How to Obtain a Digital Asset Business (DAB) Licence in Bermuda

Bermuda has established itself as one of the world’s most credible regulatory environments for digital asset businesses. Since the enactment of the Digital Asset Business Act 2018 (DABA), the jurisdiction has attracted exchanges, custodians, stablecoin issuers, and fintech start-ups seeking a robust, internationally recognised licence. This guide provides a comprehensive, practitioner-oriented walkthrough of how to secure a digital asset business Bermuda licence covering licence classes, the step-by-step application process, fees, capital tests, timeline expectations, and the latest BMA guidance updates for 2025–2026. Whether you are a founder, compliance officer, or in-house counsel, this page is designed to reduce application friction and accelerate your path to licensure.

In one sentence: how to get a DAB licence in Bermuda

To obtain a DAB licence, you must incorporate or register in Bermuda, select the appropriate licence class (F, M, or T), prepare a comprehensive application evidencing governance, AML/CFT controls, technology security, and capital adequacy, submit it to the Bermuda Monetary Authority (BMA), and satisfy the BMA’s Application Licensing Committee review.

What Is a DAB Licence and Who Must Apply

A DAB licence is the regulatory authorisation required under the DABA for any entity that conducts, or holds itself out as conducting, a “digital asset business” in or from Bermuda. The BMA Bermuda’s integrated financial regulator is the sole authority responsible for assessing applications, granting licences, and supervising licensees on an ongoing basis.

What activities fall under DABA

The DABA defines “digital asset business” broadly. Activities that trigger the licensing requirement include:

• Issuing, selling, or redeeming digital assets, virtual coins, or tokens
• Operating a digital asset exchange (matching buy/sell orders, facilitating trading)
• Providing custodial wallet services (holding, storing, or maintaining control of digital assets on behalf of clients)
• Operating as a digital asset derivatives exchange
• Providing digital asset trust services
• Acting as a payment service provider using digital assets
• Market-making or dealing as principal or agent in digital assets

Which Businesses Must Apply for a DAB Licence in Bermuda?

Any entity whether a Bermuda exempted company, partnership, or overseas entity with a Bermuda permit that engages in one or more of the above activities must hold a valid DAB licence before commencing operations. This includes issuers of single-currency pegged stablecoins (SCPS), non-fungible-token (NFT) marketplace operators whose tokens meet the statutory definition, decentralised-finance (DeFi) protocol operators with a Bermuda nexus, and digital asset payment service providers. The term “VASP” (virtual asset service provider) is sometimes used interchangeably in international guidance; however, the DABA’s scope is purposely broader, and applicants should map their activities against the statutory definitions rather than relying on FATF VASP taxonomies alone.

Licence Classes Explained Class F, Class M, Class T

The BMA issues three classes of DABA licence Bermuda operators can apply for, each calibrated to the scale, complexity, and maturity of the applicant’s business. Understanding the distinctions is critical to selecting the right entry path and managing regulator expectations.

Comparison Table: Class F vs Class M vs Class T

*Net asset floors and fee amounts are indicative. Applicants should confirm current figures against the BMA’s published fee schedule and rules.

Class F Permitted Activities

A Class F licence Bermuda holder may conduct the full range of digital asset business activities without operational caps. This is the appropriate licence for mature enterprises with established compliance infrastructure, audited track records, and robust custody solutions. Examples include global exchanges seeking a regulated domicile, institutional-grade custodians, and stablecoin issuers operating at volume.

Class M (Sandbox/Modified) Permitted Activities and Typical Conditions

The Class M sandbox licence allows the BMA to impose bespoke conditions for instance, capping the number of clients, limiting the types of digital assets that may be handled, or restricting geographic reach. It is designed for businesses that have moved beyond proof-of-concept but are not yet ready for a full Class F application. The BMA may require periodic reporting milestones and evidence of governance maturation before permitting a transition to Class F.

Class T (Test Licence) Scope and Transition

Class T is the entry-level “innovation” licence, typically valid for up to twelve months. It enables applicants to test products and business models in a controlled environment under BMA supervision. Class T licensees must present a credible plan for graduating to either Class M or Class F; the BMA will evaluate progress against agreed milestones. Evidence requirements are lighter but still include core AML/CFT controls, a minimum viable technology-security posture, and a clear business plan.

How to Apply for a DAB Licence Step‑by‑Step

The application process for a digital asset business Bermuda licence is rigorous. The following eight-step framework reflects current BMA expectations and is designed to help applicants prepare a submission-ready file that minimises regulator queries and accelerates the review timeline.

Step 0 Pre-Application Assessment

Before engaging with the BMA, conduct an internal fit-and-proper analysis. Evaluate whether each director, controller, and senior executive meets the BMA’s character and competence standards. Confirm the jurisdictional rationale for Bermuda including whether your business model satisfies the “head office” test (genuine mind-and-management presence on the island). Early engagement with local counsel is advisable at this stage to identify any structural obstacles.

Step 1 Choose Licence Class and Prepare Business Plan

Select the appropriate class (F, M, or T) based on your operational maturity, client base, and product complexity. Your business plan must articulate the product offering, target markets, projected transaction flows, revenue model, and governance structure. Include flow diagrams that illustrate the movement of digital assets and fiat currency through your platform.

Step 2 Required Forms and Filings

Prepare and complete the BMA’s prescribed application form, a detailed cover letter addressed to the BMA, and all statutory declarations required under the DABA. Ensure that each form is signed by an authorised officer and, where applicable, notarised or apostilled.

Step 3 Corporate Structure, Local Presence, and Governance

The BMA requires demonstrable Bermuda substance. This means a genuine head office on the island (not merely a registered-agent address), at least one resident senior executive, and a board of directors with relevant expertise. Provide an organisational chart, board CVs, role descriptions, and evidence of governance frameworks (committee charters, conflict-of-interest policies, board meeting schedules).

Step 4 KYC / AML / CFT File

This is often the most scrutinised component. Your AML/CFT programme must include a documented business-wide risk assessment, customer due diligence and enhanced due diligence procedures, transaction-monitoring rules and escalation protocols, sanctions-screening capabilities, and procedures for filing suspicious activity reports with Bermuda’s Financial Intelligence Agency (FIA). The BMA’s expectations are aligned with the CFATF/FATF Mutual Evaluation recommendations for Bermuda, which emphasise risk-based AML controls, beneficial-ownership transparency, and ongoing monitoring effectiveness.

Step 5 Technology and Security Evidence

The BMA expects applicants to demonstrate cyber-resilience with substantial documentary proof. Prepare architecture diagrams (cloud infrastructure, API layers, data-flow maps), custody-model documentation (hot/cold wallet architecture, multi-signature schemes, key-management procedures), penetration-testing reports, and for Class F applicants SOC 2 or equivalent third-party attestation. The BMA’s Cyber Risk Management Code sets out specific evidentiary items that must be addressed, including incident-response plans, business-continuity procedures, and third-party vendor risk assessments.

Step 6 Financial Statements, Net Assets, and Capital Projections

Submit audited financial statements (or, for newly incorporated entities, opening balance sheets audited by an approved auditor), capital-adequacy projections for 12–24 months, and confirmation of net-asset compliance with the applicable threshold for your licence class. Include a letter from your proposed auditor confirming their willingness to act and their familiarity with digital asset engagements.

Step 7 Submission, Regulator Queries, and Stakeholder Meetings

Once the file is complete, submit it to the BMA. Expect a formal acknowledgement, followed by a period of desk review during which the BMA may issue detailed written queries. Applicants are typically invited to present to the Application Licensing Committee (ALC), where senior management and compliance leadership should be prepared to answer questions on governance, AML controls, and technology resilience. Responsiveness to queries is the single most important factor in maintaining timeline momentum.

Step 8 Post-Submission Compliance Preparations

While the BMA reviews your application, begin onboarding a Bermuda-based banking relationship (which can be time-consuming), engaging local licensed service providers (auditors, compliance consultants, company secretarial services), and building the operational infrastructure for day-one regulatory reporting. Ensure your PIPA (Personal Information Protection Act) compliance framework is in place PIPA became effective on 1 January 2025 and imposes substantive data-protection obligations on all entities processing personal information in Bermuda.

DAB Licence Timeline Realistic Examples

Fee Components Explained

The BMA’s DABA licence fees consist of three components: an application fee (payable upon submission, non-refundable), a grant fee (payable upon licence approval), and an annual fee (payable each renewal year). Annual fees may be subject to a sliding or capped mechanism linked to client receipts or revenue applicants should consult the BMA’s published fee schedule for current amounts and calculation methodology. All fee figures published in third-party sources should be treated as indicative; the BMA reserves the right to amend fee schedules by notice.

Net Asset / Capital Test Overview

Each licence class carries a minimum net-asset requirement designed to ensure that licensees maintain adequate capital to protect client assets and absorb operational losses. Class F applicants face the highest threshold, reflecting the broader scope of permitted activities and the systemic risk profile. Applicants proposing custody services or stablecoin issuance should anticipate additional capital expectations. The BMA may also impose bespoke capital conditions based on the applicant’s risk profile. Current indicative floors are published in the BMA’s rules and guidance documents.

Typical Timeline Scenarios

1. Case A Clean Class T (proof of concept): Approximately 2–3 months total (2–4 weeks preparation, 4–8 weeks BMA review). Assumes a straightforward business model, complete documentation, and responsive applicant.
2. Case B Class M (sandbox scale-up): Approximately 3–6 months. The additional time reflects the BMA’s deeper assessment of governance maturity, AML programme effectiveness, and technology controls at a higher operational threshold.
3. Case C Class F (full licence, custody or SCPS): Approximately 4–6+ months. Complex custody architectures, stablecoin reserve structures, or multi-jurisdictional corporate groups may extend the timeline further. The BMA may require multiple rounds of queries and a formal ALC presentation.

Timelines are heavily dependent on the completeness and quality of cyber/AML evidence and whether the head-office test is demonstrably met from the outset. Incomplete files are the primary driver of delays.

Practical Budgeting Note

Beyond regulatory fees, applicants should budget for professional advisory fees (legal, compliance, corporate secretarial), independent security audits and penetration testing, annual statutory audit costs, ongoing compliance-officer and money-laundering reporting officer (MLRO) compensation, and technology-infrastructure expenses associated with meeting the BMA’s Cyber Risk Management Code. Industry observers suggest that total first-year costs inclusive of regulatory and professional fees can vary significantly depending on the licence class and the complexity of the applicant’s operations.

BMA Guidance and Recent 2025–2026 Updates

What Changed in 2025–2026

The BMA has published a series of guidance updates and rule documents through 2025–2026 that materially affect the DAB licensing landscape:

• Custody rules: Updated requirements for segregation of client assets, proof-of-reserves methodologies, and key-management standards.
• Cyber Risk Management Code: Enhanced evidentiary expectations for penetration testing frequency, incident-response drill documentation, and third-party vendor due diligence.
• SCPS guidance: New guidance specific to single-currency pegged stablecoin issuers, addressing reserve composition, redemption mechanisms, and disclosure obligations.
• Tightened KYC evidential standards: The BMA now expects applicants to demonstrate functional AML systems (not merely policy documents) including test-transaction logs, alert-triage samples, and beneficial-ownership verification evidence.
• Increased reporting frequency: Supervisory returns and cyber-risk returns are now required on a more frequent cadence for certain licence classes.

The Digital Asset Business Amendment Act, as published in the Official Gazette, underpins several of these changes at the statutory level, adjusting licensing tests, capital expectations, and reporting obligations.

Practical Implications for Applicants

Applicants submitting in the current cycle should ensure their files include demonstrable, functioning AML/CFT controls (not just draft policies), up-to-date penetration-testing reports (within 90 days of submission), documented custody models with third-party validation where applicable, and PIPA-compliant data-protection impact assessments. Applicants who submit updated evidence reflecting these 2025–2026 standards are experiencing faster progression through the ALC review, according to industry observers.

Where to Find Official Guidance

All current rules, codes of practice, guidance notes, and application forms are published in the BMA Documents Centre Digital Asset Business section. Applicants should bookmark this page and check for updates before finalising their submissions. The BMA’s main Digital Asset Business landing page provides an overview of the regulatory framework and links to all relevant forms.

Common Pitfalls and Audit / Inspection Expectations

Top 7 Pitfalls

• Weak AML programme: Submitting policy documents without evidence of operational testing, alert-triage samples, or transaction-monitoring calibration.
• Insufficient custody controls: Failing to document key-management procedures, multi-signature governance, or segregation of client assets from proprietary holdings.
• Inadequate key management: No documented key-ceremony procedures, backup-seed protocols, or disaster-recovery plans for cryptographic material.
• Unclear corporate governance: Missing board charters, undefined committee structures, or directors who lack demonstrable fintech or compliance experience.
• Lack of Bermuda executive presence: Relying on a nominal registered agent without genuine mind-and-management on the island; failing the head-office test.
• Incomplete PIPA / privacy compliance: Overlooking the data-protection obligations introduced by PIPA, particularly regarding client-data processing, consent frameworks, and cross-border data transfers.
• Under-scoped business plan: Presenting a generic or overly aspirational plan without transaction-flow diagrams, projected volumes, revenue assumptions, or risk-scenario analyses.

What On-Site Inspections Look Like

The BMA conducts periodic on-site inspections of licensees. Typical audit activities include reviewing AML/CFT record-keeping (client files, transaction logs, SAR records), testing cyber-security controls against documented procedures, verifying custody reconciliations and proof-of-reserves, examining board and committee minutes for evidence of active governance, and assessing third-party audit reports and remediation actions. Licensees should maintain inspection-ready documentation at all times.

Checklist: Documents to Include with Your DAB Application

One-Page Application Checklist

• Completed BMA application form signed by authorised officer
• Cover letter summarising the business, licence class requested, and key contacts
• Business plan including product description, flow diagrams, target market, revenue model, and 12–24-month projections
• Corporate structure chart showing ultimate beneficial owners, subsidiaries, and service providers
• Directors’ and officers’ CVs with personal declarations and police clearance certificates
• AML/CFT programme risk assessment, CDD/EDD procedures, transaction-monitoring rules, SAR procedures, sanctions-screening protocols
• Technology and security documentation architecture diagrams, custody model, key-management procedures, pen-test reports, incident-response plan
• Financial statements audited (or opening balance sheet with auditor letter), capital projections, net-asset confirmation
• Governance documents board charter, committee terms of reference, conflict-of-interest policy, compliance-officer appointment letter
• PIPA compliance evidence privacy-impact assessment, data-processing register, consent mechanisms
• Statutory declarations as required under the DABA
• Proof of Bermuda substance office lease, resident senior executive employment contract, board-meeting schedule

Application Pack Contents

For maximum efficiency, applicants should prepare a structured filing pack containing templates for each of the above items. Recommended templates include: application cover-letter template, business-plan outline, AML policy template, KYC risk-rating matrix, cyber-security evidence template (mapped to the BMA’s Cyber Risk Management Code), and board-resolution examples for licence application approval. A DAB licence application checklist is available as a downloadable resource for qualified applicants.

Authoritativeness and Trust

Global Law Experts maintains a worldwide network of vetted legal professionals with deep expertise in crypto licensing and digital asset regulation. For Bermuda-specific DAB licensing matters, our network includes local counsel with direct experience navigating BMA applications, ALC presentations, and post-licence compliance programmes.

Sources

• Bermuda Monetary Authority Digital Asset Business (main regulatory landing page)
• BMA Documents Centre Digital Asset Business Policy & Guidance
• Bermuda Laws Digital Asset Business Act 2018 (consolidated legislation)
• Official Gazette Digital Asset Business Amendment Act (assent notice)
• FATF / CFATF Mutual Evaluation Report Bermuda (2020)
• Government of Bermuda Personal Information Protection Act (PIPA) Commencement