British Virgin Islands: Fintech 2021

Appleby's recently published Q&A chapter in the International Comparative Legal Guides (ICLG) 'Fintech 2021' edition offers a practical cross-border insight into fintech law for the British Virgin Islands.

1. THE FINTECH LANDSCAPE

1.1: Please describe the types of fintech businesses that are active in your jurisdiction and the state of the development of the market, including in response to the COVID-19 pandemic. Are there any notable fintech innovation trends of the past year within particular sub-sectors (e.g. payments, asset management, peer-to-peer lending or investment, insurance and blockchain applications)?

• The British Virgin Islands (BVI) is recognised across the globe as a leading offshore financial centre which, as at 31 December 2020, had over 366,000 registered companies. Based on the attractiveness of BVI vehicles for international businesses, asset holding and investments, there has been an increase in the use of BVI companies as holding and operating companies across the fintech industry, and those trends follow those globally (moving from token offerings, towards decentralised finance, non-fungible tokens and other products). The BVI has, in turn, been enthusiastic to this opportunity and has sought to welcome this new business, with an attractive and pragmatic regulatory approach.

1.2: Are there any types of fintech business that are at present prohibited or restricted in your jurisdiction (for example cryptocurrency-based businesses)?

• As at the date of writing, there are no particular types of fintech businesses that are prohibited within the BVI; however, there are certain businesses that require licensing (see question 3.1 for more detail) and must meet prescribed criteria in order to obtain such a licence. The BVI does currently restrict gambling businesses, and so businesses that straddle fintech and gaming should take legal advice before proceeding to incorporate in the BVI. In August 2020, the BVI sought to remove the outright restriction on gambling activities and replace this with a licensing regime pursuant to the BVI Gaming and Betting Control Act, 2020. This proposed Act would capture entities operating in the "gaming and betting sectors", including the manufacturing, selling, supplying, installing or adapting of gaming software and providing facilities for betting of any kind. Whilst approved by the BVI government, this new regime has yet to be brought into force.

2. FUNDING FOR FINTECH

2.1: Broadly, what types of funding are available for new and growing businesses in your jurisdiction (covering both equity and debt)?

• The BVI is a popular jurisdiction for the incorporation of international businesses, and BVI companies are able to access international debt and equity capital markets. For new businesses, where obtaining debt may be hindered by a lack of track record, the BVI is a well-known jurisdiction for seed capital, angel investors and venture capital, as well as for funds targeting more established ventures.

2.2: Are there any special incentive schemes for investment in tech/fintech businesses, or in small/medium-sized businesses more generally, in your jurisdiction, e.g. tax incentive schemes for enterprise investment or venture capital investment?

• There are currently no special incentive schemes for investment in tech/fintech businesses in the BVI. The BVI is a tax-neutral jurisdiction, and entities incorporated within the BVI are zero-rated for income tax, and are not subject to capital gains tax. The BVI does not impose stamp duty on share transfers, and no withholding tax is applicable to share dividends.

2.3: In brief, what conditions need to be satisfied for a business to IPO in your jurisdiction?

• The BVI does not yet have a securities exchange, and so BVI companies wishing to IPO will need to look to exchanges outside of the BVI. The conditions to listing would, at the date of writing, be governed by the requirements of such exchange outside of the BVI. The flexibility of BVI corporate law makes the BVI a good choice for a listing vehicle.

2.4: Have there been any notable exits (sale of business or IPO) by the founders of fintech businesses in your jurisdiction?

• Notable examples include the de-SPAC of eToro, a stock and cryptocurrency exchange, which was announced in March 2021. EToro Group Ltd will merge with a wholly owned subsidiary of FinTech Acquisition Corp. V, a special purpose acquisition company, with eToro having an estimated implied equity value of approximately US$10.4 billion at closing and seeking listing on NASDAQ.

3. FINTECH REGULATION

3.1: Please briefly describe the regulatory framework(s) for fintech businesses operating in your jurisdiction, and the type of fintech activities that are regulated.

There are, as at the date of writing, no specific regulations in the BVI targeting fintech businesses generally, but where a fintech's business is focused on financial products and services, they may require licensing under the BVI's existing financial services regulations, being:
the Securities Investment Business Act, 2010 (as amended) (SIBA), which provides for the licensing of persons who are engaged in investment businesses in or from within the BVI, and for the licensing of investment funds (including funds with cryptographic fund interests);

• The Financing and Money Services Act, 2009 (as amended), which provides for the licensing of, among other areas, peer-to-peer lending platforms, fiat credit providers (in certain circumstances), money transmission businesses and fiat currency exchanges;
• The Banks and Trust Companies Act, 1990 (as amended), for fintech companies that accept fiat deposits in a manner akin to banking; and
• The Insurance Act, 2008 (as amended) for insurtech businesses.

3.2: Is there any regulation in your jurisdiction specifically directed at cryptocurrencies or crypto assets?

• As at the date of writing, there is no separate framework for the regulation of cryptocurrencies or crypto assets in the BVI. Instead, the BVI has relied upon existing legislation regulating financial instruments to capture digital assets where they exhibit characteristics of a financial product or security. To date, the primary piece of legislation affecting the regulation of digital assets (including cryptocurrencies) in the BVI has been SIBA (see question 3.1), which sets out an exhaustive list of instruments considered to be "investments" in the BVI (which include, for example, shares, debt instruments, futures and contracts for difference). Where a digital asset exhibits characteristics of an "investment" under SIBA, the issuer of the asset will be either dealing in, or arranging deals in, securities, although the issuer's activities may fall within a list of excluded activities or safe harbours under SIBA. The provisions of SIBA would not typically capture most cryptocurrencies (including, for example, bitcoin or ether) or utility tokens, but may cover digital assets which exhibit features of, for example, future property ownership, derivatives or revenue sharing. In July 2020, the BVI regulator, the Financial Services Commission (FSC), issued further guidance on the types of digital assets that would be seen to be "investments" under SIBA. In response to the Financial Action Task Force's (FATF) recommendations for a risk-based approach to digital assets and service providers, the BVI is proposing to enhance its regulatory landscape with regulation specifically directed at digital assets. It is expected that these regulations could be in force by early Summer 2021, after a short public consultation period. Such regulations are expected to follow the FATF recommendations and require the licensing and/or registration of "virtual asset service providers", increased supervision and monitoring and increased anti-money laundering requirements.

3.3: Are financial regulators and policy-makers in your jurisdiction receptive to fintech innovation and technology-driven new entrants to regulated financial services markets, and if so how is this manifested? Are there any regulatory 'sandbox' options for fintechs in your jurisdiction?

• The BVI has been positioning itself as a welcoming jurisdiction for fintech innovation, and has been coordinating efforts to both educate the population of the BVI as to new technologies, and to attract fintech businesses to incorporate in the BVI. The FSC launched a regulatory sandbox in 2020, aimed at companies, whether start-ups or established existing businesses, looking to develop, promote, utilise or implement new technology in the financial services sector. The sandbox gives companies, and their customers, the benefit and comfort of regulatory oversight, but reduces the requirements that would normally be overly costly or burdensome on new ventures. The first sandbox entrant was announced in April 2021. The BVI sandbox is open to any companies or limited partnerships incorporated in the BVI, as well as non-BVI companies looking to conduct business in the BVI. Once admitted, a participant can remain in the sandbox for up to 18 months, with the opportunity to extend for a further six months. The application consists primarily of a business proposal, with follow-on discourse with the FSC to establish parameters for activity once in the sandbox.

3.4: What, if any, regulatory hurdles must fintech businesses (or financial services businesses offering fintech products and services) which are established outside your jurisdiction overcome in order to access new customers in your jurisdiction?

In general, the regulations listed in question 3.1 apply to entities operating "in or within the BVI", regardless of their place of establishment. Consequently, where a non-BVI company is caught by such regulations, the first step is to establish whether that non-BVI company is actually operating "in or from within" the BVI. Under SIBA, a person is determined to be operating "in or from within" the BVI if:

• they occupy premises in the BVI for the purposes of carrying on investment business; or
• they solicit a person in the BVI for the purpose of offering to provide a service that constitutes investment business. As noted above, the BVI is a common jurisdiction for holding companies, and it is relatively unusual for BVI entities to have any employees or other representatives actually within the BVI, other than its registered agent. The solicitation of such an entity, by the non-BVI company, would not, in our view, result in the non-BVI company being deemed to be operating in or from within the BVI, provided that no solicitation actively takes place in the BVI and correspondence is made to an address outside the BVI. If the non-BVI company, which falls within the remit of the financial services legislation, wishes to actively solicit new customers physically in the BVI, licensing will be required. In general, there is no "passporting" or mutual recognition applicable in the BVI, and so entities that operate outside of the BVI, but which wish to actively solicit customers within the BVI, will need to register in the BVI where they fall within the remit of the BVI financial services legislation, regardless of whether they are already regulated in another jurisdiction.

4. OTHER REGULATORY REGIMES/NON-FINANCIAL

4.1: Does your jurisdiction regulate the collection/use/ transmission of personal data, and if yes, what is the legal basis for such regulation and how does this apply to fintech businesses operating in your jurisdiction?

• As at the time of writing, there is no formal legislation in force which regulates data protection in the BVI. Notwithstanding the lack of data protection legislation, BVI courts do recognise and subscribe to the common law duties of confidentiality and privacy and English common law is persuasive, although not binding in the BVI. In addition, the duty of confidentiality has been codified in various BVI legislation, such as the Banks and Trust Companies Act, 1990 (as amended) (see question 3.1), which requires licensees to maintain confidentiality of their clients' personal data, unless the client has granted specific permission for its disclosure. On 13 April 2021, the BVI introduced the Data Protection Act, 2021 (the DP Act). The DP Act, while final and assented to by the BVI government, is not yet in force and there has been, at the point of writing, no indication as to when this might come into effect. Once brought into force, the DP Act will apply to all private bodies who process or have control over, or authorises the process, of personal data in respect of commercial transactions.

4.2: Do your data privacy laws apply to organisations established outside of your jurisdiction? Do your data privacy laws restrict international transfers of data?

• As noted at question 4.1, there is no formal personal data legislation currently in force in the BVI. The common law duties described at question 4.1 will only apply to entities who are within the remit of the BVI courts. The DP Act, once in force, will apply to any persons established in the BVI, and persons not established in BVI but who use equipment in the BVI to process personal data, otherwise than for the purpose of transit through the BVI. For these purposes, all entities incorporated in the BVI will be treated as "established in the BVI", alongside partnerships and other incorporated entities formed under BVI laws, persons who are physically in the BVI for 180 or more days in any year, and persons who maintain an office, branch agency or regular professional practice in the BVI. The DP Act, once in force, will restrict data controllers from transferring personal data outside of the BVI without adequate safeguards or consent from the subject.

4.3: Please briefly describe the sanctions that apply for failing to comply with your data privacy laws.

• As noted at question 4.1, there is no formal personal data legislation currently in force in the BVI, and sanctions will be determined by the courts. Once brought into force, the DP Act will prescribe fines against bodies corporate of up to US$250,000 on summary conviction and up to US$500,000 on indictment. Where an offence is committed under the DP Act by a body corporate, but with the consent or connivance, or which is attributable to the negligence, of any director, manager, secretary or other similar officer, that person may be proceeded against in their individual capacity, and may face fines of up to US$100,000 and/or imprisonment up to five years on indictment.

4.4: Does your jurisdiction have cyber security laws or regulations that may apply to fintech businesses operating in your jurisdiction?

• The proposed DP Act (see question 4.1) includes requirements on the protection of personal data from any loss, misuse, modification, unauthorised or accidental access or disclosure, alteration or destruction, and ensuring adequate measures are in place to ensure the safety of such personal data. The Computer Misuse and Cybercrime Act, 2014 (as amended) criminalises, among other things, unauthorised access to and use of computer materials, and was amended in 2019 to include offences relating to electronic defamation, forgery and fraud and sending offensive messages through a computer and spoofing. Licensees under those regulations listed in question 3.1 and who rely heavily on technology infrastructure will be expected by the regulator to have robust IT security systems, and may be required to undertake security audits.

4.5: Please describe any AML and other financial crime requirements that may apply to fintech businesses in your jurisdiction.

• All BVI-incorporated entities are subject to the BVI Proceeds of Criminal Conduct Act, 1997 (as amended), which sets out the principal money laundering offences, including possessing proceeds of crime, assisting another to facilitate the concealment of proceeds of crime, failing to report suspicious activities and tipping-off. Certain "relevant" businesses (which would include, for instance, entities caught within the BVI financial services regulations listed at question 3.1 and other entities thought to be at a higher risk of money laundering) are further subject to the BVI Anti-Money Laundering Regulations, 2008, and the AntiMoney Laundering and Terrorist Financing Code of Practice, 2008 (each as amended), which prescribe certain identification, record-keeping and internal control procedures for such businesses. Whilst the BVI has not yet enacted the FATF's recommendations for a risk-based approach to digital assets and service providers, we expect that the upcoming virtual asset legislation (see question 3.2) will result in virtual asset service providers (as such term is defined by the FATF) being brought inside the scope of the BVI Anti-Money Laundering Regulations, 2008, and the Anti-Money Laundering and Terrorist Financing Code of Practice, 2008, and being required to comply with the identification, record-keeping and internal control procedures prescribed therein

4.6: Are there any other regulatory regimes that may apply to fintech businesses operating in your jurisdiction?

• In addition to those financial regulations discussed above (see question 3.1), upcoming virtual asset legislation (see question 3.2), economic substance requirements (see question 6.4) and incoming data protection legislation (see question 4.2), fintech businesses operating from the BVI will need to comply with general corporate and criminal legislation and consumer protection legislation.

5. ACCESSING TALENT

5.1: In broad terms, what is the legal framework around the hiring and dismissal of staff in your jurisdiction? Are there any particularly onerous requirements or restrictions that are frequently encountered by businesses?

• The majority of entities incorporated within the BVI operate outside of the territory, without staff physically in the jurisdiction. Where entities do wish to have staff within the BVI, the primary restrictions are the protections in place for the interests of BVI "belongers", being, in simple terms, persons with BVI ancestry or who are granted belongership through marriage or residence. Nonetheless, for the financial services and fintech sectors, the labour market has been supplemented with a large number of non-BVI nationals. If a business, whether BVI-incorporated or otherwise, wished to hire staff within the BVI, they would generally be required to obtain a trade licence under the Business, Professions and Trade Licences Act, 1989. There are varying requirements under such Act for obtaining a trade licence, depending on the business concerned. At the time of writing, there are proposals to reform the trade licence procedure, which, it is hoped, will speed up and clarify the process. Businesses licensed under certain financial services legislation (see question 3.1) are exempt from a requirement to obtain a trade licence. The BVI Labour Code contains certain restrictions on dismissal of staff in the territory.

5.2: What, if any, mandatory employment benefits must be provided to staff?

• The BVI Labour Code outlines certain mandatory requirements as to notice period, maternity leave, vacation leave and termination of employment for staff within the territory. Compared to other jurisdictions, the BVI is not generally prescriptive of mandatory benefits. However, commercially agreed benefits (for instance, regarding pension plans, health insurance and increased maternity leave) are common. Employees within the BVI will be subject to payroll tax of between 10 and 14 per cent (8 per cent of which is paid by the employee, and the remainder paid by the employer) on remuneration (including severance pay, bonuses and money paid under any profit-sharing scheme) for services rendered wholly or mainly in the BVI. Contributions will also be required for social security and national health insurance.

5.3: What, if any, hurdles must businesses overcome to bring employees from outside your jurisdiction into your jurisdiction? Is there a special route for obtaining permission for individuals who wish to work for fintech businesses?

• Once a trade licence is obtained or an exemption is obtained (see question 5.1), a work permit must be obtained for any employees being brought into the BVI from other jurisdictions from the BVI Labour Department. Prior to employing any person from outside the territory, companies must advertise the position to BVI belongers (see question 5.1), and give preference thereto where a belonger candidate is qualified for the position. Work permits are typically issued for a one-year period, and a fee applies based on the salary of the employee. In addition to work permits, visas may be required depending on the residency of the visitor. There are currently no visa requirements for persons from, among other places, the United States, the United Kingdom, Canada and most EU Member States. Employers should be further mindful of any border closures, restrictions or quarantine requirements then in place in response to the COVID-19 pandemic. There is no currently no special route for obtaining permission for individuals who wish to work for a fintech business.

6. TECHNOLOGY

6.1: Please briefly describe how innovations and inventions are protected in your jurisdiction.

• Protection of intellectual property (IP) in the BVI is based upon the United Kingdom. Prior to the BVI's Trademarks Act, 2013 and Trademarks Rules, 2015 coming into effect, BVI trademark
  legislation recognised trademark registration for goods and for services only if already registered in the UK. Legislative reform means that the direct registration of service marks without an existing UK registration is now possible, and that the BVI's classification system is now aligned with the Nice Classification. The BVI Patents Act provides for local patent applications and applications to extend rights under a UK registration. In practice, only existing UK registered patents will be registered in the BVI, and such patents will be valid for the same period as specified on the underlying UK registration on which it is based. Copyright protection in the BVI is based on the United Kingdom's Copyright Act of 1956, which was extended to the BVI by the Copyright (Virgin Islands) Order 1962 (with certain amendments). The BVI does not have its own copyright registry and it is not possible to formally register copyright in the BVI. For trade secrets, rules on confidentiality fall back on English common law duties, further described in question 4.1.

6.2: Please briefly describe how ownership of IP operates in your jurisdiction.

• Please refer to question 6.1 above.

6.3: In order to protect or enforce IP rights in your jurisdiction, do you need to own local/national rights or are you able to enforce other rights (for example, do any treaties or multi-jurisdictional rights apply)?

• The BVI is not a party to the Madrid Protocol and persons may only commence infringement proceedings in the BVI in relation to BVI registered trademarks or re-registered patents.

6.4: How do you exploit/monetise IP in your jurisdiction and are there any particular rules or restrictions regarding such exploitation/monetisation?

• IP rights can be monetised or utilised through assignment or licensing, and can be used as collateral for debt financing. Where trademarks are registered in the BVI, assignment can be registered on the register of trademarks. Where IP of a BVI company is used as collateral, such security interests must be registered in the internal registers of that BVI company and, optionally, in order to protect the priority of charges, can be registered publicly with the BVI Registrar of Corporate Affairs. In 2019, the BVI enacted the Economic Substance (Companies and Limited Partnerships) Act, 2018 (as amended), which requires certain businesses to establish a level of physical substance within the BVI. Where a BVI tax resident entity derives income from IP it holds, such entity will fall within the economic substance requirements. Income includes royalties, capital gains on sale, income from licensing and income from franchising agreements, provided such income is separately identifiable from any income generated from any tangible asset in which the right subsists. IP holding entities that are within scope of the economic substance requirements are required to direct and manage their "core income generating activities" from physically within the BVI and to ensure they have adequate staff physically present in the BVI in physical offices, adequate expenditure in the BVI, and, where the IP business requires the use of specific equipment, that such equipment is located in the BVI. Where entities: (i) acquired their IP assets from an affiliate or in consideration for funding research and development by another person situated in a country or territory other than the BVI; and (ii) license their IP assets to one or more affiliates, or otherwise generate income from the asset in consequence of activities (such as facilitating sale agreements) performed by foreign affiliates, such entities will be deemed to be "high risk", and will be subject to a presumption of non-compliance and higher penalties.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.