British Virgin Islands enacts new Virtual Assets Service Providers Act

The British Virgin Islands (BVI) has enacted its long-awaited Virtual Asset Service Providers Act, 2022 (the VASP Act). Having become a leading crypto and virtual assets jurisdiction in the past few years, the VASP Act demonstrates BVI's keen desire to keep hold of its favoured position in the sector while also maintaining its reputation as highly responsible international finance centre, committed to complying with international standards on transparency and fighting abuse and criminal conduct of all types.

Ogier's Virtual Asset Service Provider (VASP) experts are best in class and ready to help clients navigate the upcoming new regulatory landscape.

The VASP Act, which has yet to come into force, seeks to introduce a well-balanced registration and supervisory framework for Virtual Assets Service Providers. The VASP Act defines the activities relating to virtual assets that require registration, prescribes requirements for registration, details ongoing requirements and obligations, assigns specific powers to the BVI Financial Services Commission (the Commission) in relation to VASPs, and specifies the penalties for offences committed under the VASP Act.

Virtual Assets and VASP Activities

Subject to certain limitations, a 'virtual asset' is defined in the VASP Act as: "a digital representation of value that can be digitally traded or transferred, and can be used for payment or investment purposes". This is a broad definition and will cover all types of crypto assets, including non-fungible tokens.

The VASP Act provides that a company may apply to the Commission to be regulated as a VASP in one or more of the following categories:

• carrying on the business of providing a virtual assets service

• engaging in the business of providing a virtual assets custody service

• operating a virtual assets exchange.

Virtual Assets Service

Virtual assets service is defined in the VASP Act as the business of engaging, on behalf of another person, in the following activities:

• exchange between virtual assets and fiat currencies

• exchange between one or more forms of virtual assets

• transfer of virtual assets, where the transfer relates to conducting a transaction on behalf of another person that moves a virtual asset from one virtual asset address or account to another

• safekeeping or administration of virtual assets or instruments enabling control over virtual assets

• participation in, and provision of, financial services related to an issuer's offer or sale of a virtual asset.

The VASP Act further goes on to say that the following activities would also be considered to be the provision of a virtual assets service:

• hosting wallets or maintaining custody or control over another person’s virtual asset, wallet or private key;

• providing financial services relating to the issuance, offer or sale of a virtual asset; and

• providing kiosks (such as automatic teller machines, bitcoin teller machines or vending machines) for the purpose of facilitating virtual assets activities through electronic terminals to enable the owner or operator of the kiosk to actively facilitate the exchange of virtual assets for fiat currency or other virtual assets.

The above lists may be expanded by subsequent guidelines or regulations.

It should be noted that the issuance by a BVI company of virtual assets is currently not included in the definition of virtual assets service and so, to the extent that a BVI company is involved in a crypto project solely as the issuer of tokens, the VASP Act would not require the entity to be regulated in respect of that activity.

Virtual Assets Custody Service

This activity is defined as "the acceptance for safekeeping of virtual assets or instruments that enable a VASP to exercise control over the virtual assets or instruments". A BVI company seeking to perform this activity will be required, in addition to other obligations imposed on a VASP (considered further below), to undertake the following functions:

• enter into safekeeping arrangements with the owner of the virtual asset and related instruments, with respect to matters such as the duration of the arrangement, fees payable, client access to the virtual assets, security, etc;

• source and adopt best practices in relation to information technology to be applied to the safekeeping of virtual assets; and

• ensure that any ancillary or subsidiary proceeds relating to virtual assets and related instruments accrue to the benefit of the owner of the virtual assets, unless otherwise agreed between the parties.

Virtual Assets Exchange

A virtual assets exchange is defined in the VASP Act as "a trading platform that is operated for the purpose of allowing an offer or invitation to be made to buy or sell any virtual asset in exchange for money or any virtual asset and which comes into custody, control, power or possession of, or over, any money or any virtual asset at any point in time during its course of business".

The licensing requirements for a BVI entity that wishes to operate a virtual assets exchange are to be contained in regulations that will be released at a future date; as at this time, there is no indication of when they will be released.

Entities operating a virtual assets exchange may be subject to certain restrictions and prohibitions, which may include conditions relating to:

• the geographic area in which the virtual assets exchange may carry on its business

• the types of clients that the service may be marketed to

• the types of virtual assets that may be traded on the exchange

• disclosures to be made to clients in relation to the operation of the virtual assets exchange, including disclosures relating to theft or loss of assets and any related insurance obligations;

• supervision of trading activities, including actions concerning the freezing and suspension of trading of virtual assets;

• financing in relation to the purchase of virtual assets; and

• any other necessary control measures to safeguard the integrity of the virtual assets exchange and protect the interests of persons investing on the exchange.

A VASP that is registered to operate a virtual assets exchange is prohibited from:

• providing financing to its clients for the purchase of virtual assets, unless (i) it has permission from the Commission, and (ii) it makes disclosures to its clients regarding the terms of, and the risk associated with, the financing

• engaging in trading or marketing activities in relation to any virtual assets for its own benefit which may be detrimental to the interests of its clients, unless such activities (i) are necessary for the operation of the virtual assets exchange, and (ii) have been disclosed to its clients prior to engaging in the trading or marketing activities

• permitting the trading of a virtual asset on its virtual assets exchange in a manner that is misleading or deceptive, or designed to defraud persons who subscribe for, or purchase, the virtual asset

• permitting client to trade in or purchase a virtual asset on its virtual assets exchange without first satisfying itself that the client is aware of the risks involved in trading in, subscribing for, or purchasing, the virtual asset

• providing fiat currency to fiat currency exchange services to users of its virtual assets exchange without the written approval of the Commission

• engage in any other activity which has the potential to compromise the integrity of the virtual assets exchange or erode public confidence in the exchange.

Regulatory Sandbox

The VASP Act provides that a VASP that is engaged in the deployment of innovative fintech may be permitted to participate in the BVI's regulatory sandbox, a light-touch regulatory framework that BVI entities may register under to trial their businesses for a limited time without needing to comply with the more onerous requirements of the VASP Act.

Learn more in our guidance note on the regulatory sandbox and the requirements for registration and obligations of participants.

VASP Licence Application

An entity wishing to be licensed as a VASP will have to apply to the Commission. The VASP Act requires that the application must be accompanied by the following information:

• the names and addresses of the persons proposed as directors and senior officers of the VASP (and at least two of the directors must be individuals)

• the names and addresses of the persons who hold shares, including their level of shareholding in the VASP

• the names and addresses of the persons who have a 'controlling interest' in the VASP (which term refers to a person with control over the VASP, but who is not a shareholder or director)

• the physical address in the BVI of the VASP

• the name and address of the auditor of the VASP

• the name and address of the proposed authorised representative of the VASP (whose main function is to be the intermediary between the VASP and the Commission)

• a detailed business plan in relation to the VASP

• a written risk assessment of the VASP, outlining the risks the VASP will or may be exposed to and specifying how those risks are to be identified, measured, assessed, monitored, controlled and reported

• a written manual showing how the applicant, if granted registration, intends to comply with the requirements of the VASP Act and any regulations made thereunder, including how the applicant intends to safeguard against the activities of money laundering, terrorist financing and proliferation financing

• the internal safeguards and data protection (including cyber security) systems intended to be utilised

• the system to be put in place on how the VASP will handle client assets, custodian relationships and complaints.

The Commission has the power to request such additional information as it may consider appropriate in support of the application, in addition to the above. In considering whether to approve an application for a licence under the VASP Act, the Commission will have regard to the conditions set out in section 7 of the VASP Act. These provisions generally relate to the application meeting the requirements set out above and the ability of the applicant to carry out its business in a sound manner with appropriate safeguards in place.

In addition, each director, senior officer, and person with a significant or controlling interest in the VASP must be "fit and proper", as defined in the BVI Regulatory Code. In making the "fit and proper" determination, the Commission will have regard to the (a) honesty, integrity and reputation, (b) competence and capability, and (c) financial soundness of each of the aforementioned people.

This will include a review of documentation to be provided in respect of those people relating to, inter alia, any previous convictions, investigation or enforcement proceedings by any regulator, contravention of financial services legislation, and prior refusals of licenses or revocation of licenses.

Functionaries and Ongoing Obligations

A VASP must at all times have the following functionaries:

• an authorised representative

• an auditor

• an individual approved by the Commission who acts as compliance officer, to ensure compliance by the VASP with the provisions of the VASP Act and other applicable legislation.

A VASP will also be subject to a number of ongoing obligations, which include (but are not limited to) the obligations:

• to notify the Commission of any changes in the information submitted as part of its application

• to submit a copy of its auditor's report on an annual basis

• to file a return containing various details relating to the financial condition of the VASP, information on its client base, key performance indicators, and complaints received from clients and how they have or are being handled

• to ensure that client assets are identified (or identifiable) and appropriately segregated and accounted for, and to notify any client and the Commission in the event that an asset has in any way been unlawfully interfered with or otherwise compromised (including details of the steps the VASP has taken or is taking to restore the client’s assets and protect the assets from any further unlawful interference or from otherwise being compromised)

• to perform customer due diligence, comply with laws relating to money laundering, terrorist financing and proliferation financing, and maintain relevant records (which includes an obligation on the VASP to adopt measures to assist it in tracing and collecting the IP addresses of its customers, including their associated dates, stamps, geographical data, device indicators, virtual asset wallet addresses and transaction hashes)

In addition to the above, unless the VASP is listed on a recognised exchange, the consent of the Commission must be obtained prior to any person who owns or holds a significant or controlling interest in a VASP (directly or indirectly) selling, transferring, charging or otherwise disposing of that interest or any part of it.

Grandfathering Period

Section 40 of the VASP Act provides that any person who is carrying on the business of providing a virtual assets service on the date the VASP Act comes in to force must apply to be licensed as a VASP within six months of that date. Assuming this deadline is met, that person may continue to provide virtual asset services until the Commission has given notice to approve or refuse their application.

Conclusion

On the whole we are very encouraged by the approach and content of the proposed VASP Act and are very hopeful that it will maintain the BVI's position as a leading jurisdiction in the VASP space, while protecting counterparties and satisfying the BVI's international compliance commitments. We expect to receive further guidance from the Commission in relation to the VASP Act and its implementation as commencement approaches, and possibly additional regulations, and Ogier will work to pass all information on to clients and other stakeholders as soon as possible. In the meantime, we stand ready to advise and assist our VASP clients in detail as they navigate the new regulatory landscape to be introduced in the BVI.

Ogier's BVI-based experts are recognised as leading legal and regulatory experts in all aspects of crypto, blockchain, Web3 and VASP services – having worked on many of the BVI's major and most ground-breaking crypto and VASP-related projects and cases over recent years. If you require further information, feel free to get in touch with the key contacts listed on the right of this briefing.

About Ogier

Ogier is a professional services firm with the knowledge and expertise to handle the most demanding and complex transactions and provide expert, efficient and cost-effective services to all our clients. We regularly win awards for the quality of our client service, our work and our people.

Disclaimer

This client briefing has been prepared for clients and professional associates of Ogier. The information and expressions of opinion which it contains are not intended to be a comprehensive study or to provide legal advice and should not be treated as a substitute for specific advice concerning individual situations.

Regulatory information can be found under Legal Notice