CIMA Issues Desk-Based Review on VASPs

The Cayman Islands Monetary Authority (“CIMA”) has released its Thematic Desk-based Review Report on Registered Virtual Asset Service Providers, following an assessment conducted between September 2024 and February 2025.

CIMA confirms that: “From September 2024 to February 2025, the Authority conducted a Thematic Desk-based Review (the “Reviewˮ) pursuant to section 6(1)(b) of the Monetary Authority Act (2020 Revision) (as amended) (the “MAAˮ) and section 24(1)(c) of the VASP Act. The Review scope comprised 11 regulated VASPs (the “Selected Entitiesˮ)…Of these 11 regulated VASPs, 5 provide virtual asset custody services and these custody arrangements were also considered in the scope of the Review.”

The Report outlines generalised findings across governance, internal controls, cybersecurity, AML/CFT/CPF/Sanctions compliance, financial position, and custody arrangements. CIMA notes that: “A separate Supervisory Circular on AML/CFT On-site and Off-site Supervision of the Virtual Asset Service Providers was issued by CIMA on 18 September 2025 and should be read in conjunction with this report.”

CIMA reiterates the need for proactive compliance enhancement: “The Authority recognises that the virtual asset ecosystem is still nascent and as such, VASPs should carefully consider the findings outlined in this Report and ensure that their policies, procedures, systems, and controls are developed and maintained in line with the Authority’s regulatory expectations…This applies to all relevant governance, operational, risk management, cybersecurity frameworks and AML/CFT/CPF/Sanctions compliance areas.”

As the jurisdiction progresses through the phased implementation of the VASP Act, VASPs are strongly encouraged to review the findings and reassess their frameworks to ensure alignment with regulatory requirements and international standards.

Read the full CIMA Report here

If you would like assistance reviewing your VASP governance, compliance or cybersecurity framework in light of these findings, please contact our Regulatory team at jon.mclean@stuartslaw.com.