Crypto License in Bermuda 2026

You must first determine whether you are carrying on digital asset business in or from within Bermuda under DABA, or whether your model is instead an issuance to the public under DAIA. Activities commonly requiring a DABA licence include:

• operating a digital asset exchange;
• providing custodial wallet services or custody of client assets;
• issuing, selling or redeeming digital assets to the public as a business;
• operating as a digital asset trust services provider;
• providing vendor or payment-related services using digital assets;
• digital asset derivatives activities;
• digital asset lending, repurchase or similar financing structures.

Carrying on licensable activity without a licence is a criminal offence punishable by a fine of up to US$250,000 and/or up to 5 years imprisonment. This is why scoping is the first legal task, not a later paperwork step.

You typically need a Bermuda vehicle and a governance structure that supports the head office requirement. For most non-Class T licensees, the BMA expects the head office of the licensed undertaking to be in Bermuda, taking into account where strategic decision-making occurs, where senior executives are based, where books and records are available, and where core risk and compliance oversight is directed.

This is more than renting an address. In practice, the BMA looks at:

• where the board and senior management actually direct the business;
• whether Bermuda-based functions are meaningful rather than nominal;
• whether outsourcing is controlled and documented;
• whether local service providers can evidence real oversight;
• whether the business can be supervised effectively from Bermuda.

Many applicants also need a senior representative in Bermuda. Founders who try to run the entire operation remotely with a letterbox structure usually create avoidable friction during review.

The BMA applies a fit-and-proper standard to directors, officers, shareholder controllers and other key persons. The review covers integrity, competence, financial soundness, time commitment and regulatory history. Opaque ownership chains, nominee-heavy structures, unexplained source of wealth, or key persons with weak financial services experience materially reduce approval prospects.

A strong governance package usually includes:

• a board with relevant fintech, compliance, risk or financial services experience;
• clear allocation of responsibilities across management and control functions;
• documented conflicts management and escalation procedures;
• controller and UBO disclosures with source-of-funds evidence;
• CVs, references, police certificates and personal questionnaires for key persons.

As a practical point, the BMA tends to scrutinize whether the board can challenge founders on custody, market abuse, liquidity and outsourcing risk, not merely approve strategy passively.

Your AML/ATF framework must align with Bermuda’s anti-money laundering regime, including the Proceeds of Crime (Anti-Money Laundering and Anti-Terrorist Financing) Regulations 2008, sectoral guidance and BMA expectations for digital asset businesses. A generic template is not sufficient.

The BMA expects a risk-based control stack covering:

• business-wide ML/TF risk assessment tailored to your product and customer base;
• KYC/CDD and enhanced due diligence for higher-risk clients and jurisdictions;
• sanctions screening at onboarding and on an ongoing basis;
• transaction monitoring and blockchain analytics / KYT controls where relevant;
• Travel Rule operating model for transferable digital asset flows;
• suspicious activity escalation, recordkeeping and staff training.

For exchanges and custody providers, the regulator increasingly expects applicants to explain how wallet screening, counterparty risk scoring and off-chain/on-chain monitoring work together in practice.

Cyber and custody controls are now central to Bermuda licensing. The Digital Asset Business (Cyber Risk) Rules 2023 took effect on 1 January 2024, and the Digital Asset Business (Custody of Client Assets) Rules 2025 materially raised the bar for custody models.

You should be ready to evidence:

• access control, privileged access management and MFA;
• key management using institutional controls such as HSM or MPC where appropriate;
• wallet segregation and client asset reconciliation;
• incident response, breach escalation and business continuity / disaster recovery;
• vendor risk management for cloud, custody and analytics providers;
• independent security testing and audit trails.

One nuance many applicants miss: if you rely on a third-party custodian, the BMA still expects you to demonstrate oversight of that arrangement, not merely point to the vendor’s reputation or SOC 2 report.

There is no universal statutory minimum capital figure that works for every Bermuda crypto applicant. Capitalisation is assessed on a risk-based basis by reference to your business model, scale, custody exposure, liquidity needs, outsourcing profile and operational resilience.

Your application should therefore include:

• a detailed business plan explaining products, customer journey and revenue model;
• financial projections with realistic assumptions and downside scenarios;
• source-of-funds and source-of-wealth evidence for founders and investors;
• liquidity and treasury policy, including treatment of client assets vs own assets;
• outsourcing map and costed operating model;
• evidence that you can sustain the business through the licensing and early operating phase.

The BMA usually reacts negatively to projections that assume immediate high-volume growth without corresponding staffing, compliance tooling, cyber budget and banking arrangements.

Stablecoin, custody and lending models face the highest scrutiny in Bermuda. For single currency pegged stablecoins, the BMA’s SCPS Guidance issued in November 2024 points to expectations such as:

• full reserve backing in high-quality liquid assets;
• clear and enforceable redemption rights;
• independent monthly attestation of reserves;
• governance over reserve management and conflicts;
• operational resilience for mint, burn and redemption processes.

For lending and repo-style models, the BMA will usually test collateral management, rehypothecation logic, liquidity stress assumptions, counterparty exposure and disclosure of loss allocation. These models are licensable, but they are not reviewed as plain-vanilla wallet products.