In February 2026, the Cayman Islands Monetary Authority (“CIMA”) published its Rule and Statement of Guidance on Market Conduct for Virtual Asset Service Providers ( “RSOG”). This marks a significant evolution in Cayman’s virtual asset regulatory framework, shifting regulatory focus beyond AML compliance towards how VASPs behave in the market, communicate with clients, and protect client interests, similarly to regulations in Europe or US.

For regulated VASPs, RSOG introduces rules across marketing, disclosures, conflicts of interest, client agreements, proprietary trading, complaints handling, and custody practices. In practice, all Cayman-registered and licensed VASPs should now be conducting a full review of the Market Conduct Policy and several related policies, alongside a detailed assessment of their website disclosures, client documentation, and operational controls.

From Prudential Regulation to Market Behavior

Historically, Cayman Islands VASP regime has been perceived as prudential and AML-centric: licensing, governance, outsourcing, cybersecurity, custody segregation, and financial crime controls. Some elements of market conduct were included in the Rule for custodians and trading platforms. As the VASP market matures, the RSOG introduces conduct standards equivalent to those seen in traditional financial markets, adapted for the realities of virtual assets.

VASPs must act “honestly, fairly, professionally and in the best interests of their Clients,” and must be able to demonstrate this through documented policies, operational evidence, and transparent disclosures.

Mandatory Review of Market Conduct and Related Policies

A central implication of the RSOG is that existing Market Conduct Policies are almost certainly insufficient if they were drafted prior to February 2026.

At a minimum, VASPs should be reviewing:

• Market Conduct Policy
• Conflicts of Interest Policy and Register
• Marketing & Communications Policy
• Client Onboarding and Client Agreement templates
• Complaints Handling Policy and Complaints Log
• Proprietary Trading Policy (where applicable)
• Custody Policy (for custodians)
• Disclosure Framework and Website Compliance Content

As per existing Rule on Internal controls, CIMA is explicit that policies must not merely exist – they must be implemented, evidenced, and aligned to the firm’s operating model. Group-wide policies may be used, but only where Cayman-specific legal and regulatory requirements are fully met and any gaps are addressed.

Marketing, Advertising and Promotions

One of the most detailed sections of the RSOG addresses marketing and client communications, reflecting global regulatory concern over misleading crypto promotions.

VASPs must ensure that all marketing and promotional materials are:

• Fair, clear, and not misleading.
• Clearly identifiable as marketing.
• Free from exaggerated claims, guarantees, or implied safety.
• Balanced, with risks disclosed as prominently as benefits.
• Suitable for the target audience’s level of sophistication.

CIMA specifically cautions against language implying certainty or urgency, such as “guaranteed,” “assured,” or references to speculative future value. Where performance data is shown, it must be contextualised and accompanied by appropriate risk warnings.

Critically, these obligations apply to websites, social media, newsletters, investor decks, dashboards, and any other communication channel.

In effect, CIMA is signaling that risk disclosure must be clear, prominent, and integrated into the client journey. For example Rule 9.3 e) states: “(…) uses a font size in the indication of relevant risks that is at least equal to the predominant font size used throughout the information provided, as well as a layout that ensures that such an indication is prominent;”

VASPs should also note the requirement to retain records of marketing campaigns, making them available to the Authority upon request.

Website and Public Disclosure Obligations Are Now Explicit

For the first time, CIMA sets out a structured expectation around public disclosures, transforming what was previously a best-practice area into a clear compliance obligation.

VASPs must publicly disclose, in an accessible and understandable manner:

• Their licensing or registration status and authorised number
• Key governance structures
• Members of the Governing Body, Senior Management, and Control Functions

As per Statement of Guidance, the disclosures should also include:

• Material changes to operations, ownership, services, or risk profile
• Fee structures and changes and material risks associated with services
• Regulatory status

These disclosures must be kept up to date and presented consistently across communication channels. Where a VASP operates within a group, clients must clearly understand which legal entity they are transacting with and what regulatory protections apply.

From a practical standpoint, many VASP websites will now require review.

Conflicts of Interest

The RSOG strengthens expectations around conflicts of interest.

VASPs must:

• Identify, document, and manage conflicts of interest
• Maintain a formal conflicts register
• Ensure appropriate segregation of duties
• Require annual conflict declarations from directors and senior officers
• Disclose conflicts or potential conflicts to clients in writing

Where conflicts arise, affected individuals must recuse themselves from decision-making, and clients must be provided with sufficient detail to make an informed decision.

This is particularly relevant for VASPs operating hybrid models (e.g. custody plus trading, proprietary trading alongside client execution, or group-wide shared services).

Client Agreements

The RSOG introduces granular guidance on client onboarding and client agreements.

Key obligations include:

• A written client agreement must be in place before services commence
• All fees, commissions, charges, and inducements must be clearly disclosed
• Limitation of liability and indemnities must not be unreasonably one-sided
• Key risks must be disclosed in plain language and acknowledged by clients
• Clients must receive advance notice of material contractual changes

CIMA also expects firms to assess client suitability, taking into account knowledge, experience, risk tolerance, and financial position – particularly where discretion or complex products are involved.

Complaints Handling

Under the RSOG, VASPs must implement formal, transparent, and auditable complaints frameworks.

Minimum requirements include:

• Written complaints handling policies
• Clear public disclosure of how to submit a complaint
• Written acknowledgement without delay
• Timely investigation and resolution
• A maintained complaints log with prescribed data points
• Escalation to the Authority where complaints indicate material risk

The Governing Body must also receive regular reporting on complaints trends, reinforcing board-level accountability.

Proprietary Trading and Market Abuse Controls

For VASPs that trade on their own account or operate trading platforms, the RSOG introduces robust expectations around market integrity.

Firms must implement controls to prevent:

• Insider trading
• Market manipulation (including spoofing, wash trading, front-running)
• Preferential treatment of proprietary trades

This includes real-time surveillance, escalation procedures, information barriers, and auditable data access controls. Importantly, client data must not be used to gain trading advantage, unless anonymised or expressly consented to.

Custodians and Trading Platforms

Despite a separate rule on conduct for custodians and trading platforms, Rules 15 and 16 add some new or enhanced requirements to the existing framework, including:

• Market Abuse
• Pricing policies
• Clear segregation of client assets
• Disclosure of storage methods (hot, cold, hybrid)
• Quarterly client updates on storage posture
• Clear treatment of staking rewards, airdrops, and governance rights
• Incident reporting to CIMA and affected clients within 72 hours

Custodians must also maintain daily reconciliations and provide clients with mechanisms to verify holdings, including on-chain or read-only access where appropriate.

Enforcement and Supervisory Focus

As a reminder, the Market Conduct RSOG is fully enforceable. A breach of Rules may lead to the imposition of a fine or regulatory action, while SOG represents measures against which CIMA will assess compliance of licensees.