.svg)
Cayman VASP custody licensing and CIMA's market conduct rules: what digital asset funds should verify
Since 1 April 2025, providing virtual asset custody or operating a virtual asset trading platform in or from the Cayman Islands has required a licence from the Cayman Islands Monetary Authority rather than a registration. In February 2026 CIMA added a Rule and Statement of Guidance on Market Conduct for Virtual Asset Service Providers, which sets out how custodians are expected to segregate, reconcile, insure and report on client assets. For a digital asset fund, the value of these standards is practical: they turn custody due diligence from a set of representations into a set of documents that can be requested, read and checked. A licence is where that work starts, not where it ends.
"For institutional financial services, credible regulation is a commercial advantage, provided it is proportionate, clearly articulated, and consistently applied." David Lloyd, Chief Executive Officer of CV5 Capital
From registration to licensing
The Virtual Asset (Service Providers) Act was implemented in phases. The first phase, from 2020, required virtual asset service providers to register with CIMA and established the regulatory perimeter, with an emphasis on anti-money laundering and counter-terrorist financing obligations. The second phase commenced on 1 April 2025. From that date, entities providing virtual asset custody services or operating a virtual asset trading platform in or from the Cayman Islands must hold a licence, and registered persons already carrying on those activities were given 90 days to apply. Other virtual asset services remain subject to registration.
The CIMA Rule and Statement of Guidance for Virtual Asset Custodians and Virtual Asset Trading Platforms came into effect alongside the licensing regime. In February 2026 CIMA updated those instruments and moved a number of provisions into the new market conduct framework, so the two should now be read together.
For a fund, the distinction between registration and licensing matters because the questions an allocator asks about a custodian are licensing questions: how assets are safeguarded, who can authorise a transfer, how client assets are kept apart from the provider's own, and what happens when something goes wrong.
What the February 2026 market conduct rule adds
The Rule and Statement of Guidance on Market Conduct for Virtual Asset Service Providers applies to every entity authorised under the Act, whether by licence, registration or waiver, and takes effect on publication in the Gazette. It combines binding rules, which are marked as such in the text, with guidance, and CIMA has said it will assess compliance in proportion to the size, complexity, nature and risk profile of each business. Its scope runs from conflicts of interest, marketing, client onboarding and complaints handling to public disclosures, cross-border transactions and trading on own account, with dedicated sections for trading platforms and for custodians.
The custody provisions are the ones a fund board will use most. They map directly onto the questions in an operational due diligence questionnaire.
Custody provisions to map to the fund's diligence file
- Segregation. A custodian must ensure client assets are clearly identified and segregated from its own and its group's assets, and protected from third party creditors. Where shared wallets are used, client assets attributable to the Cayman entity are expected to be identifiable and auditable.
- Custody policy. A custodian must establish a custody policy with internal rules and procedures.
- Staking rewards, airdrops and voting rights. Benefits arising from client assets must be dealt with in accordance with the client agreement, with appropriate disclosure.
- Storage disclosure. Clients must receive clear and accurate information on how their assets are stored, with updates and notice of material changes.
- Breach reporting. Breaches of, or unauthorised access to, custody systems must be reported to CIMA and to affected clients. The guidance sets 72 hours after discovery of a material incident as the latest point for notifying CIMA, and 72 hours from detection for notifying affected clients.
- Reconciliation. Client asset balances must be reconciled in a timely and consistent manner, and the guidance points to at least daily reconciliation of the custodian's own and client holdings.
- Insurance. Where applicable, a regulated entity must maintain insurance protection to CIMA's satisfaction.
- Outsourced custody. An entity that outsources custody of client virtual assets remains responsible for ensuring the third party complies with the applicable requirements.
What a licence evidences, and what it does not
A custody licence tells a fund three useful things. The provider has been assessed by CIMA before authorisation. It is subject to continuing supervision. And it is bound by the standards above, which gives the fund a published benchmark against which to read the provider's own documents.
A licence does not tell the fund that its particular assets exist, that they are held for the fund rather than for another client, or that they are controlled in the way the fund's offering documents describe. It does not confirm that the licence covers every asset type or service the fund intends to use, or that the entity named on the custody agreement is the entity that holds the licence. And it is not an endorsement by CIMA of the provider, its pricing or its technology. Those points are matters of evidence, and they remain the fund's responsibility to establish.
That is why licensing raises the standard of diligence rather than replacing it. The fund now has a regulatory reference point for what good practice looks like, and allocators increasingly expect to see that the manager and the board have tested the custodian against it.
What the board and the investment manager should verify
The following sequence converts the market conduct standards into a custody file that an administrator, an auditor and an allocator can each work from.
| Request | What to check |
|---|---|
| Licence and public disclosures | Current licence status on the CIMA register; the licensed entity is the contracting entity; the licence covers custody of the assets the fund will hold. |
| Custody agreement and custody policy | Segregation language; any right to use or rehypothecate client assets; treatment of staking rewards, airdrops and voting rights consistent with the fund's documents. |
| Reconciliation evidence | Frequency; a per-client register; statements the administrator can reconcile independently to its own records and to on-chain data. |
| Storage disclosure | How assets are split between storage methods; how and when the fund is told of changes. |
| Incident notification terms | Contractual notice to the fund that is at least as prompt as the regulatory expectation; a named contact; the fund's own escalation route to the board. |
| Insurance | What is covered, the limit and whether it is shared across clients, and the principal exclusions. |
| Sub-custody and outsourcing | Any third party in the custody chain, its own regulatory status, and how responsibility is allocated. |
The review should be minuted by the board at launch and repeated at least annually, with an interim review on any change of control, security incident or change in licence status. The evidence an auditor and an administrator will rely on at year end is set out in more detail in our analysis of the custody evidence an auditor and administrator will accept, and the wider allocator view of custody selection is covered in crypto custody due diligence for fund managers.
Where tokenised fund interests sit
A related question arises for managers issuing fund interests as tokens. Amendments to the Mutual Funds Act, the Private Funds Act and the Virtual Asset (Service Providers) Act commenced on 24 March 2026. They confirm that the issue of digital equity tokens by a regulated tokenised mutual fund, or digital investment tokens by a regulated tokenised private fund, is not a virtual asset issuance for the purposes of the Virtual Asset (Service Providers) Act. Those funds are regulated under the funds legislation instead.
The carve-out is limited to the issue of the fund's own interests. Where a fund or a related entity provides virtual asset services to others, such as custody or the operation of a trading venue, that activity is analysed under the virtual asset framework in the ordinary way. And the fund's own underlying digital assets still need a custody arrangement that meets the standard described above. The structure and governance of tokenised funds are covered in our tokenised funds hub, and the separate question of when a business that calls itself non-custodial falls inside the perimeter is addressed in why non-custodial is not a regulatory status.
How the CV5 platform approaches custody
CV5 Capital provides regulated Cayman fund infrastructure through which third party investment managers launch and operate digital asset funds as segregated portfolios of CV5 Digital SPC. Custody and counterparty arrangements for each portfolio sit within the platform's governance framework from day one, so the evidence described above is assembled as part of the launch rather than reconstructed when an allocator asks for it. The investment manager remains responsible for its strategy and for its own regulatory obligations in its home jurisdiction.
David Lloyd discussed the move from registration to licensing, the market conduct rule and the tokenised funds amendments in a panel published in The Digital Assets Edge, Issue 022 (October 2026).
Key takeaways
- Since 1 April 2025, virtual asset custody and trading platform services in or from the Cayman Islands require a CIMA licence. Other virtual asset services remain subject to registration.
- CIMA's February 2026 market conduct rule applies to every authorised virtual asset service provider and sets out expectations on segregation, custody policy, storage disclosure, breach reporting, reconciliation and insurance.
- A licence is evidence that a custodian is assessed and supervised. It is not evidence that a particular fund's assets exist, are held for that fund or are controlled as its documents describe.
- Fund boards and investment managers should request the licence, the custody agreement and policy, reconciliation evidence, storage disclosures, incident terms and insurance details, and minute the review.
- Regulated tokenised funds issuing their own interests sit within the funds framework, but separate virtual asset services and the custody of underlying assets are not affected by that carve-out.
Discuss your fund launch
CV5 Digital SPC provides the governance, administration and counterparty architecture a digital asset fund needs from day one, including documented custody arrangements.
The CV5 Fund Terms Questionnaire is the first structuring step. It captures the proposed strategy, investment manager, launch assets, target investors, dealing and liquidity terms, fees, custody and banking arrangements.
Start the Digital Asset Fund QuestionnaireCayman Fund Intelligence, Direct to Your Inbox
Receive concise analysis on Cayman fund formation, digital asset funds, regulation, governance and institutional infrastructure.
Considering launching a Cayman fund?
Complete the relevant CV5 Fund Terms Questionnaire to provide the core information required to assess the proposed structure.
Stay current on Cayman fund formation
Receive practical updates on Cayman hedge funds, digital asset funds, CIMA regulation, governance and institutional infrastructure.
