BVI Law and Practice Contributed by: Andrew Jowett, Patrick Gill and Jack Igglesden, Appleby
six months. At the end of the testing period (includ- ing any extension to the original testing period), the sandbox participant must employ an exit strategy and exit the regulatory sandbox by applying to transition to continue as a licensee or wind down operations. An application for entry into the sandbox will consist principally of a business proposal to cover, among other things, the following: • the proposed product or service, and how this encompasses innovation to improve accessibil- ity, efficiency, effectiveness, security, quality in the provision of, or addresses shortcomings or opens up new opportunities in, financial services or the regulation thereof; • the testing already carried out on the proposed product (with the expectation that testing, to the extent permitted by legislation, will be carried out prior to entry into the sandbox); • details on the proposed customers (including estimated numbers, investment experience and geographical reach); • an analysis of the risk profile of the proposals and the measures to be taken to manage those risks; • an indication of the resources (whether financial, technological, human or otherwise) available to the application; and • a strategy for exiting the sandbox. 1.1.3 Regulation of Blockchain Technology The Commission recognises the importance of new technologies used to provide or support financial ser- vices business and the potential impact on financial services being offered in or from within the BVI. Indus- try stakeholders, including regulators and regulated entities, are increasingly relying on fintech to obtain economies of scale, to facilitate financial supervision and compliance, to improve the delivery of services and to manage risks. In March 2025, the Commission announced the estab- lishment of a VASP Advisory Committee (the Com- mittee) which formalises the membership of a core group of persons from within the private sector with whom the Commission engages on matters relating to VASPs and the VASP Act. Such a forum, made up of a number of industry stakeholders, is a welcome initia-
tive and reflects a positive approach to collaboration and transparency within the jurisdiction. The BVI operates a technology-neutral approach for regulating blockchain, which does not seek to regulate the technology that underlies virtual assets or VASP activities but the natural or legal persons behind such technologies that conduct VASP activities as a busi- ness on behalf of another natural or legal person. This approach is in line with the Financial Action Task Force (FATF) Standards from which the VASP Act derives. Data Protection The BVI’s Data Protection Act, 2021 (DPA), is drafted around a set of EU-style data protection principles to which data controllers must adhere. Personal data must be collected in a fair and transparent manner and only be used and disclosed for purposes prop- erly understood and agreed to by data subjects. Any personal data collected must be adequate and kept up to date, and should not be retained for longer than is necessary to fulfil the collection purposes. Importantly, the DPA provides a standard framework for both public and private entities in the management of the personal data they use. Internationally active organisations will find many similarities between the DPA and data protection laws of other jurisdictions where they are active, but there are some key differ- ences. The DPA provides for a lighter-touch approach to data protection regulation than other jurisdictions in the region. BVI courts recognise and subscribe to the common law duties of confidentiality and privacy, and English common law is persuasive, although not binding, in the BVI. As a result, all entities that manage and main- tain personal data will be subject to the common law duty of confidentiality described above. The duty of confidentiality has also been codified in various aspects of BVI legislation, in particular the Banks and Trust Companies Act, 1990 (as amended), which regulates all banking and trust/fiduciary-related activities in the BVI. Licensed operators of such busi- nesses, regulated by the Commission, are under a general obligation to maintain the confidentiality of a client’s personal data unless the individual has grant-
152 CHAMBERS.COM
Powered by FlippingBook