Listen to this article
0:00 / 0:00

Key Takeaways

  • Bermuda offers a defined VASP licensing regime under its Digital Asset Business Act, with licence classes matched to token issuance, exchanges, and custody.
  • Tax neutrality lets a foreign-owned crypto company hold and trade digital assets without local profit tax, though economic substance obligations still apply.
  • Counterparty reputation tends to favour a regulated Bermuda entity, but fiat settlement and crypto on/off-ramp friction can complicate banking and stablecoin rails.
  • Choosing Bermuda makes sense for licensed digital-asset operations, yet some Web3 ventures may find it the wrong fit and need practical workarounds.

A Bermuda crypto company suits operators who want a recognised regulatory credential rather than a place to hide. The jurisdiction built one of the first sector-specific digital asset frameworks anywhere, through the Digital Asset Business Act 2018, and supervision sits with a single regulator, the Bermuda Monetary Authority (BMA), whose reputation rests on decades of overseeing one of the world's largest insurance and reinsurance markets. You can read the BMA's own account of the regime on its digital asset page.

This regime rewards institutional maturity and penalises shell structures. The primary vehicle is the Exempted Company under the Companies Act 1981, with the Bermuda LLC available as an alternative, and neither carries foreign-ownership or foreign-exchange restrictions.

This article walks through licensing, token issuance, custody, tax treatment, substance, banking, reputation, and the points at which the jurisdiction stops being a sensible fit. It speaks to founders and advisers building exchanges, custodians, tokenisation platforms, or stablecoin issuers that need credible oversight, not to garage-stage protocols looking for the cheapest registration.

Two statutes govern the space. DABA regulates the conduct of digital asset business as a service, while the Digital Asset Issuance Act 2020 (DAIA), enacted 23 June 2020, governs public offers of digital assets to raise capital.

The cornerstone rule is simple: you must hold a licence before conducting digital asset activities in or from the jurisdiction. DABA predates the FATF Recommendation 15 model for virtual asset service providers but tracks it closely, including the list of licensable activities.

Around the Act sits a body of supervisory instruments, all issued by the BMA. These include the DAB Code of Practice (April 2023), the Custody of Client Assets Rules 2025, the Client Disclosure Rules 2018, and the Cyber Risk Rules 2023, the last effective 1 January 2024.

Anti-money-laundering obligations apply in parallel. The Proceeds of Crime Act 1997, its 2008 regulations, the Anti-Terrorism (Financial and Other Measures) Act 2004, and international sanctions rules all bind a licensee at once.

The framework continues to develop. A late-2024 consultation proposed amendments to DABA and the annual return rules, aimed at sharpening enforcement powers, refining definitions, and adjusting reporting requirements.

Company Incorporation in Bermuda

Set up your company in Bermuda with Expanship handling registration end to end.

The BMA grants three classes of digital asset business licence, scaled to where your venture stands.

DABA licence classes and minimum net assets
Class Purpose Minimum net assets
Test "T" Proof-of-concept testing US$10,000
Modified "M" Expanding operations for a limited period US$100,000
Full "F" Any or all digital asset business activities US$100,000

The BMA can require more capital where the nature, scale, and complexity of the business warrant it. A Class T application moves quickest; a Class F takes longer because of the depth of review.

Timing follows a published sequence: acknowledgement within two business days, a completeness check within three business days, and presentation to the Assessment and Licensing Committee within 20 business days following the first Friday after a complete application is received. That committee draws on specialists in supervision, financial technology, actuarial work, and AML compliance.

An established custodian arriving with mature governance may qualify directly for Class F. Most firms instead enter through transitional licensing, letting institutional capability develop under supervision before stepping up.

Some activities sit outside the regime. Independent miners, node validators, and data storage providers are generally exempt where they do not perform financial activities for clients, and certain funds can claim an exemption under the Digital Asset Business Exemption Order 2023 if they appoint a qualifying investment manager and file an annual notice.

No no-action letters

There is no formal "no-action" mechanism under the digital asset regimes. The BMA has offered informal reassurance on models such as gaming tokens and proprietary trading, but you cannot rely on a binding clearance before you commit.

DABA's definition of a digital asset is deliberately wide: anything in binary format carrying the right to use, including a digital representation of value. That sweep covers exchange tokens, security tokens, and utility tokens, and it captures NFTs, which are regulated rather than carved out.

Because the law regulates the business activity rather than the token's technical label, you can adjust product offerings without automatically changing your regulatory status, provided the new activity stays within an approved business plan. Tokenisation of real-world assets has taken root here, including yield-bearing stablecoins backed by US Treasuries.

A public token offering is a different matter. DAIA defines a digital asset issuance as an offer to the public to acquire digital assets, and no one may run such an offer in or from the jurisdiction without BMA authorisation.

Licensing activity under DAIA has been thin. For a project whose sole aim is a one-time public token sale with no ongoing exchange or custody business, the regulatory scrutiny is high relative to the commercial payoff, and lighter-touch venues often make more sense.

Stablecoin issuers face a defined prudential regime. The 2024 SCPS Guidance requires fiat-pegged stablecoins to hold backing assets in high-quality liquid form at least equal to the value of tokens in circulation, with independent monthly attestation and redemption rights for holders. That reserve requirement effectively shuts out algorithmic stablecoins.

Ongoing Compliance in Bermuda

Keep your Bermuda entity compliant with filings, returns, and statutory obligations.

Whether you need a licence to hold or trade depends on whether you serve anyone but yourself. An activity falls outside DABA where it is conducted purely for an entity's own business purposes or for a group undertaking, as set out in the exemption order, so pure proprietary trading for your own account with no client-facing element may sit outside the regime.

Once client assets are involved, the obligations are exacting. A licensee holding client assets must maintain a surety bond, trust account, or indemnity insurance, keep books that show client assets as segregated and identifiable at any time, and hold customer funds in a dedicated account.

The Custody Rules 2025 tighten this further. They mandate segregation, limit asset pooling without client consent, demand stricter due diligence on third-party custodians, and raise reconciliation and accounting standards.

Control of private keys is the test the BMA uses to determine control of digital assets, including where an MPC wallet relies on authorisation procedures. The Custody Code carries technical standards for managing those keys.

Reporting is fixed and audited. Financial statements must be audited under recognised GAAP for Canada, the UK, or the US, or under IFRS, and you must file an Annual Return with a Certificate of Compliance within four months of the financial year-end.

The headline position is straightforward. There is no corporate income tax for most companies, no capital gains tax, no withholding tax on dividends, and no VAT or GST, and these apply equally to trading gains, staking income, and token issuance proceeds.

Existing protection runs further. Under the Exempted Undertakings Tax Protection Act 1966, an exempted company that obtains a certificate is shielded from any newly enacted tax on income or capital gains until 2035.

A 15% Corporate Income Tax took effect on 1 January 2025, but it bites only at groups above €750 million in consolidated revenue. The vast majority of mid-market digital asset startups and protocol developers fall below that line and keep the tax-neutral position intact.

CARF reporting from 2027

The jurisdiction joins the Crypto-Asset Reporting Framework, with data collection on crypto transactions due to begin in 2027. Build transaction-level data capture and reporting infrastructure well before that date.

On treaties, set expectations clearly. There is no broad double-tax treaty network, only Tax Information Exchange Agreements with the US, the UK, and most EU states. For a crypto company with no withholding exposure on its own profits this rarely matters; it becomes relevant only where a subsidiary or investor in a treaty country faces source-country withholding on payments flowing in.

Bermuda Incorporation Pricing

See transparent pricing to incorporate and maintain a company in Bermuda.

Substance is where the cost reality lands. The Economic Substance Act 2018 and its regulations require relevant entities to have genuine local activity, and the Economic Substance Amendment Act 2026 and accompanying regulations came into force on 31 March 2026, with oversight moving from the Registrar of Companies to the Corporate Income Tax Agency.

A DABA-licensed firm running exchanges, custody, or token issuance as an ongoing service is likely classified under "finance and leasing" or "distribution and service centre" activity. Both attract the full substance test, not the reduced test for pure equity-holding entities.

The full test calls for adequate employees physically present, adequate local expenditure, suitable premises, core income-generating activities performed locally, and direction and management from within the jurisdiction. DeFi software development that generates revenue from intellectual property triggers the IP substance test, the most demanding category of all.

DABA layers a second, parallel obligation on top. The Act independently requires a head-office presence, with the BMA looking through outsourcing to confirm that mind and management sit locally, and demands resident senior officers including a Chief Executive Officer, a Chief Compliance Officer, and a Money Laundering Reporting Officer.

These rules deliberately end the viability of brass-plate shells. The practical consequence is real staffing and office cost in one of the world's most expensive places to operate, a material factor that early-stage ventures should price in before committing.

Stablecoin infrastructure has a visible foothold here. A government-led initiative works with Circle and Coinbase, with Circle Mint powering digital treasury accounts and Coinbase providing onboarding engineering, alongside a planned sovereign stablecoin, the Bermuda Digital Dollar, built on Stellar and backed by fiat reserves at traditional banks.

Live use cases exist. A BMA-run trial saw residents receive USDC by airdrop and spend it in a marketplace, cashing out through MoneyGram on-site, and the national airline accepts stablecoin payments via DABA licensee Zerohash.

Fiat settlement is the harder part. The local banking market is small, with Clarien Bank, HSBC Bermuda, Butterfield Bank, and Bermuda Commercial Bank as the principal regulated banks, and crypto companies have historically met heavy KYC scrutiny and occasional account refusal.

A DABA licence materially improves the odds of opening a local corporate account by lending regulatory legitimacy, but approval is neither guaranteed nor fast. USD wire settlement still depends on US correspondent banks, which apply their own crypto-risk policies regardless of where you are incorporated.

A digital asset business bank licensing regime, among the first of its kind, opens a path to crypto-native banking services. It does not, however, resolve every on/off-ramp friction for unlicensed or early-stage entities, and no public data confirms named global processors formally listing the jurisdiction for crypto merchant services.

Credibility is the strongest part of the case. DABA was designed to hold digital asset firms to the same standard as other financial institutions, and the regime has continued to attract legitimate institutional players.

The clean-list status matters to investors and counterparties. The jurisdiction is not on the FATF grey list or blacklist, is a CFATF member rated through FATF mutual evaluation, and appears on neither the EU list of non-cooperative tax jurisdictions nor the EU AML high-risk list. It is rated "largely compliant" by the OECD Global Forum and has committed to the Common Reporting Standard and CARF.

Institutional counterparties such as prime brokers and custodian banks generally treat a BMA DABA licence as a credible credential. It stands comparable to a Cayman Islands VASP registration or a Gibraltar DLT licence, though it sits below MiCA authorisation when the goal is EU-market access.

The constraints are real, and most have a workable response if you plan early.

  • Substance cost. A resident CEO, CCO, MLRO, and physical office create heavy fixed overhead in a high-cost market. This can be disproportionate for an early-stage token project, so model the full annual run-rate before incorporating.
  • No treaty network. Outbound profit flows usually face no withholding here, but token projects distributing income to investors in high-withholding jurisdictions should model the source-country impact rather than assume neutrality.
  • 15% CIT for large groups. Groups at or above €750 million in consolidated revenue need transfer pricing and BEPS Pillar Two planning; smaller ventures keep the neutral position.
  • Operational resilience deadline. The Operational Resilience and Outsourcing Code, finalised September 2025, requires compliance by 31 March 2028. Begin mapping important business services and impact tolerances early.
  • DeFi and DAO gap. A fully decentralised protocol without a central operator has no clear licensing pathway, despite an active DAO Working Group and a BMA consultation on embedded supervision. Structuring through a Bermuda foundation or operating company as the legal interface is the usual workaround.
  • No no-action letters. Engage the BMA's Innovation Hub for pre-application guidance, since informal comfort is possible but never binding.
  • Class T and M caps. Net-asset and liquidity limits on smaller licences mean rapid growth can force an upgrade to Class F, which costs more and takes longer. Plan the upgrade roadmap at inception.
  • US exposure. Incorporation here does not displace US securities law, CFTC jurisdiction, or FinCEN obligations where US persons are served. Separate US legal analysis is mandatory.

Some models simply do not fit, and saying so up front saves money.

A pure one-time ICO or token generation event with no ongoing exchange or custody business attracts scrutiny out of proportion to the benefit, given how little licensing activity DAIA has seen. Lighter token-offering venues, such as the BVI, a Cayman exempted offer, or a Swiss AG with a FINMA no-action position, are often more cost-efficient.

A pre-revenue protocol struggles against mandatory substance and the US$100,000 minimum for a Class F licence. The regime rewards institutional maturity and was not built for garage-stage projects.

A fully decentralised protocol with no legal entity faces unresolved ambiguity, because individuals who create, own, or control a DeFi arrangement may still fall within the FATF service-vendor definition without any safe harbour. An EU-facing retail exchange is equally ill-served, since a DABA licence carries no MiCA passport; the jurisdiction can hold a parent or treasury entity, but cannot serve as the EU regulatory home.

Algorithmic stablecoin issuers are effectively shut out by the SCPS reserve-backing requirement. Projects needing broad treaty access for royalty, interest, or dividend flows should look to a treaty-resident holding company, with a local entity used only as an operating subsidiary if at all.

The deciding factor is whether your venture is built to carry a real regulated business. For an exchange, custodian, tokenisation platform, or fiat-backed stablecoin issuer with institutional ambitions, a DABA licence delivers genuine regulatory standing on a clean, transparent footing, and the tax position remains neutral below the €750 million CIT threshold.

Weigh that against the fixed cost of mandatory local substance, which is unforgiving in one of the world's most expensive operating environments. Before committing, build a realistic annual budget for resident officers and premises, and confirm your model is not one of the cases the regime quietly closes the door on.

Expanship supports foreign founders through the full path of standing up a licensed digital asset business, from selecting the right corporate vehicle and licence class to assembling the head-office substance the BMA expects, and then keeps the entity compliant once it is live. The same team handles the wider needs of any foreign-owned company operating locally.

  • Incorporation of an exempted company or LLC suited to your licence class
  • Registered agent and registered office services
  • Economic-substance planning and tax certificate registration
  • Ongoing regulatory and filing compliance, including annual returns
  • Accounting and bookkeeping aligned to recognised audit standards
  • Introductions to local banks and digital asset banking providers

To discuss your project and map a licensing route, contact Expanship Bermuda.

Yes, in almost all client-facing cases. DABA requires a licence before you conduct digital asset business in or from the jurisdiction, including exchanges, custody, payment services, and issuance as a service. Pure proprietary trading for your own account, with no service to clients or third parties, may fall outside the regime under the Digital Asset Business Exemption Order 2023.

The minimum net assets are US$10,000 for a Test "T" licence and US$100,000 for both Modified "M" and Full "F" licences. The BMA can require more depending on the nature, scale, and complexity of your business, so treat these figures as floors rather than targets.

For most ventures, yes. There is no corporate income tax, capital gains tax, or VAT, and these apply equally to trading gains, staking income, and issuance proceeds. A 15% Corporate Income Tax took effect on 1 January 2025, but only for groups above €750 million in consolidated revenue, leaving smaller firms in a tax-neutral position.

No. A DABA licence does not produce MiCA authorisation and carries no passport into the EU single market. To reach EU retail customers you need a MiCA-licensed entity in a member state, though a local company can hold the parent or treasury function.

No. The economic substance regime and the BMA's parallel head-office test both require genuine local presence, including resident senior officers and physical premises. Attempting to operate everything from abroad fails both tests, and brass-plate structures are no longer viable.

The jurisdiction joins the Crypto-Asset Reporting Framework, with collection of crypto transaction data due to begin in 2027. You should build transaction-by-transaction data capture and reporting systems well ahead of that date rather than waiting for the deadline.