Overview Of Fintech Laws And Regulations In Bermuda 2024 - Fin Tech

1. WHAT ARE THE SOURCES OF PAYMENTS LAW IN YOUR JURISDICTION?

The main laws which regulate electronic payments in Bermuda are the:

Banks and Deposit Companies Act 1999 (Banks Act)
Bermuda Monetary Authority Act 1969 (BMA Act)
Electronic Transaction Act 1999 (ETA)
Money Service Business Act 2016 (MSB Act)

With the introduction of digital assets to Bermuda the Digital Asset Business Act 2018 (DABA) working in tandem with the statutes listed above regulates payments made using cryptocurrencies.

2. CAN PAYMENT SERVICES BE PROVIDED BY NON-BANKS, AND IF SO, ON WHAT CONDITIONS?

Payment services can be provided by non-banks on the condition they have received a licence from the Bermuda Monetary Authority to do so. The licence that will apply will depend on the type of activities and business to be carried out by the applicant from and within Bermuda.

3. WHAT ARE THE MOST POPULAR PAYMENT METHODS AND PAYMENT INSTRUMENTS IN YOUR JURISDICTION?

The most popular payment methods in Bermuda are Debit/Credit Cards, Cash and Cheques.

4. WHAT IS THE STATUS OF OPEN BANKING IN YOUR JURISDICTION (I.E. ACCESS TO BANKS' TRANSACTION DATA AND PUSH-PAYMENT FUNCTIONALITY BY THIRD PARTY SERVICE PROVIDERS)? IS IT MANDATED BY LAW, IF SO, TO WHICH ENTITIES, AND WHAT IS STATE OF IMPLEMENTATION IN PRACTICE?

Bermuda's current legislation does not directly address the sharing of bank transaction data or the use of push-payment functionality by third-party service providers. This means there is no legal mandate for open banking in the jurisdiction.

However, the Bermuda Monetary Authority (BMA) recognizes the need for updated payment regulations to reflect industry advancements. While legislation evolves, residents can leverage third-party providers from other jurisdictions, like PayPal, to connect to their bank accounts and initiate “push payments” following guidance issued by the BMA.¹

In short, open banking is not formally established in Bermuda yet, but there are workarounds and ongoing developments to bridge the gap.

5. HOW DOES THE REGULATION OF DATA IN YOUR JURISDICTION IMPACT ON THE PROVISION OF FINANCIAL SERVICES TO CONSUMERS AND BUSINESSES?

DATA REGULATION

Bermuda's data regulatory landscape primarily revolves around two key statutes: the Electronic Transactions Act (ETA) and the Personal Information Protection Act (PIPA). These regulations significantly influence how financial services providers in Bermuda can collect, use, and share consumer and business data.

The ETA Introduced “data protection principles” similar to the EU, including definitions of “personal data” and “data processor.” The act governs electronic transactions and addresses “electronic records” and “personal data” specifically. Part VI of the act enables the creation of standards for data use and processing, known as the “Privacy Standards.” These standards include personal information protection requirements.

In order to modernize the regulation of data in Bermuda the government passed PIPA in 2016, which applies to all organizations in Bermuda using personal information, including financial services providers.

PIPA has not come into full force allowing the entities incorporated within the jurisdiction to take advantage of a transitional phase and prepare their businesses to be compliant with the act upon full proclamation in 2025.

The act introduces a set of “data protection principles” aligned with international standards to facilitate secure data transfer. The updated regime will hold organizations directly responsible for data privacy compliance, even when outsourcing processing and requires them to:

Contractually ensure all PIPA obligations flow down to overseas third-party service providers.
Assess the level of data protection offered by such providers and the applicable laws.
Implement “contractual mechanisms or other means” to ensure overseas providers offer comparable protection if needed.

Organisations remain fully liable for PIPA compliance despite any risk allocation through contracts.

IMPACT ON FINANCIAL SERVICES:

Both acts enforce data privacy requirements, requiring financial service providers to implement measures to protect customer and business data. This can involve obtaining consent for data collection, implementing security measures, and ensuring responsible data use and sharing practices.

Compliance with these regulations can increase operational costs for financial institutions, but also fosters trust and transparency with customers. Bermuda's alignment with international data protection standards aims to facilitate cross-border financial transactions and attract international business.

Overall, data regulation in Bermuda aims to balance innovation and growth in the financial services sector with the protection of individual and business data privacy. PIPA's strict liability clauses emphasize the critical role financial institutions play in safeguarding personal information, even when relying on third-party services.

6. WHAT ARE REGULATORS IN YOUR JURISDICTION DOING TO ENCOURAGE INNOVATION IN THE FINANCIAL SECTOR? ARE THERE ANY INITIATIVES SUCH AS SANDBOXES, OR SPECIAL REGULATORY CONDITIONS FOR FINTECHS?

The Authority actively encourages innovation in the financial sector through various initiatives, catering specifically to fintech companies. The Authority frequently publishes guidance documents and frequently asked questions to clarify regulations for fintech companies, promoting understanding and compliance.

The Authority also regularly engages with industry stakeholders through workshops, conferences, and open forums, fostering collaboration and addressing emerging challenges. In the spirit of collaboration and innovation Bermuda has introduced regulatory sandboxes to allow for controlled development of the fintech industry:

Digital Asset Business: The BMA established a sandbox for exploring innovative digital asset businesses. This allows companies to test their concepts in a controlled environment with tailored regulations, facilitating the development of new products and services.
Insuretech: The BMA launched parallel innovation tracks for insurtech, including an insurance regulatory sandbox and an Innovation Hub. These initiatives provide a safe space for testing new insurance technologies with streamlined regulatory processes.

Special Regulatory Conditions:

Class T License: The Digital Asset Business Act (DABA) introduced a three-tier licensing system, including a Class T license specifically designed for proof-of-concept testing. This allows fintech companies to experiment with new technologies and business models in a less restrictive environment before seeking full licensing.

7. DO YOU FORESEE ANY IMMINENT RISKS TO THE GROWTH OF THE FINTECH MARKET IN YOUR JURISDICTION?

The fintech market is volatile and subject to constant change as it continues to sophisticate and reach equilibrium both globally and in Bermuda. The imminent risks to the market in Bermuda mirror those which face the market globally.

8. WHAT TAX INCENTIVES EXIST IN YOUR JURISDICTION TO ENCOURAGE FINTECH INVESTMENT?

Under current Bermuda law, we are not subject to tax on income, profits, withholding, capital gains or capital transfers. Furthermore, we obtained from the Minister of Finance of Bermuda under the Exempted Undertakings Tax Protection Act 1966 (as amended) (the “EUTP Act”) an assurance that, in the event Bermuda enacts legislation imposing tax computed on profits, income, any capital asset, gain or appreciation, or any tax in the nature of estate duty or inheritance tax, then the imposition of the tax will not be applicable to us or our operations or to our ordinary shares, debentures or other obligations except insofar as such tax applies to persons ordinarily resident in Bermuda or to any taxes payable by us in respect of real property owned or leased by us in Bermuda until March 31, 2035. As a result of changes made to the EUTP Act by the CIT Act (as defined below), this assurance has been made subject to the application of any taxes pursuant to the CIT Act, as described further below.

In the 2023 Budget, the Bermuda government announced the formation of an International Tax Working Group consisting of specialists in international tax matters and representatives of various bodies whose members may be directly impacted by such to examine how Bermuda can appropriately implement the Global Minimum Tax initiative. The Working Group reported its findings and provided recommendations to the Bermuda Government in July 2023. The Bermuda Government subsequently issued three public consultation papers as part of its considerations on the introduction of a corporate income tax in Bermuda, on August 8, 2023, October 5, 2023 and November 10, 2023. On December 15, 2023, the Bermuda House of Assembly passed the Corporate Income Tax Act, 2023 (the “CIT Act”) which was also passed by the Senate on December 18, 2023 and will become fully operative with respect to the imposition of corporate income tax on January 1, 2025.

Under the CIT Act, Bermuda corporate income tax will be chargeable in respect of fiscal years beginning on or after January 1, 2025 and will apply only to Bermuda entities that are part of MNE groups with EUR 750 million or more in annual revenues in at least two of the four fiscal years immediately preceding the fiscal year in question (“Bermuda Constituent Entity Group”). Where corporate income tax is chargeable to a Bermuda Constituent Entity Group, the amount of corporate income tax chargeable for a fiscal year shall be (1) 15% of the net taxable income of the Bermuda Constituent Entity Group less (2) tax credits applicable to the Bermuda Constituent Entity Group under Part 4 of the CIT Act, or as prescribed. The CIT Act introduces certain “qualified refundable tax credits” which are set to be developed during 2024 to incentivize companies to support Bermuda residents through investments in key areas such as education, healthcare, housing, and other projects to help develop Bermuda's workforce. Bermuda will continue to monitor further developments around the world as other jurisdictions address the OECD's standards.

The imposition of a Bermuda corporate income tax could, if applicable, have a material adverse effect on a company's financial condition and results of operations.

9. WHICH AREAS OF FINTECH ARE ATTRACTING INVESTMENT IN YOUR JURISDICTION, AND AT WHAT LEVEL (SERIES A, SERIES B ETC)?

Not applicable.

10. IF A FINTECH ENTREPRENEUR WAS LOOKING FOR A JURISDICTION IN WHICH TO BEGIN OPERATIONS, WHY WOULD IT CHOOSE YOURS?

Bermuda is a leading international financial centre with a long history of providing pragmatic financial and professional services to international businesses.

The Island is renowned for its strong (re)insurance, investment fund, asset management and trust sectors which are supported by a world-class advisory and financial services infrastructure, including a sophisticated legal system, a robust regulatory framework, speed-to-market capability, a business-friendly government, simple tax regime, a highly-skilled work force, close proximity to the US and direct flights to the US, UK and Canada.

In 2018 Bermuda introduced new legal and regulatory frameworks designed to govern and regulate initial coin offerings, digital asset business and insuretech. The new legislation sets out expected standards of disclosure for initial coin offerings, a dual licensing system (including sandbox) for anyone seeking to provide digital asset business services to the sector and both a sandbox regime and innovation hub for those in insuretech.

The insuretech sandbox allows companies to test new technologies and offer innovative products, services and delivery mechanisms to a limited number of clients in a controlled environment and for a limited period of time. The insuretech innovation hub has been designed as an incubator for entrepreneurs to conceptualise and collaborate on new ideas prior to seeking sandbox entry.

11. ACCESS TO TALENT IS OFTEN CITED AS A KEY ISSUE FOR FINTECHS – ARE THERE ANY IMMIGRATION RULES IN YOUR JURISDICTION WHICH WOULD HELP OR HINDER THAT ACCESS, WHETHER IN FORCE NOW OR IMMINENTLY? FOR INSTANCE, ARE QUOTAS SYSTEMS/IMMIGRATION CAPS IN PLACE IN YOUR JURISDICTION AND HOW ARE THEY DETERMINED?

Every non-Bermudian employee requires a work permit (unless they are a spouse of a Bermudian or holder of a permanent resident certificate). In support of Bermuda's interest in fintech, “The Fintech Business Permit Policy” was introduced. Following vetting and approval of the Fintech business' business plan by the FinTech Advisory Committee, the company will be able to apply for a Fintech Business Permit (Permit) using the relevant application form. A certificate of incorporation, and the date the company expects to commence operating in Bermuda, must be included with the Permit application. Additionally, the company must submit an immigration business plan which outlines plans for the hiring and training of Bermudians and plans for engaging local service providers.

Once the initial Permit has been approved, the company will receive automatic approval for 5 additional work permits. These must be applied for within the first 6 months of the initial Permit. Work permit terms can be granted for up to 5 years and regular statutory council referral rules apply. Jobs categorised as closed, restricted, or are entry level in nature, cannot be filled using the Permit.

Upon expiry of the initial Permit term, the entity will be obligated to apply for a Standard Work Permit if they desire the Permit holder to continue working in Bermuda. This permit will be granted subject to Bermuda's regular advertising and recruitment requirements to ensure that no suitably qualified Bermudian, Permanent Residence Certificate (PRC) holder or spouse of a Bermudian are available for the position. Automatic advertisement waivers are available for C-suite positions such as Chief Executive Officer or Chief Operating Officer. Waivers can be requested and are granted at the Minister's discretion; typically if the applicant has a specific skillset or is a senior executive.

Long term immigration permissions are available via the Incentive for Job Makers provisions. Companies that have at least 10 Bermudians on staff, employ Bermudians at all levels, have entry level positions that are filled by Bermudians and enforce sound employment practices will be eligible. Proof of significant contribution to the local economy and protection of local interests is also viewed favourably.

Benefits include work permit exemptions for eligible senior executives and the opportunity to apply for a PRC. At the moment, this is the only avenue available for work permit holders to be able to obtain this certificate.

12. IF THERE ARE GAPS IN ACCESS TO TALENT, ARE REGULATORS LOOKING TO FILL THESE AND, IF SO, HOW? HOW MUCH IMPACT DOES THE FINTECH INDUSTRY HAVE ON INFLUENCING IMMIGRATION POLICY IN YOUR JURISDICTION?

See reference to “The Fintech Business Permit Policy” above.

13. WHAT PROTECTIONS CAN A FINTECH USE IN YOUR JURISDICTION TO PROTECT ITS INTELLECTUAL PROPERTY?

COPYRIGHT

The principal IP right that protects software for example, is copyright – the right to prevent others from, among other things, copying the software. The Copyright and Designs Act 2004 expressly includes a computer program, preparatory design material for a computer program, and a database within the definition of “literary work.” For computer-generated work, the copyright expires at the end of the period of 50 years from the end of the calendar year in which the work was made.

TRADEMARKS

The Trade Marks Act 1974 provides IP protection to trade and service marks of which can carry one of two levels of protection, Part A or Part B. Trade and service marks can be registered and renewed repeatedly or unregistered. Unregistered trade mark rights are enforced through the law of passing off. Trademarks are registered locally at the Registrar General for a fee, the process of which generally takes 18 months.

PATENTS

Currently, patent protection in Bermuda is provided by the Patents and Designs Act 1930 (1930 Act). The 1930 Act is largely based on the United Kingdom Patents and Designs Act 1919. The Registry General offers three types of patent applications: a national patent, a provisional (national) patent, or a registration of a patent granted United Kingdom (UK) or European Patent with a UK designation to Bermuda. A patent granted in the UK or a European Patent that designates the UK can be registered in Bermuda within three years of its original grant and will be in force for as long as the original patent is in force. As with patents globally, patents are non-renewable.

14. HOW ARE CRYPTOCURRENCIES TREATED UNDER THE REGULATORY FRAMEWORK IN YOUR JURISDICTION?

“Digital Assets” pursuant to the Digital Asset Business Act 2018 (DABA) are defined as anything that exists in binary format and comes with the right to use it and includes a digital representation of value that:

is used as a medium of exchange, unit of account, or store of value and is not legal tender, whether or not denominated in legal tender;
is intended to represent assets such as debt or equity in the promoter;
is otherwise intended to represent any assets or rights associated with such assets; or
is intended to provide access to an application or service or product by means of a distributed ledger technology;

Cryptocurrencies such as bitcoin fall within this definition and are regulated under the DABA.

15. HOW ARE INITIAL COIN OFFERINGS TREATED IN YOUR JURISDICTION? DO YOU FORESEE ANY CHANGE IN THIS OVER THE NEXT 12-24 MONTHS?

Initial coin offerings are regulated under the Digital Assets Issuance Act 2020 (DAI Act).

The DAI Act became operative on 6 May 2020 and strikes a balance between market integrity and consumer protection. Under the DAI Act, a Digital Asset Issuance (DAI) is regulated by the Bermuda Monetary Authority (Authority). The DAI Act regulates persons who are creating, promoting, investing in and conducting DAIs and digital assets as well as companies who are seeking to raise capital through DAIs.

Under the DAI Act, the colloquially used term ‘white paper' is defined as Digital Asset Issuance Document (Issuance Document). Once consent is received from the BMA a company must publish its Issuance Document in electronic form. Subject to specific statutory exemptions (including but not limited to whether the digital assets are listed on an appointed stock exchange or appointed digital asset exchange), a company is required to file such document with the Authority.

In addition to the requirements, which may be prescribed by the Authority, the Codes of Conduct or any regulations ancillary to the DAI Act, the Issuance Document must contain the following minimum details:

information on the promoter;
information on the officers of the promoter (if a corporate body);
the business or proposed business;
a description of the project and the proposed timeline for the project including any proposed project phases and milestones;
the amount of money equivalent (in Bermuda dollars) that the DAI is intended to raise;
disclosure as to the allocation of the amounts intended to be raised amongst the classes of any issuance (i.e. pre-sale or post-digital asset issuance);
the rights or restrictions on the digital assets that are being offered;
cooling off rights
the date and time of the opening and closing of the offering of digital assets;
the DAI risk warning; and
a statement as to how personal information will be used.

The particulars listed above must be kept accurate during the offer period of the digital asset concerned. Failure to do so could lead to the responsible persons (including directors and officers of the issuer and promoters of the DAI) being liable to civil penalties. Please note that under the DAI Act, the Authority may make such rules and regulations requiring additional information to be included in the Issuance Document.

A risk warning statement must appear in the Issuance Document and on the platform in which the DAI will be launched (DAI Platform). The DAI Platform shall include an electronic public forum that the promotor or the company shall maintain once the offer is open such that relevant parties to the DAI have an opportunity to enquire more about the DAI. The DAI Platform should also specify how a participant in a DAI may withdraw its application; as such application can be withdrawn by the participant for up to three business days after an application is made.

All undertakings authorised to launch a DAI must also have appropriate procedures in place to ensure that they verify the identity of the participants in the DAI and also ensure that all confidentiality, disclosure of information and connected matters are complied with by the issuer under Bermuda laws.

We do not foresee any change in the next 12 – 24 months.

16. ARE YOU AWARE OF ANY LIVE BLOCKCHAIN PROJECTS (BEYOND PROOF OF CONCEPT) IN YOUR JURISDICTION AND IF SO IN WHAT AREAS?

We are not aware of any specific projects.

More generally, the Bermuda Government has made a commitment to completely digitise its activities and services. As part of this commitment Bermuda has began to develop a blockchain based electronic identification project that intends to provide for the complete digitisation of identification of all individuals residing in Bermuda across all sectors from government to industry.

17. TO WHAT EXTENT ARE YOU AWARE OF ARTIFICIAL INTELLIGENCE ALREADY BEING USED IN THE FINANCIAL SECTOR IN YOUR JURISDICTION, AND DO YOU THINK REGULATION WILL IMPEDE OR ENCOURAGE ITS FURTHER USE?

Other than a handful of projects that have been mentioned in the local press, we are not aware of any specific instances of AI that is used in the financial sector in Bermuda. In our view Bermuda legislation encourages and will continue to encourage development of AI products in and within from Bermuda.

18. INSURTECH IS GENERALLY THOUGHT TO BE DEVELOPING BUT SOME WAY BEHIND OTHER AREAS OF FINTECH SUCH AS PAYMENTS. IS THERE MUCH INSURTECH BUSINESS IN YOUR JURISDICTION AND IF SO WHAT FORM DOES IT GENERALLY TAKE?

While insurtech might lag behind other fintech sectors globally, Bermuda is fostering a vibrant insurtech ecosystem, particularly compared to its regional counterparts. The following illustrate the diverse forms insurtech takes in Bermuda:

Streamlining Underwriting & Data: Startups are developing user-friendly pricing and data capture systems for underwriters and brokers, enhancing efficiency and accuracy.

Automating Reinsurance: Tech companies are offering solutions for data integration and process automation within the (re)insurance sector, optimizing workflows and reducing costs.

Crypto-Native Insurance Platforms: We are seeing new innovative platforms connect third-party capital providers, underwriters, and other entities to conduct insurance business using cryptocurrency, opening new avenues for risk transfer.

These examples highlight the entrepreneurial spirit and focus on tech-driven solutions within Bermuda's insurtech landscape. While the sector might not match the sheer volume of other fintech areas, its unique offerings and focus on automation and blockchain technology position it for continued growth and potential to disrupt the traditional insurance market.

19. ARE THERE ANY AREAS OF FINTECH THAT ARE PARTICULARLY STRONG IN YOUR JURISDICTION?

Due to Bermuda status as a primary reinsurance and financial jurisdiction in the world, we are seeing an increasing maturity in the investment provider and insurance spaces for fintech.

20. WHAT IS THE STATUS OF COLLABORATION VS DISRUPTION IN YOUR JURISDICTION AS BETWEEN FINTECHS AND INCUMBENT FINANCIAL INSTITUTIONS?

There is a strong sense of collaboration between the incumbent financial institutions and the new entrants being the fintech firms. In developing the legislation which regulates the fintech industry the Authority and Bermuda Government release consultation papers to market participants to allow the opportunity to voice any issues, suggest amendments of provide comments on what they believe the effect of proposed fintech legislation will have on their company.

21. TO WHAT EXTENT ARE THE BANKS AND OTHER INCUMBENT FINANCIAL INSTITUTIONS IN YOUR JURISDICTION CARRYING OUT THEIR OWN FINTECH DEVELOPMENT / INNOVATION PROGRAMMES?

Bermuda based banks have not announced any intention to carry out their own fintech programs. Of the four banks in Bermuda two are “crypto friendly” in that they will bank fiat of companies whose activities are in whole or in part based on digital assets.

22. ARE THERE ANY STRONG EXAMPLES OF DISRUPTION THROUGH FINTECH IN YOUR JURISDICTION?

Not as of yet.

Originally provided for Legal 500's Guide to Fintech in Bermuda, 2024.

Footnote

1. Discussion Paper: MONEY SERVICE BUSINESS, PAYMENT SERVICES, and FOREIGN EXCHANGE SERVICES

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

Bermuda: Overview Of Fintech Laws And Regulations In Bermuda 2024