Q&A: Safe harbours for VASPs - part 2

In 2023, Jersey and the British Virgin Islands passed legislation indicating they were welcoming virtual asset service providers, joining the likes of the Cayman Islands as regulated virtual asset friendly jurisdictions.

Asian Legal Business was keen to hear from our experts on how this will allow virtual asset services providers (VASPs) to anchor in theses jurisdictions, despite increased regulatory burdens, compliance costs and stringent penalties.

Part two covers balancing compliance without stifling innovation, how firms can rectify their compliance status, how these jurisdictions are enforcing these new regulations, and recommendations for financial services providers to ensure they are compliant with regulations.

The Jersey perspective was provided by partner Alexander Curry, the view from Cayman by counsel Chris Wall, and from BVI by managing associate David Mathews.

Keeping the balance

Given the rigorous regulatory requirements, how can financial service providers balance compliance with AML frameworks without stifling innovation in the virtual asset space? Are there any specific measures or best practices that clients should consider in this regard?

Alexander: Jersey is a well-regulated jurisdiction with financial service providers already required to implement measures to prevent and detect money laundering. Increasing the regulatory burden will require amendments to be made to policies and procedures and in many cases training will be required to upskill those working in the regulatory compliance teams to ensure that they are able to manage the risks effectively. Those wishing to participate in virtual asset or VASP activities will have to absorb the cost if they wish to grow this sector. However, it is worth noting that the impact of such changes will be limited compared to other jurisdictions where such entities are not already required to comply with AML policies and procedures. It is also likely that further regulation and legislative changes will be implemented in the future as the sector becomes more sophisticated. Entities must be prepared to adapt and move quickly to ensure ongoing compliance.

Chris: Cayman's very high AML and CFT standards, the Cayman VASP Act and connected Cayman AML Regs require Cayman VASPs to ensure adequate protections are in place to combat money laundering and terrorism/proliferation financing. Irrespective of this, this has not deterred some big names in the market seeking registration under the Cayman VASP Act and has not stifled innovation. Indeed, we are seeing software companies developing solutions for this specific purpose from within the Cayman Islands. Given the shift to ensure more credibility to the virtual asset market, the high standards in Cayman make it an attractive proposition for VASPs to be regulated in the jurisdiction. Even for entities who are not required to be regulated under the Cayman VASP Act (or not required to comply with the Cayman AML Regs), we are seeing adoption of at least equivalent standards of AML / CFT compliance on a voluntary basis and putting specific policies and procedures in place as a matter of best practice.

David: As a matter of best practice, it is always advisable to engage the services of a specialist AML advisor, to assist any licensee under the BVI VASPA to comply with its obligations under the BVI AMLR and BVI AML Code. This will ensure that the client is able to comply with its obligations, and has the confidence that it is doing so, while freeing up the time and energy of its management team to focus on delivering and developing their product.

Getting up to speed

With the expanded definition and scope, do you anticipate any challenges for entities that may not be aware of the changes and now find themselves requiring a license to handle virtual assets or related tools? What steps should such entities take to rectify their compliance status and avoid legal consequences?

Alex: We would always encourage entities to take legal and regulatory advice before considering establishing a VA or VASP presence in Jersey. Entities that are already operating in the sector in Jersey should already be registered for AML and will be in breach of the law if they aren’t registered with the JFSC. New businesses should take advice on how to prepare an application to the JFSC. Ogier can provide relevant advice in this regard and can also provide assistance with the preparation of policies and procedures and business risk assessments.

Chris: The Cayman VASP Act has been in place for some time, so we see many market participants knowledgeable about Cayman and Cayman structures and accordingly those that need to be registered generally have already done so. Those that do not want to be regulated by CIMA have either moved their operations to other jurisdictions or otherwise changed their operating model to comply with Cayman laws and regulations pertaining to virtual assets. Entities who are operating without a registration will likely have received cease and desist letters from CIMA, who have been proactive in ensuring compliance.

David: The BVI VASPA had a six-month grandfathering period, during which time persons already operating a virtual assets business using a BVI entity were able to continue operating before they had to apply for a licence. After the licence application was made, these entities are able to continue operating until the BVI FSC has finally approved or refused to grant a licence to that entity. In this way, the BVI FSC have attempted to ensure that existing businesses have been afforded the chance to continue operating seamlessly while the new regime under the BVI VASPA is implemented.

Any entity that was not operating its virtual assets business on 1 February 2023, or did not submit an application for a licence under the BVI VASPA within the specified timeframe, will be unable to start or continue business. It must submit an application for a licence and may only begin operations once it has been granted. If an entity has already begun operations, they must cease until the licence is granted.

Enforcement

How do the offshore jurisdictions plan to enforce these new regulations, and what are the potential penalties for non-compliance? Are there any leniency or transitional measures in place to assist entities in adapting to the updated regulatory landscape?

Alex: Jersey’s AML / CFT / CPF regime is underpinned by legislation that applies to all money laundering crimes including those associated with VAs. Criminal penalties can be levied in Jersey for breach of the law and there is very little flex within the system for those who do not comply.

Chris: As the Cayman VASP Act is in force for the purposes of registration of all Cayman VASPs, any transition period has passed and accordingly any Cayman entity providing virtual assets services in or from within the Cayman Islands must register with CIMA under the Cayman VASP Act. 

Pursuant to the Cayman VASP Act, if it appears that a virtual asset service provider has failed to comply with any of the requirements under that Act, CIMA may, by written notice, direct the virtual asset service provider to comply with the requirement(s) within such period of time and on such terms and conditions as CIMA may specify and the virtual asset service provider shall comply with the notice. If CIMA knows, or has reasonable grounds to believe, that a virtual asset service provider has, among other things, failed to comply with a lawful direction of CIMA or has contravened any provision of the Cayman VASP Act or of any Cayman AML regulations, then it may cancel any registration given or, once the Phase 2 is in effect, revoke any licence. In addition, among other things, it may in the case of a reasonable belief that the VASP has contravened the Cayman AML Regs report the same to the Director of Public Prosecutions in the Cayman Islands.

CIMA can also impose administrative fines on those that breach a prescribed provision of a "Regulatory Act" which includes the Cayman VASP Act. CIMA may also impose an administrative fine on individuals purporting to act in such capacity of a body corporate, where the body corporate commits a breach that was committed with the consent or connivance of, or is attributable to the neglect on the part of, such officer. CIMA has similar fining powers under the administrative fines regime in respect of partners or persons involved in the management or control of partnerships or other unincorporated associations.

David: Any entity that is granted a licence under the BVI VASPA is required, each year, to submit an auditor's report and a compliance report to the BVI FSC, both of which will detail compliance with aspects the BVI VASPA regime. Where failures or weaknesses are identified, the BVI FSC will impose the relevant penalty as set out in the BVI VASPA. It should be noted that a number of potential breaches of the BVI VASPA may be criminal in nature and the person committing such breach may be liable to pay a fine and also, in the most serious cases, receive a custodial sentence.

Where a person to whom the BVI VASPA applies carries on a virtual assets business without the necessary licence (and without the benefit of any grandfathering provisions, considered above), they commit an offence under the BVI VASPA and are liable to a fine as well as potentially being subject to a custodial sentence of up to five years' imprisonment.

Recommendations

As clients navigate the evolving regulatory landscape for virtual assets, what specific advice or recommendations do you have for them to ensure they are well-prepared and compliant with the latest legislation in offshore jurisdictions? Are there any common pitfalls or misconceptions that clients should be aware of when it comes to virtual asset-related regulations in these jurisdictions?

Alex: If you are considering Jersey as a jurisdiction from which to conduct your VA business, the first act should be to commission a detailed regulatory review before committing to proceed. The regulatory review can be undertaken by Ogier and will highlight whether or not your proposed business falls within the Jersey VASP regime and whether or not your business will be required to register with the Jersey regulatory for AML / CFT / CPF purposes. In most cases, it is not possible to incorporate a company in Jersey without using a regulated corporate service provider. Selecting a corporate service provider is an important decision and not all service providers are currently equipped to deal with VAs. We can of course provide suitable guidance in this regard at the regulatory review stage. Applicants will need to prepare and provide a detailed business risk assessment looking at AML / CFT / CPF processes. Applicants also need to have a detailed business plan which the regulator will require to critically assess the business and its operations. Ogier can assist clients with the preparation of their business risk assessment and necessary policies and procedures but much of this information should already be quite well developed by the client.

Chris: Many things must be considered when a transaction or structure involves virtual assets in the Cayman Islands. Unlike some other jurisdictions such as the BVI, Cayman regulates public issuances of tokens. Accordingly, care must be taken when issuing tokens in or from within the Cayman Islands such that they are deemed private sales, otherwise any public offering or sale would require regulation under the Cayman VASP Act. Furthermore, consideration must be given as to whether an entity is participating in virtual asset services, which given the complexity of the asset class and decentralised nature of some structures, may not always be obvious. In addition, there are other laws and regulations to consider when structures involve virtual assets, including, but not limited, to Cayman's AML Regs, the Proceeds of Crime Act, the Terrorism Act, the Proliferation Financing (Prohibition) Act, sanctions regimes, Securities and Investment Business Act, economic substance requirements and Cayman's funds legislation. Where a Cayman entity is interacting with virtual assets in any way, we suggest legal advice is sought from the outset of the project so appropriate legal and regulatory consideration can be given to the structure so as to not breach any applicable Cayman laws and regulations.

David: As a general rule, we would advise anyone looking to establish a virtual assets business to seek legal counsel at the earliest opportunity. Similarly, we would always recommend that suitably qualified service providers are engaged to assist with compliance and AML, to ensure that the business is operated in a manner that complies with the BVI VASPA, BVI AMLR and BVI AML Code. The single most common pitfall for clients in the virtual assets space that we have seen has been failing to involve BVI specialist advisors until after the business is up and running; by this time, many common mistakes will have already been made and so time and energy are spent in rectification, rather than in further progressing and developing the business.

Read part one of our Q&A, which discusses the key provisions of each piece of legislation, the challenges financial service providers should expect, and the incentives of these jurisdictions.

An original version of this article was first published in Asian Legal Business's January and February 2024 Asia edition.

About Ogier

Ogier is a professional services firm with the knowledge and expertise to handle the most demanding and complex transactions and provide expert, efficient and cost-effective services to all our clients. We regularly win awards for the quality of our client service, our work and our people.

Disclaimer

This client briefing has been prepared for clients and professional associates of Ogier. The information and expressions of opinion which it contains are not intended to be a comprehensive study or to provide legal advice and should not be treated as a substitute for specific advice concerning individual situations.

Regulatory information can be found under Legal Notice