Cayman CARF vs VASP Act: Understanding the Different Scopes

Two regimes, one industry, but not the same beast.

By Paul Millen

The Cayman Islands has long been a pragmatic jurisdiction: it watches carefully, moves deliberately, and gets things right. As the digital asset industry matures and reporting regimes multiply, Cayman-based crypto businesses now face two distinct regulatory frameworks with overlapping but importantly different scopes: the OECD's Crypto-Asset Reporting Framework (CARF) and Cayman's own Virtual Asset (Service Providers) Act (VASP Act). Understanding where they diverge is not just a compliance exercise — it is a prerequisite for building any sensible operational strategy.

Two Regimes, One Industry

The VASP Act is primarily a licensing and anti-money laudering/know-your-customer (“AML/KYC”) regime. It asks: are you providing virtual asset services in or from the Cayman Islands? If so, you need a licence and you must identify your customers. The VASP Act casts a wide net over entities conducting a broad range of activities involving virtual assets — from exchange and transfer services to custody and administration — with the goal of ensuring that Cayman's marketplace meets international AML/KYC standards.

CARF, by contrast, is a tax transparency regime. It asks a different question entirely: are you effectuating exchange transactions involving relevant crypto-assets on behalf of customers as a business? If so, you are likely a Reporting Crypto-Asset Service Provider (RCASP) and you have due diligence and reporting obligations designed to expose taxable income concealed in the crypto world. Where the VASP Act is concerned primarily with who you are dealing with and whether your house is clean, CARF is concerned with telling the tax authorities what your customers did and how much it was worth.

Where the Scopes Differ

The differences in scope matter enormously in practice. A business that qualifies as a VASP under the VASP Act may not be an RCASP under CARF, and vice versa. Let’s consider a few examples.

Most plainly, the Cayman VASP Act covers issuers of in-scope virtual assets, whereas CARF does not. In addition, Cayman VASPs include purveyors of crypto custody services (i.e. wallet providers), irrespective of any participation in the sort of exchange transactions required under CARF.

The broader definitional scope does not flow only in the direction of more VASPs than RCASPs though. Cayman CARF sets out a list of specific finanical activities, such as market-making and underwriting, which might be captured by the VASP Act’s catch-all financial services category, but might well not. Finally, the VASP Act appears steadfastly uninterested in exchanges of crypto assets for real world goods and services, whereas Cayman CARF explicitly captures certain retail transactions paid for with crypto assets.

Moreoever, a party that qualifies as both a VASP and an RCASP under Cayman’s rules may nevertheless not turn out to be a Cayman RCASP because it is subject to CARF regulations in another CARF Jurisdiction with which it has a higher or equivalent level of jurisdictional contact. For example, a crypto exchange operating from Cayman that effectuates trades between customers and takes a bid-ask spread seems squarely within both definitions. Here the two regimes overlap substantially. Even then, however, CARF's jurisdictional nexus rules may mean that the exchange fulfills its CARF obligations in a CARF Jurisdiction other than Cayman. For example, a limited partnership established under Cayman’s Partnership Act is eligible for a Cayman VASP license, but is likelier to comply with CARF elsewhere if it is effectively managed outside of the Cayman Islands.

Why This Matters for CaymanBusinesses

For Cayman-based operators in the digital asset space, the practical upshot is this: VASP Act licensing and CARF compliance are separate workstreams requiring separate analyses. Assuming that VASP registration absolves you of CARF compliance — or, more troublingly that being outside the VASP Act means you are free and clear of CARF — is an error that carries real consequences as the Cayman Department for International Tax Cooperation’s (DITC’s) RCASP registration deadline of 30 April 2026 approaches.

The starting point for any Cayman digital asset business is a straightforward but careful assessment: are you an RCASP? CARFtools offers a free interactive tool to help answer exactly that question — and the answer may surprise you.

CARFtools provides practical compliance materials for RCASPs and digital asset businesses navigating Cayman’s CARF and related regimes.

Disclaimer: This article is intended for general informational purposes only and does not constitute legal or regulatory advice. Parties should seek qualified legal counsel regarding their specific obligations under the applicable CARF/DAC8 regulations.