FINTECH MARKET

The Development of FinTech Products and Services

TAs one of the foremost offshore financial centres, home to approximately 70% of the world’s offshore investment funds and with an absence of any direct taxation on companies or individuals, the Cayman Islands is well placed to become an attractive destination for FinTech entrepreneurs. Cayman’s ambition to become a global FinTech leader is also supported by a sound legal framework, modern infrastructure, state-ofthe-art communication systems, a 155% mobile penetration rate and a stable political climate.

While much of Cayman’s financial services legislation was written before the FinTech revolution began, recent years have seen the Cayman Islands take a number of legal and regulatory steps to make the Islands a jurisdiction that will allow FinTech innovation to thrive. In particular, Cayman has the potential to become an important offshore hub for the development and commercial exploitation of IP rights with updated copyright, trade mark and patent laws passed in 2016. Traditionally, the Cayman Islands trade mark registry only served to extend rights that had previously been registered in the UK or the EU. Recent reforms will see the creation of a new standalone trade mark system that will not require a first registration elsewhere.

The Islands have also established a special economic zone (SEZ) allowing technology companies to benefit from specific advantages such as zero taxes, an offshore presence and fast-tracked work permit applications for relocating employees. Finally, in March 2017, the Legislative Assembly passed the Data Protection Law. Seen by many on the Islands as the final piece in the legislative jigsaw enabling the FinTech revolution to take hold in Cayman, the new law is drafted around a set of EU-style privacy principles and protects the processing of all personal data in the Cayman Islands.

The Market for FinTech Products and Services

See 1.1 The Development of FinTech Products and Services and 1.4 FinTech Technologies/Companies.

The Key Market Participants in the Specified Activities

Although the FinTech sector is still at an early stage in the Cayman Islands, the SEZ provides a useful measure of local FinTech activity. At the time of writing there were approximately 220 active companies that have set up a physical presence in the zone and 40% of those are based in the internet and technology park within the SEZ.

Participants include payment solutions providers, cloud services providers and data-driven due diligence and analytics companies.

FinTech Technologies/Companies

New FinTech companies have not begun to displace traditional financial service providers yet, but it is clear that the push to move forward with FinTech in the Cayman Islands is being driven by technology-focused new entrants to financial services. In particular, the focus is on technology solutions that deliver performance improvements to existing paper-based checks and balances in areas such as customer due diligence, fraud detection and beyond. Customer due diligence procedures in the Cayman Islands continue to follow paper-based standards where the customer is required to supply copy identification during a face-to-face meeting. For larger financial institutions with substantial compliance overheads, the promise of FinTech to replace manual processes with technologies that are cheaper and more cost effective at achieving compliance and managing risk has yet to be realised but the possibilities are certainly being explored.

As the majority of FinTech solutions are ‘data-driven’ — relying upon advanced techniques to analyse large volumes of data to gain insights — now that the Data Protection Law has been passed there are opportunities in Cayman to reinvent the compliance function altogether through advanced data analytics.

Partnerships Between Traditional Institutions and FinTech Companies

Cayman Finance, a group that represents Cayman’s financial services sector, is a key advocate for developing the growth of FinTech in the Cayman Islands. In the past twelve months the group has established a FinTech working group to engage with the financial services industry, regulators, the government and the media to promote the development of FinTech on the Islands. Informal conversations have also started concerning a potential framework of laws, developed under Cayman Finance and the Cayman Islands Monetary Authority, that might direct FinTech towards the institutional market.

FINTECH REGULATION

Regulatory Regimes for Specified Activities or FinTech Companies

The FinTech sector is still at an early stage in the Cayman Islands but a number of legal and regulatory steps (described in 1.1 The Development of FinTech Products and Services) have been taken in recent years to make the Islands a jurisdiction that will allow FinTech innovation to thrive.

Regulatory or Governmental Agencies for Specified Activities or FinTech Companies

The Cayman Islands Monetary Authority (CIMA), which has responsibility for licensing and regulating banking and trust business in the Islands, will be the main regulator for the FinTech sector as it develops. One of CIMA’s obligations is to promote and maintain a sound financial system in the Cayman Islands.

CIMA regulates banking and trust business in accordance with the:

laws and regulations specifically governing banking and trust services, as well as with the legislation that applies to all licensees;
relevant rules, guidance, policies and procedures issued by CIMA; and
international supervisory standards articulated by the Basel Committee on Banking Supervision and other international bodies.

CIMA has membership in the Offshore Group of Banking Supervisors, the Caribbean Group of Banking Supervisors and the Association of Supervisors of Banks of the Americas.

CIMA’s Banking Supervision Division is responsible for processing applications for licences and making recommendations to the management committee on the issue (or non-issue) of a licence. The division is also responsible for ongoing supervision and regulation of the activities of banks.

Capital and Liquidity Requirements

FinTech companies at present are not subject to any specific regulatory requirements, nor any capital, liquidity or transaction limitations, other than those required for any normal Cayman Islands-registered company/partnership.

“Sandbox” or Other Regulatory “Neutral Zones”

No such zones or initiatives have been established in the Cayman Islands at the time of writing.

As mentioned in 1.1 The Development of FinTech Products and Services, the Cayman Islands government has established the SEZ, which enables technology companies from outside Cayman easily and cost-effectively to set up and operate offshore with a genuine physical presence.

Change of Control Approval Requirements

No governmental consents are required from a Cayman law perspective; however, subject to limited exceptions for publicly listed companies, regulated entities and the like, all registered Cayman Islands companies are required to maintain due diligence on certain beneficial owners within the company.

Recent Developments or Notable Proposed/ Forthcoming Regulatory Changes

See 1.1 The Development of FinTech Products and Services.

Burden of Regulatory Framework and Protection of Customers

Regulatory Impediments to FinTech Innovation at Traditional Financial Institutions

At present, there are no additional specific FinTech requirements.

Outreach by Regulators or Government Authorities to Engage with FinTech Innovators

As described in 1.5 Partnerships Between Traditional Institutions and FinTech Companies, Cayman Finance is engaging with the financial services industry, regulators, the government and the media to promote the development of the FinTech sector in the Islands.

The establishment of the SEZ has also attracted a number of technology companies to establish themselves in the country.

Unregulated Specified Activities

Please see 1.1 The Development of FinTech Products and Services.

Foreign FinTech Companies

There are special limitations, requirements and barriers to entry for foreign FinTech companies. Companies incorporated in the Cayman Islands fall into two principal categories: companies formed to trade primarily in the Cayman Islands and companies incorporated for the purpose of conducting business outside the Cayman Islands. FinTech companies seeking to carry on business within the local Cayman Islands market will be required to have certain levels of local ownership and participation, or an exemption from such requirements.

However, see 2.4 “Sandbox” or Other Regulatory “Neutral Zones” regarding the exemption available to technology companies establishing themselves in the SEZ.

Regulatory Enforcement Actions Against FinTech Companies

There have been no regulatory enforcement actions against FinTech companies in the Cayman Islands recently.

“Shadow Banking”

Within the Cayman Islands there is a general prohibition against undertaking banking business without a licence, banking business being defined as the business of receiving (other than from a bank or trust company) and holding on current, savings, deposit or other similar account money that is repayable by cheque or order and may be invested by way of advances to customers or otherwise. Penalties for a breach are serious. Robust money-transfer business regulations are in place.

Form of Legal entity

Potential Forms of Charter

Companies incorporated in the Cayman Islands fall into two principal categories: companies formed to trade primarily in the Cayman Islands and companies incorporated for the purpose of conducting business outside the Cayman Islands. FinTech companies seeking to carry on business within the local Cayman Islands market will be required to have certain levels of local ownership and participation, or an exemption from such requirements.

The main types of companies/partnerships in the Cayman Islands consist of:

Exempted companies: where the proposed activities of a company are to be carried out mainly outside the Cayman Islands.

Exempted limited partnerships: may be formed for any lawful purpose to be carried out and undertaken in or from within the Cayman Islands or elsewhere.

Limited liability companies: a limited liability company is a corporate structure whereby the members of the company cannot be held personally liable for the company’s debts or liabilities.

Exempted limited duration companies: this form of exempted company, while preserving the limited liability to its members if desired, offers the possibility in certain jurisdictions of advantageous treatment as a partnership.

Resident companies: companies carrying on business within the Cayman Islands. A company conducting banking and/ or trust business must obtain a licence under the Banks and Trust Companies Law. Companies engaging in the insurance business must obtain a licence under the Insurance Law and those wishing to operate in company management must obtain a licence under the Companies Management Law.

Non-resident companies: the company may deal in shares of exempted companies, foreign corporations and partnerships, but may only carry on such other business in the Cayman Islands as is necessary for the furtherance of its foreign business.

Foreign registered companies: a foreign company is a company incorporated outside the Cayman Islands. Registration as a foreign company in the Cayman Islands is necessary to enable non-Cayman Islands companies to hold land or carry on business in the Cayman Islands, or to act as the general partner of a Cayman Islands Exempted Limited Partnership.

Special economic zone companies: a special economic zone company is a type of exempt company that is authorised to carry on business in a special economic zone pursuant to any law in force in the Islands.

Segregated portfolio companies: the segregated portfolio company (SPC) is a form of exempted company. The law provides for an exempted company, a company by way of continuation and an exempted limited duration company to re-register as a segregated portfolio company.

All the above entities can be used for FinTech specified activities and the regulations mentioned in 2 Regulation may be applicable

Key Differences in Form

All the entities described above can be used for the specified activities. The best choice, however, will depend on whether the business is incorporated or registered in — but carrying on business outside — the Cayman Islands, or if the intention is to carry on local trade.

The Cayman Islands predominantly sees exempted companies or exempted limited partnerships being utilised and business conducted outside the Islands.

recent legal changes

See 3.1 Potential Forms of Charter and 3.2 Key Differences in Form. Limited liability companies are new and increasingly popular for their commercial flexibility. The legislation provides only the basic requirements for such entities and the parties are largely free to operate their business in accordance with a contract agreed between them.

Legal Infrastructure (Non-regulatory)

Desirable Changes to Facilitate Specified Activities

At this stage there are no changes to areas of the law that are necessary or desirable to facilitate any elements of the specified activities, save for the updated laws referred to in 1.1 The Development of FinTech Products and Services. The FinTech sector is still at an early stage in the Cayman Islands.

Access to Real Time Gross Settlement Systems

In the Cayman Islands, FinTech companies must access realtime gross settlement systems through regulated financial institutions.

Special Insolvency Regimes

There are no special insolvency regimes or other regimes that apply differently to FinTech companies as compared to regulated financial institutions. FinTech companies are subject to the same insolvency regimes as any type of company or partnership registered in the Cayman Islands.

Electronic Signatures

The Electronic Transactions Law (2003 Revision) (ETL) generally puts electronic signatures on an equal footing with “wet ink” signatures in the Cayman Islands.

Technologically neutral, the ETL was established to promote public confidence in the validity, integrity and reliability of conducting transactions electronically and recognises electronic records as records created, stored, generated, received or communicated by electronic means.

However, the ETL could present challenges to more advanced FinTech solutions, such as smart contracts that envisage a blockchain solution executing as well as recording the transaction.

Standards for Proving Identity in Electronic Transactions

The Cayman Islands does not have standards for proving identity in electronic transactions. While the ETL contains a certification mechanism, to be effective this would rely on a third party verifying the identity of the person or entity controlling the signature device. The government is considering updating the ETL and digital identification is likely to feature in that discussion.

Data Privacy and Cybersecurity

Data Privacy and Cybersecurity Regulatory Regimes

The Data Protection Law was passed by the Cayman Islands Legislative Assembly in March 2017 and will govern all personal data processed in the Islands.

Drafted around a set of internationally recognised privacy principles, the new law will provide a framework of rights and duties designed to give individual data subjects greater control over their personal data. The new law is a welcome move for Cayman and supports a growing expectation from international businesses and their clients that organisations operating in offshore jurisdictions have in place comprehensive data protection compliance policies backed up by robust data privacy legislation.

At the time of writing, a date has not yet been set for the Data Protection Law to come into force, but it is expected that the law will be introduced in stages over 12-18 months to enable organisations to achieve compliance. This period will also be used to prepare secondary legislation, draft guidelines and staff the Information Commissioner’s office, which will be responsible for enforcing the new law.

It is intended that the new law will allow the Cayman Islands to be recognised by the EU Commission as providing adequate data protection for the free flow of EU national data between the Islands and the EU.

The new law grants to living individuals (“data subjects”) specific rights in relation to their personal data, including, subject to specified limitations:

the right to be informed by a data controller whether their personal data is being processed;
the right to access their personal data and certain information about its use and source;
the right to require that processing of their personal data cease;
the right to require that processing of their personal data for the purpose of direct marketing cease; and
the right to require that a decision that significantly affects him or her is not made solely by the processing by automatic means of personal data.

The law also imposes specific obligations on the persons who control the processing of personal data (“data controllers”), including:

the duty to apply the data protection principles;
the duty to respond in a timely fashion to requests from data subjects in relation to their personal data; and
the duty to notify data subjects and the Information Commissioner of any personal data breaches.

If the processing of personal data is to be carried out on behalf of a data controller by a data processor, the processing must be carried out under a contract that conforms to specific requirements. In order to be a “data controller,” a person must be the one who, alone or with others, determines the purposes, conditions and means of the processing of personal data. The regulated activity of “processing” personal data is very widely defined to include obtaining, recording or holding data, or carrying out any operation or set of operations. In order to ensure that personal data can be used in appropriate circumstances, the Data Protection Law recognises a number of exemptions to the obligations noted above, including national security, law enforcement, legal proceedings, personal family or household affairs, corporate finance, negotiations and legal privilege. The Information Commissioner will be responsible for enforcing the legislation.

The new law establishes a number of offences and penalties for failure to comply with its requirements. Penalties includes fines of up to KYD100,000 per breach, monetary penalties of up to KYD250,000 and prison sentences of up to five years. The Information Commissioner also has the power to ‘name and shame’ organisations found to be in breach of the new law.

Recent and Significant Data Privacy Breaches

There have been no recent and significant data privacy breaches or other cybersecurity attacks involving FinTech companies. In May 2016 CIMA issued a notice to each of its licensees to confirm that CIMA will be reviewing each licensee’s approach to cybersecurity. Separately, data breach notification is a requirement for all data controllers under the new Data Protection Law

Companies Utilising Public Key Infrastructures or Other Encryption Systems

There are no laws relevant specifically to companies utilising public key infrastructures or other encryption systems at this stage.

biometric data

Biometric data is not subject to specific regulation in the Cayman Islands. However, to the extent that biometric data is also personal data, the general principles of the Data Protection Law will apply to its use. Personal data is defined widely under the new law to include any data that allows an individual to be identified. Biometric data may also be sensitive personal data under the new law that benefits from enhanced protection under the new Data Protection Law.

Intellectual Property

Intellectual Property Protection Regime

The Cayman Islands is a common law jurisdiction that has a robust IP protection regime.

In 2015 and 2016 the Cayman Islands updated its copyright laws to bring them in line with the most recent developments under the UK Copyright, Designs and Patents Act 1988, which expressly includes computer programs and databases within the definition of “literary works” and therefore protects them as such for a duration of 50 years.

For FinTech providers, the principal IP right that protects software is copyright: the right to prevent others from, among other things, copying the software. In the Cayman Islands, copyright vests in the author on creation.

The main IP rights available to protect branding are registered and unregistered trade and service marks. FinTech companies will generally own a combination of an established brand or trade name — and this can include logos or icons — protected as registered or unregistered trade marks.

Trade mark rights give registered owners the right to prevent others using identical or confusingly similar marks to their registered mark. Brand owners can also rely on unregistered trade mark rights through the law of passing off. This allows the owner to prevent others from damaging their goodwill with customers by using branding or get-up that is identical or confusingly similar to its own.

The Trade Marks Bill 2016, which at the time of writing was expected to enter into law during the second half of 2017, will allow companies incorporated in the Cayman Islands and foreign companies to obtain trade mark protection without completing a first registration in the UK or EU. At present, trade marks registered in the UK or at the European level can be separately extended to apply in the Cayman Islands.

Patents and industrial designs registered in the UK or at the European level can also be protected in the Cayman Islands by extension with the Cayman Islands Register of Patents and Trademarks. In addition, the patent regime has been amended to provide innovators with additional protections against abusive challenges to their rights by entities that obtain patents for the sole purpose of taking legal action against those who innovate and develop new products. The Cayman Islands patent laws have been amended to prohibit bad faith infringement claims by so-called patent trolls.

Trade Secret Regime

Trade secrets are protected in the Cayman Islands through a combination of common law and rules of equity. A range of remedies are available where trade secrets have been improperly acquired, disclosed or used.

Confidential information is protected through a contractual agreement to keep certain information confidential or through the common law obligation to keep information confidential, because of the nature of the relationship between the discloser and disclose, the nature of the communication or the nature of the information itself.

Whilst most kinds of information are capable of being protected, to establish that there has been a breach of confidence, something extra is needed: a situation or relationship that imposes on the recipient an obligation to keep the information confidential. Even where there is no such relationship, a non-disclosure agreement or confidentiality clause in a commercial contract can impose such an obligation. There is no restriction as to the type of information that can constitute a trade secret. Anything beyond mere trivia can be protected.

Equitable remedies such as injunctions preventing the use or disclosure of trade secrets are available. Injunctions may be available even after the information has become public, if the party who used the information while it was still confidential had obtained an advantage to market over others who waited to obtain the same information legitimately.

Another available remedy is damages. Unless the information formed part of a package that was subject to an established licence fee, the court will look at a range of issues and factors to come to an assessment.

Copyrights, Patents, Trade Marks

Under the updated copyright laws in the Cayman Islands — the Copyright (Cayman Islands) Order 2015 and the Copyright (Cayman Islands) (Amendment) Order 2016 — copyright will automatically subsist in works such as computer code and software. Copyright will only be infringed where copying occurs; independent development of the same technology will not infringe.

For FinTech companies, software is not, of itself, patentable, although processes or methods performed by running software may be. Importantly, such processes or methods would need to bring about a technical effect or solve a technical problem in order to be patentable.

Protection of Intellectual Property or Trade Secrets

There are no other ways for FinTech companies to protect their IP or trade secrets, save as described above.

Joint Development of Intellectual Property

Although the FinTech sector is at an early stage in the Cayman Islands, there are no restrictions under Cayman law preventing collaborations between technology developers and service providers. These collaborations can happen in a variety of ways; for example, through funding FinTech startups, but the IP rights issues will be broadly similar, irrespective of the model used.

Where FinTech is developed by employees within an organisation, for the IP rights to vest with the employer, the development work must be done in the course of employment. If an employee is not employed to develop new technology, the employer may not have any rights to claim ownership of work created outwith the employee’s normal role.

FinTech developed by team members engaged as consultants will generally be owned by the individual consultant, unless there is an agreement providing otherwise. Pre-existing IP rights (background IP) should be addressed in an agreement to make it clear who will own the IP going forward and what happens if the IP becomes incorporated in new FinTech that is developed

As FinTech solutions are often required to interact with other third-party solutions, arrangements permitting inter-operability may also be required. At its simplest, collaboration can occur through a process of cross-licensing.

Where all the FinTech development is being conducted by a third party and the solution is being offered to, or implemented for, an organisation by an external vendor, the organisation may not acquire any IP rights and may, as a customer, only obtain a licence to the solution.

Intellectual Property Litigation

IP for FinTech companies is not a significant source of litigation in the Cayman Islands at this stage but could be as the sector grows.

Open Source Code

Open-source code is not separately regulated or protected in the Cayman Islands. The issues relating to collaboration and ownership identified above apply equally to unplanned collaborations over a period of time. It is possible for every contributor to the open-source code to own the copyright to their contribution, although in practice most contributors are likely to agree to license their material under the same licence as the original work. It can sometimes be difficult to ascertain who should make a legal complaint if someone decides to use the program in a way that violates its licence. To avoid this issue, contributors can explicitly assign the copyright in their contributions to a centralised body that administers the open-source project, making enforcement of the licence easier. An alternative approach would be to have contributors license their contributions to the project’s administrative body under a licence agreement that permits the body to relicense these individual contributions.

Tax Matters

Special Tax Issues, Benefits or Detriments

The Cayman Islands is a tax-neutral jurisdiction and therefore a registered Cayman Islands entity is not subject to Cayman Islands tax. There may be tax implications for beneficial owners in their own jurisdiction, however.

Issues Specific to the Specified Activities

Additional Legal Issues

There is no usury or interest limitation legislation in the Cayman Islands. However, interest levels that are so high as to be considered penal in nature may not be upheld by the courts.

The use of anonymised and aggregated data by FinTech companies for commercial gain will be governed by the Data Protection Law. Aggregation of data for commercial gain will only be permissible where the collection, aggregation and commercial use of the data meets all the data protection principles, is legitimate and meets the fair processing disclosure requirements as outlined in 5.1 Data Privacy and Cybersecurity Regulatory Regimes. The standard required for data to be truly anonymised (and therefore not be personal data) is a high one. The rise of social media and the increase in online public data sources means the ability to ‘re-identify’ individuals by combining that information with anonymised or aggregated datasets has never been easier.