Why Choose Bermuda for Crypto Licensing?
Bermuda offers the world’s first prudential and AML framework for digital asset businesses, administered by an established financial-services regulator with reinsurance-market credibility, and a tax-neutral environment for sub-threshold operators. The Digital Asset Business Act 2018 covers 36 licensees as of , growing 50% year-on-year, and the Caribbean Financial Action Task Force ranks Bermuda first globally on technical compliance.[1][2]
Bermuda’s Digital Asset Business Act framework carries more institutional weight than most offshore VASP regimes, and that difference shows up directly in banking conversations with US correspondents and European counterparties. Operators choosing between Bermuda Class F and a lighter Caribbean registration are choosing between credibility and speed, not between two equivalent products.
Mature supervisor with first-mover credibility
The BMA was established by the Bermuda Monetary Authority Act 1969 as Bermuda’s sole financial-services regulator and is best known internationally as the supervisor of the world’s third-largest reinsurance market.[3] When the Digital Asset Business Act 2018 entered force on , it became the first comprehensive prudential plus AML framework for digital asset businesses anywhere. The BMA has since accumulated nearly eight years of supervisory experience across Class T sandbox pilots, Class M conditional authorisations, and Class F full licences. Unlike newer offshore VASP regimes that combine registration with light-touch supervision, the BMA operates a supervisor-led model: pre-application engagement, an Assessment and Licensing Committee that reviews every file, on-site inspections, and continuous off-site monitoring.[2][4]
Tax-neutral for sub-threshold groups, transparent for the rest
Bermuda retains a 0% corporate tax rate on profits, capital gains, dividends, and withholdings for the vast majority of digital asset businesses, with no VAT, no GST, no capital gains tax, and no withholding tax. The Corporate Income Tax Act 2023 reaches only the largest in-scope multinational groups; the thresholds, rate, and Tax Assurance Certificate protection are set out in the Taxation section.
CFATF-leading AML standing
The CFATF Mutual Evaluation Report of Bermuda, published , rated Bermuda compliant or largely compliant on 39 of 40 FATF Recommendations, ranked first globally on technical compliance at publication and among the top six on effectiveness.[1] Bermuda is not on the FATF Grey List, not on the European Union Anti-Money Laundering high-risk third-country list, and not on the United Kingdom anti-money laundering high-risk list. Unlike the British Virgin Islands, which entered the FATF grey list in and now triggers enhanced due diligence at major correspondent banks, Bermuda remains in regular CFATF follow-up.[1][6] Bermuda licensees benefit from the lowest counterparty due-diligence friction in the premium offshore tier.
Reinsurance-market crossover
Bermuda is the world’s largest reinsurance market after London and New York, with international business activity dominated by reinsurance accounting for 26% of GDP per the 2020 CFATF Mutual Evaluation Report.[1] This is operationally relevant: Bermuda’s Segregated Accounts Companies Act 2000 and Incorporated Segregated Accounts Companies Act 2019 provide bankruptcy-remote structures for stablecoin reserves and tokenised real-world asset backing, used in production by single-currency-pegged stablecoin issuers under the BMA’s Single Currency Pegged Stablecoins (SCPS) Guidance.[7] Custody insurance, parametric crypto cover, and digital asset cyber insurance written from Bermuda reinsurance carriers create infrastructure that newer offshore jurisdictions lack.
Regulatory Framework
Bermuda regulates digital asset business under the Digital Asset Business Act 2018 (DABA), enacted in July 2018 and operative from . The BMA administers DABA as Bermuda’s sole financial-services regulator, supported by 10 or more subsidiary instruments including the Digital Asset Business Code of Practice (revised ), the Digital Asset Business (Cyber Risk) Rules 2023, and the Digital Asset Business (Custody of Client Assets) Rules 2025.[2][8] DABA has been amended three times: in 2019 (derivative exchange and benchmark administrator additions), 2020 (Class T sandbox licence), and 2023 (digital asset lending and repurchase service provider).[9]
Definition: DABA Licence
A Bermuda DABA licence is an authorisation issued by the Bermuda Monetary Authority under the Digital Asset Business Act 2018 (2018:28). It permits the holder to carry on one or more defined digital asset business activities: issuing or redeeming digital assets, operating a digital asset payment service, operating a centralised or decentralised digital asset exchange, providing custodial wallet services, operating a digital asset derivative exchange, acting as a digital asset services vendor, market-making, or providing digital asset lending or repurchase services.
Regulatory History
DABA was Bermuda’s response to a coordinated Bermuda Government strategy announcing fintech as the jurisdiction’s fourth economic pillar under Premier David Burt.[10] The Act was passed in July 2018 alongside the Banks and Deposit Companies Amendment Act 2018, which created a restricted bank licence permitting institutions that serve digital asset businesses without high-street retail presence. Jewel Bank received a combined restricted bank and Class F DAB licence in , the first new bank in Bermuda in 21 years.[11] The Digital Asset Issuance Act 2020 (DAIA) followed, covering public token offerings as a separate regime from DABA. The 2020 DABA amendment introduced Class T (test) as a formal sandbox licence; the 2023 amendment added digital asset lending and repurchase service providers in response to the post-FTX market shift toward institutional credit structures.[9]
Bermuda’s market also absorbed material crypto-business contagion: BlockFi International Ltd, a BMA Class F licensee granted in , was placed into provisional liquidation by the Supreme Court of Bermuda on following the FTX collapse.[12] The Bermuda court’s winding-up order in Re BlockFi International Ltd (Chief Justice Narinder Hargun) is now treated as landmark cross-border crypto-insolvency precedent. For clarity, FTX Digital Markets Ltd was a Bahamian-incorporated, Securities Commission of The Bahamas-licensed entity under the DARE Act, with joint provisional liquidators appointed by the Bahamas Supreme Court; the BMA had no FTX role.[13]
Recent Regulatory Developments
- : BMA Q4 2025 Regulatory Update. Confirms the DAB Thematic Review findings on vertical integration, governance, outsourcing, and head-office substance; reports the embedded supervision pilot launched Q4 2025 with Chainlink Labs, Apex Group, Hacken, and Blueprint.[8]
- : Travel Rule reforms. Implements FATF June 2025 Recommendation 16 revisions for all payment service providers under DABA and the Proceeds of Crime Regulations.[14]
- : Guidance Note for Prospective Applicants for Licensing. Formalises the pre-application engagement model: every prospective licensee meets the BMA before formal submission.[15]
- : Operational Cyber Risk Management Code of Practice (updated). Three Lines of Defence; CISO mandate; secure software development lifecycle; annual Cyber Risk Return.[16]
- : Custody of Client Assets Rules 2025. Segregation, asset-pooling limits, third-party-intermediary due diligence, enhanced reconciliation.[17]
- : Single Currency Pegged Stablecoins Guidance. Bankruptcy-remote backing assets via Segregated Accounts Company or Incorporated Segregated Accounts Company structures; stress testing; recovery and resolution planning; own-funds requirements.[7]
Court rulings on digital asset business
In Lai et al v Bermuda Monetary Authority and Minister of Finance [2025] SC (Bda) 49 Civ, the Supreme Court of Bermuda confirmed DABA’s constitutional standing and the BMA’s enforcement architecture.[18] In practice, the Lai judgment closed the route for licensees to challenge BMA decisions on adjudicating-authority grounds: the DABA Tribunal under Part 6 of the Act is the constitutionally correct appeal mechanism. Subsequent rulings in Re Bittrex Global (Bermuda) Ltd established Supreme Court oversight of digital asset business liquidations, including the title-to-assets analysis under customer terms and conditions ([2025] SC (Bda) 78 civ, 11 July 2025) and the formula-based conversion of remaining digital assets into stablecoin for distribution ([2025] SC (Bda) 113 Civ, 3 November 2025).[19][20]
Regulatory Overlap
| Overlapping regime | Trigger | Practical consequence |
|---|---|---|
| Banks and Deposit Companies Act 1999 (as amended 2018) | Deposit-taking activity | Separate restricted bank licence required; DABA Class F insufficient on its own |
| Investment Business Act 2003 | Tokens qualifying as investments (security tokens, tokenised securities) | Separate IBA licence required; dual DABA + IBA possible |
| Digital Asset Issuance Act 2020 (DAIA) | Public token issuance to retail | Separate DAIA authorisation; accredited DABA-licensed exchanges can act as gatekeepers |
| Money Service Business Act 2016 | Cross-border fiat-fiat remittance distinct from digital asset payment | MSB licence required in addition; proposed Payment Services Act will consolidate |
Tokenised securities and RWA
A tokenised investment, a tokenised share, bond, fund unit, or other real-world asset, sits at a junction of two Bermuda regimes. It is a “digital asset” under DABA, so secondary-market activity such as exchange or custody runs through a DABA licence; but where the same token qualifies as an “investment”, it may also fall under the Investment Business Act 2003, and its public issuance engages the Digital Asset Issuance Act 2020. A single instrument can therefore trigger two or three authorisations at once. We scope each token against this overlap rather than assuming a generic crypto licence covers it, and pair the structuring with fund licensing where the underlying is a fund vehicle.
The BMA is actively narrowing this overlap. It published a Discussion Paper on Asset Tokenisation on 5 November 2025, followed by a Consultation Paper on 9 April 2026 proposing to remove dual-licensing friction, for example by exempting tokenised fund units from the Digital Asset Issuance Act 2020. These proposals are at consultation stage, not settled law, so a tokenisation structure built today should be scoped against the live consultation and confirmed with the BMA before launch.
License Types and Activities Covered
DABA section 10 establishes three licence classes calibrated to the applicant’s scale, business model maturity, and operational complexity. Class T is the sandbox pilot licence; Class M is a conditional, time-bound licence used either as a graduation path from Class T or as the entry point for modified-scope operators; Class F is the full licence without specified term, suitable for institutional-grade operators.[2] All three classes cover the same defined digital asset business activities, differentiated by conditions, term, and capital expectations.
Class T: Test Licence
The Class T licence was added by the Digital Asset Business Amendment Act 2020 and is designed for pilot, beta, and proof-of-concept testing of digital asset business activities.[9] BMA application and annual fees are USD 1,000 flat across all activities; minimum net assets are reduced to USD 10,000; the BMA may waive the Bermuda head-office and Bermuda-resident Senior Representative requirements. The licence is granted for a specified period (typically 12 months, extendable once) and is expected to graduate to Class M or Class F. Activity scope is limited to the conditions specified in the licence; the BMA tightly bounds what a Class T licensee may do.
Class M: Modified Licence
The Class M licence is BMA-conditional and BMA-time-bound. It is granted with operational conditions (geographic restrictions, customer-type restrictions, transaction-volume caps, capital phasing) and a specified period during which the licensee is expected to graduate to Class F.[2] Bermuda head office and a BMA-approved Bermuda-based Senior Representative are mandatory. Minimum net assets are USD 100,000, subject to BMA discretion to direct higher amounts based on the activity, scale, and risk.
Class F: Full Licence
The Class F licence is the full digital asset business authorisation without specified term, subject only to ongoing BMA conditions.[2] It carries the broadest activity scope and the highest institutional credibility. Bermuda head office, Bermuda-based Senior Representative, USD 100,000 minimum net assets (typically materially higher for custodians, exchanges, and stablecoin issuers per the SCPS Guidance and Custody Rules), full annual cyber risk return, mandatory annual external audit by a BMA-approved auditor, and the full Statement of Principles compliance load apply.
Covered Activities
DABA section 10(2), as amended in 2019, 2020, and 2023, defines the following digital asset business activities, each requiring authorisation under one of the three licence classes:[2][9]
- Issuing, selling, or redeeming digital assets: the issuer activity for non-public offerings (public offerings trigger DAIA).
- Operating as a payment service provider business utilising digital assets: peer-to-peer payments, merchant settlement, cross-border remittance using digital assets as the rail.
- Operating a digital asset exchange: centralised or decentralised electronic marketplace for spot trading; covers both order-book and automated market maker designs.
- Providing custodial wallet services: with or without custody of private keys; the latter captures non-custodial wallet provision for the first time after a amendment.
- Operating a digital asset derivative exchange: perpetuals, futures, options on digital assets.
- Operating as a digital asset services vendor: transacting on behalf of clients, exercising power of attorney, market-making as principal, administering a benchmark, providing trust services in respect of digital assets.
- Digital asset lending or repurchase transaction service provider: added by the , in force from 9 June 2023.
Definition of “digital asset”
Under DABA section 2, a digital asset is “anything that exists in binary format and comes with the right to use it” and includes any digital representation of value used as a medium of exchange, unit of account, or store of value.[2] Two carve-outs apply: (1) closed-loop affinity or rewards programmes that cannot be exchanged for legal tender, bank credit, or any digital asset; and (2) in-game value within an online game (or family of online games) sold by the same publisher.
What does not require a DABA licence
- Mining. Cryptocurrency mining is not a digital asset business activity under DABA.
- Public token issuance. Issuance to the public is regulated separately under the Digital Asset Issuance Act 2020 (DAIA), although ancillary DABA licences are often required for related secondary-market activity.
- Tokenised securities. Tokens qualifying as investments are regulated under the Investment Business Act 2003 (IBA); a separate IBA licence is required and may run alongside DABA.
- Investment funds. Bermuda-domiciled funds with IBA-licensed or recognised managers may obtain exemption under the Digital Asset Business Exemption Order 2023.
Requirements
DABA imposes a layered fit-and-proper, governance, capital, custody, and cybersecurity framework. Minimum net assets are USD 100,000 for Class M and Class F as a baseline, with BMA discretion to require materially higher amounts based on the activity, scale, and risk profile; custodians and stablecoin issuers routinely hold multiples of the baseline.[2][7][17] Bermuda head office and a BMA-approved Bermuda-based Senior Representative are mandatory for Class M and Class F.
| Requirement | Class T | Class M | Class F |
|---|---|---|---|
| Minimum net assets | USD 10,000 | USD 100,000 baseline (BMA may direct higher) | USD 100,000 baseline (BMA may direct higher) |
| Capital adequacy framework | Principles-based (DABA Schedule 1) | Principles-based (DABA Schedule 1) | Principles-based (DABA Schedule 1) |
| Bermuda head office | Not required (BMA discretion) | Required | Required |
| Bermuda-based Senior Representative | BMA may approve non-resident | Required; BMA-approved | Required; BMA-approved |
| Directors | Minimum 2 effective; corporate directors permitted | Minimum 2 effective; typically ≥1 non-executive | Minimum 2 effective; ≥1 non-executive expected |
| MLRO, Compliance Officer, CISO | Required (proportional) | Required | Required |
| Annual external audit | Required (BMA-approved auditor) | Required (BMA-approved auditor) | Required (BMA-approved auditor) |
| Cyber Risk Annual Return | As directed by BMA | As directed by BMA | Within 4 months of fiscal year-end |
| Insurance (custody / PI / cyber) | Risk-based | Risk-based | Surety bond, trust account, or indemnity insurance acceptable to BMA |
| Foreign ownership | 100% permitted (exempted company) | 100% permitted | 100% permitted |
Fit-and-Proper Assessment
The BMA assesses every controller (at the 10%, 20%, 33%, and 50% thresholds under DABA Part 4), every director, the Senior Executive, the Compliance Officer, the MLRO, the CISO, and any other officer the BMA designates.[2] Dimensions evaluated include integrity and probity, competence and capability, financial soundness, and time commitment. Personal Information Questionnaires (Appendix III), Bermuda Police criminal record certificates, home-jurisdiction criminal record certificates (apostilled), professional references, personal financial statements, and source-of-funds and source-of-wealth declarations for controllers are required.[15] The common mistake is treating fit-and-proper as a documentation exercise: the BMA expects substantive engagement and will request follow-up interviews where the file leaves material questions unanswered.
Local Presence: Bermuda Head Office
For Class M and Class F, the BMA requires a genuine Bermuda head office (not a registered-office address) from which the business is managed and directed.[15] Strategic direction, risk management, finance, compliance, and key decision-making must be exercised on-island. Operationally this means dedicated Bermuda office space (typically Hamilton or Pembroke financial-district premises at USD 60–120 per square foot per year), a Bermuda-based Senior Representative pre-approved by the BMA, and Bermuda-based members of the senior management team. Outsourcing the operational delivery of these functions to a service provider is permitted with documented oversight; outsourcing the decision-making itself is not.
AML/CFT and Travel Rule
Bermuda’s AML and counter-financing-of-terrorism framework rests on the Proceeds of Crime Act 1997 (POCA), the Anti-Terrorism (Financial and Other Measures) Act 2004 (ATFA), the Proceeds of Crime (Anti-Money Laundering and Anti-Terrorist Financing) Regulations 2008 (POCR), and the Proceeds of Crime (AML/ATF Supervision and Enforcement) Act 2008.[1] The Financial Intelligence Agency is Bermuda’s FIU and an Egmont Group member. DAB licensees are AML/ATF Regulated Financial Institutions supervised by the BMA.
The Travel Rule threshold is USD or EUR 1,000 for full originator and beneficiary information; verification of sub-threshold transfers is recommended where no business relationship exists.[14] Self-hosted wallet transfers currently fall outside the Travel Rule perimeter but the reforms align Bermuda with the FATF June 2025 Recommendation 16 revisions. Sanctions screening applies to United Nations Security Council, United Kingdom Office of Financial Sanctions Implementation (extended to Bermuda by Order in Council), United States Office of Foreign Assets Control (extraterritorially), and European Union lists.
Application Process
The BMA acknowledges receipt of an application within two business days and completes a formal completeness check within three business days. The Assessment and Licensing Committee considers the file at the next eligible meeting (typically 20 business days after the first Friday following a complete submission) and issues an initial decision approximately four weeks later.[15] In practice, this stated timeline holds only when the application package is genuinely complete on first submission: most files go through two to four RFI rounds before the ALC reaches a decision.
The application language is English; no translations are required for Bermuda submissions. Pre-application engagement is effectively mandatory in practice and formalised by the BMA Guidance Note for Prospective Applicants for Licensing.[15] The pre-application phase typically runs four to twelve weeks and includes initial scoping meetings with the BMA’s Fintech Department, presentation of the business model, discussion of expected licence class and conditions, and identification of any structural issues that would prevent authorisation before formal documents are drafted.
Entity Formation and Pre-Engagement
Forming a Bermuda entity is the first step: see the full Bermuda company formation guide →. Incorporate the Bermuda exempted company under the Companies Act 1981, secure consent under section 4(1)(b) of the Act where required, file the Beneficial Ownership Registry filing, appoint the Bermuda-resident director or Resident Representative or Resident Secretary, secure office space, and book pre-application meetings with the BMA Fintech Department.
Document Drafting
The full document package runs to 50–120 pages for the business plan alone, plus 200–400 pages of compliance documentation (AML/CFT/AT-PF policy suite, sanctions framework, Travel Rule policy, CDD/EDD procedures, transaction monitoring, risk appetite, IT security policy mapped to the BMA Operational Cyber Risk Code, BCP and disaster recovery plan, custody key management policy where applicable). All documents must be Bermuda-specific.
Formal Submission and Completeness Check
Submit the application package with the BMA application fee (USD 1,000 Class T, USD 2,266 Class M and Class F). The BMA acknowledges within two business days and completes the formal completeness check within three business days.[15] If documentation is incomplete, the BMA returns the file with a list of gaps.
RFI Rounds
The BMA issues Requests for Further Information, typically two to four rounds for well-prepared files. Each round addresses governance, AML detail, custody architecture, cybersecurity controls, financial projections, and operational substance. Response quality drives timeline more than response speed.
Assessment and Licensing Committee Review
The ALC is a multi-disciplinary committee with specialists in supervision, fintech, actuarial services, and AML compliance.[15] The ALC reviews the final file, makes the initial decision, and identifies any conditions for grant.
Conditional Approval to Final Authorisation
Capital injection, insurance arrangements (custody, professional indemnity, cyber), final hires, and operational readiness must be completed before final grant. The BMA issues the licence on satisfaction of conditions.
Jagelski & Partners’ specialist compliance partners draft Bermuda-specific AML and counter-financing-of-terrorism policy suites, the BMA Operational Cyber Risk Management programme, custody and key management procedures, and Bermuda Travel Rule frameworks as part of the DABA licensing engagement. The compliance documentation is the most time-intensive component of any Bermuda DABA application: 8 to 16 weeks of specialist work mapped to the Custody of Client Assets Rules 2025 and the other operative Bermuda instruments.
Required Documents
The BMA’s Guidance Note for Prospective Applicants for Licensing of sets out the document expectations across corporate, personal, compliance, business plan, and operational categories.[15] Every document must be Bermuda-specific and tailored to the applicant’s business model: the BMA explicitly rejects templates adapted from other jurisdictions, citing missed references to POCR 2008, the BMA Sector-Specific Guidance Notes Annex VIII, and Bermuda-specific sanctions implementation.
Corporate Documents
- Memorandum of Association and Bye-laws of the Bermuda exempted company (or LLC Operating Agreement for LLC applicants)
- Group structure chart (ownership through to ultimate beneficial owners at 25% threshold)
- Organisational chart and board composition with Non-Executive Director CVs
- Bermuda office lease or evidence of premises
- Bermuda-based Senior Representative engagement letter (Class M and Class F)
Personal Documents (Controllers, Directors, Senior Officers)
- Personal Information Questionnaire (PIQ) per BMA Appendix III for each Controller, Director, Senior Executive, CISO, and MLRO
- Bermuda Police criminal record certificate plus home-jurisdiction certificate (apostilled, within 6 months)
- Two professional and one personal reference per individual
- CVs and proof of qualifications
- Personal financial statements and net-worth declarations
- Source-of-funds and source-of-wealth declarations for controllers at 10% and above
Compliance Documentation
The compliance documentation is the most heavily scrutinised component of any Bermuda DABA application. Jagelski & Partners’ specialist compliance partners draft each of these documents as part of the licensing engagement: bespoke and Bermuda-specific, not templates adapted from other jurisdictions. Each document must reflect the applicant’s specific business model, risk profile, and operational structure.
- AML/CFT Policy Manual. Bermuda-specific anti-money-laundering and counter-financing-of-terrorism programme mapped to POCA 1997, ATFA 2004, POCR 2008, and BMA Sector-Specific Guidance Notes Annex VIII Digital Asset Business. The manual must reference the specific POCR provisions applicable to DAB licensees, identify the MLRO and reporting lines into the BMA and FIA, and address digital-asset-specific typologies including mixers, anonymity-enhanced coins, cross-chain bridges, and self-hosted wallet transfers. Generic AML manuals from EU or other Caribbean jurisdictions are routinely rejected.
- Enterprise-Wide Risk Assessment. ML/TF, operational, technology, custody, and jurisdictional risk identification with quantified residual-risk scoring. It must cover Bermuda-specific risks (correspondent banking concentration, US dollar clearing dependency, FATF reassessment exposure), digital-asset-specific risks (custody key management, smart contract vulnerabilities, oracle manipulation, chain reorganisation), and customer-base risks. The BMA expects quantified residual-risk scoring after controls.
- Risk Appetite Statement. Board-approved statement of risk tolerance across credit, market, operational, technology, and compliance risk dimensions. It must be specific enough that the BMA can test whether the operational model the applicant proposes is consistent with the stated risk tolerance. Vague statements (“low to moderate risk appetite”) trigger RFIs.
- Sanctions Screening Procedures. UN Security Council, UK HM Treasury OFSI, US OFAC, and EU lists with refresh frequency, screening hit-rate testing, and escalation matrix. Bermuda implements UK sanctions through Orders in Council under the International Sanctions Act 2003. The procedures must address extraterritorial OFAC compliance, the differences between US Specially Designated Nationals and EU Consolidated lists, and the screening protocol for both natural-person and wallet-address sanctions.
- Restricted Countries and Jurisdictions Matrix. Territory-by-territory eligibility classification with rationale. The BMA expects a documented rationale for every restricted territory, referenced to FATF status, EU AML list, OFAC sanctions, and specific national prohibitions. The matrix must be reviewed at least annually.
- Transaction Monitoring Framework. Typology library, threshold-and-pattern detection rules, alert handling procedure, and disposition workflow. The framework must include digital-asset-specific typologies: chain-hopping, peel-chain laundering, mixer ingress and egress, anonymous-enhanced coin patterns. The BMA expects evidence of typology back-testing against the applicant’s transaction sample where one exists.
- Travel Rule Implementation. Recommendation 16 compliance with originator and beneficiary information collection, transmission, and verification. The Bermuda Travel Rule threshold is USD/EUR 1,000 for full data collection. Implementation typically uses an IVMS101-based messaging standard via a third-party provider. The policy must address counterparty-VASP due diligence and the self-hosted-wallet protocol.
- Suspicious Activity Report (SAR) Procedures. Reporting to the Financial Intelligence Agency with tipping-off prohibitions and record-keeping. SARs must be filed with the FIA as soon as reasonably practicable. Tipping-off is criminalised under POCA. Record-keeping is five years from the end of the business relationship or transaction. The procedures must identify the MLRO as the sole authorised filer.
- KYC and Client Onboarding (including KYB). Natural-person and corporate-customer due diligence with risk-based EDD triggers. CDD is required at onboarding, on the establishment of a business relationship, on occasional transactions at or above EUR 15,000, on wire transfers at or above USD/EUR 1,000, and on suspicion of money laundering or terrorist financing. EDD applies to politically exposed persons, high-risk-country customers, and complex ownership structures. KYB for institutional customers must include UBO identification at 25% threshold.
- Compliance Monitoring Programme. Annual testing schedule covering AML controls, sanctions effectiveness, Travel Rule compliance, and Code of Practice adherence. The BMA expects the Compliance Officer to maintain an annual testing schedule and report to the board on findings. The programme must address every BMA Code of Practice expectation and the BMA’s Statement of Principles for Digital Asset Business.
- Data Protection Policies. PIPA 2016 compliance with data subject rights, retention schedules, and cross-border transfer protocols. Bermuda’s Personal Information Protection Act 2016 entered full force on . The policies must address data subject rights, lawful basis for processing, retention periods aligned with POCR record-keeping, and cross-border transfer mechanisms for non-Bermuda data processors.
Business Plan and Financial Projections
- Three-year financial projections (income statement, balance sheet, cash flow) with stress scenarios
- Product-specific risk assessment per BMA Product Due Diligence Guidance Note
- Revenue model with fee assumptions, volume projections, and customer cohort analysis
- Capital adequacy plan demonstrating that capital scales with operational complexity, leverage, and client-money exposure
Technology and Operational Documentation
- IT security policy mapped to the BMA Operational Cyber Risk Management Code of Practice
- Business continuity and disaster recovery plan
- Custody key management policy (where applicable): hot/warm/cold wallet split, multi-signature configuration, hardware security module specification, signing-ceremony procedures, key-rotation schedule
- Outsourcing register with vendor due diligence documentation
- Wind-down plan (mandatory for stablecoin issuers per the SCPS Guidance; recommended for all custodians)
Costs and Pricing
BMA fees for digital asset business are set by the BMA Annual Fee Schedule, last revised and effective from 1 January 2025.[21] Annual fees are calculated as the lower of USD 450,000 or 0.00075 multiplied by estimated client receipts, subject to activity-tiered minimums. Total Year 1 cost ranges from USD 100,000 for a minimum-scope Class T to USD 1,500,000 for a custody-heavy Class F operator.
Government / BMA Fees
| Fee | Class T | Class M | Class F |
|---|---|---|---|
| Application fee | USD 1,000 | USD 2,266 | USD 2,266 |
| Grant of licence fee | USD 1,000 | Lower of USD 450,000 or 0.00075 × estimated client receipts (subject to activity minimum) | Lower of USD 450,000 or 0.00075 × estimated client receipts (subject to activity minimum) |
| Annual fee (recurring) | USD 1,000 | Lower of USD 450,000 or 0.00075 × estimated client receipts (subject to activity minimum) | Lower of USD 450,000 or 0.00075 × estimated client receipts (subject to activity minimum) |
Activity minimums (Class M and Class F annual and grant of licence fee): USD 15,000 for standard activities (issuance and redemption, payment service, exchange, services vendor, market maker); USD 100,000 for digital asset lending or repurchase; USD 100,000 for non-custodial wallet services; USD 150,000 for custody of client private keys.[21] The USD 450,000 cap applies across all activities.
Total Cost Summary
| Cost component | Class T (Year 1) | Class M (Year 1) | Class F (Year 1) | Annual ongoing |
|---|---|---|---|---|
| BMA fees (application + grant + first annual) | USD 3,000 | USD 17,266 + activity | USD 17,266 + activity | USD 15,000–450,000 |
| Bermuda company formation and registered office | USD 5,000–8,000 | USD 5,000–8,000 | USD 5,000–8,000 | USD 3,000–6,000 |
| Legal advisory (Bermuda Bar firm, application drafting and BMA engagement) | USD 25,000–60,000 | USD 50,000–150,000 | USD 75,000–250,000 | USD 15,000–50,000 |
| Compliance documentation (AML manual, risk assessment, Travel Rule, sanctions framework, custody) | USD 30,000–60,000 | USD 50,000–100,000 | USD 75,000–150,000 | USD 25,000–60,000 |
| Bermuda head office, Senior Representative, and on-island team | Optional (Class T) | USD 100,000–250,000 | USD 150,000–400,000 | USD 150,000–400,000 |
| Audit setup (BMA-approved auditor) | USD 15,000–40,000 | USD 25,000–60,000 | USD 25,000–100,000 | USD 25,000–80,000 |
| Insurance (surety, PI, cyber, custody as applicable) | USD 10,000–50,000 | USD 20,000–100,000 | USD 30,000–250,000+ | USD 30,000–250,000+ |
| Total Year 1 cost | USD 100,000–250,000 | USD 300,000–700,000 | USD 600,000–1,500,000 | USD 250,000–1,200,000 |
Bermuda exempted companies pay a Government of Bermuda annual fee based on assessable capital, with a USD 2,095 minimum (assessable capital up to USD 12,000) and a higher cap for large entities. Companies on the register pay the annual fee by for the current calendar year. Payroll tax bands for the 2026–27 fiscal year (effective ) apply employer rates of approximately 9.75% to 10.25% for international business undertakings, with employee bands ranging from 0.25% (income up to BMD 48,000) to 12.5% (income BMD 500,000 to BMD 1,000,000).[22] Social Insurance is BMD 75.30 total per employee per week, split equally between employer and employee.
Timeline
Realistic Bermuda DABA timelines vary by licence class and depend heavily on application quality at first submission. The BMA’s published targets are conservative: acknowledgement within two business days, completeness check within three business days, Assessment and Licensing Committee consideration within 20 business days of the first Friday following a complete submission, ALC initial decision approximately four weeks after complete submission.[15] Experienced applicants complete pre-application engagement before formal submission, which compresses the RFI phase.
| Stage | Class T | Cum. T | Class M | Cum. M | Class F | Cum. F |
|---|---|---|---|---|---|---|
| Pre-application engagement | 4–8 weeks | 4–8 weeks | 4–10 weeks | 4–10 weeks | 4–12 weeks | 4–12 weeks |
| Document drafting (parallel) | 6–12 weeks | 8–12 weeks | 8–14 weeks | 12–16 weeks | 8–16 weeks | 12–18 weeks |
| Formal submission and completeness check | 1–2 weeks | 9–14 weeks | 1–2 weeks | 13–18 weeks | 1–2 weeks | 13–20 weeks |
| RFI rounds (typically 2–4) | 2–6 weeks | 11–20 weeks | 4–10 weeks | 17–28 weeks | 4–12 weeks | 17–32 weeks |
| ALC review and decision | 2–4 weeks | 13–24 weeks | 4–6 weeks | 21–34 weeks | 4–8 weeks | 21–40 weeks |
| Conditional approval to final authorisation | 1–4 weeks | 14–28 weeks | 4–8 weeks | 25–42 weeks | 4–12 weeks | 25–52 weeks |
| Total | 3–5 months | 4–7 months | 6–12 months |
Bermuda licensed 36 DABs as of , up 50% year-on-year from 24 at end-2023.[2] The real constraint is pre-application document quality, not BMA processing capacity: the BMA’s Fintech Department is well-resourced for the current cohort size.
Taxation
Bermuda is a tax-neutral jurisdiction for the vast majority of digital asset businesses: but operators within multinational enterprise groups at or above EUR 750 million in consolidated revenue are now subject to the Corporate Income Tax Act 2023 at a 15% rate. There is no VAT, no GST, no capital gains tax, and no withholding tax. Bermuda has not enacted Pillar Two Income Inclusion Rule or Undertaxed Profits Rule provisions; the Corporate Income Tax Act 2023 is structured exclusively as a Qualified Domestic Minimum Top-Up Tax.[5]
| Tax | Rate | Crypto application |
|---|---|---|
| Corporate income tax | 0% (sub-threshold) / 15% (in-scope MNE groups, effective ) | Applies to Bermuda Constituent Entities of MNE groups with consolidated revenue ≥ EUR 750m in two of four prior fiscal years |
| Capital gains tax | 0% | No capital gains tax in Bermuda |
| VAT / GST | 0% | No VAT in Bermuda |
| Withholding tax | 0% | No withholding tax on dividends, interest, or royalties |
| Payroll tax (employer) | ~9.75%–10.25% (international business) | Bands per 2026 Budget; reduced by 0.5–2% across bands |
| Stamp duty | Variable | Stamp Duties (International Business Relief) Act 1990 exempts many exempted-undertaking transactions |
Tax rates effective for the 2026–27 fiscal year unless otherwise stated.
Corporate Income Tax Act 2023 (Pillar Two QDMTT)
The Corporate Income Tax Act 2023 was assented to on and applies to fiscal years beginning on or after .[5] The scope is restricted to Bermuda Constituent Entities of multinational enterprise groups with consolidated revenue of at least EUR 750 million in two of the four prior fiscal years: sub-threshold entities continue to pay 0% corporate tax. The Corporate Income Tax Agency was established under the CIT Agency Act 2024 in . Final Administrative Regulations took effect on .
Tax Assurance Certificates under the Exempted Undertakings Tax Protection Act 1966 protect against future Bermuda taxes on profits, income, capital gains, or appreciation until : overridden only for in-scope Bermuda Constituent Entities by the Corporate Income Tax Act 2023.
CARF and CRS Reporting
Bermuda is in the 52-jurisdiction first-exchanges-by-2027 cohort committed to implementing the OECD Crypto-Asset Reporting Framework (CARF) per the joint statement.[23] Domestic legislation will be in effect from , with first information collection in 2026 and first exchanges of information in 2027. Common Reporting Standard (CRS) reporting has been in force in Bermuda since 2017. Bermuda has a Model 2 FATCA Intergovernmental Agreement with the United States in force since 2014.
Bermuda’s Position on Pillar Two
The QDMTT is Bermuda’s only component of the OECD Global Minimum Tax (GloBE) framework. By enacting it while leaving the Income Inclusion Rule and the Undertaxed Profits Rule unimplemented, Bermuda ensures that in-scope multinational groups pay the Pillar Two minimum in Bermuda rather than in another jurisdiction’s IIR or UTPR.
Ongoing Compliance & Post-Registration
A Bermuda DABA licence creates a permanent compliance infrastructure obligation. The licence carries no statutory term for Class F, but BMA conditions, annual reporting, fee payment, fit-and-proper monitoring, change-of-control approvals, and annual external audit are continuous obligations. Material breaches can trigger civil penalties of up to USD 10 million under DABA, and operating without a DABA licence carries fines up to USD 250,000 and imprisonment up to five years.[2]
Annual Reporting Obligations
- Annual Prudential Return under the DAB (Prudential Standards)(Annual Return) Rules 2018, due within four months of the licensee’s fiscal year-end for Class F. The return is accompanied by audited financial statements, next-year business plan, products and services offered, customer-geography breakdown, AML and AT-PF controls effectiveness review, governance arrangements, and outsourcing register.
- Cyber Risk Annual Return under the DAB (Cyber Risk) Rules 2023, due within four months of fiscal year-end for Class F; submission frequency for Class M and Class T is directed by the BMA.[16]
- Annual audit by a BMA-approved auditor, mandatory; audit waiver is not available for BMA-licensed entities.
- AML/ATF statistical returns as required by the BMA.
- Annual fee payable by for the current calendar year (Class M and Class F: scaled per activity; Class T: USD 1,000 flat).
Regulatory Inspections
The BMA conducts at least one Class F on-site supervisory examination per cycle, per the BMA Annual Report 2023.[24] Off-site supervision is continuous, with monthly or quarterly review touchpoints for Class M and Class T. Thematic reviews, most recently the DAB Thematic Review on vertical integration, governance, outsourcing, and head-office substance, apply across the licensee population and may trigger entity-specific follow-up requests.[8]
Change of Control
DABA Part 4 sets controller thresholds at 10%, 20%, 33%, and 50%. Each requires prior notice to the BMA and BMA approval; the BMA can serve a notice of objection within 30 days of receipt under DABA sections 36 and 37.[2] Failure to notify or to obtain approval is a criminal offence.
Enforcement
- Operating without DABA authorisation: fine up to USD 250,000 and/or imprisonment up to five years.
- Civil penalty for licensee breaches: up to USD 10 million under DABA.
- Code of Practice and Statement of Principles breaches: BMA may issue formal directions, impose additional conditions, or initiate licence variation or cancellation proceedings.
- DABA Tribunal: licensees may appeal BMA decisions to the DABA Tribunal under DABA Part 6, confirmed as the constitutionally correct adjudicating authority in Lai v BMA.[18]
Advertising and Promotion Rules
DAB Code of Practice Section IX governs advertising, promotions, sales practices, communications, disclosure, suitability, internet business, and complaints. All marketing must be fair, clear, and not misleading. The Client Disclosure Rules 2018 require pre-transaction disclosures covering material risks, licence class, fee schedules, insurance coverage, transfer irrevocability, governance and voting rights over custodied assets, and liability and redress mechanisms.[25] Mandatory disclosures include licence class and risk warnings; stablecoin issuers must additionally publish attestation and reserve composition.
ICT Risk Management & Operational Resilience
The DAB (Cyber Risk) Rules 2023 replaced the 2018 Cybersecurity Rules and entered force on .[16] The DAB Operational Cyber Risk Management Code of Practice was last updated . The framework requires:
- Three Lines of Defence model: operational management (1st line), risk management and compliance (2nd line), internal audit (3rd line).
- Board-level CISO mandate with direct reporting to the board on cyber risk metrics.
- Annual Cyber Risk Return for Class F licensees, due within four months of fiscal year-end.
- Incident reporting to the BMA as soon as reasonably practicable for material cyber events.
- External vulnerability scanning annually as baseline; penetration testing recommended annually or after material changes.
- Documented business continuity and disaster recovery plan with annual testing.
- Custody and wallet management: hot/warm/cold wallet split per risk-based approach; multi-signature where appropriate; hardware security module specification; key-rotation schedule.
- Third-party ICT risk management: material outsourcings notifiable to the BMA; the Operational Resilience and Outsourcing Code (final version September 2025) has a DAB compliance deadline of .
What Bermuda’s regime does not cover is mandatory threat-led penetration testing on the DORA model; the Code is risk-based, not prescriptive on testing frequency. Operators with EU exposure should still align with DORA Article 26 expectations where they intend to serve EU clients through a separate CASP authorisation.
Banking
Banking is the hard part. Bermuda’s four domestic banks are scheme members of the Bermuda Deposit Insurance Corporation, and onboarding digital asset businesses is selective. In practice, a Class F licensee with audited financials, institutional-scale operations, and a substantive Bermuda team can secure domestic banking; early-stage Class T or Class M operators routinely cannot. The licensed digital asset stack typically combines US correspondent banking, European Electronic Money Institutions, fintech-bank hybrids, and stablecoin settlement.[26]
Bermuda’s restricted bank licence regime was introduced by the Banks and Deposit Companies Amendment Act 2018. Jewel Bank, a Bermuda-incorporated restricted bank and DABA Class F licensee, received its combined authorisation in , in what Premier David Burt described in an official Government of Bermuda statement as Bermuda’s first new bank in 21 years.[11] The Bermuda Deposit Insurance Corporation provides scheme coverage up to BMD 25,000 per eligible depositor per scheme member.[27] The real constraint for digital asset operators is that BDIC coverage applies to Bermuda Dollar deposits only: USD and other foreign currency balances are not covered, and digital asset business working capital is overwhelmingly USD.
The practical multi-rail stack for Bermuda DABA licensees:
- US correspondent banking for USD clearing: direct relationships post the March 2023 collapse of two major crypto-friendly US banks, or indirect through Bermuda domestic banks with US correspondent arrangements.
- European Electronic Money Institutions licensed in jurisdictions such as Lithuania, Cyprus, or Spain: for EUR ramps and SEPA access. Multi-jurisdictional EMI licensing distributes counterparty risk.
- Fintech-bank hybrids: institutions licensed in Switzerland, Liechtenstein, Gibraltar, or Bermuda itself (restricted bank licences), offering combined fiat and digital asset rails.
- Stablecoin settlement for inter-institutional settlement and treasury management, including BMA-licensed single-currency-pegged stablecoin issuers under the November 2024 SCPS Guidance.[7]
Jagelski & Partners’ banking partner network includes 90+ institutions across US correspondent banking, European EMIs, fintech-bank hybrids, and stablecoin settlement providers: pre-qualified for Bermuda DABA-licensed operators. A licence without banking access is a certificate on the wall: learn about our Banking service →
Bermuda’s multi-rail reality makes pre-qualification worth more than in single-bank jurisdictions: each layer of the stack is a separate onboarding exercise with its own thresholds. The partner network maintains live account-opening routes in every jurisdiction Jagelski & Partners services, and banking feasibility is confirmed at the scoping stage, before any licence application is filed.
US correspondent rails for USD clearing, European EMIs for EUR and SEPA access, fintech-bank hybrids for combined fiat and digital asset rails, and stablecoin settlement providers, configured as one stack rather than negotiated institution by institution.
Explore Banking SolutionsFATF Status & International Standing
Bermuda is not on the FATF Grey List, not on the EU Anti-Money Laundering high-risk third-country list, and not on the UK anti-money laundering high-risk list. The CFATF Mutual Evaluation Report of Bermuda was published on following an on-site visit from 24 September to 5 October 2018 and adoption at the CFATF Plenary in Antigua and Barbuda in November 2019.[1] Bermuda was rated compliant or largely compliant on 39 of the 40 FATF Recommendations (the highest technical compliance ranking globally at publication) and rated among the top six globally on effectiveness, with high effectiveness on risk assessment.
The CFATF MER ratings cover compliance with FATF Recommendations including: R.1 (assessing risks and applying a risk-based approach): Compliant; R.3 (money laundering offence): Compliant; R.5 (terrorist financing offence): Compliant; R.10 (customer due diligence): Compliant; R.11 (record-keeping): Compliant; R.4 (confiscation and provisional measures): Largely Compliant; R.6 (targeted financial sanctions related to terrorism): Largely Compliant; R.12 (politically exposed persons): Largely Compliant; R.13 (correspondent banking): Largely Compliant.[1] Bermuda remains in regular CFATF follow-up.
EU Market Access
A Bermuda licence does not confer EU passporting rights. MiCA contains no third-country equivalence regime, there is no mechanism for the European Commission to recognise a non-EU licence as equivalent. MiCA Article 61 permits third-country firms to serve EU clients only when the client initiates contact entirely on their own initiative. ESMA’s guidelines (published , applicable from ) interpret this restrictively: any form of EU-targeted marketing, EU-language website content, geo-targeted advertising, app store availability, or use of EU-based influencers constitutes solicitation that voids the exemption. The exemption is designed for isolated contacts, not systematic EU market access. For a detailed analysis of what constitutes solicitation and the documentation requirements, see Reverse Solicitation Under MiCA →.
Advantages and Limitations
Bermuda is the strongest premium-offshore option for institutional-grade digital asset businesses prioritising credibility, regulatory maturity, and tax neutrality. The trade-offs are cost, timeline, and the absence of EU market access: operators who need a fast, low-cost authorisation or systematic EU passporting will choose other jurisdictions.
The 0% corporate tax headline is accurate but incomplete: in-scope MNE groups now pay 15% under the Corporate Income Tax Act 2023, and the payroll tax on Bermuda-based personnel is the operational tax most digital asset businesses actually feel. Operators planning the Bermuda head-office substance carefully will find that the effective tax position remains highly competitive: but the analysis cannot stop at the corporate-tax rate alone.
- World’s first prudential DAB framework. The Digital Asset Business Act 2018 has nearly 8 years of supervisory practice across Class T, M, and F. No newer offshore VASP regime can match the BMA’s track record.
- CFATF #1 on technical compliance. Bermuda was rated compliant or largely compliant on 39 of 40 FATF Recommendations in the 2020 mutual evaluation, first globally at publication. Counterparty due diligence friction is materially lower than for grey-listed peers.
- Tax-neutral for sub-threshold operators. 0% corporate tax, no capital gains tax, no VAT, no withholding tax, with Tax Assurance Certificate protection until 2035.
- Three-class licensing scales with business model maturity. Class T sandbox, Class M conditional, Class F full: single Act, single regulator, predictable graduation path.
- Reinsurance market crossover. Custody insurance, parametric crypto cover, and digital asset cyber insurance written from Bermuda are credible institutional offerings; SAC and ISAC structures support stablecoin reserves.
- Mature judicial framework for crypto disputes. Re BlockFi International (2023) and the Re Bittrex Global sequence (2025) establish Bermuda Supreme Court oversight of crypto wind-downs; a positive signal for institutional counterparties.
- High total Year 1 cost. Class F operators face USD 600,000 to USD 1,500,000 in first-year costs. Mitigation: Start with a Class M or Class T licence to validate the business model at lower cost, then graduate to Class F. The BMA’s three-class structure exists for exactly this purpose.
- 6 to 12 month Class F timeline. Authorisation is materially slower than registration-based offshore regimes. Mitigation: Begin pre-application engagement with the BMA early; run document drafting in parallel with entity formation; use Class T or Class M as a faster entry path if business-model maturity permits.
- Genuine Bermuda head-office substance required. Class M and Class F licensees must operate strategic functions on-island, with material ongoing payroll and office costs. Mitigation: Plan Bermuda team build-out alongside the application; use the Bermuda Government Fintech Business Permit Policy for up to five fintech work permits to ease the immigration burden.
- No EU passporting. A Bermuda licence does not grant access to the EU market. Mitigation: Operators targeting EU clients can obtain a separate CASP authorisation in an EU member state (full market access via passporting) or, for isolated genuinely unsolicited contacts only, may fall within the narrow reverse solicitation exemption under MiCA Article 61.
- Selective domestic banking access. Bermuda domestic banks selectively onboard DAB licensees; early-stage operators rely on multi-provider, multi-jurisdiction stacks. Mitigation: Plan banking arrangements before the BMA application is filed; combine US correspondent banking, European EMIs, fintech-bank hybrids, and stablecoin settlement; engage a banking partner network with pre-qualified Bermuda DABA experience.
How Bermuda Compares
Bermuda sits in the premium offshore tier alongside the Cayman Islands and the British Virgin Islands, with Gibraltar as the regulated-upgrade reference outside the MiCA perimeter. Cayman and the BVI beat Bermuda on cost and timeline; the comparison Bermuda wins is institutional: supervision model, counterparty credibility, and regime depth. The BVI’s June 2025 FATF grey-listing has reshaped its banking position, and Gibraltar trades higher cost for UK-adjacent regulatory pedigree without a MiCA CASP licence.
| Factor | Bermuda | Cayman Islands | British Virgin Islands | Gibraltar |
|---|---|---|---|---|
| Licence Type | DABA Class T / M / F | VASP Registration (CIMA) | VASP Registration (FSC) | DLT Provider Licence (GFSC) |
| Regulator | Bermuda Monetary Authority (BMA) | Cayman Islands Monetary Authority (CIMA) | BVI Financial Services Commission (FSC) | Gibraltar Financial Services Commission (GFSC) |
| Supervision Model | Full prudential licensing; three classes scale with business-model maturity | Dual-track VASP registration plus licence | Registration regime (VASP Act 2022) | Full licensing (DLT Provider / VAAP) |
| Timeline | 6–12 months (Class F) | 3–12 months | 4–6 months | 6–9 months from complete Stage 1 |
| Min. Capital | USD 100,000 baseline net assets | No fixed statutory minimum | No fixed statutory minimum | Risk-based |
| Total Year 1 Cost | USD 600,000–1,500,000 (Class F) | USD 150,000–1,500,000+ | USD 40,000–156,000 | USD 400,000–900,000 |
| Corporate Tax | 0% (sub-threshold) / 15% (in-scope MNE) | 0% | 0% | 15% (Gibraltar-source profits) |
| Local Presence | Bermuda head office + Senior Representative | Cayman office + auditor | Registered agent + AML officer | Gibraltar office + management presence |
| EU Passporting | No | No | No | No (Gibraltar exited EU post-Brexit) |
| FATF Status | Clear (CFATF #1 technical compliance) | Clear (delisted ) | Grey-listed (June 2025) | Clear (delisted ) |
| Institutional Credibility | High; world’s first prudential DAB framework, CFATF #1 technical compliance | High; CIMA institutional-grade, deepest hedge-fund domicile | Low; grey-listing drives enhanced counterparty due diligence | High; first bespoke DLT regime, MONEYVAL top-tier |
| Banking Access | Selective; domestic banks onboard institutional Class F; multi-rail stacks standard | Moderate; improved post-delisting but selective | Difficult; local banks decline crypto; EU EMI routes standard | Workable but demanding; local account plus EU EMI architecture |
| Best For | Premium institutional operators buying regulatory weight, supervisory maturity, and tax neutrality | Funds-adjacent crypto; large-scale exchanges with audit credibility | Speed and cost (pre-grey-listing); lighter VASP registration | UK-adjacent regulated environment without MiCA CASP |
Compare every crypto jurisdiction side by side →
Bermuda’s competitive position is regulatory weight, not speed or cost. Cayman registration is faster (3–6 months, against 6–12 for a Phase 2 licence) and entry costs start lower (from USD 150,000), but Cayman’s regulation runs through the Virtual Asset (Service Providers) Act as a dual-track registration-plus-licence regime rather than Bermuda’s full prudential licensing model. The common mistake is treating the four jurisdictions as a single offshore basket: Bermuda Class F and Cayman VASP are fundamentally different products with different counterparty acceptance profiles.
The BVI’s June 2025 FATF grey-listing has materially changed the picture: enhanced due diligence at major correspondent banks now applies to BVI VASPs irrespective of the entity’s own compliance quality. Bermuda’s clear status and CFATF #1 ranking now widens the gap to BVI in banking conversations. Gibraltar remains the regulated-upgrade reference for operators who want UK-adjacent positioning without taking a MiCA CASP licence: the GFSC DLT Provider Licence carries strong recognition with UK and EU counterparties even without passporting rights.
When Bermuda Is the Right Choice
Choose Bermuda if you need (1) institutional credibility for US, UK, and EU counterparty acceptance; (2) tax-neutral structuring for sub-threshold operations; (3) a mature judicial framework for digital asset disputes; or (4) reinsurance-market crossover for custody insurance, parametric cover, or stablecoin reserves.
Consider alternatives if you (1) need to launch in 3 to 4 months, Cayman Islands VASP Registration is faster; (2) cannot fund USD 600,000+ Year 1, Cayman Islands VASP Registration is the lower-cost premium offshore alternative; (3) need systematic EU market access: choose an EU member state with a MiCA CASP licence (Estonia, Cyprus, Malta, or Lithuania); or (4) want a UK-adjacent regulated environment: Gibraltar DLT Provider Licence is the GFSC alternative.
Not sure which column is you? Ask Emma. She compares these jurisdictions in seconds, in your language.
Common Mistakes in Bermuda Applications
Bermuda Monetary Authority application timelines slip primarily on document quality, not on processing capacity. What the BMA’s guidance does not cover is how to demonstrate Bermuda head-office substance to the ALC’s satisfaction: operators reading only the published Code of Practice and Statement of Principles routinely underprovision both the on-island team and the AML and cybersecurity documentation, then face two to four RFI rounds that add 8 to 16 weeks to the timeline.
- Boilerplate AML and CFT policies adapted from other jurisdictions. The single most common cause of timeline slippage: generic AML manuals lacking the Bermuda-specific references (see Required Documents above) are returned with extensive RFIs.
- Thin Bermuda head-office substance. Renting a serviced office and naming a Senior Representative without genuine on-island operational presence (see Local Presence above) will not satisfy the ALC.
- Insufficient cybersecurity documentation. Applicants who submit a generic IT security policy without mapping each control to the DAB Operational Cyber Risk Management Code of Practice (see ICT Risk Management above) receive systematic RFIs covering every Code section.
- Skipping pre-application engagement. Operators who submit cold, without prior BMA Fintech Department meetings, routinely find their licence-class selection misaligned with their business model, triggering either a class change mid-application or a structural redesign.
- Undercapitalisation against the activity scope. The USD 100,000 figure is a baseline, not a target: capital plans that scale only to it, without addressing operational complexity, leverage, and client-money exposure, invite RFIs and conditional approval delays.
- Missing or weak wind-down plan. The November 2024 SCPS Guidance made wind-down plans mandatory for stablecoin issuers, and the proposed DABA amendments would extend the mandatory requirement to all licensees. Applicants whose business model involves custody of client assets or stablecoin issuance need a wind-down plan that addresses customer-asset return, recovery and resolution scenarios, and operational continuity through wind-down: even where the requirement is not yet statutorily binding.
Frequently Asked Questions
A Bermuda DABA licence is an authorisation issued by the Bermuda Monetary Authority under the Digital Asset Business Act 2018 (2018:28) to carry on one or more defined digital asset business activities: issuing or redeeming digital assets, operating a digital asset payment service, operating a centralised or decentralised digital asset exchange, providing custodial or non-custodial wallet services, operating a digital asset derivative exchange, acting as a digital asset services vendor or market-maker, or providing digital asset lending or repurchase services. Any person carrying on these activities in or from Bermuda needs a DABA licence. Mining is not a digital asset business activity under DABA.
Class T (test) is for pilot, beta, and proof-of-concept operators with bounded scope, lower capital, and a 12-month time horizon. Class M (modified) is for operators with a clear product but BMA-imposed conditions: geographic, customer-type, or volume-based. Class F (full) is for institutional-scale operators with broad activity scope, no specified term, and the highest credibility. Total Year 1 cost ranges from USD 100,000 to USD 1,500,000 depending on class. Most early-stage operators start with Class T or Class M and graduate to Class F as the business matures.
Class T runs 3 to 5 months end-to-end. Class M runs 4 to 7 months. Class F runs 6 to 12 months with a median of 6 to 9 months for well-prepared applications. The BMA acknowledges receipt within two business days, completes a formal completeness check within three business days, and the Assessment and Licensing Committee considers complete files within 20 business days of the first Friday following completeness: with an initial decision approximately four weeks after complete submission. Pre-application engagement of 4 to 12 weeks runs in parallel with document drafting and is effectively mandatory.
The BMA’s Guidance Note for Prospective Applicants for Licensing of 8 September 2025 does not formally mandate pre-application engagement, but the practitioner reality is that every successful application includes it. Pre-application meetings allow the BMA Fintech Department to confirm the appropriate licence class, identify structural issues before formal documents are drafted, and align the applicant’s business model with the supervisor’s expectations. Cold submissions without prior BMA engagement routinely face misaligned licence class assignments and structural RFIs that add 8 to 16 weeks to the timeline.
BMA application fees are USD 1,000 for Class T and USD 2,266 for Class M and Class F. Annual fees are calculated as the lower of USD 450,000 or 0.00075 multiplied by estimated client receipts, subject to activity minimums: USD 15,000 for standard activities, USD 100,000 for digital asset lending or non-custodial wallet, USD 150,000 for custody of client private keys. Total Year 1 cost, including BMA fees, Bermuda formation, legal and compliance advisory, on-island team, audit setup, and insurance, ranges from USD 100,000 to USD 250,000 for Class T, USD 300,000 to USD 700,000 for Class M, and USD 600,000 to USD 1,500,000 for Class F.
The DABA baseline minimum net assets is USD 100,000 for Class M and Class F, and USD 10,000 for Class T. This is a baseline: the BMA exercises discretion under DABA Schedule 1 to direct higher amounts based on the nature, scale, complexity, and risk of the proposed activity. Custodians of client private keys, digital asset exchanges, and single-currency-pegged stablecoin issuers routinely hold multiples of the baseline. The capital adequacy framework is principles-based: the regime asks whether the business is conducted in a prudent manner, not whether a fixed paid-up share capital threshold has been met.
No. Bermuda is not on the FATF Grey List, not on the EU Anti-Money Laundering high-risk third-country list, and not on the UK anti-money laundering high-risk list. The CFATF Mutual Evaluation Report of Bermuda, published , rated Bermuda compliant or largely compliant on 39 of 40 FATF Recommendations (first globally on technical compliance at publication) and among the top six on effectiveness. Bermuda is in regular CFATF follow-up. A subsequent CFATF assessment cycle is underway following the November 2025 Travel Rule reforms.
Sometimes. Bermuda’s four domestic banks are selective in onboarding DAB licensees. Class F operators with audited financials, institutional-scale operations, and a substantive Bermuda team can secure domestic banking; early-stage Class T or Class M operators routinely cannot. Most DAB licensees combine US correspondent banking, European Electronic Money Institutions, fintech-bank hybrids, and stablecoin settlement in a multi-provider stack. The restricted bank licence regime introduced in 2018 (under which Jewel Bank received its combined restricted bank and DABA Class F licence in ) is expanding the on-island banking options over time.
Only if your business is a Bermuda Constituent Entity of a multinational enterprise group with consolidated revenue of at least EUR 750 million in two of the four prior fiscal years. The Corporate Income Tax Act 2023 applies a 15% rate for fiscal years beginning on or after , structured as a Qualified Domestic Minimum Top-Up Tax under OECD Pillar Two. Sub-threshold entities continue to pay 0% corporate tax on profits, capital gains, dividends, and withholdings. Tax Assurance Certificates protect sub-threshold operators against future Bermuda taxes until .
Not on its own. A tokenised security or real-world asset is a “digital asset” under DABA, so exchange and custody activity runs through a DABA licence; but where the token also qualifies as an “investment” it can fall under the Investment Business Act 2003, and public issuance engages the Digital Asset Issuance Act 2020, so a single instrument may need two or three authorisations at once. The BMA is clarifying this overlap: it published a Discussion Paper on Asset Tokenisation on 5 November 2025 and a Consultation Paper on 9 April 2026 proposing to remove the dual-licensing friction, for example by exempting tokenised fund units from the Digital Asset Issuance Act 2020. These proposals are at consultation stage, not settled law, so we scope each structure against the live consultation and pair it with fund licensing where the underlying is a fund vehicle.
A Bermuda licence does not grant EU market access or passporting rights. MiCA Article 61 permits third-country firms to serve EU clients only when the client initiates contact entirely on their own initiative; but ESMA’s guidelines (published , applicable from ) interpret this exemption very narrowly, and any form of EU-targeted marketing, EU-language website content, geo-targeted advertising, app store availability, or use of EU-based influencers voids it. Operators seeking systematic EU market access should obtain a separate CASP authorisation in an EU member state. For full detail see the Reverse Solicitation Under MiCA guide.
Start Your Bermuda DABA Application
Jagelski & Partners coordinates Bermuda exempted-company formation, BMA Class T, M, or F authorisation, banking, and ongoing compliance in a single engagement. One point of contact, end-to-end.
Not ready to book? Ask Emma first. She answers now, and if it needs a human she takes your details so the consultation starts ahead.
References
Show all references
- CFATF, Mutual Evaluation Report of Bermuda, fatf-gafi.org, accessed .
- Bermuda Monetary Authority, Digital Asset Business Act 2018 (consolidated), bma.bm, accessed .
- Bermuda Monetary Authority, About the BMA, bma.bm, accessed .
- Bermuda Monetary Authority, Digital Asset Business Code of Practice, bma.bm, accessed .
- Government of Bermuda, Corporate Income Tax Act 2023, gov.bm, accessed .
- FATF, Jurisdictions under Increased Monitoring: June 2025, fatf-gafi.org, accessed .
- Bermuda Monetary Authority, Digital Asset Business, Single Currency Pegged Stablecoins (SCPS) Guidance, bma.bm, accessed .
- Bermuda Monetary Authority, Q4 2025 Regulatory Update, bma.bm, accessed .
- CommonLII, Digital Asset Business Amendment Act 2023, commonlii.org, accessed .
- Government of Bermuda, Bermuda Fintech Strategy, bermudafintech.com, accessed .
- Government of Bermuda, Premier and Minister of Finance Congratulates Jewel Bank, gov.bm, accessed .
- The Royal Gazette, Court issues winding-up order for BlockFi International, royalgazette.com, accessed .
- PwC Bahamas, FTX Digital Markets Ltd. (In Official Liquidation), pwc.com, accessed .
- The Royal Gazette, Bermuda Monetary Authority announces sweeping Travel Rule reforms, royalgazette.com, accessed .
- Bermuda Monetary Authority, Guidance Note: Digital Asset Business: Guidance for prospective applicants for licensing, bma.bm, accessed .
- Bermuda Monetary Authority, Digital Asset Business Operational Cyber Risk Management Code of Practice, bma.bm, accessed .
- Carey Olsen, Bermuda digital assets: December 2025 update, careyolsen.com, accessed .
- Government of Bermuda, Lai and Others v Bermuda Monetary Authority and Minister of Finance: Final Judgment, gov.bm, accessed .
- Government of Bermuda, Re Bittrex Global (Bermuda) Ltd [2025] SC (Bda) 78 civ, gov.bm, accessed .
- Government of Bermuda, Re Bittrex Global (Bermuda) Ltd [2025] SC (Bda) 113 Civ, gov.bm, accessed .
- Bermuda Monetary Authority, 2025 Bermuda Monetary Authority Fees, bma.bm, accessed .
- Government of Bermuda, Calculating Payroll Tax 2026, gov.bm, accessed .
- OECD Global Forum, Jurisdictions Committed to Implement CARF, First Exchanges by 2027, oecd.org, accessed .
- Parliament of Bermuda, Bermuda Monetary Authority Annual Report 2023, parliament.bm, accessed .
- Bermuda Monetary Authority, Digital Asset Business (Client Disclosure) Rules 2018, bma.bm, accessed .
- Walkers, Global Legal Insights FinTech 2024: Bermuda chapter, walkersglobal.com, accessed .
- Bermuda Deposit Insurance Corporation, Front Page, bdic.bm, accessed .