Digital-asset custody licensing in Cayman Islands

Operating a digital-asset custody business in the Cayman Islands without the correct authorisation is not a grey area. Under the Virtual Asset (Service Providers) Act (the VASP Act), custody of virtual assets for third parties is a regulated activity, and the Cayman Islands Monetary Authority (CIMA) supervises compliance. Enforcement exposure, loss of banking relationships and reputational damage follow quickly from unlicensed operation. This page maps the regulated basis, the application path, the cross-border interactions that shape the structure, and the decision points a serious operator needs to work through before committing capital.

Is custody a regulated activity under Cayman law?

Custody of virtual assets for third parties is a regulated activity under the VASP Act, meaning any business that holds, stores or safeguards digital assets on behalf of clients must obtain the appropriate authorisation from CIMA before operating. The VASP Act distinguishes between a registration track and a full licensing track, and which pathway applies depends on the nature and scale of the business. Custody – particularly when combined with other activities such as exchange or portfolio management – is likely to require the full licence rather than simple registration.

The definitional scope is broad. A business incorporated in the Cayman Islands that provides custody to clients located anywhere in the world falls within the regime. Equally, a business incorporated elsewhere that conducts custody activities from Cayman – or markets those services to Cayman-resident clients – may trigger CIMA oversight. The territorial reach of the VASP Act is one of the first questions any inbound operator must resolve.

In our practice, the most common structural error is assuming that a holding company or a technology subsidiary sitting in Cayman is outside the VASP perimeter because client-facing activity sits elsewhere. CIMA has made clear that substance and activity, not just contractual flow, determine licensing status.

What is the CIMA VASP framework for custody businesses?

CIMA administers the VASP Act and has issued detailed guidance covering the activities that require authorisation, the fit-and-proper standards for controllers and officers, and the ongoing obligations that attach to an authorised VASP. Custody is explicitly named as a virtual-asset service, and the Act contemplates that a single entity may carry on multiple virtual-asset services under one authorisation, provided each activity is disclosed and approved.

The applicable regime requires applicants to demonstrate adequate systems and controls across AML/CFT, technology risk, custody safeguarding, and client disclosure. The FATF Recommendations – including Recommendation 15, which addresses virtual assets and their service providers, and the Travel Rule (the obligation to pass originator and beneficiary data with a transfer) – inform CIMA's supervisory expectations. Cayman's AML/CFT framework is closely aligned with FATF standards, and CIMA will assess both the policy documentation and the operational implementation.

An important structural point: the VASP Act sits alongside Cayman's broader AML framework. A custody business that also receives and transmits assets will face obligations under both regimes. Operators we advise routinely discover that their compliance programme addressed one layer but not the other.

Registration or full licence – which track applies to a custody business?

The VASP Act creates two distinct tracks: registration and full licensing. Custody as a standalone or principal activity falls under the licensing track, which carries a more extensive application process, higher ongoing obligations and direct CIMA supervisory engagement. Registration is a lighter regime generally applicable to lower-risk or limited-scope activities. Treating a custody operation as a registration-only matter is a structural error that CIMA has corrected on examination.

Full licensing requires CIMA to be satisfied on several fronts: the legal structure and ownership chain, the fitness and propriety of all controllers and senior managers, the adequacy of the AML/CFT framework, the technical and operational safeguards for custody (including segregation of client assets, key management and business-continuity arrangements), and the financial resources available to the entity.

Where an operator combines custody with exchange, lending or management services, each additional activity must be authorised. The combined-activity scenario also tends to attract closer scrutiny of the governance and conflicts-of-interest management framework. We have seen CIMA raise detailed questions on the separation between proprietary and client assets in combined-service applications.

CTA #1 — The distinction between registration and full licensing turns on facts specific to your business model. A scoped pre-application assessment can confirm your track and the documentation required before you commit to the process. Contact OBOLUS at info@oboluslaw.com to map your options.

What does the CIMA licensing application process involve, and how long does it take?

A CIMA VASP licence application for a custody business is a document-intensive process that typically proceeds through a pre-filing engagement, formal submission, review and supplemental queries, and a final determination. The timeline varies by application quality and CIMA's current caseload; qualitatively, applicants should plan for the process to extend over several months from initial submission to authorisation, and a rushed or incomplete submission can reset that clock materially.

The core documentation set for a custody licensing application includes:

• A detailed business plan covering the custody services offered, the client types targeted and the intended operating jurisdictions of clients.
• AML/CFT policies and procedures aligned with FATF Recommendation 15 and Cayman's AML Regulations, including the Travel Rule compliance framework.
• A technology and operational risk assessment covering custody architecture, key-management protocols, access controls and business-continuity planning.
• Governance documentation: constitutional documents, organisational charts, details of all controllers, directors and senior managers with supporting fitness-and-propriety evidence.
• Financial projections and evidence of adequate financial resources.
• Client-disclosure and terms-of-service documentation.

CIMA reserves the right to request supplemental information on any element of the application. In practice, questions arise most frequently around the beneficial ownership chain, the AML/CFT framework and the technology-risk assessment. Engaging qualified counsel before filing – rather than as a remediation exercise – materially reduces the cycle time.

How do tax and banking interact with a Cayman custody licence?

The Cayman Islands impose no corporate income tax, no capital-gains tax and no withholding tax on digital-asset custody businesses – a structurally important factor for operators choosing between the Cayman framework and EU or UK-regulated equivalents. However, the tax position of the operator's clients, and of the entity itself in the jurisdictions where it holds substance, is a separate question entirely.

Cayman is a FATCA/CRS-reporting jurisdiction. A custody entity holding client assets will have reporting obligations under the Common Reporting Standard and, where US persons are involved, under FATCA. Operators who structure a Cayman custody vehicle without accounting for the reporting layer create compliance exposure that surfaces at the banking stage.

Banking is the most operationally sensitive cross-border variable. Cayman-incorporated VASPs can access correspondent banking, but the quality and stability of those arrangements depend heavily on the robustness of the CIMA authorisation, the comprehensiveness of the AML/CFT programme and the nature of the underlying custody business. Banks conducting enhanced due diligence on a CIMA-licensed custodian will scrutinise the client base, the geographic reach of custody services and the on-chain controls. In our cross-border practice, we map the banking architecture in parallel with the licensing application – not as an afterthought – because a licensing decision made without visibility on banking can leave the entity stranded.

Where the operating entity or its parent sits in a different jurisdiction – for example, a Cayman custody vehicle within a group whose exchange licence is in Singapore under MAS, or whose EU business is authorised as a CASP under MiCA – the cross-jurisdictional regulatory interaction must be managed. Regulators in the leading hubs increasingly expect consolidated group-wide AML/CFT frameworks, not jurisdiction-by-jurisdiction silos.

Which operator profiles choose Cayman for custody licensing?

Cayman custody licensing is well-suited to specific profiles, and not to others. Understanding where Cayman sits relative to competing regimes is central to making the right structural decision.

Fund-focused custodians – operators whose primary clients are Cayman-domiciled investment funds (hedge funds, private equity vehicles, venture funds) will find regulatory alignment in keeping the custody function within the same jurisdiction as the fund structures. Cayman's mature funds-regulation environment, administered by CIMA under the Mutual Funds Act and the Private Funds Act, creates a coherent supervisory framework for the whole capital stack.

Institutional and wholesale custodians – operators targeting institutional counterparties globally, without a retail client base, can use a Cayman licence as part of a multi-jurisdiction custody architecture. The absence of a corporate income tax and the familiarity of the common-law legal system are positive factors.

Operators with EU or UK clients – Cayman is not a passportable jurisdiction under MiCA. A custodian seeking to serve EU clients at scale will likely need a concurrent CASP authorisation in an EU member state. Cayman can remain the principal custody vehicle for non-EU institutional business, with the EU-facing business carried under a separately authorised entity. This two-vehicle structure is one we regularly help operators design and operate.

Operators seeking a rapid deployment – Cayman is not automatically faster than other jurisdictions. The quality and completeness of the application is the principal determinant of timeline. An operator with a well-documented compliance framework and a clean ownership structure will move through CIMA review more predictably than one filing an underprepared application in the hope of speed.

A recent custody licensing matter

In a recent licensing engagement, an institutional-grade custodian – a technology firm with custody operations servicing professional investors across the Asia-Pacific region – approached us after a preliminary CIMA inquiry identified gaps in their AML/CFT documentation and their key-management risk assessment. We conducted a full compliance audit of the existing documentation, restructured the custody safeguarding policy to reflect CIMA's expectations under the VASP Act, and rebuilt the governance annex to correctly map all controlling parties. The revised application was resubmitted within weeks; CIMA's subsequent queries were limited to one clarification request, and the authorisation was granted. The operator had initially underestimated the level of detail CIMA requires on technology-risk controls – a pattern we see consistently across custody applications.

CTA #2 — If a prior CIMA application drew supplemental questions or was delayed, a second read of the documentation can identify the structural reason. Write to OBOLUS at info@oboluslaw.com to discuss a scoped remediation review.

What are the most common mistakes in Cayman custody licensing applications?

The most frequent errors we see in CIMA custody applications fall into four categories, each of which adds weeks or months to the process when not addressed pre-filing.

Incomplete beneficial-ownership chains. CIMA requires full transparency on the ownership structure up to and including ultimate beneficial owners. Intermediate holding structures, trust arrangements and nominee arrangements all require documentation. An incomplete chain is the single most common cause of supplemental-information requests.

Generic AML/CFT policies. A boilerplate AML policy that does not reflect the custody business model – its specific client types, transaction flows and geographic reach – will not satisfy CIMA. The policy must be tailored, operationally credible and demonstrate that the business has a functioning compliance function, not just a document library.

Underweighted technology-risk assessment. CIMA expects a custody applicant to demonstrate that it understands the specific risk profile of the custody architecture in use: key management (hardware security modules, multi-signature protocols, air-gapped storage), access-control frameworks, penetration-testing methodology and incident-response plans. A generic "we use industry-standard security" narrative does not meet the standard.

Assuming registration is sufficient. As noted above, custody as a principal activity requires the full licensing track. Operators who file on the registration track – often because the documentation requirement appears lighter – find themselves required to switch track mid-process, adding material delay.

A common assumption is that one offshore licence covers global operations

A common assumption among operators considering Cayman is that a single CIMA VASP licence provides sufficient regulatory cover for a custody business serving clients worldwide. This is not correct. The Cayman licence authorises the entity to operate as a VASP under Cayman law. It does not licence the business to conduct regulated custody activity in other jurisdictions. An operator with custody clients in the EU, the UK, Singapore or Hong Kong will need to assess – jurisdiction by jurisdiction – whether those client relationships trigger local licensing obligations.

The regulatory analysis turns on several factors: where the custody services are marketed, where the clients are located, where the assets are technically held, and whether any local exemption applies to the specific client category. In our practice, we regularly advise operators who believed their Cayman structure was globally self-sufficient, only to discover that their EU-client book required a MiCA CASP authorisation, or that their UK marketing activity was caught by FCA financial-promotion rules.

The practical answer is a jurisdiction-by-jurisdiction licensing map, prepared before the business goes live – not as a retrospective compliance exercise after the client base has grown.

Related at OBOLUS

• Licensing and registration for digital-asset businesses – The full licensing-stack methodology across 70+ jurisdictions for exchanges, custodians and issuers.
• Digital-asset custody authorisation in Malta – How the MFSA CASP regime under MiCA works for custody businesses entering the EU.
• Worldwide freezing orders – what recent enforcement tells operators – The enforcement and asset-recovery risks that follow unlicensed or non-compliant operations.

FAQ

How long does a crypto licence take to obtain?

The timeline for a CIMA VASP licence depends on the completeness of the application, the complexity of the ownership structure and CIMA's current review caseload. A well-prepared custody application submitted with complete documentation will generally move through review more quickly than one that requires supplemental queries. Qualitatively, operators should plan for a process measured in months, not weeks, and should not make commercial commitments that depend on a specific licensing date until authorisation is confirmed.

Which jurisdiction is best for licensing my crypto business?

There is no single best jurisdiction. The right licensing venue depends on your client base, the activities you conduct, where you want to hold substance, your banking architecture and your investors' expectations. Cayman works well for fund-focused custodians and institutional operators without an EU retail client book. Businesses targeting EU clients directly will likely need a concurrent MiCA CASP authorisation. An independent multi-jurisdiction assessment – covering licence, tax and banking together – is the correct starting point.

Do I need a separate custody licence?

In the Cayman Islands, custody is a regulated virtual-asset service under the VASP Act. If your business holds or safeguards digital assets for third parties as a principal activity, you will need CIMA authorisation that covers custody specifically. Where custody is combined with other activities – exchange, lending or asset management – each activity must be included in the authorisation scope. A registration-only filing does not cover custody as a principal service. Legal advice on your specific activity set is essential before filing.

OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We map the licence stack across operating, custody and payment layers before our clients commit capital. Digital assets are the entirety of our practice, and we act only for businesses. To discuss your Cayman custody licensing situation or your cross-border structure, contact info@oboluslaw.com or message us at t.me/oboluslaw.

By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in VASP authorisation processes and multi-jurisdiction custody structures for institutional digital-asset operators.

This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.