Bermuda DABA: The Commonwealth Offshore Crypto Licence That Sits Between Cayman and Singapore

Most founders scanning offshore crypto jurisdictions stop at three names: Cayman, BVI, and Singapore. They skip Bermuda — which is almost always a mistake when the structure is fund-adjacent, institutional, or counterparty-facing.

Bermuda built its Digital Asset Business Act in 2018 — six years before MiCA, four years before VARA, and a year before Singapore's PSA 2019. The framework was designed by people who had spent decades running prudential supervision over (re)insurance, and it shows.

The critical distinction is this: a DABA licence is supervised, not registered. The BMA reviews capital adequacy, governance, custody, and operations — the same way it reviews a captive insurer or a bank. That changes what the licence is worth to a counterparty, and who should choose it.

Cayman and BVI run registration-style regimes for crypto. CIMA reviews fitness and propriety, AML programmes, and a few risk policies — but it does not run prudential supervision the way it does over a bank. BVI's VASP regime is similar in posture.

Bermuda chose a different path. The BMA supervises DABA licensees on an ongoing prudential basis — minimum capital, liquidity buffers, board composition, MLRO appointment, custody segregation, business continuity, and quarterly reporting. The closest analogue is a small Singapore DPT licensee, not a Cayman VASP registrant.

The trade-off is immediate. A Cayman VASP registration can be obtained in 3–6 months with light capital. A Bermuda Class F DABA typically runs 9–15 months and demands real capital, real staff, and a real office. What you buy with the extra time is counterparty credibility.

The Digital Asset Business Act 2018¹^[1] was Bermuda's purpose-built statute for crypto firms. It covers five regulated activities: issuing digital assets, operating an exchange, providing custody, operating a payment service using digital assets, and operating an ATM. Any of those carried on in or from Bermuda triggers a licensing requirement.

The BMA²^[2] administers four licence classes — Class F (full), Class M (modified), Test (sandbox), and Restricted. Each is governed by the same primary Act but a different supervisory intensity. The Code of Practice sets the operational expectations in detail.

This is the supervised-not-registered distinction. The BMA reads your business plan, stress-tests your capital, looks at your custody arrangements, and meets your senior officers. A Cayman VASP application is thinner by design.

The Four-Class DABA Map is how Finconduit benchmarks Bermuda for clients. Each class is calibrated to a different business model and a different risk appetite — and the four are not interchangeable. Picking the wrong class is the most common founder mistake.

The Class F licence is the workhorse. It permits the full scope of regulated digital asset business — issuance, exchange, custody, payments, ATM — without restriction on customer type, jurisdiction, or transaction volume. It is the credible-counterparty version of the licence.

Minimum assessable capital under the Code of Practice³^[3] starts at $100,000 but is uplifted in practice — for custody and exchange activities, the BMA expects $500,000 to $1 million depending on volume and risk model. The BMA can — and does — set institution-specific capital floors.

Class F also carries the heaviest governance overlay: independent directors, separation of CRO and CCO functions where size warrants, an appointed MLRO resident in Bermuda, and a full ICAAP-style risk assessment. Time-to-licence is typically 9–15 months end-to-end.

The Class M licence is restricted — typically by customer type (institutional only), product scope (single activity), or transaction limit. The BMA applies lighter prudential expectations: lower capital, simpler governance, a single combined senior officer for risk and compliance.

Class M is the right fit for single-purpose vehicles — a token issuance SPV, a fund-adjacent custody vehicle serving only the manager's funds, a restricted institutional trading desk. It is not a retail or open-perimeter licence.

Capital typically sits in the $100,000 to $250,000 range. Time-to-licence is 6–10 months. The Class M is the most underused of the four — it gives founders prudential credibility without paying the full Class F operational cost.

The Test class is Bermuda's regulatory sandbox. The BMA issues a time-limited permit (typically 12 months, extendable) to test a novel product, technology, or operating model against real customers but with bounded scope. Exit is either a full Class F upgrade or a wind-down.

Test class is appropriate for products that don't fit cleanly into the five regulated activities, or that need real-world data before committing to a full prudential stack. The BMA has been notably open to tokenisation, RWA, and stablecoin-adjacent models under this class — more open than CIMA or the SFC.

The Restricted class is the narrowest. It covers activities the BMA considers low-risk by virtue of customer type (e.g. intra-group services), geographic confinement, or technical scope (e.g. infrastructure-only). The licence is genuinely restricted — straying outside scope triggers a breach.

Capital expectations are correspondingly modest. The Restricted class is most often used by infrastructure providers supplying regulated DABA licensees rather than dealing with end customers directly.

Bermuda's Economic Substance Act 2018⁴^[4] applies to every relevant entity carrying on a relevant activity — and that captures most DABA licensees automatically. The Core Income Generating Activities (CIGAs) must be undertaken in Bermuda.

In practice this means: a physical office in Hamilton, an adequate number of qualified employees resident in Bermuda, adequate operating expenditure incurred on-island, and board meetings held with a quorum of resident directors. A PO-box-and-nominee structure does not pass ESA.

Bermuda's killer use case is fund-adjacent crypto. The island has been a global hub for (re)insurance, captive insurance, and fund administration for forty years. The professional services bench — fund admins, audit, legal, actuarial — is unusually deep for a jurisdiction of its size.

Pair a Bermuda Class M DABA with a Bermuda Segregated Accounts Company or Incorporated Segregated Account master/feeder structure and you have something Cayman simply cannot replicate at the same supervisory level. Institutional allocators value the BMA's track record more than they value a CIMA registration line.

This is also where the institutional counterparty maths starts to work. A prime broker, qualified custodian, or Tier-1 bank running diligence sees a prudential licensee, not a registrant — and that materially shortens onboarding.

Bermuda's banking sector is small but functional for licensed VASPs. There is no general retail banking access for unlicensed crypto entities — but for an entity holding a DABA Class F or Class M, the on-island banks have institutional appetite, and there are dedicated crypto-aware EMIs in Europe, the UK, and the US that will onboard a BMA licensee where they would not onboard a Cayman registrant.

USD-clearing access is the genuine constraint. A Bermuda VASP almost always pairs an on-island operating account with one or two specialist crypto-native EMIs for USD rails, and — where qualified — a US correspondent for institutional flows. The BMA understands this and does not expect a single banking relationship to do everything.

Bermuda has historically run a 0% corporate income tax regime with no capital gains, withholding, or VAT. That headline rate is intact for most DABA licensees — but the picture has shifted at the top end.

From 2025, Bermuda introduced a 15% Corporate Income Tax aligned with the OECD's Pillar Two global minimum tax. It applies only to in-scope multinational groups with consolidated revenue above €750 million. For sub-threshold founder-led VASPs, the effective rate remains 0% — but ESA and CRS reporting apply regardless.

Bermuda is a fully participating jurisdiction under the OECD's Common Reporting Standard⁵^[5]. DABA licensees are also subject to AML obligations under the Proceeds of Crime Act 1997 framework.

The Proceeds of Crime Act 1997⁶^[6] — together with its AML/ATF regulations — applies a full risk-based CDD/EDD regime to DABA licensees that is broadly comparable to 6AMLD in scope, though procedurally distinct.

Choose Bermuda when your structure is fund-adjacent, your counterparties are institutional, you want prudential credibility without Singapore's price tag or timeline, and you can afford real on-island substance.

Choose Cayman when you need the fastest, cheapest offshore wrapper, you can tolerate banking friction, and counterparty diligence is not your binding constraint. Choose Singapore when your customer base is APAC, you can clear MAS's bar, and you accept 17% CIT as the price of the gold-standard licence.

The most common Finconduit recommendation for a sophisticated crypto fund manager looking offshore is a Bermuda Class M paired with a Cayman fund vehicle — Bermuda for the supervised licensee, Cayman for the LP-facing fund wrapper. Two jurisdictions, two purposes, one structure.

Yes. Bermuda was one of the first jurisdictions globally to enact a purpose-built crypto statute — the Digital Asset Business Act 2018 — and is a participating jurisdiction under FATF, OECD CRS, and Pillar Two. The BMA is a respected prudential supervisor with a four-decade track record in (re)insurance and fund services.

The Bermuda DABA is a prudential licence — the BMA reviews capital, governance, custody, and operations on an ongoing basis. The Cayman VASP framework is closer to a registration — CIMA reviews fitness and AML programmes but does not run prudential supervision. Bermuda costs more and takes longer; Cayman is faster and cheaper.

A Class F full licence typically takes 9–15 months end-to-end. A Class M modified licence runs 6–10 months. A Test class sandbox permit can be issued in 3–6 months. Timelines depend on the completeness of the business plan, the quality of the governance team, and the BMA's prioritisation queue.

Yes. The Economic Substance Act 2018 captures DABA licensees and requires a physical office, qualified resident staff, adequate operating expenditure on-island, and board governance held in Bermuda. A nominee-and-PO-box structure does not pass ESA. Plan for $400k–$900k in annual substance cost for a Class F operation.

• Banking Offshore VASPs: Cayman, BVI, Seychelles — how offshore VASPs actually solve the banking problem, and which jurisdictions clear which rails.

• EEA/UK/Offshore Crypto Incorporation — the decision framework for where to incorporate a crypto business in 2026.

• Non-EU VASP Banking Stack — how non-EU VASPs assemble multi-rail banking across operating, USD-clearing, and settlement layers.

• The 2026 Substance Bar — what real economic substance looks like across the major offshore and onshore jurisdictions.

Bermuda is the offshore jurisdiction founders most often underestimate. It is not cheaper than Cayman or faster than BVI — but it is the only Commonwealth offshore licence that lets a fund-adjacent crypto firm sit across the table from a prime broker or Tier-1 bank and be treated as a peer, not a counterparty risk. For the right structure, that is worth every dollar of substance and every month of timeline.

A second-order point that gets lost in headline comparisons: the BMA also runs a dedicated FinTech innovation team with direct access to senior supervisors. Pre-application engagement is genuinely useful — unlike many supervisors who route founders to junior officers, BMA case officers tend to be subject-matter specialists who can give a binary read on whether a model fits a class within two or three meetings. That compresses uncertainty early, which is where most offshore licensing projects waste six months.

Bermuda's track record on enforcement also matters for the counterparty-credibility argument. The BMA has revoked licences, issued public censures, and imposed conditions on DABA holders that breached the Code. The licence is therefore meaningful — which is the underlying reason institutional counterparties take it seriously. A jurisdiction that never revokes licences is signalling the licence is ornamental; the BMA's posture signals the opposite.

The fully-loaded annual cost of running a Class F DABA operation is the line item founders most often get wrong. The licence fee itself is modest; the real cost is substance, staffing, and the prudential overlay.

• Office and substance: $120k–$250k/yr — a real Hamilton office, IT, and on-island operating spend.

• Resident senior officers: $300k–$500k/yr — MLRO, compliance lead, plus a portion of CEO/CRO time on-island.

• Audit, legal, and ICAAP: $80k–$150k/yr — Bermuda professional rates are not Cayman rates.

• BMA fees and regulatory reporting: $30k–$80k/yr depending on class and uplift.

That puts a credible Class F at $530k–$980k in annual run-rate, before regulatory capital is even committed. A Class M comes in materially lower — typically $250k–$450k/yr — which is why the M class is the workhorse for fund-adjacent SPVs that don't need full-service scope.

The BMA's review is materially different from a registration-style supervisor in three ways. First, it reads the business plan as a prudential document — capital adequacy must be tied to stressed scenarios, not balance-sheet snapshots. Second, it expects named senior officers with traceable track records, not generic CV summaries. Third, it asks about custody architecture in technical detail — segregation, key management, insurance, and the operational distinction between hot and cold storage.

Applications that treat the BMA the way they treat CIMA fail. The successful template is closer to how a BaFin or MAS application is built — risk-based, governance-heavy, capital-justified, and operationally specific. Founders who internalise that early shave six months off the timeline.

One specific area where Bermuda differs from peers: the BMA is genuinely interested in the operational resilience layer — cyber, business continuity, third-party risk. Expect detailed questioning on incident response, key-recovery procedures, and vendor concentration. This reflects the (re)insurance heritage: operational risk is treated as a first-class concern, not an annex.

Sophisticated multi-entity crypto groups increasingly treat Bermuda as a jurisdictional hedge against single-jurisdiction concentration risk. A group with a primary EU CASP, a UAE entity, and a Bermuda DABA can route institutional flows, fund-adjacent activity, and US-facing counterparty work through whichever entity offers the cleanest path — without ever being captive to a single supervisor's political weather.

This matters more than it sounds. The 2023–2024 wave of US enforcement made the cost of single-jurisdiction concentration visible in real time. Groups that had only US licensing were exposed; groups with diversified regulatory footprints — including offshore prudential licences — kept operating. Bermuda was strategically positioned because the BMA was both a credible supervisor and a politically independent one.

The same logic applies forward. If MiCA tightens, if MAS becomes more selective, if VARA adjusts capital floors — having a Bermuda licence on the shelf is option value. And unlike a Cayman registration, a Bermuda DABA is institutional enough that it can absorb business if a primary licence is constrained.

The closing operational truth is simpler. Bermuda is not the right offshore licence for every crypto founder — but it is the only offshore option that materially upgrades counterparty credibility for institutional, fund-adjacent, or settlement-facing structures. If that is the shape of the business, Bermuda's cost premium is not a cost — it is the product.