Blockchain.com Secures Cayman VASP Custody Licence: What Accounting Firms and CFOs Must Assess Now
On 22 July 2026, the Cayman Islands Monetary Authority granted Blockchain.com a full virtual asset service provider custody licence. The approval is not just a corporate milestone. For accounting firms, auditors, and CFOs that hold digital assets through third-party custodians or process client transactions via licensed platforms, a newly regulated counterparty in a major offshore financial centre reshapes due-diligence obligations, AML documentation requirements, and how those relationships are recorded in your crypto accounting software. This article unpacks what happened, why the Cayman licence matters beyond the press release, and the specific steps practitioners should take across each affected jurisdiction.
What CIMA Actually Approved
The Cayman Islands Monetary Authority issued the VASP custody licence on 22 July 2026. The pathway was not sudden: CIMA had issued a conditional approval in December 2025, giving Blockchain.com roughly seven months to satisfy the outstanding regulatory conditions before the full licence was granted.
Scope of the Licence
The licence covers three distinct activities. First, regulated crypto custody, meaning the safekeeping of digital assets on behalf of clients. Second, crypto-to-fiat exchange services. Third, crypto-to-crypto exchange services. Bundling custody with exchange permissions under a single VASP licence is significant: it means Blockchain.com can offer a more complete institutional stack to clients domiciled or operating in the Cayman Islands without routing each activity through a separate regulatory wrapper.
The Company's Existing Cayman Footprint
Blockchain.com has held a VASP registration in the Cayman Islands since May 2022. A registration and a licence are not the same thing under CIMA's framework. Registration is a lighter-touch entry point; a full licence implies a higher standard of scrutiny, including capital adequacy, governance, AML controls, and ongoing supervisory engagement. The upgrade from registered to fully licensed is therefore a material step up in regulatory standing, not a routine administrative renewal.
The Multi-Jurisdiction Regulatory Picture
Lane Kasselman, co-CEO of Blockchain.com, placed the Cayman approval in a broader context. The company has also obtained a Markets in Crypto-Assets Regulation licence in Europe and authorisation from the UK Financial Conduct Authority. The three licences together, covering the Cayman Islands, the European Union, and the United Kingdom, represent a deliberately constructed multi-jurisdiction regulated presence.
Why This Matters for Counterparty Risk Assessment
For accounting firms advising corporate clients and for CFOs managing treasury positions in digital assets, the identity and regulatory status of a custodian is a first-order risk variable. A custodian that holds a CIMA licence, a MiCA authorisation, and an FCA approval is categorically different from one that operates under a single lighter-touch regime or no licence at all. Counterparty due diligence should be updated to reflect the elevated regulatory standing, and that update should be documented in your engagement records and, where relevant, in board-level risk registers.
MiCA and UK FCA Context
The EU's MiCA framework, now in full effect for crypto-asset service providers, requires CASPs to maintain authorisation before offering services to EU clients. The FCA's registration regime for cryptoasset businesses similarly sets baseline AML and conduct standards. Blockchain.com holding approvals under both frameworks means EU and UK institutional clients dealing with the firm can point to a regulated counterparty when satisfying their own AML and governance obligations. Our earlier coverage of ESMA's fourth MiCA update and the growing CASP register provides useful context on how authorised CASPs are being tracked at a pan-European level.
Accounting and Audit Implications
A custodian's regulatory status affects more than contract selection. It flows directly into how digital asset positions are disclosed, audited, and managed on a balance sheet.
Custodian Assessment Under IFRS and UK GAAP
Under IFRS 9 and IAS 32, when an entity holds digital assets through a custodian, the question of whether those assets remain on the entity's balance sheet depends in part on whether the custodian holds them in a segregated, identifiable way. A CIMA-licensed custodian operating under explicit regulatory requirements for asset segregation provides a stronger audit trail than an unlicensed or lightly registered intermediary. Auditors reviewing crypto holdings should verify that the custodian's licence documentation, including the specific permissions granted by CIMA, is on file and current.
Digital Asset Accounting Software Workflows
Firms using crypto accounting software to reconcile client digital asset positions will need to ensure that any data feeds or API connections to Blockchain.com custody accounts are correctly mapped to reflect the entity's licence status and service scope. Exchange services, custody balances, and fiat conversion events each carry different accounting treatment. A single platform offering all three under one licence makes transaction categorisation more complex, not simpler, because the same counterparty may generate custody records, trading records, and fiat settlement records that must be accounted for separately.
AML Documentation for Accounting Firms
Under the UK's Money Laundering Regulations 2017 and equivalent EU frameworks, accounting firms carrying out designated activities must apply customer due diligence to their own clients and, in some circumstances, must assess the AML standing of third parties through whom client assets pass. Where a client uses Blockchain.com as a custodian, the firm's MLRo (Money Laundering Reporting Officer) or equivalent should update the client's risk file to record the custodian's CIMA licence details, the date of grant, and the scope of permitted activities. This is standard practice but is often overlooked when a counterparty's status changes mid-engagement.
Cayman Islands Regulatory Framework: Brief Context
The Cayman Islands is a significant offshore financial centre hosting a large proportion of crypto funds, structured vehicles, and institutional treasury arrangements. CIMA's VASP regime, introduced under the Virtual Asset (Service Providers) Act, requires entities carrying on virtual asset business to either register or obtain a full licence depending on the nature and scale of their activities. Custody specifically, because it involves holding client assets, typically attracts the higher licensing bar. The December 2025 conditional approval and the July 2026 full grant suggest CIMA conducted a detailed review over that period before confirming that Blockchain.com met the full licensing standards.
Implications for Cayman-Domiciled Funds and SPVs
Many investment funds structured in the Cayman Islands hold digital assets either directly or through sub-funds and SPVs. Fund administrators and their accounting advisers should note that engaging a CIMA-licensed custodian can satisfy part of the fund's own regulatory obligations regarding asset safekeeping. Where a fund's constitutional documents or investor agreements specify the use of a regulated custodian, Blockchain.com's newly licensed status may now qualify it for that role in a way that its prior registration alone may not have. Legal counsel should confirm this point for each fund structure, but accounting teams should flag the question as part of their next operational review cycle.
CFO Action Points
CFOs overseeing treasury functions that include digital asset positions have several immediate areas to review following this development.
Counterparty Registry Update
If Blockchain.com appears anywhere in your counterparty registry, its status should now be updated to reflect the full CIMA VASP custody licence granted on 22 July 2026, alongside the existing MiCA and FCA authorisations. The licence number and scope should be recorded rather than just a general note that the entity is "regulated." This level of granularity matters in the event of an audit or regulatory inspection.
Treasury Policy and Governance
Many corporate treasury policies set minimum regulatory thresholds for custodians. If your policy required a full VASP licence rather than just a registration, the 22 July grant may open Blockchain.com's custody service as a permitted option in the Cayman Islands for the first time. Conversely, if your policy has not been reviewed since the firm's regulatory landscape has changed, this is a prompt to do so. Our coverage of Bybit's Austrian EMI licence and what dual-entity EU structures mean for accounting firms illustrates how quickly the licensed custodian landscape is shifting across multiple jurisdictions simultaneously.
Insurance and Indemnity Considerations
Some cyber and crime insurance policies covering digital asset losses contain provisions that reduce coverage if assets are held with an unlicensed or non-regulated custodian. A custodian's upgrade from registration to full licence may therefore have a direct bearing on your insurance position. Brokers and risk managers should be notified of material changes in custodian regulatory status as a matter of routine.
What Comes Next
The Cayman licence is a point-in-time approval. CIMA, like all licensing authorities, conducts ongoing supervision. Accounting firms should build a process to monitor whether licensed counterparties maintain their approvals, particularly in a regulatory environment where licence suspensions and revocations are increasing across multiple jurisdictions. Setting a calendar reminder to check CIMA's public VASP register annually is a low-cost control that protects the firm's AML and counterparty-risk documentation.
At the same time, the multi-jurisdiction approval pattern emerging across the industry, with CIMA, MiCA, and FCA licences being sought in parallel, signals that institutional custody providers are investing heavily in regulatory infrastructure. For firms advising clients on digital asset strategy, this trend is relevant: the pool of custodians that can satisfy stringent regulatory requirements across multiple client domiciles is growing but remains small. Tracking which firms hold which licences, and maintaining that data in your crypto bookkeeping software workflows, is becoming a basic operational competence rather than a specialist task.
Frequently Asked Questions
What is the difference between a CIMA VASP registration and a full VASP licence?
A VASP registration under the Cayman Islands' Virtual Asset (Service Providers) Act is an entry-level status that allows a firm to carry on virtual asset business with relatively lighter regulatory requirements. A full VASP licence, by contrast, involves a more intensive application process, including assessments of governance, capital adequacy, AML controls, and fitness of key personnel. Custody activities, which involve holding client assets, typically require the higher licensed status rather than simple registration.
Does a CIMA custody licence automatically satisfy EU or UK custody requirements?
No. Regulatory licences are jurisdiction-specific. A CIMA VASP custody licence satisfies Cayman Islands regulatory requirements. To serve EU clients under MiCA, a CASP must hold a separate MiCA authorisation in an EU member state. For UK clients, FCA registration or authorisation is required. Blockchain.com holds all three separately, which is why it can serve clients across each jurisdiction, but holding one does not substitute for the others.
How should an auditor treat digital assets held at a CIMA-licensed custodian?
The auditor should obtain and inspect the custodian's current licence documentation, confirm the scope of permitted activities matches how the client is using the custodian, and verify that assets are held in a segregated manner consistent with the licence conditions. Evidence of a valid CIMA licence supports, but does not replace, direct confirmation of balances with the custodian and a review of the custodian agreement's asset-segregation provisions.
What AML records should an accounting firm maintain when a client's custodian obtains a new licence?
The firm's client risk file should be updated to record the custodian's name, the licensing authority, the licence reference number, the date of grant, and the scope of activities covered. Any change in the custodian's regulatory status, whether an upgrade, a condition, or a revocation, is a material change that should trigger a refresh of the client's risk assessment rather than being noted informally.
Where can I verify that a Cayman Islands VASP is currently licensed?
CIMA maintains a public register of virtual asset service providers on its official website. Firms should use that register as the primary verification source rather than relying solely on representations made by the VASP itself. The register records both registrations and full licences and is updated when status changes.
Source: Cointelegraph