Cayman extends its cybersecurity rule to virtual asset service providers
14 APRIL 2023, GEORGE TOWN
The Cayman Islands extended its cybersecurity rule to virtual asset service providers on 14 April 2023. The move brought VASPs under the same cybersecurity expectations as other regulated entities, broadening the rule's scope to cover the digital asset sector. It signalled that the jurisdiction treats virtual asset businesses as subject to the same baseline security obligations.
Extending a rule is a beginning rather than an end. A 2025 review found gaps that remained to be addressed, which shows supervisors expect to refine expectations as they see how firms implement them. The review turned the initial extension into an ongoing process of tightening, rather than a one-time change that settled the matter.
Cybersecurity obligations connect naturally to quantum risk. The rule covers the protection of systems and data, which depends on cryptography, so quantum-vulnerable algorithms fall within its concern as the threat grows. VASPs under the rule have a basis to treat quantum risk as part of the cybersecurity obligations they already must meet.
Why it matters. Cayman's extension of its cybersecurity rule to VASPs placed digital asset firms under a recognised security baseline, and the 2025 review shows the regulator intends to keep refining it. Because the rule covers the cryptography protecting systems and data, it gives quantum risk a home among existing obligations. VASPs can address quantum readiness as part of meeting a cybersecurity rule that already applies to them.