A VASP application to CIMA asks detailed questions about systems, security, continuity and outsourcing. We prepare those sections, and the policies and evidence behind them, alongside your legal counsel and compliance team.
Your technology, security, continuity and outsourcing measured against CIMA's requirements for your category, with every gap logged and rated.
The technology, cybersecurity and business continuity content of your application, written to match how you really operate.
Information security, access control, wallet and key management, incident response and continuity policies.
Diagrams, risk assessments, test records and provider due diligence, organised for review.
Mock inspections and briefing for management before CIMA's review.
Your services and licence category confirmed with counsel.
Gaps against CIMA's requirements identified.
Policies, sections and evidence completed.
Help with CIMA questions during review.
Since April 2025, virtual asset custodians and trading platforms in the Cayman Islands have required a CIMA licence under the Virtual Asset (Service Providers) Act.
Source: Virtual Asset (Service Providers) Act
CIMA regulated entities must notify CIMA no later than 72 hours after discovering a material cybersecurity incident.
Source: CIMA Rule on Cybersecurity for Regulated Entities
No. We work alongside counsel and your compliance team, covering the technology, security and continuity content.
Trading platforms, custodians, exchanges and token issuers, plus funds and service providers with virtual asset exposure.
Yes. Ongoing compliance covers annual policy reviews, control testing, incident simulations and board reporting.
Tell us what you're working on. We'll listen, ask the right questions and recommend a practical next step. No obligation.