About Loeb Smith
People
Sectors
Expertise
- Legal Service
- Banking and Finance
- Blockchain, Fintech and Cryptocurrency
- Capital Markets and Privatization
- Corporate
- Cybersecurity and Data Privacy
- Insolvency, Restructuring and Corporate Recovery
- Insurance and Reinsurance
- Intellectual Property
- Investment Funds
- Litigation and Dispute Resolution
- Mergers and Acquisitions
- Private Client and Family Office
- Private Equity and Venture Capital
- Governance, Regulatory and Compliance
- Entity Formation and Managed Services
- Consulting
- Legal Service
News and Announcements
Locations
Subscribe Newsletters
Contact
General legal and regulatory framework
Legal framework
What legal framework governs cryptoassets? Is there specific legislation governing cryptoassets and businesses transacting with cryptoassets?
Generally, cryptoassets themselves are not subject to any specific regulation in the Cayman Islands, but a person who conducts business in relation to cryptoassets may be regulated by various legislations as detailed below.
The Virtual Asset (Service Providers) Act (As Revised) (the VASP Act) provides the primary legal framework for the conduct of virtual assets business in the Cayman Islands and for the registration and licensing of persons providing virtual asset services. Under the VASP Act, virtual asset service means:
“the issuance of virtual assets or the business of providing one or more of the following services or operations for or on behalf of a natural or legal person or legal arrangement – (a) exchange between virtual assets and fiat currencies; (b) exchange between one or more other forms of convertible virtual assets; (c) transfer of virtual assets; (d) virtual asset custody service; or (e) participation in, and provision of, financial services related to a virtual asset issuance or the sale of a virtual asset.”
However, it is important to note that, according to section 3(2) of the VASP Act, virtual service tokens, defined as “a digital representation of value that is not transferrable or exchangeable with a third party at any time and includes digital tokens whose sole function is to provide access to an application or service or to provide a service or function directly to its owner”, are not considered to be virtual assets and hence anyone providing services involving virtual service tokens will fall out-side the scope of the registration regime and licensing regime under the VASP Act.
Furthermore, if the relevant crypto-asset is considered to be securities under the Securities Investment Business Act (As Revised) (the SIBA), the SIBA may also be applicable in regulating the carrying out of securities investment business that relates to cryptoassets.
Government policy
How would you describe the government’s general approach to the regulation of cryptoassets in your jurisdiction?
The Cayman Islands government has been proactive in developing a regulatory framework that strives to align with global regulatory standards and requirements of the Financial Action Task Force recommendations, as well as offering satisfactory consumer or investor protections, while striking a balance to provide considerable room for operation and organic growth.
Regulatory authorities
Which government authorities regulate cryptoassets and businesses transacting with cryptoassets?
The Cayman Islands Monetary Authority (CIMA) is the primary government agency that is responsible for enforcing the VASP Act and the SIBA, and has wide discretionary, supervisory and enforcement powers in relation to the regulation of virtual asset services and securities investment businesses.
Regulatory penalties
What penalties can regulators impose for violations relating to cryptoassets (eg, injunctions, fines or prison terms)?
Under the VASP Act, the Cayman Islands Monetary Authority (CIMA) has wide discretionary enforcement powers in response to various corresponding suspected or actual non-compliance circumstances, including but not limited to:
- directing the virtual asset service provider to cease and desist from carrying out a particular act or conduct;
- directing the virtual asset service provider by written notice to comply with the relevant statutory requirement(s) within such period of time and on such conditions as specified therein;
- revoking the virtual asset licence or sandbox licence or cancel the registration;
- imposing conditions upon the relevant licence or amend or revoke such conditions;
- applying to the court for any order that is necessary to protect the interests of clients or creditors of the licensee or registered person;
- at the expense of the virtual asset service provider, requiring that a licensee or registered person obtain an auditor’s report to be submitted to CIMA on its anti-money laundering systems and procedures for compliance with the Anti-Money Laundering Regulations (As Revised);
- requiring the substitution of any senior officer or trustee of the virtual asset service provider appointed, or the divestment of ownership or control;
- at the expense of the licensee, appointing a person to advise the licensee on the proper conduct of its affairs and reporting the same to CIMA; and
- requiring such action to be taken by the virtual asset service provider as CIMA reasonably believes necessary.
Under the SIBA, CIMA has wide discretionary enforcement powers in response to various corresponding suspected or actual non-compliance circumstances, including but not limited to:
- directing the licensee or registered person to cease or refrain from committing a particular act or pursuing a particular course of conduct and to perform such acts as, in the opinion of CIMA, are necessary to remedy or ameliorate the situation;
- directing the licensee or registered person by written notice to comply with the relevant statutory requirement(s) within such period of time and on such conditions as specified therein;
- revoking the relevant licence or cancel the registration;
- imposing conditions or further conditions upon the relevant licence or registration or amend or revoke such conditions;
- applying to the court for any order that is necessary to protect the interests of clients or creditors of the licensee or registered person;
- at the expense of the licensee or registered person, requiring that a licensee or registered person obtain an auditor’s report to be submitted to CIMA on its anti-money laundering systems and procedures for compliance with the Anti-Money Laundering Regulations (As Revised);
- requiring the substitution of any senior officer or trustee of the licensee or registered person appointed, or the divestment of ownership or control;
- at the expense of the licensee or registered person, appointing a person to advise the licensee or registered person on the proper conduct of its affairs and reporting the same to CIMA; and
- requiring such action to be taken by the licensee or registered person as CIMA reasonably believes necessary.
Court jurisdiction
Which courts have jurisdiction over disputes involving cryptoassets?
Generally, the main court of first instance for disputes involving cryptoassets is the Grand Court of the Cayman Islands (the Grand Court), but certain disputes having a subject matter of CI$20,000 or below may be given jurisdiction to the Summary Court of the Cayman Islands. Any appeal from the Grand Court is dealt with by the Court of Appeal of the Cayman Islands (the Court of Appeal), and any further appeal from the Court of Appeal is heard by His Majesty’ s Judicial Committee of the Privy Council in London, UK.
Legal status of cryptocurrency
Is it legal to own or possess crypto-currency, use cryptocurrency in commercial transactions and exchange cryptocurrency for local fiat currency in the Cayman Islands?
In general, there is no legal prohibition on owning or possessing crypto-currency, using cryptocurrency in commercial transactions and exchanging cryptocurrency for local fiat currency in the Cayman Islands. However, if the exchange of cryptocurrency for local fiat currency is carried out in the course of business of the relevant person, that person might be considered as a virtual asset service provider under the VASP Act and hence may be legally required to register with CIMA before it may conduct such business.
At the same time, if the relevant cryptocurrency qualifies as securities under the SIBA and the use of such cryptocurrency in commercial transactions is carried on in the course of business of the relevant person, and such use of cryptocurrency qualifies as one of the regulated activities of securities investment business under the SIBA, that person might have to be licensed or registered with CIMA before it may conduct such business.
Fiat currencies
What fiat currencies are commonly used in the Cayman Islands?
The official currency of the Cayman Islands is the Cayman Islands dollar, but the United States dollar is also accepted in the Cayman Islands.
Industry associations
What are the leading industry associations addressing legal and policy issues relating to cryptoassets?
By way of example, Cayman Finance is one of the industry associations that have been proactive in reporting news and issues relating to cryptoassets.
The Blockchain Association of the Cayman Islands (BACI) is the jurisdiction’s independent, not-for-profit industry body championing the growth of blockchain, digital-asset and Web3 innovation across Cayman and beyond. Founded in 2019 and run by practitioners “on the ground”, BACI brings together technology entrepreneurs, financial services experts, professional advisers, blockchain enthusiasts, regulators and educators to advance one shared goal: positioning Cayman as the premier global hub for compliant, cutting-edge blockchain business.
Cryptoassets for investment and financing
Regulatory threshold
What attributes do the regulators consider in determining whether a cryptoasset is subject to regulation under the laws in the Cayman Islands?
A person will be regulated by the Virtual Asset (Service Providers) Act (As Revised) (the VASP Act) if it provides certain virtual asset service that involves virtual assets, and a crypto-currency shall be considered as a virtual asset under the VASP Act if it is “a digital representation of value that can be digitally traded or transferred and can be used for payment or investment purposes but does not include a digital representation of fiat currencies”.
Meanwhile, a person will be regulated by the Securities Investment Business Act (SIBA) if it is engaged in certain securities investment business, which involves securities (e.g., advising on securities, dealing in securities, arranging deals in securities, or managing securities), and a cryptocurrency would be considered as securities under the SIBA if it is an asset, right or interest specified in Schedule 1 to the SIBA, which is stated in paragraph 14 of Schedule 1 to the SIBA as including, in particular, virtual assets that “can be sold, traded or exchanged immediately or at any time in the future that — (a) represent or can be converted into any of the securities listed in paragraphs 1 to 13 of this Schedule; or (b) represent a derivative of any of the securities listed in paragraphs 1 to 13 of this Schedule”. Whereas paragraphs 1 to 13 of Schedule 1 to the SIBA include the broad categories of shares, instruments creating or acknowledging indebted-ness, instruments giving entitlements to securities, certificates representing certain securities, options, futures and contracts for differences.
Investor classification
How are investors in cryptoassets classified and treated differently (eg, ordinary (retail), institutional, sophisticated, accredited)?
The applicability and regulations of the VASP Act generally depend on the business activities of a relevant person, instead of the type of investors.
Under the SIBA, however, where the securities investment business is carried out exclusively for one or more sophisticated persons and high net worth person, an exemption will be offered to that relevant person, who is required to only register with CIMA instead of obtaining a full licence from CIMA. The regulatory burden and requirements applicable to a relevant person carrying on securities investment business exclusively for sophisticated persons and for high net worth persons is substantial but not as great as that applicable to a relevant person required to obtain a full licence from CIMA.
Further, in the context of Cayman Islands funds that invest in crypto-assets, it is worth noting that any regulation that typically applies to funds marketed or whose securities are offered to investors situated in certain geographical locations, e.g. Japan and any European Union member state, shall continue to apply.
Initial coin offerings
What rules and restrictions govern the conduct of, and investment in, initial coin offerings (ICOs)?
If the coin or token falls within the definition of a virtual asset under the VASP Act, the ICO might constitute an issuance of virtual assets, which is one of the virtual asset services regulated under the VASP Act, rendering the need to register with CIMA and to obtain advance approval before the issuance. The act of investing in ICOs will likely not be regulated by the VASP Act unless, for example, such act constitutes ‘participation in, and provision of, financial services related to a virtual asset issuance or the sale of a virtual asset’.
At the same time, by making reference to the SIBA and the Electronic Transactions Act (As Revised) of the Cayman Islands, CIMA may qualify coins/tokens issued on blockchain through ICOs as stock or debt (under the SIBA) if the rights attached to the coins/tokens (as represented in the white paper published in connection with the relevant ICO) resemble rights normally attached to equity interests or debt. Therefore, all persons engaging, in the course of business, in the conduct of, or investment in, ICOs may be subject to the registration or licensing requirements under the SIBA.
In certain other circumstances, a registration with or a license from CIMA may also be required in connection with an ICO, such as: (1) under the Money Services Act (As Revised), if the coins/tokens issued could give access to money transmission or currency exchange services; (2) under the Mutual Funds Act (As Revised) or the Private Funds Act (As Revised), if under proposed new amendments to these two pieces of legislation, the issuer of the coins/tokens is essentially a collective investment scheme ( e. g. a tokenised mutual fund or a tokenised private fund) and the coins or tokens are digital equity tokens or digital investment tokens.
Irrespective of whether coins/tokens issued qualify as securities or other-wise, existing anti-money laundering (AML) and know-your-customer (KYC) requirements under Cayman Islands laws will apply if the ICO is used as a money-raising event. Under the Proceeds of Crime Act (As Revised) (the Proceeds of Crime Act) and the Anti-Money Laundering Regulations (As Revised) (the AML Regulations), persons engaged in certain types of financial business are required to implement client identification and verification, record-keeping, and internal reporting and control procedures. In addition, it is an offence for a financial service provider to form a business relationship, or to carry out as a one-off transaction, with an applicant for business without maintaining the AML policies and procedures.
Security token offerings
What rules and restrictions govern the conduct of, and investment in, security token offerings (STOs)?
Certain pieces of legislation and regulations shall similarly apply to STOs so long as the security token being offered falls within the corresponding scope.
Stablecoins
What rules and restrictions govern the issue of, and investment in, stablecoins?
Generally, stablecoins fall within the definition of a virtual asset under the VASP Act, and therefore the issuance of stablecoins will typically constitute an issuance of virtual assets under the VASP Act, which would require the issuer to register with CIMA and to obtain advance approval before the issuance. On the other hand, the VASP Act does not regulate the making of an investment in stablecoins unless, for example, such act constitutes ‘participation in, and provision of, financial services related to a virtual asset issuance or the sale of a virtual asset’.
If stablecoins fall within one of the broad categories of securities under the SIBA, the issue of, or investment in, stablecoins in the course of a person’s business may constitute a securities investment business that mandates that relevant person to register with or be licensed by CIMA.
Airdrops
Are cryptoassets distributed by air-drop treated differently than other types of offering mechanisms?
Yes, airdrop of cryptoassets might be treated differently by the VASP Act than other types of offering mechanisms as previously mentioned. According to the VASP Act, issuance of virtual assets means “the sale of newly created virtual assets to the public in or from within the Islands in exchange for fiat currency, other virtual assets or other consideration but does not include the sale of virtual service tokens”. However, since an airdrop typically does not involve any consideration, it is likely that an airdrop of cryptoassets would not constitute as an issuance of virtual assets or any other virtual asset ser-vices regulated by the VASP Act.
Advertising and marketing
What laws and regulations govern the advertising and marketing of cryptoassets used for investment and financing?
The VASP Act generally does not regulate or restrict the mere acts of advertising and marketing of cryptoassets used for investment and financing because these activities do not fall within any virtual asset services regulated by the VASP Act, except to the extent such activities constitute “participation in, and provision of, financial services related to a virtual asset service or the sale of a virtual asset”. However, it is worth noting that the Virtual Asset (Service Providers) Regulations, 2020 (the VASP Regulations) differentiates an issuance of virtual assets, which is one of the virtual asset services regulated by the VASP Act, from a private sale, which does not require any registration or licensing with CIMA under the VASP Act. A private sale is defined as “a sale, or offer for sale, which is not advertised and is made available to a limited number of persons or entities who are selected prior to the sale by way of a private agreement”, whereas the VASP Regulations stipulates that CIMA will determine whether a sale of virtual assets qualifies as an issuance of virtual assets by assessing, among other things, whether such sale or offer for sale will be advertised to persons or entities in the Cayman I s lands. Furthermore, when granting a sandbox licence under the VASP Act, CIMA may also impose restrictions on the sandbox licensee’s advertising.
Similarly, the SIBA generally does not regulate or restrict the mere acts of advertising and marketing of crypto-assets used for investment and financing because these activities do not fall within any regulated activities of securities investment business regulated by the SIBA, unless it involves the marketing of the shares, trust units or partnership interests of an EU Connected Fund (as defined in the SIBA) to investors or potential investors in a European Union member state.
Trading restrictions
Are investors in an ICO/STO/stablecoin subject to any restrictions on their trading after the initial offering?
No, generally investors in an ICO, STO or stablecoin are not subject to any legal restrictions on their trading after the initial offering.
Crowdfunding
How are crowdfunding and cryptoasset offerings treated differently under the law?
Crowdfunding and cryptoasset offerings are generally not treated differently under laws of the Cayman Islands. So long as the crowdfunding or cryptoasset offering is conducted in the course of one’s business and falls within the relevant regulated business activity under the VASP Act and/or the SIBA, such fundraising exercise would be subject to the corresponding registra-tion or licensing requirements.
Transfer agents and share registrars
What laws and regulations govern cryptoasset transfer agents and share registrars?
If the provision of transfer agency and share registrar services of the crypto-asset transfer agents and share registrars involves cryptoassets that qualify as a virtual asset under the VASP Act, such business may constitute providing a virtual asset service in the sense of ‘participation in, and provision of, financial services related to a virtual asset issuance or the sale of a virtual asset’, thereby subjecting them to the registration or licensing requirements of the VASP Act.
Anti-money laundering and know-your-customer compliance
What anti-money laundering (AML) and know- your- customer (KYC) requirements and guidelines apply to the offering of cryptoassets?
In terms of the AML Regulations, assuming an offering of cryptoassets refers to the general issuance of cryptoassets for fundraising purpose, if such offering of cryptoassets qualifies as securities issues or issuing and managing means of payment under the Proceeds of Crime Act, the relevant offeror will be required to comply with the requirements under the AML Regulations, which include, among other things, implementing client identification and verification, record-keeping, and internal reporting and control procedures. However, if the offering of cryptoassets does not qualify as securities issues or issuing and managing means of payment under the Proceeds of Crime Act, it is unlikely that such offering shall be subject to any AML requirements of the AML Regulations, because such offering will not fall within any of the relevant financial businesses under the Proceeds of Crime Act, especially when the definition of virtual asset services therein does not include issuance of virtual assets. On the other hand, assuming an offering of cryptoassets refers to anything other than the general issuance of cryptoassets for fundraising purposes, it will be subject to the relevant AML requirements of the AML Regulations if such activity is consid-ered to fall within any of the relevant financial businesses under the Proceeds of Crime Act.
In terms of the VASP Act, assuming that the offering of cryptoassets constitutes as a “virtual asset service”, when CIMA is making a decision to grant a virtual asset service licence or a sandbox licence, to register an applicant or to waive a requirement to licence or register under the VASP Act, it will consider, among other things, (1) the procedures that the applicant has in place to combat money laundering, terrorist financing and proliferation financing, as well as (2) the applicant’s ability to comply with the VASP Act and the relevant requirements of the AML Regulations.
The VASP Act also sets out the following AML-related factors that CIMA will take into account when determining whether to approve an issuance of virtual assets by a licensee or registered person under the VASP Act:
- whether the virtual asset interferes with the functions of CIMA relating to AML, combating of terrorist financing and anti-proliferation financing; and
- the AML processes utilised by or available to the virtual asset issuer.
In terms of the general ongoing AML requirements in the context of an offering of cryptoassets, virtual asset service providers who carry out virtual asset services (including issuance of virtual assets) and thus are regulated by the VASP Act are required to comply with the following:
- at CIMA’s request, to provide an independent auditor’s report on the AML systems and procedures for compliance with the AML Regulations;
- to comply with the AML Regulations and other laws relating to the combating of money laundering, terrorist financing and proliferation financing;
- for the purpose of ensuring compliance with the AML Regulations, to put in place AML systems and procedures;
- to designate an employee as the officer with responsibility for the procedures for combating money laundering, terrorist financing and proliferation financing; and
- to obtain prior approval from CIMA before appointing a senior officer or trustee or an AML compliance officer, who is required to be a fit and proper person.
Furthermore, according to the VASP Act, CIMA may impose additional requirements specific to the relevant issuance of virtual assets on a virtual asset service provider to ensure compliance with the AML Regulations.
Under the VASP Act, CIMA also has the power to examine the affairs or business of any virtual asset service provider by way of the receipt of regular returns, on-site inspections, auditor’s reports or in such other manner as CIMA may determine, for the purpose of, inter alia, confirming that the AML Regulations are being complied with.
Sanctions and Financial Action Task Force compliance
What laws and regulations apply in the context of cryptoassets to enforce government sanctions, anti-terrorism financing principles, and Financial Action Task Force (FATF) standards?
In the context of cryptoassets, both the AML Regulations and the VASP Act were enacted with an aim to ensure that government sanctions are enforced and anti-terrorism financing principles and FATF standards are observed.
This publication is not intended to be a substitute for specific legal advice or a legal opinion. For more information or specific legal advice, please contact:
E: gary.smith@loebsmith.com
E: robert.farrell@loebsmith.com
E: elizabeth.kenny@loebsmith.com
E: vanisha.harjani@loebsmith.com
E: faye.huang@loebsmith.com
E: vivian.huang@loebsmith.com
The Cayman Islands introduced The Virtual Assets (Service Providers Act) (“VASP Act”) to align with the standards and recommendations set out by the Financial Action Task Force relating to the AML/CFT supervision of virtual asset services providers (“VASPs”). The VASP Act (including the enhanced prudential and government requirements that apply to VASPs) provides a clear digital assets framework, which has cemented the Cayman Islands as a credible, transparent jurisdiction for operating a virtual assets business.
The VASP Act adopted a phased implementation approach. Phase 1 came into effect on 31 October 2020 – this required VASPs to register with CIMA, with regulatory oversight focused on anti-money laundering (“AML”), counter-terrorist financing (“CTF”), combatting proliferation financing (“CPF”), targeted financial sanctions and cybersecurity. Phase 2 commenced on 1 April 2025, which introduced a licensing regime for virtual asset trading platforms and virtual asset custodians. As of 4 February 2026, there are 19 VASPs registered with the Cayman Islands Monetary Authority (“CIMA”).
CIMA is the designated supervisor of VASPs registered in the Cayman Islands and as such, has responsibility for monitoring the regulatory compliance of VASPs and determining the frequency and focus of both on-site inspections and off-site inspections of VASPs.
CIMA is the designated supervisor of VASPs registered in the Cayman Islands and as such, has responsibility for monitoring the regulatory compliance of VASPs and determining the frequency and focus of both on-site inspections and off-site inspections of VASPs.
Ongoing monitoring of VASPs
After approval is granted by CIMA, VASPs have certain ongoing statutory obligations, which are in addition to any event-driven filings e.g. VASPs are required to submit an annual AML Return and quarterly Travel Rule Return to CIMA. CIMA leverages software to automate both (1) the collection and analysis of data relating to the cross-border transactions conducted by VASPs and (2) the scoring of inherent risks and controls in relation to VASPs.
CIMA inspections of VASPs
CIMA commenced its risk-based AML/ CTF on-site inspections of VASPs to assess their AML/CTF policies, procedures, systems and controls in 2023 – in particular, for compliance with the requirements of the Anti-Money Laundering Regulations, the CIMA Guidance Notes on the Prevention and Detection of AML/ CTF and CPF and the Travel Rule.
Since then, CIMA has conducted a Thematic Desk-based Review of 11 regulated VASPs from September 2024 to February 2025 (“Desk-Top Review”), including a mixture of both virtual asset exchanges and virtual asset custody service providers – the key findings of the Desk-Top Review were published in November 2025. The most important learning point from the Desk-Top Review is that as the VASP regime is nascent, VASPs must continue to regularly monitor changes and take proactive steps to remain compliant with ongoing regulatory obligations.
In addition to the Desk-Top Review, CIMA has also published a separate Supervisory Circular on 18 September 2025 relating to more specific AML/ CTF related considerations (“AML/ CTF Review”).
A summary of the key findings of both the Desk-Top Review and AML/ CTF Review (together, the “CIMA Reviews”) are set out below:
Key observations from the CIMA Reviews
- Corporate governance deficiencies – while the VASP Act has been amended since first enactment, so that now three (3) Directors are required (including at least one independent Director with no vested interest in the VASP), CIMA still noted that 27% of VASPs reviewed did not meet this requirement and 36% were operating without any formal succession planning for the governing body and key senior management.
- Inadequate cybersecurity governance – the Desk-Top Review showed that 27% of VASPs had not appointed a qualified CISO or CIO and had insufficient documentation on IT and cybersecurity audits. A staggering 82% of VASPs reviewed lacked any cybersecurity insurance. Further deficiencies were identified in data protection, IT controls and in the oversight of outsourced arrangements.
- Inadequate virtual asset custody policy – while the Rule and Statement of Guidance – Virtual Asset Custodians and Virtual Asset Trading Platforms was only published by CIMA in December 2024 and CIMA acknowledged in the Desk-Top Review that VASPs would need more time to comply, CIMA found that 40% of the VASPs reviewed had inadequate policies for virtual asset custody services.
- Deficiencies in business continuity planning – the Desk-Top Review showed inadequate business continuity planning, including examples of Business Continuity Plans (“BCP”) not in compliance with the applicable Statement of Guidance and no board approval, testing or independent review of the BCP.
- Inadequate risk assessments. Customer risk assessments that are not up-to-date, not adequately documented or do not demonstrate that all risk factors (e.g. jurisdiction of operation, transactions and delivery channels) have been considered.
- Inadequate assessment of technology solutions. Inadequate assurance reviews for technology solutions to ensure systems are operating effectively e.g. screening for sanctions and adverse media, e-KYC and on-chain analytic tools.
- Missing KYC. Missing customer due diligence and absence of verification on customer files (e.g. failure to maintain constitutional documents for customers who are legal persons) and failure to appropriately categorize higher risk customers e.g. PEPs as high-risk customers requiring EDD.
- No ongoing monitoring. Some instances were identified in the AML/ CTF Review of no ongoing monitoring of business relationships, on either a timely basis, or at all.
- Employee issues. Lack of escalation and staff understanding of a VASP’s transaction monitoring system. In addition, examples of only very generic employee training, which did not cover the regulatory framework relevant to the Cayman Islands and gaps in the maintenance of records to demonstrate adequate AML/ CTF/ CPF training had been provided to employees were stated in the AML/ CTF Review.
- Inadequate sanctions compliance. Failure to carry out ongoing sanctions screening after onboarding, inadequate record keeping of name matches and of the rationale for clearing or dismissing alerts. In addition, the AML/ CTF Review found a failure of policies and procedures to set out a clear path for handling on-chain transactions alerts, by not setting out who at the VASP can approve transactions related to higher-risk exposure and for treatment of exposure to sanctions entities and jurisdictions.
- Oversight of the compliance function. Inadequate board oversight of the VASP’s AML/ CTF compliance function e.g. board packs and minutes not indicating any discussion of AML/ CTF issues, lack of evidence of board approval of AML policies and procedures and lack of outsourcing agreements.
- No AML/CTF audit. CIMA found instances of no internal audit function having been established and AML/ CTF audits not being conducted at all/ not conducted by an operationally independent person.
- Gaps in record keeping. Poor record management systems to ensure the timely provision of information to CIMA e.g. CDD, transactions records or sanctions screening.
- Financial position. In instances where VASPs had not yet achieved profitability, supplementary information is required to be submitted to CIMA to support the assessment that it remains as a going concern with sufficient resources to meet its financial obligations as required. This means that in practice, VASPs must develop robust policies, procedures and control to adequately manage financial and liquidity risk.
- Failure to notify CIMA of key changes. CIMA noted instances where changes to key personnel or business operations of a VASP had not been communicated in a timely manner to CIMA/ approval sought where required. For example, (i) appointments of senior officers require the prior approval of CIMA, (ii) any penalties imposed, enforcement action or litigation proceedings brought against the VASP in another jurisdiction must be reported to CIMA within 30 days, and (iii) any cybersecurity incident must be reported to CIMA within 30 days.
Regulatory warning: CIMA takes enforcement action!
The registration of a VASP (AC Holding Limited) was recently cancelled by CIMA on 5 June 2025 for multiple deficiencies by the VASP to provide documents to CIMA, for failing to put into place AML systems and procedures, in addition to breaches of other CIMA Rules e.g. Rule on Corporate Governance and Rule on Internal Controls.
This enforcement action underscores CIMA’s serious approach to regulatory compliance and its readiness to take decisive action where breaches are not remedied.
This publication is not intended to be a substitute for specific legal advice or a legal opinion. For specific legal advice on the subject matter of this Briefing, please contact your usual Loeb Smith attorney or any of the following:
Partner: Elizabeth Kenny
E: elizabeth.kenny@loebsmith.com
Liz is a Partner in the Corporate and Funds Group and is also Head of Regulatory and Risk in which capacity she is key thought leader on regulatory licence applications, virtual assets, crypto and fintech regulation, corporate governance reviews, anti-money laundering compliance frameworks, regulatory audits, Corporate Governance, CIMA inspections and remediations, sanction reporting and licencing, data protection laws, regulatory enforcement notices, administrative fines and on mandatory information exchange requirements.
Regulatory framework and authorities
How is fund management regulated in the Cayman Islands? Which authorities have primary responsibility for regulating funds, fund managers and those marketing funds?
The main regulatory body in the Cayman Islands that regulates open-ended investment funds, closed-ended investment funds, fund managers and parties marketing investment funds is the Cayman Islands Monetary Authority (CIMA). The main statutes from which CIMA derives its supervisory powers and duties in respect of investment funds are the Mutual Funds Act and the Private Funds Act, and in respect of fund managers, is the Securities Investment Business Act (the SIB Act).
Fund administration
Is fund administration regulated in your jurisdiction?
A Cayman Islands-domiciled entity that carries on business as a mutual fund administrator is required to have a valid licence for doing so and is required to be regulated by CIMA. There is more than one type of mutual fund administrator licence and CIMA will assess, among other things, whether the applicant has sufficient expertise to administer regulated investment funds (both open-ended and closed-ended) and whether the business as a mutual fund administrator will be administered by persons who are fit and proper to be directors or, as the case may be, managers or officers in their respective positions.
Mutual fund administration is defined in the Mutual Funds Act as the management or administration of a mutual fund to provide the principal office of the mutual fund in the Cayman Islands or the provision of an operator to the mutual fund. An overseas fund administrator that is not established in the Cayman Islands is not regulated by CIMA and may be the administrator of a Cayman Islands investor fund if the administrator is authorised or otherwise permitted to carry out administration activities to investment funds in any non-high risk jurisdiction.
Authorisation
What is the authorisation or licensing process for funds? What are the key requirements that apply to managers and operators of investment funds in the Cayman Islands?
The vast majority of open-ended funds will qualify as mutual funds under the Mutual Funds Act (as amended), which requires mutual funds to be licensed or regulated as such. Closed-ended funds (i.e., funds that issue investment interests that are not redeemable pr repurchasable at the option of the investor of record), which fall within the scope of the Private Funds Act, are required to register with, and consequently become regulated by, CIMA.
The authorisation process for an open-ended fund will depend on the regulatory category it chooses to register under (e.g., a licensed fund under section 4(1)(a) of the Mutual Funds Act, an administered fund under section 4(1)(b) of the Mutual Funds Act, a registered fund under section 4(3) of the Mutual Funds Act, or a limited investor fund under section 4(4) of the Mutual Funds Act). For closed-ended funds, the authorisation process requires the private fund to:
-
-
- submit an application for registration to CIMA within 21 days after its acceptance of capital commitments from investors for the purposes of investments;
- file prescribed details in respect of the private fund with CIMA;
- pay a prescribed annual registration fee to CIMA in respect of the private fund;
- comply with any conditions of its registration imposed by CIMA; and
- comply with the provisions of the Private Funds Act.
-
A Cayman Islands-domiciled fund manager will have to either apply to CIMA for a licence to undertake business as such under the Securities Investment Business Act (as revised) or apply to CIMA to be registered under a less regulatory onerous regime as a Registered Person. An overseas fund manager can provide services to a Cayman Islands investment fund and there is no requirement for the overseas fund manager to be licensed by or registered with CIMA unless that fund manager establishes itself in the Cayman Islands. Operators of mutual funds, such as directors, are subject to registration or licensing requirements under the Director Registration and Licensing Act and are required to register with CIMA and pay annual renewal fees to maintain their registration in good standing.
Territorial scope of regulation
What is the territorial scope of fund regulation? Can an overseas manager perform management activities or provide services to clients in the Cayman Islands without authorisation?
The laws in the Cayman Islands (e.g., Mutual Funds Act, Private Funds Act and the Securities Investment Business Act are not extraterritorial in scope and effect. An overseas fund manager can provide services to a Cayman Islands investment fund and there is no legal requirement for the overseas fund manager to be licensed by or registered with CIMA unless that fund manager establishes operations in the Cayman Islands.
Acquisitions
Is the acquisition of a controlling or non-controlling stake in a fund manager in the Cayman Islands subject to prior authorisation by the regulator?
There is no requirement for an overseas fund manager to be licensed by or be registered with CIMA unless that fund manager establishes itself in the Cayman Islands. Accordingly, there would be no need for any prior notification to, or authorisation by, CIMA of a change in controlling or non-controlling stake in a fund manager established overseas. A fund manager regulated in the Cayman Islands (i.e., whether as a CIMA licensee or a registered person) under the SIB Act is prohibited from issuing, voluntarily transferring or disposing of any shares or partnership interests (as applicable) without the prior approval of CIMA, but CIMA may grant an exemption from this prior approval requirement where the fund manager’s securities are publicly traded on a recognised securities exchange.
Restrictions on compensation and profit sharing
Are there any regulatory restrictions on the structuring of the fund manager’s compensation and profit-sharing arrangements?
There are no regulatory restrictions on the structuring of the fund manager’s compensation and profit-sharing arrangements.
This publication is not intended to be a substitute for specific legal advice or legal opinion. For more information or specific legal advice, please contact:-
E: gary.smith@loebsmith.com
E: robert.farrell@loebsmith.com
E: elizabeth.kenny@loebsmith.com
E: vanisha.harjani@loebsmith.com
E: faye.huang@loebsmith.com
E: vivian.huang@loebsmith.com
Our firm has been ranked as Lexology Legal Influencer for Dispute Resolution – Central and South America for Q4 2025. We are proud that Loeb Smith’s articles were ranked as Legal Influencer in all quarters of 2025! Many thanks to our readers and to our contributing author colleagues for making it possible. Find out more about our Litigation and Disputes service.

Loeb Smith Attorneys: Reflecting on a Remarkable 2025
The Common Reporting Standard (“CRS”) which was published by The Organisation for Economic Co-operation and Development (“OECD”) is intended to, among other things, improve international tax transparency. The CRS achieves this objective by, among other things, requiring committed jurisdictions to obtain information on offshore accounts held with “Financial Institutions” and automatically exchange that information with the jurisdiction of residence of taxpayers on an annual basis.
However, the scope of CRS is based on traditional financial assets and fiat currencies, such that crypto-assets in most cases do not fall within the remit of CRS. In contrast to conventional financial instruments, crypto-assets can be stored and transferred directly between users without relying on traditional regulated financial intermediaries e.g. banks and any central administrator. Additionally, the growth of the crypto-asset market has led to the emergence of a new set of largely unregulated or self-regulating intermediaries and service providers, including crypto exchanges and digital wallet operators.
Given the rapid growth of the crypto-asset market and lack of visibility of tax administrations on verifying tax liabilities relating to crypto-assets held by taxpayers, the OECD developed the Crypto-Asset Reporting Framework (“CARF”), which is designed to ensure the collection and automatic exchange of information on transactions in “Relevant Crypto-Assets” in a standardized manner on an annual basis.
As at 4 December 2025, 48 jurisdictions have committed to implementing the CARF in time to commence first exchanges in 2027 (which includes the Cayman Islands), with a further 27 by 2028 (which includes BVI and Hong Kong). The U.S.A has committed to implementing the CARF by 2029.
What is the CARF designed to do?
The CARF provides for the automatic exchange of tax relevant-information on crypto-assets. In the same vein as the CRS, the CARF is intended to achieve transparency for transactions in crypto-assets by the annual, automatic exchange of crypto-asset transaction information among the participating jurisdictions whose tax residents hold or engage in crypto-asset transactions.
Which crypto-assets are Relevant Crypto-Assets that are within scope of the CARF?
The definition of “Crypto-Assets” in the CARF focuses on the use of cryptographically secured distributed ledger technology or “similar technology”. This is intended to cover crypto-assets which can be held and transferred in a decentralized manner, without the intervention of traditional financial intermediaries, including stablecoins, derivatives issued in the form of a crypto-asset and certain NFTs. However, the CARF does not apply to crypto-assets which do not have the capacity of being used for payment or investment purposes, central bank digital currencies and specified electronic money products.
Who is a Reporting Crypto-Asset Service Provider covered by the scope of the CARF?
Individuals or entities that “as a business” provide services effectuating exchange transactions in Relevant Crypto-Assets, for and on behalf of customers are in scope of the CARF (“Reporting Crypto-Asset Service Providers”). This would cover, for example, Cayman Islands licensed crypto-asset exchanges and broker-dealers trading crypto-assets on behalf of customers, but would not include an investment fund which invests in crypto-assets or a token issuer.
What type of transactions are Relevant Transactions that are reportable under the CARF?
The following transactions are relevant transactions which are reportable under the CARF:
-
-
- exchanges between Relevant Crypto-Assets and fiat currencies;
- exchanges between one or more Relevant Crypto-Assets; and
- transfers of Relevant Crypto-Assets (including air drops, income derived from staking or a loan).
-
A transfer of Relevant Crypto-Assets includes a transfer of Relevant Crypto-Assets by a retail merchant in consideration of goods or services for a value exceeding US$50,000.
Who does a Reporting Crypto-Asset Service Provider need to report on?
A Reporting Crypto-Asset Service Provider needs to (i) report on each customer who is a “Reportable User” i.e. if he/ she is resident in a Reportable Jurisdiction (being a jurisdiction which is subject to the CARF reporting) and (ii) determine whether a customer which is an entity has one or more controlling persons who are Reportable Persons.
For each type of transaction, a Reporting Crypto-Asset Service Provider must report:
-
-
- identifying details of customers (name, address, date of birth, TIN and tax residence);
- details of transactions of Crypto-Assets, including the type of Crypto-Asset, the aggregate gross amount paid and the aggregate fair market value; and
- transfers to wallets not linked to a financial institution or service provider, enhancing visibility into self-custody holdings.
-
A Reporting Crypto-Asset Service Provider must maintain all documentation and data for a period of not less than 5 years.
What due diligence information must a Reporting Crypto-Asset Service Provider collect on its customers?
A Reporting Crypto-Asset Service Provider must obtain a self-certification for each of its customers in order to determine their tax residence, in addition to any AML/ KYC collected in accordance with the Reporting Crypto-Asset Service Provider’s procedures.
Has the Cayman Islands implemented a domestic framework for the CARF?
The Tax Information Authority (International Tax Compliance) (Crypto-Asset Reporting Framework) Regulations, 2025 (“CARF Regulations”) and Tax Information Authority (International Tax Compliance) (Common Reporting Standard) (Amendment) Regulations, 2025 were published in the Cayman Islands Gazette on 27 November 2025 (together, the “Amendment Regulations”). The CARF Regulations implement the global Crypto-Asset Reporting Framework in the Cayman Islands to enhance tax transparency and fight evasion and money laundering.
Both Amendment Regulations take effect from 1 January 2026 (“Effective Date”).
What are the key takeaways from the CARF Regulations?
The CARF Regulations apply the standard for automatic exchange of information relating to Crypto-Assets developed by the OECD.
Under the CARF Regulations, a Cayman Islands Reporting Crypto-Asset Service Provider will need to:
-
-
- establish and maintain written policies and procedures to comply with the CARF;
- obtain a self-certification for each of its customers in order to determine their tax residence;
- register with the Cayman Islands Department for International Tax Co-operation as a Crypto-Asset Service Provider. For existing entities which are Cayman Islands Reporting Crypto-Asset Service Providers prior to the Effective Date, the deadline for registration is 30 April 2026. For all entities which become Cayman Islands Reporting Crypto-Asset Service Providers after the Effective Date, the deadline for registration is 31 January the following year;
- submit an annual return for each of its Crypto-Asset users who are Reportable Users or have Controlling Persons that are Reportable Persons by 30 June of the year following the calendar year to which the return relates; and
- retain all documents and records for 6 years.
-
Cayman Islands Reporting Crypto-Asset Service Provider can appoint an agent to carry out the duties imposed under the CARF Regulations and act as principal point of contact (“PPoC”) – the PPoC must be any entity or individual resident in the Cayman Islands.
Further Assistance
This publication is not intended to be a substitute for specific legal advice or a legal opinion. If you require further advice relating to the matters discussed in this Briefing, please contact us. We would be delighted to assist.
E: gary.smith@loebsmith.com
E: robert.farrell@loebsmith.com
E: elizabeth.kenny@loebsmith.com
E: vanisha.harjani@loebsmith.com
E: vivian.huang@loebsmith.com
E: faye.huang@loebsmith.com
E: yun.sheng@loebsmith.com
Introduction
On 27 November 2025, the Tax Information Authority (International Tax Compliance) (Common Reporting Standard) (Amendment) Regulations, 2025, (the “Amendment Regulations”) were published in the Cayman Islands Gazette which, upon coming into force on 1 January 2026 (other than the new regulations for CRS returns and compliance forms which come into force on 1 January 2027), will introduce a number of important amendments to the Tax Information Authority (International Tax Compliance) (Common Reporting Standard) Regulations (2021 Revision).
The amendments introduce practical changes to registration, reporting deadlines, penalty mechanics and information-gathering requirements, and also update the CRS framework to address electronic money and virtual assets.
Registration and Changes in Details
From 1 January 2026:
-
- A Cayman Financial Institution that becomes a Financial Institution in a given calendar year must register with the Tax Information Authority of the Cayman Islands (TIA) by 31 January of the following year via the TIA’s AEOI portal.
- There are transitional provisions for those entities that became a Cayman Financial Institution during 2025 whereby the deadline for their registration with the TIA is 30 April 2026.
In addition, if any information in a Financial Institution’s registration changes (for example, CRS classification, name, or contact details), a change form must be submitted within 30 days of the change taking effect.
PPOC must be within the Cayman Islands
The Amendment Regulations require the principal point of contact for each Cayman Financial Institution (“PPOC”) to be located within the Cayman Islands. Previously, the PPOC could be based anywhere. For those entities that are currently registered and whose PPOC is not based within the Cayman Islands, they must appoint a Cayman-based PPOC and notify the TIA by 31 January 2027.
Returns, Compliance Forms and Deadlines
The dates by which CRS Returns and CRS Compliance Forms must be filed are changing and will now fall on the same date. From 1 January 2027 (i.e. for the reporting for 2026):
-
- CRS returns (including nil returns) must be filed by 30 June of the year following the relevant calendar year (moved forward from 31 July which is the current deadline); and
- The CRS Compliance Form filing deadline will also be 30 June (brought forward from the current deadline of 15 September).
For both CRS returns and Compliance Forms, they must be filed through the TIA’s electronic portal in the required form and must be accompanied by a declaration that the information is “adequate, accurate and current”. These terms are defined in the Amendment Regulations as follows:
-
- “adequate” means that information provided contains all details required by the relevant regulation;
-
- “accurate” means the information provided is correct and reliable; and
- “current” means the relevant information is as up to date as is reasonably practicable and reflects any change of circumstances that occurred within the period to which the information relates.
Due Diligence
The Amendment Regulations will also require Cayman Financial Institutions to collect and report additional information, particularly in relation to “Controlling Persons” (who are, effectively, the ultimate beneficial owners of a relevant entity) and also additional information in respect of the reported accounts (e.g. whether the account is held in a single name or in joint names).
This information will be collected via a self-certification form, which must be completed by the relevant reportable person. Financial Institutions must now also report whether valid self-certifications have been obtained for all account holders required to provide them.
For accounts maintained as at 31 December 2025, and for reporting periods ending by the second calendar year after that date, the additional information on roles is required only where that information already exists in electronically searchable form.
Penalties for non-compliance
The Amendment Regulations also make changes to the approach that the TIA will take in relation to issuing penalties for non-compliance. In particular, where a Cayman Financial Institution fails to submit the required CRS return and Compliance Form by their due date, the TIA may now issue a penalty notice immediately without first issuing a notice of breach, which previously allowed representations to be made to the TIA in mitigation. Otherwise, the TIA’s procedures for the issuance of penalties remain unchanged.
The previous provisions under which interest accrued on unpaid penalties have been repealed. In the case of an appeal against a penalty, enforcement of the penalty will continue to be stayed pending the outcome of that appeal.
Digital assets
The Amendment Regulations introduce a comprehensive update to align the regime with the growing use of electronic money and crypto-assets. The scope of a “Depository Institution” is widened so that entities holding “Specified Electronic Money Products” or “Central Bank Digital Currencies” (“CBDCs”) for customers are treated in the same way as traditional deposit-takers, and the definition of a “Depository Account” is expanded accordingly.
The concept of a “Financial Asset” is also broadened to include Relevant Crypto-Assets (i.e. crypto-assets capable of being used for payment or investment), so that dealing, managing or trading in such assets may now cause an entity to be classified as an “Investment Entity” for CRS purposes. As a result, businesses involved in e-money issuance, digital wallets, exchange activities or custody of digital assets may fall within CRS reporting or due diligence obligations where they previously sat outside the framework.
The amendments also coordinate CRS reporting with the forthcoming “Crypto-Asset Reporting Framework” (“CARF”) by relieving Financial Institutions from having to report gross proceeds on Financial Assets where those proceeds will already be reported under CARF.
Altogether, the new provisions ensure that e-money, CBDCs and certain crypto-assets are treated in a consistent way under CRS, closing previous gaps and bringing digital-asset service providers more firmly within the global transparency and reporting framework.
Next steps
In light of the Amendment Regulations, Cayman Financial Institutions (e.g. investment funds, investment managers, and discretionary investment advisers) should:
-
- consider their CRS registration status and ensure processes are in place to meet the new registration deadlines. In particular, those who became Financial Institutions in 2025 will need to ensure they are registered with the TIA by 30 April 2026;
- identify whether the business has a Cayman-based PPOC and if not, plan for an appointment of a Cayman-based and TIA notification by 31 January 2027;
- update account opening and onboarding procedures so that valid self-certifications (with all required data fields) are obtained before account opening;
- review whether systems can capture the new reportable data elements (joint account status, account type, Controlling Person roles, self-certification status) and whether such data is stored in electronically searchable form;
- for e-money, CBDC or crypto-asset businesses, assess whether the updated definitions bring additional entities, products or accounts within CRS scope and take action accordingly;
- adjust internal reporting calendars and compliance workflows to align with the new 30 June deadline for both CRS returns and compliance forms; and
- ensure that internal sign-off is consistent with the requirement to declare that filings are adequate, accurate and current.
We provide the services for PPOC and advise a broad range of clients on CRS classification, registration, due diligence frameworks and reporting under the Cayman Islands’ international tax compliance regime, including the impact of the Amendment Regulations.
If you would like to appoint a Cayman-based PPOC and/or discuss how these changes may affect your business, your CRS classification or your onboarding and reporting processes, please contact any member of our team.
E: gary.smith@loebsmith.com
E: robert.farrell@loebsmith.com
E: elizabeth.kenny@loebsmith.com
E: vanisha.harjani@loebsmith.com
E: vivian.huang@loebsmith.com
E: yun.sheng@loebsmith.com
Wonderful news: Loeb Smith Attorneys’ Cayman Islands team has once again been recognised in the rankings of Legal500, one of the top international publications that evaluates law firms and legal professionals worldwide.
In the 2026 edition, Loeb Smith Attorneys reaffirms its strong Cayman Islands positioning standing out in the Investment Funds practice top tier firms and receiving an accolade for Client Satisfaction.

This recognition highlights the trust our clients place in us, the depth of our expertise and the strength of our multidisciplinary teams focused on delivering outstanding client service.
We are very proud of our team and thankful to our clients for taking their time to talk to Legal500. Here is what our clients shared to Legal 500 about us:
‘Their deep knowledge of the nature of digital assets, wallet structures, and Web3 business
models is reflected directly in their drafting. Instead of relying on generic fund templates, they
proactively incorporate crypto-specific wordings and clauses into fund documents, making them
clear, accurate, and practical for all stakeholders, from fund managers to service providers and
even auditors.’
***
‘I’ve worked with Loeb Smith on a number of crypto fund matters, including fund formation,
regulatory compliance, and handling in-kind subscriptions using digital assets.’
***
‘Gary Smith is particularly impressive. He is not only highly knowledgeable on the legal side but
also well-versed in how crypto businesses operate in practice. Their ability to explain complex
regulatory matters in plain language makes decision-making much easier on our end and the
crypto client side.’
Cayman Islands exempted companies are widely utilized in structuring cross-border finance transactions. One of the key reasons for this is that the Cayman Islands provides a flexible and well-tested regime for secured financing transactions that is attractive to borrowers and lenders alike. The process for creating security in the Cayman Islands is also straightforward and will not typically impact the timeframe of a proposed transaction.
In this brief guide, we address certain of the key Cayman Islands law points pertaining to the creation and protection of security over shares (the “Secured Shares”) in a Cayman Islands exempted company (the “Secured Company”).
Creation of Security
The Companies Act (as Revised) of the Cayman Islands (the “Act”) does not contain any provisions with respect to the creation of security over Secured Shares in a Secured Company. Therefore, the security should adhere to the following principles derived from common law:
-
- it must be in writing;
- the security document must be signed by, or with the authority of, the security provider; and
- the security document must clearly indicate the intention to create security over the Secured Shares and the amount secured or how that amount is to be calculated.
Cayman Islands law recognizes various forms of security over assets, including equitable mortgages and charges which are most commonly taken over Secured Shares in a Secured Company.
Execution Formalities and Regulatory Approvals
Cayman Islands law does not prescribe a particular mode of execution with respect to security over Secured Shares in a Secured Company and it is not necessary for such security to be certified, notarized or apostilled to make the security valid or enforceable from a Cayman Islands law perspective. That being said, in practice, a security document with respect to Secured Shares in a Secured Company is customarily executed as a deed.
From an execution standpoint, it is important to review the memorandum of association and articles of association (the “M&A”) of the relevant security provider and the relevant Secured Company, to the extent it is a party to the security document, to ensure compliance with any applicable signing formalities.
Unless security is being taken in a Secured Company which is a “regulated person”, such as a bank or a mutual fund, no regulatory approvals are necessary to create valid and enforceable security as a matter of Cayman Islands law.
Stamp Duty and Taxes
No stamp duty or taxes are payable with respect to the creation of security over Secured Shares in a Secured Company or upon any transfer thereof in an enforcement as a matter of Cayman Islands law so long as:
-
- the security document and any ancillary documents thereunder are not executed or delivered in, brought into, or produced before a court of, the Cayman Islands; and/or
- the Secured Company does not have an interest in land in the Cayman Islands, or shares in a subsidiary that has an interest in land in the Cayman Islands.
Governing Law of the Security
Cayman Islands law permits security over Secured Shares in a Secured Company to be governed by Cayman Islands law or foreign law.
In cross-border finance transactions, it is relatively common for the governing law of a security document over Secured Shares in a Secured Company to be aligned with the governing law of the principal finance documents. One advantage of adopting a foreign governing law clause in a security document is that it may make available certain additional remedies (such as appropriation) which are not available under Cayman Islands law. Care should however be taken to ensure that there are no conflicts of law issues where a security document is governed by foreign law. English, Hong Kong and Singapore law are frequently adopted to govern security over Secured Shares in a Secured Company and no major conflicts of law issues are likely to arise.
Cayman Islands law governed security document
Where the security document is governed by Cayman Islands law, so long as it is in customary form, the secured party is entitled to the following remedies in the event of a default:
-
- the right to take possession of the Secured Shares in the Secured Company (subject to redemption by the security provider upon the settlement of the debt);
- the right to sell the Secured Shares in the Secured Company; and
- the right to appoint a receiver who may:
-
- vote the Secured Shares in the Secured Company;
- receive distributions in respect of the Secured Shares in the Secured Company; and
- exercise other rights and powers of the security provider in respect of the Secured Shares in the Secured Company.
-
If the secured party acquires legal title to the Secured Shares in the Secured Company, it also has a right of foreclosure. This remedy extinguishes the security provider’s legal and beneficial title to the Secured Shares in the Secured Company but not its obligation to pay any secured and unpaid sums. Foreclosure involves a time-consuming and costly court process and is not usually exercised in practice given its draconian nature.
For further details regarding the enforcement of security over Secured Shares in a Secured Company, please refer to our guide entitled “Enforcing security over shares in a Cayman Islands exempted company”.
Foreign law governed security document
Where the security document is governed by foreign law, the:
-
- security document should comply with the requirements of its governing law to be valid and binding; and
- remedies available to a secured party are governed by the governing law and the terms of the security document.
Application of Proceeds of Enforcement
Subject to any provisions to the contrary in the security document, all amounts that accrue from the enforcement of the security document are applied in the following order of priority:
-
- firstly, in paying the costs incurred in enforcing the security document;
- secondly, in discharging the sums secured by the security document; and
- thirdly, in paying any balance due to the security provider.
Security Deliverables
The terms of a well-drafted Cayman Islands law governed security document with respect to Secured Shares in a Secured Company and the principal finance document will usually require the security provider to deliver the following documents to the secured party to assist with an enforcement:
-
- any original share certificate(s) with respect to the Secured Shares in the Secured Company;
- an undated share transfer form with respect to the Secured Shares in the Secured Company;
- an undated resignation letter from each director of the Secured Company;
- a letter of authorization from each director of the Secured Company authorizing the secured party to date each undated letter of resignation upon the occurrence of a default under the security document;
- an irrevocable proxy with respect to the Secured Shares in the Secured Company in favor of the secured party;
- a letter of instruction to the Secured Company’s registered office service provider containing, among other things, directions to register a transfer of Secured Shares in the Secured Company upon the occurrence of a default under the security document;
- a letter of acknowledgement from the registered office service provider with respect to the instructions referenced in the letter of instruction;
- if the security provider is a Cayman Islands exempted company, a certified copy of its register of mortgages and charges showing the security created over the Secured Shares in the Secured Company (see further below);
- a certified copy of the Secured Company’s register of members annotated to show the security created over the Secured Shares in the Secured Company (if commercially agreed – see further below);
- if the security provider is a Cayman Islands exempted company, a copy of the board resolutions of its board of directors authorizing:
-
- its entry into and execution of the security document; and
- the updates to its register of mortgages and charges;
-
- a copy of the board resolutions of the Secured Company authorizing:
-
- its entry into and execution of the security document (if it is a party);
- its register of members to be annotated (if commercially agreed); and
- its register of members to be annotated (if commercially agreed); and
-
- special resolution passed by the Secured Company with respect to certain changes to its M&A, if required (see further below).
Security Protection Steps
Register of mortgages and charges of a Cayman Islands security provider
Pursuant to section 54 of the Act, if the security provider is a Cayman Islands company, it must record particulars of the security created over any Secured Shares in the Secured Company in its register of mortgages and charges. The register of mortgages and charges must include:
-
- a short description of the property mortgaged or charged;
- the amount of charge created; and
- the names of the mortgagees or persons entitled to such charge.
There is no statutory timeframe within which the register needs to be updated. However, a well-advised secured party will request that the register is updated promptly so that third parties that inspect it are on notice of the security.
Any variations and releases of charge should also be reflected in the register of mortgages and charges.
As there is no statutory regime for registering security interests under Cayman Islands law, the common law rules of priority continue to apply. In general terms, these rules specify that priority between competing security interests is determined by the dates on which the relevant security interests were created. It is important to note that inserting details of mortgages and charges in the register of mortgages and charges of a Cayman Islands company does not confer priority on a charge in respect of the relevant secured asset.
Register of members of the Secured Company
A Secured Company may annotate its register of members to include:
-
- a statement that security has been created over the Secured Shares;
- the name of the secured party; and
- the date on which the statement and the secured party’s name are entered in its register of members.
Although it is optional to annotate a Secured Company’s register of members with details of any security that has been created, this puts third parties that inspect the register on notice of the security. Therefore, a secured party usually insists on this.
M&A of the Secured Company
A secured party will usually request the Secured Company to make certain changes to its M&A to ensure, among other things, that there are no restrictions on the transfer of Secured Shares in the Secured Company which may impede enforcement action. Any changes to the Secured Company’s M&A must be made by passing special resolutions. Although such resolutions need to be filed with the Registrar of Companies of the Cayman Islands within 15 days of being passed, they take effect upon signing.
Further Assistance
This publication is not intended to be a substitute for specific legal advice or a legal opinion. For specific advice on the matters covered in this Legal Insight, please contact your usual Loeb Smith attorney or any of the following:
E: vanisha.harjani@loebsmith.com
E: max.lee@loebsmith.com
This article was first published in the Hong Kong Lawyer: https://law.asia/cayman-digital-asset-law/Granting and Protecting Security Over Shares in a Cayman Islands Exempted Company | Hong Kong Lawyer.
An increasing number of high-net-worth individuals are utilizing offshore trusts in the Cayman Islands and the BVI as instruments for family wealth succession. The Discretionary Trust, as one of the most flexible types of trust, can grant the trustee(s) very broad discretionary powers. For more on Discretionary Trusts, please see our Briefing on Cayman Islands and BVI Trusts.
However, when establishing a Discretionary Trust, the settlor may often be concerned that the Trustee might make decisions contrary to their wishes and the Trust’s purpose. Therefore, at the time of establishing the trust, in addition to the trust instrument, the settlor will typically also sign a Letter of Wishes (LoW), outlining their intentions regarding trust beneficiary arrangements, assets distribution, investments, management, and other matters of the Trust. How effective is the Letter of Wishes? What details need to be considered in a Letter of Wishes? Can a Trust have only one Letter of Wishes throughout its existence? When multiple Letters of Wishes conflict, which one prevails? Will a Trustee’s decision contrary to the intentions expressed in the Letter of Wishes be valid? This Briefing will focus on these questions to provide a brief introduction to the effectiveness and role of the Letter of Wishes in Trusts.
1. Legal Effectiveness and Role of the Letter of Wishes
Firstly, the Letter of Wishes is a document separate from the Trust Instrument. Unlike the Trust Instrument, the Letter of Wishes does not have binding legal force. It is more akin to a guiding document, providing advisory guidance to the Trustee in administering the Trust. This means the Trustee has the discretion to decide whether or not to adopt the contents of the Letter of Wishes. Settlors might ask the question: if the Letter of Wishes lacks enforceability, isn’t creating one meaningless?
In practical application, if a Trustee’s failure to follow the Letter of Wishes results in harm to a beneficiary’s interests, the beneficiary may sue the Trustee in court. If the Trustees cannot provide sufficient evidence to prove that their decision-making process and purpose complied with the law and the provisions of the Trust Instrument, the court may assume the Trustees’ decision is invalid. For further details, see the section below on the validity of Trustee decisions contrary to the Letter of Wishes.
2. Considerations of details in Drafting the Letter of Wishes
Typically, settlors do not include excessive detail within the Trust Instrument itself. Instead, specific wishes for trust administration will be placed in the Letter of Wishes. The main contents of a Letter of Wishes usually cover the following points:
-
- Trust/Beneficiary Arrangements. These often include prioritizing children’s education and medical needs. Additionally, conditions for beneficiaries to receive benefits can be set, such as age thresholds or educational requirements. Specific scenarios for excluding beneficiaries can also be stipulated. For example, distribution may be suspended or a beneficiary may be excluded if they are involved in drug-related crimes.
- Principles for Trust Asset Distribution. The Letter of Wishes can specify methods for distributing Trust assets, such as regular distributions, emergency distributions, and distributions upon the occurrence of significant events.
- Explanation of Trust Purpose. Elaborating on the Trust’s purpose within the Letter of Wishes is also a key measure to prevent Trust disputes. For instance, stating that the Trust aims to safeguard the livelihood of family members and their descendants. The Trustee must then weigh these purposes when making decisions.
- Stipulation of Special Clauses. For example, sometimes, while the law grants Trustees discretionary power to invest the Trust assets, the Letter of Wishes could state a recommendation to limit the proportion of assets invested in high-risk financial products to a specific range.
- Confidentiality Requirements. The settlor may state in the Letter of Wishes that its contents will not be disclosed to minor beneficiaries.
3. Resolving Conflicts Between Multiple Letters of Wishes
A settlor can usually sign multiple Letters of Wishes, reflecting the flexibility of Trusts. The settlor can update and adjust such non-binding guidance to the Trustee over time, based on changes in their circumstances (e.g., family situation, financial status, tax environment). It is generally understood that the most recently signed Letter of Wishes takes precedence, as it better reflects the settlor’s current situation and intentions. To avoid conflicts between multiple Letters of Wishes, a new Letter of Wishes should clearly and explicitly state that it revokes and replaces all prior Letters of Wishes or specified prior Letters of Wishes.
However, if the settlor fails to explicitly revoke prior versions in the new Letter of Wishes and conflicts arise between the old and new documents, the Trustee can face difficulties in decision-making. In such cases, the Trustee needs to consider all the Trust documents and make decisions based on the settlor’s overall intent. If the conflict is irreconcilable, the Trustee should seek legal advice to determine the course of action that best serves the interests of the Trust and aligns with the settlor’s true intentions, while avoiding liability for breaching fiduciary duties.
4. Validity of Trustee Decisions Contrary to the Letter of Wishes
As mentioned, the Letter of Wishes itself lacks binding force. This means that, under specific circumstances, the Trustee has the right to make decisions that deviate from or even contradict the instructions in the Letter of Wishes. However, this does not mean the Trustee can arbitrarily disregard the settlor’s wishes. The Trustee’s power to deviate is strictly limited by the core requirement that the Trustee must fulfill his/her/its fiduciary duties, particularly the duties of loyalty, prudence, and adherence to the Trust’s purpose and terms.
Referencing a classic case, the Wong Case (Grand View Private Trust Company v Wong & Others [2022] UKPC 17), the UK Privy Council (whose judgment is persuasive authority in the Cayman Islands and the BVI) issued a number of guiding principles.
Based on the facts stated in the UK Privy Council’s judgment, the Wong brothers co-founded the large Taiwanese conglomerate Formosa Plastics Group (FPG) in the 1950s. In 2001, the brothers established two Bermuda trusts. The first was a discretionary family trust named the Global Resource Trust No. 1 (GRT), holding approximately US$560 million worth of FPG shares, with the beneficiaries being the settlors’ children and descendants. This discretionary family trust also granted the Trustee the discretionary power to add or remove “any person or class or description of persons” to the beneficial class of the Trust. The second Trust was a purpose trust named the Wang Family Trust (WFT), serving both charitable and non-charitable purposes. In 2005, The Trustee of the GRT exercised its powers of addition and exclusion to exclude all family members of the founders from the beneficial class of the Trust, and to add the Trustee of the WFT as the sole beneficiary. The dispute accordingly focused on the GRT trust deed, which granted the Trustee the power to add or exclude beneficiaries. Further, as early as 2001, the founding brothers had signed a memorandum of wishes before establishing the Trusts. This memorandum stated their intention in establishing the family trust was for the benefit of their children. The UK Privy Council admitted this memorandum as evidence, concluding that the purpose of the GRT discretionary trust was for the benefit of the founder’s family members. According to the Letter of Wishes, if the family Trust was established to benefit the family, how could excluding the family members to benefit another Trust serve a proper purpose? Consequently, the UK Privy Council found that the Trustee’s exercise of its power to exclude the existing beneficiaries and add the purpose Trust as a beneficiary was invalid.
Although the above case is an extreme and unusual example, it illustrates that a Trustee cannot ignore the settlor’s wishes and purposes when exercising their administrative powers. However, when dealing with such cases, courts will not automatically find a Trustee in breach simply for not following the Letter of Wishes. The reasonableness of the Trustees’ decision-making process and basis, and whether they have complied with their fiduciary duties, are also crucial factors. The court will consider the Letter of Wishes as significant evidence for understanding the settlor’s intent.
5. Summary
The Letter of Wishes, as a key non-binding document within a Trust, plays an indispensable role in family wealth succession planning. Its core value lies in providing guiding principles for the Trustee regarding the management of Trust assets, distribution of gains or profits, and addition or removal of beneficiaries, thereby significantly compensating for the potential lack of detailed execution provisions in the Trust Instrument, which prioritizes flexibility.
Although the Letter of Wishes itself lacks binding legal force, its practical influence and risk management value in practice of Trust administration cannot be overlooked. When making discretionary trust administration decisions, Trustees should fully understand the settlor’s Trust intentions to avoid dispute.
Further Assistance
This publication is not intended to be a substitute for specific legal advice or a legal opinion. For specific advice on the matters covered in this Legal Insight, please contact your usual Loeb Smith attorney or any of the following:
E: gary.smith@loebsmith.com
E: robert.farrell@loebsmith.com
E: elizabeth.kenny@loebsmith.com
E: vanisha.harjani@loebsmith.com




