VASP Licensing Requirements in Jamaica: The Complete Checklist

 

Everything you must assemble to apply for a virtual asset service provider licence — eligibility, capital, fit and proper, cybersecurity, AML/CFT, substance and class-specific conditions — in one practical, printable checklist.

 

In short: to be licensed as a VASP in Jamaica, an applicant must be a Jamaican-incorporated company that can demonstrate a credible business plan, at least J$16 million in paid-up capital with a clean source of funds, fit-and-proper directors and owners, a cybersecurity policy, a full AML/CFT framework built on an institution-wide risk assessment, genuine local substance, and the class-specific conditions for the activities it intends to carry on. An application is only assessed once it is complete — so assembling the full pack correctly the first time is the single biggest time-saver. This article gives you the complete checklist.

What does the FSC require to license a VASP?

The Licensing Requirements set out criteria that must be satisfied at application and maintained for the life of the licence. They fall into a handful of categories — eligibility, business plan, capital, fit and proper, cybersecurity, AML/CFT, prudential and market-conduct requirements, third-party oversight, substance, and class-specific conditions. We walk through each below, then bring them together in a printable checklist. (For the bigger picture, see “Jamaica’s Proposed VASP Licensing Regime: The Complete Guide,” and to confirm which licence class you need, see “The Six VASP Licence Classes in Jamaica.”)

1. Eligibility — the right legal vehicle

Only a company incorporated in Jamaica may apply — either under the Companies Act or the International Business Companies (IBC) Act. Foreign-incorporated entities are not eligible, and individuals cannot apply; offering virtual-asset services without a licence will be an offence. Where the applicant is an IBC, it must have a board of at least two directors. Getting the vehicle right at the outset avoids a fundamental, fatal gap later.

2. Business plan and financial projections

Applicants must submit a detailed business plan that lets the Commission assess the commercial viability and stability of the business. It should cover present and proposed services, the target market, the revenue model, the operational structure, the risk-management framework, and financial projections. Treat the plan as the spine of the application: it frames everything the assessor reads afterwards, and a thin or inconsistent plan invites information requests that pause the clock.

3. Minimum capital and source of funds

Applicants must demonstrate paid-up share capital of at least J$16 million. You must evidence the source of those funds and confirm they are not a temporary loan or arrangement put in place solely to satisfy the requirement. The Commission may require more capital for larger or more complex operations or for higher-risk classes. Prepare the capital file early — bank confirmations, share records and a clean, documented funding trail — because source-of-funds questions are a common cause of delay.

4. Fit and proper — your people

Every director, principal officer, substantial shareholder (holding 10% or more) and any other person with significant influence over the applicant must satisfy the Commission’s fit-and-proper requirements. The assessment looks at three things: integrity and reputation (criminal, regulatory and conduct history); competence and capability (relevant knowledge and experience in virtual assets or financial services, and understanding of AML/CFT obligations); and financial soundness (bankruptcy, unsatisfied judgments, or involvement in failed or de-licensed entities). The Commission may request more information, conduct interviews, and seek information from other regulators. Assemble complete fit-and-proper packs for each relevant individual, and remember the test is repeated whenever these people change.

5. Cybersecurity policy

Applicants must submit a cybersecurity policy addressing, at minimum: governance of cybersecurity risk; access controls and authentication; incident detection and response; data encryption and secure storage; business continuity and disaster recovery; and third-party technology-risk management. The Commission will issue supervisory rules on cybersecurity against which applicants are assessed at licensing and monitored thereafter, so build a policy that is genuinely operational, not merely a document.

6. AML/CFT compliance

This is central. Applicants must submit AML/CFT policies, procedures and systems evidencing controls that satisfy the Proceeds of Crime Act, the Terrorism Prevention Act, UNSCRIA and the FATF Travel Rule. Crucially, you must conduct and document an institution-wide money-laundering, terrorist-financing and proliferation-financing risk assessment before applying, identifying the risks arising from your proposed activities and the controls you will implement. The framework should cover customer due diligence and enhanced due diligence, ongoing monitoring, blockchain analytics and wallet screening, sanctions screening, suspicious-activity reporting to the Financial Investigations Division via goAML, and seven-year record-keeping.

7. Prudential requirements

Prudential expectations protect clients and the firm’s stability. They include strict segregation of customer funds and assets from the VASP’s own assets; maintenance of minimum capital or financial reserves; risk-management policies covering operational, credit, market and liquidity risk; reserve management sufficient to meet customer withdrawals, with periodic audits; and appropriate insurance against losses from theft, hacking, fraud or other events affecting client assets.

8. Market-conduct requirements

Applicants must show how they will meet market-conduct expectations: tools to detect and prevent market manipulation (wash trading, spoofing, layering, pump-and-dump, oracle manipulation and the like); mechanisms for fair and timely complaints handling; consumer-protection measures including clear terms and transparent fees and risks; full regulatory reporting (large transactions, suspicious activity, security incidents); adherence to the FSC’s corporate-governance standards; conflict-of-interest policies; and data protection in line with the Data Protection Act, 2020.

9. Third-party and outsourcing oversight

If you rely on third parties, you must demonstrate due diligence on every existing and proposed provider — including assessment of their AML/CFT controls — contractual arrangements assigning AML/CFT obligations and oversight, and procedures for regular audit of those providers. The principle to internalise: outsourcing never transfers responsibility. The VASP retains full regulatory and AML/CFT accountability for whatever it outsources, and the FSC must be able to access information held by third parties on the VASP’s behalf.

10. Substance — a genuine local presence

The regime is built to prevent letterbox operations. Each licensee must maintain real substance in Jamaica, summarised below — every item is a discrete thing to put in place and evidence.

Substance requirement	What it means
Functioning office	A working Jamaican office able to access all VASP, customer, transaction and AML/CFT records
Resident director	At least one director resident in Jamaica (for an IBC, at least one of the two required directors)
Nominated Officer	A POCA Nominated Officer located in Jamaica — this role cannot sit offshore
Jamaican bank account	An account with a licensed local deposit-taking institution
Quarterly board meetings	Board meetings held at least once each quarter
Qualified local staff	Staff with relevant expertise in virtual assets and VASP operations
Record accessibility & complaints register	All records accessible locally; a consumer-complaints register maintained at the office

11. Class-specific conditions

On top of the general criteria, each licence class carries its own conditions, which must be satisfied at application and maintained thereafter:

• Class A (trading platforms): a board-approved virtual-asset listing/assessment policy, trade surveillance, and quarterly proof of reserves.
• Class B (advisory): a documented client suitability framework.
• Class C (custody): cold-storage and key-management controls, a custody wind-down plan, and quarterly proof of reserves.
• Class D (broker-dealer): a client appropriateness assessment (and full suitability where acting on a discretionary basis).
• Class E (wallet services): cold-storage and key-management controls.

The complete VASP application checklist

Print this and work through it. Each ticked box should map to a document or demonstrable control in your application pack.

✓	Requirement	What to prepare
☐	Eligibility	Jamaican company under the Companies Act or IBC Act; IBC has at least two directors
☐	Business plan	Services, target market, revenue model, operational structure, risk-management framework and financial projections
☐	Minimum capital	At least J$16m paid-up, with evidence of source of funds (not a temporary arrangement)
☐	Fit and proper	Complete packs for directors, principal officers, 10%+ shareholders and significant influencers (integrity, competence, financial soundness)
☐	Cybersecurity policy	Governance, access/authentication, incident response, encryption, business continuity/DR, third-party tech risk
☐	AML/CFT framework	Policies plus a documented institution-wide ML/TF/PF risk assessment; POCA/TPA/UNSCRIA and Travel Rule controls
☐	Prudential controls	Asset segregation, capital/reserve adequacy, risk-management policies, reserve audits, insurance
☐	Market conduct	Manipulation surveillance, complaints handling, consumer protection, regulatory reporting, governance, conflicts, data protection
☐	Third-party oversight	Provider due diligence, contracts assigning AML/CFT duties, audit rights (responsibility retained)
☐	Substance	Local office, resident director, Nominated Officer in Jamaica, local bank account, quarterly board, qualified staff, accessible records, complaints register
☐	Class-specific conditions	Listing policy (A); suitability (B); cold storage & key management (C, E); appropriateness (D); proof of reserves (A, C)
☐	Fees	J$800,000 application processing fee plus the annual fee for each licence class

How the FSC assesses your application

An application is not formally accepted — and review does not begin — until the Commission is satisfied it is complete. A completeness review is indicatively conducted within ten business days; an incomplete application may be rejected without substantive assessment (you can reapply). Once accepted, the substantive assessment — indicatively sixty to ninety business days — examines the business plan and projections, fit-and-proper status, AML/CFT controls, cybersecurity, substance, and the viability and integrity of the model. The clock pauses whenever the Commission has an outstanding information request, which is why a complete, internally consistent pack is the fastest route to a decision.

Common reasons applications stall or are refused

Most delays and refusals trace back to a short list of avoidable issues: an incomplete application missing mandatory items; weak or generic AML/CFT controls that do not match the proposed activities; fit-and-proper concerns about a director or owner; an unclear or undocumented source of capital; or a model the Commission considers not in the public interest given its size, scope and complexity. Providing false, misleading or materially incomplete information is itself a ground for refusal. The remedy for all of these is the same: prepare thoroughly, document everything, and address weaknesses before you file rather than after.

What to do next

Use the checklist above to run an honest gap assessment against your current state, prioritise the items that take longest to build — capital documentation, the AML/CFT framework and risk assessment, fit-and-proper packs, and substance — and engage the FSC early through pre-application discussion. The companion piece “The VASP Application Process and Timeline: A Step-by-Step Walkthrough” then shows you how the submission unfolds from there.

Frequently asked questions

What are the main requirements for a VASP licence in Jamaica?

Eligibility as a Jamaican company, a business plan, at least J$16 million in paid-up capital with a documented source of funds, fit-and-proper directors and owners, a cybersecurity policy, a full AML/CFT framework with an institution-wide risk assessment, local substance, and class-specific conditions for the activities you carry on.

How much capital do I need?

A minimum of J$16 million in paid-up share capital, with evidence of source of funds. The Commission may require more depending on the licence class and the scale and complexity of the business.

Who has to pass the fit-and-proper test?

Directors, principal officers, substantial shareholders holding 10% or more, and anyone else with significant influence over the applicant. The assessment is repeated whenever these individuals change.

What is the institution-wide risk assessment?

A documented assessment, completed before you apply, that identifies the money-laundering, terrorist-financing and proliferation-financing risks arising from your proposed activities and the controls you will implement to manage them.

What happens if my application is incomplete?

The Commission may reject it without substantive assessment. You can reapply. Because the review clock only runs on a complete application, assembling the full pack correctly the first time is the fastest path to a decision.

How Dawgen Global can help Assembling a complete, internally consistent VASP application is exactly the kind of multidisciplinary work that delays applicants who tackle it piecemeal. Dawgen Global helps you do it once, correctly — a readiness diagnostic against this checklist, the business plan and financial model, the capital and source-of-funds file, fit-and-proper packs, the AML/CFT framework and risk assessment, cybersecurity and governance, and the local substance build. As an independent professional services firm, we also provide the assurance the regime requires, including proof-of-reserves and client-asset audits. We act as adviser and independent auditor to the virtual-asset ecosystem; we are not a licence applicant. For a VASP licensing readiness diagnostic, contact us at [email protected] or visit dawgen.global.

This article is part of The Caribbean Virtual Asset Regulation Imperative™ series by Dawgen Global, powered by DAGAF™ — the Dawgen Digital Asset Governance & Assurance Framework. It is general information based on the FSC’s consultation documents of 10 June 2026 and is not legal, regulatory or investment advice. The proposals remain subject to change following consultation.

About Dawgen Global