Michael Killourhy David Mathews January 19 2023 British Virgin Islands enacts new VASP Act Ogier | Private Client & Offshore Services - British Virgin Islands Michael Killourhy, David Mathews Private Client & Offshore Services IntroductionVirtual assets and VASP activitiesVirtual assets serviceVirtual assets custody serviceVirtual assets exchangeRegulatory sandboxVASP licence applicationFunctionaries and ongoing obligationsGrandfathering periodCommentIntroductionThe British Virgin Islands has enacted its long-awaited Virtual Asset Service Providers Act 2022 (the VASP Act). Having become a leading crypto and virtual assets jurisdiction in the past few years, the VASP Act demonstrates the British Virgin Islands' keen desire to keep hold of its favoured position in the sector while also maintaining its reputation as a highly responsible international finance centre, committed to complying with international standards on transparency and fighting abuse and criminal conduct of all types.The VASP Act, which has yet to come into force, seeks to introduce a well-balanced registration and supervisory framework for virtual assets service providers. The VASP Act:defines the activities relating to virtual assets that require registration;prescribes requirements for registration;details ongoing requirements and obligations;assigns specific powers to the BVI Financial Services Commission (the commission) in relation to VASPs; andspecifies the penalties for offences committed under the VASP Act.Virtual assets and VASP activitiesSubject to certain limitations, a "virtual asset" is defined in the VASP Act as "a digital representation of value that can be digitally traded or transferred, and can be used for payment or investment purposes". This is a broad definition and will cover all types of crypto assets, including non-fungible tokens.The VASP Act provides that a company may apply to the commission to be regulated as a VASP in one or more of the following categories:carrying on the business of providing a virtual assets service;engaging in the business of providing a virtual assets custody service; and;operating a virtual assets exchange.Virtual assets serviceVirtual assets service is defined in the VASP Act as the business of engaging, on behalf of another person, in the following activities:exchange between virtual assets and fiat currencies;exchange between one or more forms of virtual assets;transfer of virtual assets where the transfer relates to conducting a transaction on behalf of another person that moves a virtual asset from one virtual asset address or account to another;safekeeping or administration of virtual assets or instruments enabling control over virtual assets; andparticipation in, and provision of, financial services related to an issuer's offer or sale of a virtual asset.The VASP Act goes on to say that the following activities would also be considered to be the provision of a virtual assets service:hosting wallets or maintaining custody or control over another person's virtual asset, wallet or private key;providing financial services relating to the issuance, offer or sale of a virtual asset; andproviding kiosks (eg, automatic teller machines, bitcoin teller machines or vending machines) for the purpose of facilitating virtual assets activities through electronic terminals to enable the owner or operator of the kiosk to actively facilitate the exchange of virtual assets for fiat currency or other virtual assets.The above lists may be expanded by subsequent guidelines or regulations.It should be noted that the issuance by a BVI company of virtual assets is currently not included in the definition of virtual assets service and so, to the extent that a BVI company is involved in a crypto project solely as the issuer of tokens, the VASP Act would not require the entity to be regulated in respect of that activity.Virtual assets custody serviceThis activity is defined as "the acceptance for safekeeping of virtual assets or instruments that enable a VASP to exercise control over the virtual assets or instruments". A BVI company seeking to perform this activity will be required, in addition to other obligations imposed on a VASP (considered further below), to undertake the following functions:enter into safekeeping arrangements with the owner of the virtual asset and related instruments, with respect to matters such as the duration of the arrangement, fees payable, client access to the virtual assets, security, etc;source and adopt best practices in relation to information technology to be applied to the safekeeping of virtual assets; andensure that any ancillary or subsidiary proceeds relating to virtual assets and related instruments accrue to the benefit of the owner of the virtual assets, unless otherwise agreed between the parties.Virtual assets exchangeA virtual assets exchange is defined in the VASP Act as:a trading platform that is operated for the purpose of allowing an offer or invitation to be made to buy or sell any virtual asset in exchange for money or any virtual asset and which comes into custody, control, power or possession of, or over, any money or any virtual asset at any point in time during its course of business.The licensing requirements for a BVI entity that wishes to operate a virtual assets exchange are to be contained in regulations that will be released at a future date. At this time, there is no indication of when they will be released.Entities operating a virtual assets exchange may be subject to certain restrictions and prohibitions, which may include conditions relating to:the geographic area in which the virtual assets exchange may carry on its business;the types of clients that the service may be marketed to;the types of virtual assets that may be traded on the exchange;disclosures to be made to clients in relation to the operation of the virtual assets exchange, including disclosures relating to theft or loss of assets and any related insurance obligations;supervision of trading activities, including actions concerning the freezing and suspension of trading of virtual assets;financing in relation to the purchase of virtual assets; andany other necessary control measures to safeguard the integrity of the virtual assets exchange and protect the interests of persons investing on the exchange.A VASP that is registered to operate a virtual assets exchange is prohibited from:providing financing to its clients for the purchase of virtual assets, unless:it has permission from the commission; andit makes disclosures to its clients regarding the terms of, and the risk associated with, the financing;engaging in trading or marketing activities in relation to any virtual assets for its own benefit which may be detrimental to the interests of its clients, unless such activities:are necessary for the operation of the virtual assets exchange, andhave been disclosed to its clients prior to engaging in the trading or marketing activities;permitting the trading of a virtual asset on its virtual assets exchange in a manner that is misleading or deceptive, or designed to defraud persons who subscribe for, or purchase, the virtual asset;permitting client to trade in or purchase a virtual asset on its virtual assets exchange without first satisfying itself that the client is aware of the risks involved in trading in, subscribing for, or purchasing, the virtual asset;providing fiat currency to fiat currency exchange services to users of its virtual assets exchange without the written approval of the commission; orengaging in any other activity which has the potential to compromise the integrity of the virtual assets exchange or erode public confidence in the exchange.Regulatory sandboxThe VASP Act provides that a VASP that is engaged in the deployment of innovative fintech may be permitted to participate in the BVI's regulatory sandbox, a light-touch regulatory framework that BVI entities may register under to trial their businesses for a limited time without needing to comply with the more onerous requirements of the VASP Act.(1)VASP licence applicationAn entity wishing to be licensed as a VASP will have to apply to the commission. The VASP Act requires that the application must be accompanied by the following information:the names and addresses of the persons proposed as directors and senior officers of the VASP (and at least two of the directors must be individuals);the names and addresses of the persons who hold shares, including their level of shareholding in the VASP;the names and addresses of the persons who have a "controlling interest" in the VASP (this term refers to a person with control over the VASP, but who is not a shareholder or director);the physical address in the British Virgin Islands of the VASP;the name and address of the auditor of the VASP;the name and address of the proposed authorised representative of the VASP (whose main function is to be the intermediary between the VASP and the commission);a detailed business plan in relation to the VASP;a written risk assessment of the VASP, outlining the risks the VASP will or may be exposed to and specifying how those risks are to be identified, measured, assessed, monitored, controlled and reported;a written manual showing how the applicant, if granted registration, intends to comply with the requirements of the VASP Act and any regulations made thereunder, including how the applicant intends to safeguard against the activities of money laundering, terrorist financing and proliferation financing;the internal safeguards and data protection (including cyber security) systems intended to be utilised; andthe system to be put in place on how the VASP will handle client assets, custodian relationships and complaints.The commission has the power to request such additional information as it may consider appropriate in support of the application, in addition to the above. In considering whether to approve an application for a licence under the VASP Act, the commission will have regard to the conditions set out in section 7 of the VASP Act. These provisions generally relate to the application meeting the requirements set out above and the ability of the applicant to carry out its business in a sound manner with appropriate safeguards in place.In addition, each director, senior officer and person with a significant or controlling interest in the VASP must be "fit and proper", as defined in the BVI Regulatory Code. In making the "fit and proper" determination, the commission will have regard to the:honesty, integrity and reputation;competence and capability; andfinancial soundness of each of the director, senior officer and person with a significant or controlling interest.This will include a review of documentation to be provided in respect of those people relating to, among other things, any previous convictions, investigation or enforcement proceedings by any regulator, contravention of financial services legislation, and prior refusals of licenses or revocation of licences.Functionaries and ongoing obligationsA VASP must at all times have the following functionaries:an authorised representative;an auditor; andan individual approved by the commission who acts as compliance officer, to ensure compliance by the VASP with the provisions of the VASP Act and other applicable legislation.A VASP will also be subject to a number of ongoing obligations, which include (but are not limited to) the obligation to:notify the commission of any changes in the information submitted as part of its application;submit a copy of its auditor's report on an annual basis;file a return containing various details relating to the financial condition of the VASP, information on its client base, key performance indicators, and complaints received from clients and how they have or are being handled;ensure that client assets are identified (or identifiable) and appropriately segregated and accounted for, and to notify any client and the commission in the event that an asset has in any way been unlawfully interfered with or otherwise compromised (including details of the steps the VASP has taken or is taking to restore the client's assets and protect the assets from any further unlawful interference or from otherwise being compromised); andperform customer due diligence, comply with laws relating to money laundering, terrorist financing and proliferation financing, and maintain relevant records (which includes an obligation on the VASP to adopt measures to assist it in tracing and collecting the IP addresses of its customers, including their associated dates, stamps, geographical data, device indicators, virtual asset wallet addresses and transaction hashes).In addition to the above, unless the VASP is listed on a recognised exchange, the consent of the commission must be obtained prior to any person who owns or holds a significant or controlling interest in a VASP (directly or indirectly) selling, transferring, charging or otherwise disposing of that interest or any part of it.Grandfathering periodSection 40 of the VASP Act provides that any person who is carrying on the business of providing a virtual assets service on the date the VASP Act comes into force must apply to be licensed as a VASP within six months of that date. Assuming this deadline is met, that person may continue to provide virtual asset services until the commission has given notice to approve or refuse their application.CommentOn the whole, the approach and content of the proposed VASP Act is encouraging, and it will likley maintain the British Virgin Islands' position as a leading jurisdiction in the VASP space, while protecting counterparties and satisfying the British Virgin Islands' international compliance commitments. Further guidance is expected from the commission in relation to the VASP Act and its implementation as commencement approaches, and possibly additional regulations. In the meantime, VASP clients should seek assistance as they navigate the new regulatory landscape to be introduced in the British Virgin Islands.For further information on this topic please contact Michael Killourhy or David Mathews at Ogier by telephone (+1 284 852 7300) or email ([email protected] or [email protected]). The Ogier website can be accessed at www.ogier.com.Endnotes (1) For further details on the regulatory sandbox and the requirements for registration and obligations of participants, please see here.