CAYMAN ISLANDS Law and Practice Contributed by: Peter Colegate, Marsha Williamson and Dean Bennett, Appleby
rights, and fork-handling provisions are addressed explicitly in constitutional and project documents. The immutability of public blockchains creates irresolvable tension with the right to withdraw or modify works in which IP subsists, and this tension is best managed through careful contractual architecture rather than reliance on any Cayman statutory solution. 1.1.2 Regulatory Sandbox The VASP Act contains a statutory basis for a regula- tory sandbox, authorising CIMA to grant time-limited sandbox registrations or licences of up to one year to VASPs or other fintech service providers where the proposed activity presents elevated supervision, anti-money laundering (AML)/counter-terrorist financ- ing (CFT), or systemic risk, or where the novelty of the model warrants a probationary period of monitored operation before full authorisation is considered. As at the date of this guide, the sandbox provision is not yet in force as CIMA has not issued the imple- menting regulations or application procedures that would bring the sandbox to life. In the absence of a formal programme, CIMA has maintained a prac- tice of pre-application engagement with prospec- tive entrants, and this informal supervisory dialogue serves a broadly similar function – allowing regula- tors to assess novel propositions and applicants to understand regulatory expectations – but it provides no regulatory relief and confers no formal rights. 1.1.3 Regulation of Blockchain Technology Regulatory Attitude: Permissive and Facilitative The Cayman Islands government and CIMA have con- sistently adopted a permissive and facilitative stance toward blockchain and digital asset businesses. Policy is calibrated to attract credible, well-governed operators rather than to suppress innovation in the absence of identifiable harm. No particular blockchain use case is prohibited under Cayman law, and the government has actively encour- aged development through the special economic zones within Cayman Enterprise City, offering tailored incentives for web3 and technology businesses. The prohibition on retail investor participation that features in many onshore regimes is largely absent in the Cay- man context, though CIMA applies close scrutiny to
the fitness and propriety of those operating toward less sophisticated market participants. Blockchain Technology Without Crypto-Assets The use of blockchain technology in a purely infra- structural or software capacity – for example, a fund administrator using blockchain-based record-keeping – does not of itself trigger any additional regulatory obligation in the Cayman Islands beyond those appli- cable to the regulated entity generally. There is no blockchain-specific technology regulation, and CIMA does not require regulated entities to seek separate approval before deploying distributed ledger solutions within their existing businesses. CIMA’s general conduct-of-business and risk man- agement expectations apply equally to blockchain- based technology deployments. Regulated firms are expected to understand and manage the operational and technology risks associated with any material system, and to ensure that outsourcing of blockchain- based services to third parties is subject to appro- priate oversight consistent with CIMA’s outsourcing guidance. Data Privacy The Cayman Islands’ data protection framework is established by the Data Protection Act (as revised) (the DPA), broadly modelled on the EU General Data Protection Regulation. The DPA confers on data subjects the right to erasure of their personal data in defined circumstances, including where data is no longer necessary for the purpose for which it was collected. The application of this right to blockchain- recorded personal data creates an irresolvable tech- nical tension: the immutable, append-only character of most public blockchain architectures means that data recorded directly on-chain cannot, as a technical matter, be deleted. The most defensible approach is architectural: per- sonal data should not be stored on-chain at all. Blockchain-based products should record only cryp- tographic hashes, pseudonymous identifiers, or point- ers to off-chain data stores that can be modified or erased in response to a data subject erasure request. Where personal data has already been recorded on-
175 CHAMBERS.COM
Powered by FlippingBook