Harneys Lawyers: How to Apply for a BVI VASP Licence

Mirza Manraj is a lawyer at the global offshore law firm Harneys and an expert in digital asset regulation. The author would like to thank Aki Corsoni-Husain and Maggie Kwok for working together on this piece.
__________

The British Virgin Islands (BVI)’s Virtual Asset Service Providers Act 2022 (the VASPA) came into force on 1 February 2023. Any person who is conducting virtual asset service (VAS) business prior to the VASPA coming into force should be looking to be registered with the BVI Financial Services Commission (the BVI FSC) within the 6-month transitional window which expires on 31 July 2023.

All applicants should try their best to submit a full and complete VAS application to the BVI FSC within the transitional timeframe. Incomplete VAS applications run the risk of not being processed by the BVI FSC.

It is important that regulatory advice be taken by persons who are conducting VAS business to ensure that the VAS regime is applicable to them. Once it is determined that a person is a virtual asset service provider (VASP), it is important to start working on the registration application to be filed with the BVI FSC.

Applicants for registration under the VAS regime would need to consider:

(a) Governance issues: of always having 2 individual directors, there may be a requirement for a local resident director to be appointed and also having in place a VASPA approved authorised representative based in the BVI who will have to possess sufficient knowledge of the applicant’s VAS related business as well as an auditor;

(b) Ownership structure: full information on the ultimate beneficial ownership structure of the VASP including all intermediary structures (if any) will need to be disclosed – complex structures may lead to delays;

(c) Business plans: detailed business plans will need to be submitted taking into account matters related to corporate governance, capital reserves, technological audits, liquidity, risk management strategies, consumer protection provisions, related parties and public disclosures, custody and safe-guarding, escrow and lock up provisions, interoperability, cessation of business and succession planning, implementation of the travel rule;

(d) Policies and procedures: an applicant will need to have robust internal controls including, risk assessment frameworks, AML/CFT/CPF and sanctions compliance procedures, outsourcing agreements and policies, data protection and cybersecurity framework, statement of technological infrastructures, business continuity plans, custody and safe-keeping of assets framework, complaints handling procedures, technology audits framework and suitable insurance requirements;

(e) AML/CFT/CPF requirements: a VASPA will be considered a “relevant person” doing “relevant business” under the AML/CFT/CPF legislation, as such, a VASPA will need to ensure that as a part of the AML/CFT/CPF regime that it is identifying procedures in relation to new and continuing business relationships, establishing and maintaining verification procedures, where there is reliance on third parties that there is the appropriate channels to obtain the identification documents from those third parties as a means of recording the identity of customers, maintaining records and underlying documents, appointing the necessary compliance and money laundering reporting officers, conducting annual training etc.

It is imperative that all VASPs, once registered under the VASPA, ensures that they comply with all of the on-going regulatory requirements that apply to the VAS regime, e.g.:

(a) remaining fit and proper, as such, fulfilling the BVI FSC’s assessment that all VASPs are competent and that they conduct their business in line with the regulatory principles in the Regulatory Code 2009;

(b) notification / pre-approval requirements: for example, change of information provided, change of name, maintaining financially sound condition, appointment of directors, appointment of authorised representative and auditor, submission of audited financial statements, maintenance of records, disposition or acquisition of significant or controlling interest in a VASP, client assets, AML/CFT/CPF and sanctions compliance;

(d) maintaining adequate human and technological resources and policies, procedures and mechanisms to ensure compliance; and

(e) considering and adapting resources and procedures to any changes in scope of business and legislative development.

Failure to comply with the requirements under the VASPA or the AML/CFT/CPF regime can lead to various criminal offences which carry both monetary penalties and custodial sentences. The BVI FSC would also have at its disposal the administrative penalty regime for any administrative breach by a VASP. These would be the mechanisms that the BVI FSC can use as a part of any enforcement action to be taken.

As with any new legislative regime, it is important that existing VASPs and potential VASPs work closely with their service providers to understand the regime created by the VASPA and its subsidiary legislation and guidance to ensure that the VASP is ensuring full regulatory compliance with the VAS framework.

____