expected window. The investor's condition was satisfied and the transaction closed.

How does Cayman compare to other custody licensing hubs?

Cayman occupies a specific position in the licensing spectrum. It is not a first-stop jurisdiction for operators seeking a global operating licence – MiCA passporting from an EU jurisdiction, or an MAS licence in Singapore, offers broader market access. What Cayman does well is serve fund-domiciled structures: where the assets under custody sit in a Cayman vehicle, authorising the custody layer in the same jurisdiction reduces regulatory fragmentation and simplifies the fund's own governance disclosures.

For a custody-only operator without a Cayman fund connection, the decision matrix looks different. An operator serving EU clients primarily may find a MiCA CASP authorisation in a passporting EU member state more efficient; one serving institutional clients in Asia may prefer Singapore's MAS regime under the Payment Services Act. Cayman is most compelling when the fund and custody layers are co-located and the operator values the jurisdiction's common-law framework, judicial infrastructure and established fund industry relationships.

Switzerland – via FINMA's fintech or banking licence routes – offers an alternative for custody operators seeking a more bank-like regulatory imprimatur, though capital and ongoing compliance costs are calibrated accordingly. The BVI VASP Act 2022 provides a lighter registration regime, but it is not equivalent in institutional recognition to a CIMA licence. There is no universally correct answer; the right jurisdiction is the one that aligns the licence type, the client profile and the capital and compliance cost the operator can sustain.

When is the decision point to engage counsel?

The decision point is earlier than most operators assume. By the time a custody business is operational, the structural choices – entity type, ownership, key-management model, banking jurisdiction – are largely fixed. Retrofitting those choices to satisfy CIMA's authorisation requirements, or unwinding them when they create a tax or sanctions problem, is materially more costly than making the right choice at incorporation.

The profile that benefits most from early counsel is an operator in one of three situations: first, an existing business that has been holding assets on behalf of clients without formal VASP authorisation and needs to regularise; second, a new entrant building a fund-custody structure and deciding whether Cayman is the right domicile for the custody layer; third, an operator with an existing VASP registration in another jurisdiction that is expanding its Cayman fund relationships and needs to understand where the authorisation obligation now sits.

A common assumption in this market is that a single offshore registration – a BVI VASP registration, for example – is sufficient to service clients globally, including through Cayman-domiciled structures. It is not. Each jurisdiction analyses the activity within its own regulatory perimeter. A BVI entity that holds assets for a Cayman fund, takes instructions from a Cayman management company, and has Cayman-based principals will attract CIMA's attention regardless of where it is registered. The analysis is substance-over-form: where does the custody activity actually occur?

We regularly advise operators on these multi-layer questions. The output is a short-form authorisation opinion and a recommended structure – not a generic checklist, but a jurisdiction-specific analysis of which activities in which entity require which authorisation, and in what sequence.

Related at OBOLUS

• Licensing and registration for digital-asset businesses – the full licensing practice across 70+ jurisdictions for exchanges, custodians and token issuers.
• Digital-asset custody authorisation in Switzerland – FINMA's custody routes compared for operators weighing an EU-adjacent hub.
• Smart contract legal review: where the legal lines are drawn – how on-chain logic interacts with custody obligations and enforcement risk.

About OBOLUS

OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence stack across operating, custody and payment layers before a client commits to a structure – and where assets have been misappropriated, we work alongside forensic partners to convert on-chain evidence into court-ready disclosure applications. To discuss your custody authorisation question, contact info@oboluslaw.com or message us at t.me/oboluslaw.

By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in VASP authorisation strategy for fund-linked custody structures across Cayman, BVI and the major Asian and European licensing hubs.

FAQ

How long does a crypto licence take to obtain?

Timelines vary by jurisdiction and licence type. A well-prepared CIMA application for a Cayman VASP licence typically progresses to conditional approval within a matter of weeks to a few months from the date of a complete submission. The principal variable within the applicant's control is the completeness and quality of the documentation at the point of lodgement. Poorly structured applications, or those requiring structural amendment during review, can extend the process significantly.

Which jurisdiction is best for licensing my crypto business?

There is no universally correct answer. Cayman is well-suited to fund-linked custody structures where the underlying assets sit in a Cayman vehicle. EU operators seeking passporting access are better served by a MiCA CASP authorisation through an EU member state. Singapore's MAS regime under the Payment Services Act is a strong fit for Asian institutional business. The right jurisdiction aligns the licence type, the client profile and the ongoing compliance cost the operator can sustain. We advise on this selection as a distinct scoping exercise.

Do I need a separate custody licence?

In the Cayman Islands, custody is a regulated activity under the VASP Act. An entity that holds or controls virtual assets on behalf of another person will ordinarily require a CIMA authorisation covering that activity – it cannot rely on a licence issued in another jurisdiction. Whether custody must be authorised separately from exchange or other services depends on the business model and how CIMA categorises the combined activity. Multi-activity operators should obtain a scoped authorisation opinion before launching.

This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.