Introduction
Scope
Licensing requirements
Criteria for licensees
BMA's supervision and enforcement powers

Introduction

The current Bermuda government was elected in 2017 to:

• create new economic pillars in Bermuda;
• identify new opportunities for economic diversification; and
• seek local and overseas investment to develop new local industry and thereby create jobs in Bermuda.

Since its election, it has enthusiastically embraced the fintech sector and the potential that it offers and has repeatedly expressed its intention for Bermuda to be a significant centre for this industry.

In furtherance of this goal, a significant part of the government's legislative programme for 2018 has been the implementation of a comprehensive regulatory regime aimed at providing legal certainty to industry participants and ensuring that business in the sector conducted in or from Bermuda is done in a properly regulated matter, in accordance with the highest international standards.

The central pillar of this regime is the Digital Asset Business Act, which came into force on 10 September 2018. The act comprises a regulatory regime for fintech businesses. This article explores the act and how Bermuda is leading the way in imposing internationally recognised regulatory standards in this rapidly evolving sector.

Scope

The act applies to:

• any entity incorporated or formed in Bermuda that carries on digital asset business (irrespective of the location from which the activity is carried out); and
• any entity incorporated or formed outside Bermuda that carries on digital asset business in or from Bermuda.

The term 'digital asset' in the legislation is defined widely enough to capture cryptocurrencies and other coins and tokens, but specifically excludes rewards points of the kind used by airlines and hotels, as well as in-game currencies.

For the purposes of the act, 'digital asset business' is defined as the provision of the following activities to the general public as a business.

Issuing, selling or redeeming virtual coins, tokens or any other form of digital asset
This is intended to regulate any business providing these services to other businesses or to individuals. It will not include initial coin offerings (ICOs) to fund the issuer's or promoter's own business or project. Instead, ICOs are regulated in Bermuda under a separate regime which is beyond the scope of this article.

Operating as a payment service provider business utilising digital assets, which includes the provision of services for the transfer of funds
The term 'payment service provider' is used globally in anti-money laundering and anti-terrorist financing laws, regulations and guidance, and is defined in Bermuda's Proceeds of Crime (Anti-money Laundering and Anti-terrorist Financing) Regulations 2008 (as amended) as "a person whose business includes the provision of services for the transfer of funds". The aim here is to ensure that businesses involved in the transfer of digital assets fall within the act's ambit.

Operating as an electronic exchange
This category captures online exchanges allowing customers to buy and sell digital assets, whether payments are made in fiat currency, bank credit or in another form of digital asset, and exchanges facilitating the offer of new coins or tokens through ICOs.

Providing custodial wallet services
This covers any business whose services include storing or maintaining digital assets or a virtual wallet on behalf of a client.

Operating as a digital asset services vendor
A 'digital asset services vendor' is a person that, under an agreement as part of its business, can undertake a digital asset transaction on behalf of another person or has power of attorney over another person's digital asset, or a person who operates as a market maker for digital assets. It is intended to capture any other business providing specific digital asset-related services to the public, such as operating as a custodian of digital assets.

In addition to the above categories, the act includes an option for the minister of finance, after consultation with the Bermuda Monetary Authority (the BMA), the territory's financial regulator, to be able to add new categories or to amend, suspend or delete any of the categories listed above by order.

The act specifically provides that certain activities (including, notably, mining) do not constitute digital asset business.

Licensing requirements

Generally, the act requires persons carrying out digital asset business to obtain a licence before doing so. Two classes of licence are available for applicants:

• The class M licence is a form of 'sandbox' licence, with modified requirements and certain restrictions. Class M licences will be valid for a specified period, the duration of which will be determined by the BMA on a case-by-case basis. Following the expiry of this specified period, it is generally expected that the licensee will either have to apply for a class F licence (as described in further detail below) or cease carrying on business, although the BMA will have discretion to extend the specified period.
• The class F licence is a full licence not subject to any specified period, although it may still be subject to restrictions that the BMA deems appropriate.

A prospective licensee may not necessarily receive the licence for which it applies: an applicant for a Class F licence may receive a Class M licence if the BMA decides that a Class M licence would be more appropriate in the circumstances. The licence will specify the category (or categories) of digital asset business in which the licensee is permitted to engage.

Carrying on digital asset business without a licence is a criminal offence punishable by a fine of up to US$250,000, imprisonment for up to five years or both.

Criteria for licensees

The act provides that the BMA may not issue a licence unless it is satisfied that the applicant fulfils certain minimum criteria regarding:

• the fitness and propriety of directors and officers;
• whether the business is conducted in a prudent manner;
• the integrity and skill of the business's management; and
• standards of corporate governance observed by the (prospective) licensee.

This is consistent with the position under other regulatory laws applicable to other sectors and is intended to ensure that the BMA maintains high standards for the conduct of regulated business. The BMA has also recently published a code of practice for digital asset businesses detailing requirements as to governance and risk management in a manner which is proportionate to the size, complexity and risk profile of a licensee.

The act requires licensees to notify the BMA upon changes in directors or officers, and the BMA has powers to, among other things, object to and prevent new or increased ownership of shareholder controllers and the power to remove controllers, directors and officers who are no longer fit and proper to carry on their role.

Licence holders are further subject to several ongoing obligations concerning:

• the dissemination of key information to customers;
• the implementation and maintenance of a crisis management programme;
• the custody and protection of any customer assets held by licensees;
• a requirement to appoint a senior representative, to be approved by the BMA, who must be:
  • resident in Bermuda; and
  • sufficiently knowledgeable about both the licensee itself and the industry in general;
• the maintenance of the licensee's head office in Bermuda; and
• the filing of an annual prudential return with the BMA.

BMA's supervision and enforcement powers

The act grants the BMA wide-ranging powers of supervision and enforcement. The regulator will have the power to:

• compel production of information and documents (with criminal penalties for making false or misleading statements);
• issue directions for the purpose of safeguarding the interests of a business's customers or potential customers; and
• impose conditions and restrictions on licences.

For example, the BMA may:

• require a person or entity to take certain steps or refrain from adopting or pursuing a particular course of action, or restrict the scope of its business activities in a particular way;
• impose limitations on the acceptance of business;
• prohibit a person or entity from soliciting business, either generally or from prospective customers;
• prohibit a person or entity from entering into any other transactions or class of transactions; and
• require the removal of any officer or controller.

In more extreme cases, the BMA may revoke a licence altogether and, if it so elects, subsequently petition the court for the entity whose licence it has revoked to be wound up.

If a licensee fails to comply with a condition, restriction or direction imposed by the BMA or with certain requirements of the act, the BMA can impose fines of up to US$10 million. Alternatively, it may issue a public censure (ie, naming and shaming), issue a prohibition order banning a person from performing certain functions for a Bermuda regulated entity or obtain a court injunction.

For further information on this topic please contact Adam Bathgate at Carey Olsen Bermuda by telephone (+1 441 542 4500) or email (adam.bathgate@careyolsen.com). The Carey Olsen Bermuda website can be accessed at www.careyolsen.com.