Guide to Fintech Law in the Isle of Man 2024

1. the isle of man fintech landscape

1.1 Please describe the types of fintech businesses that are active in the isle of man and the state of the development of the market, including in response to the COVID-19 pandemic and ESG (Environmental, Social and Governance) objectives. Are there any notable fintech innovation trends of the past year within particular sub-sectors (e.g. payments, asset management, peer-to-peer lending or investment, insurance and blockchain applications)?

The Isle of Man has a well-developed and active fintech community covering a broad range of sectors, with a welcoming and supportive government.

Insurance is the largest sector of the economy, making up 18.2% of the economy. The island is home to world-leading brands in life insurance and a considerable captive insurance market. Insurtech is a key focus for Finance Isle of Man (one of four executive agencies of the island’s Department for Enterprise), which ran an Insurtech Accelerator Programme during 2022/23 to bring together a cohort of international start-ups to collaborate with the island’s insurance community to provide innovative solutions for insurance providers and encouraging a network of skill and technological development.

Similarly, Digital Isle of Man (another executive agency of the island’s Department for Enterprise) ran a Fintech Innovation Challenge in 2023. A cohort of participants from across the world partnered with local industry mentors to develop ideas for digital ID and e-KYC, AI forecasting and ESG auditing, amongst other things. In 2024, the Department for Enterprise is running a similar larger Innovation Challenge to develop solutions that tackle key issues in Fintech, Cleantech, and Artificial Intelligence.

eGaming is the second largest contributor to the island’s GDP, making up 15.7% of the economy.

More broadly, the island is also home to global payment service providers, crypto exchanges and a number of software developers, including innovative fund administration systems, e-gaming software and systems used by government registries across the world.

1.2 Are there any types of fintech business that are at present prohibited or restricted in the isle of man (for example cryptocurrency-based businesses)?

There are no prohibitions or restrictions specific to fintech businesses, save that it is the policy of the Isle of Man Financial Services Authority (IOMFSA) to refuse to register persons carrying out initial coin offerings (ICO) where the coin issued provides no benefit to the purchaser other than the coin itself.  Such virtual currencies are generally considered by the IOMFSA to pose an unacceptably high risk that the money raised from the ICO could be used for unanticipated and illegal purposes, as well as posing a risk to consumers.

2. funding for fintech in the isle of man

2.1 Broadly, what types of funding are available for new and growing businesses in the isle of man (covering both equity and debt)?

The Isle of Man Department for Enterprise offers a number of grants and funding support schemes:

• Under the Micro Business Grant Scheme, new qualifying start-up businesses may be offered funding of up to £6,000 and a further £10,000 to support creation of jobs alongside training and mentoring opportunities.
• The Financial Assistance Scheme provides a range of grants and loan support of up to 40% funding toward capital and operating items for start-ups, local businesses looking to expand and off-island businesses looking to relocate to the Isle of Man.
• The Business Improvement Scheme may provide a grant of 50% towards improvement projects with a maximum of £5,000 per project to businesses wishing to undertake an improvement project.
• Under the Business Energy Saving Scheme, a business seeking to improve their energy efficiency and lower their energy costs may be offered 100% interest-free unsecured loans up to £20,000.
• The Graduate Role Incentive offers businesses of any sector 20% of the first-year salary of a graduate hire up to £6,000, alongside an employer National Insurance rebate for each graduate hire.
• The Employee Relocation Incentive provides a 20% grant of up to £10,000 towards the cost of relocating an employee to the Isle of Man.

Businesses can of course also seek public sector funding, such as bank loans, private equity or venture capital investment.

2.2 Are there any special incentive schemes for investment in tech/fintech businesses, or in small/medium-sized businesses more generally, in the isle of man, e.g. tax incentive schemes for enterprise investment or venture capital investment?

See question 2.1 above.

2.3 In brief, what conditions need to be satisfied for a business to IPO in the isle of man?

There are a number of Isle of Man companies listed on stock exchanges around the world, including the Main Market and Alternative Investment Markets of the London Stock Exchange. Conditions to carrying out an IPO will be driven by the listing rules of the relevant stock exchange.

2.4 Have there been any notable exits (sale of business or IPO) by the founders of fintech businesses in the isle of man?

Yes, a number of Isle of Man fintech companies have carried out IPOs.  In some cases (Playtech PLC and Kape Technologies PLC), listed Isle of Man fintech companies have seen subsequent takeover offers.

The M&A market for more traditional financial services businesses has also been very active in recent years, with a number of notable insurance acquisitions including Quilter International’s sale to Utmost.

3. isle of man Fintech Regulation

3.1 Please briefly describe the regulatory framework(s) for fintech businesses operating in the isle of man, and the type of fintech activities that are regulated.

The applicable regulatory framework will depend upon the activities undertaken by the business:

• Online Gambling – online gambling activities are regulated by the Isle of Man Gambling Supervision Commission (IOMGSC) under the Online Gambling Regulation Act 2001.
• Online Gambling Software – although not mandatory, suppliers of software and related services used in online gambling can apply to the IOMGSC for a software supply licence, which has the benefit of their products being listed on a register maintained by the IOMGSC.
• Investment Business – providing custody services, investment advice or discretionary management services, and dealing or arranging deals in investments are activities which are regulated by the IOMFSA under the Financial Services Act 2008 (FSA08).
• Collective Investment Schemes – funds are regulated by the IOMFSA under the Collective Investment Schemes Act 2008, including those investing into fintech business or issuing security tokens.
• E-money – the issuance of e-money is regulated by the IOMFSA under the FSA08.
• Payment Services – the provision of payment services is regulated by the IOMFSA under the FSA08.
• Lending – lending is regulated by the Isle of Man Office of Fair Trading under the Moneylenders Act 1991 and is also a designated business as discussed at question 3.2 below.
• Insurance business – insurance business is regulated by the IOMFSA under the Insurance Act 2008.
• Cryptocurrencies – cryptocurrency businesses that are not otherwise regulated by the IOMFSA or IOMGSC are overseen by the IOMFSA as described at question 3.2 below.

3.2 Is there any regulation in the isle of man specifically directed at cryptocurrencies or cryptoassets?

Currently, there is no district regime for cryptocurrencies or cryptoassets; rather the property of the token and the activities undertaken by the business will dictate the applicable regulatory regime.  For example, as discussed at question 3.1, where a cryptoasset is analogous to a security or e-money, this could trigger a licensing requirement under the FSA08.  However, this may be subject to change as the IOMFSA issued a discussion paper in February 2024 seeking views on the current approach to the oversight of crypto-asset activities and the potential approaches to further regulation.

Currently businesses carrying out “convertible virtual currency activity” that are not otherwise regulated by the IOMFSA or the IOMGSC must register as a “designated business” with the IOMFSA under the Designated Business (Registration and Oversight) Act 2015 (DBROA).  The definition of “convertible virtual currency activity” is very broad and will capture almost every business operating in the cryptocurrency/cryptoasset sector.  However, the IOMFSA issued a consultation in March 2024 on making changes to DBROA that would see “convertible virtual currency activity” replaced with “virtual asset service provider” and the definition being more closely aligned with that used by the Financial Action Task Force (FATF) and widely adopted by other jurisdictions.

Registration under the DBROA is not full regulation and there are no protections for consumers, no capital or liquidity requirements and no conduct of business rules.  However, a designated business must comply with anti-money laundering and countering the financing of terrorism (AML/CFT) legislation including the Anti-Money Laundering and Countering the Financing of Terrorism Code 2019 (AML/CFT Code), as discussed at question 4.5 below.

3.3 Are financial regulators and policy-makers in the isle of man receptive to fintech innovation and technology-driven new entrants to regulated financial services markets, and if so how is this manifested?  Are there any regulatory ‘sandbox’ options for fintechs in the isle of man?

Policymakers are very receptive to fintech innovation and new technology-driven business, as demonstrated by their support of the Innovation Challenges noted at question 1.1 above.

As a member of the Global Financial Innovation Network (GFIN), the IOMFSA has sharpened its focus on innovation and dynamic regulation, launching an innovation hub on its website to offer guidance to businesses seeking authorisation using innovative technology in delivering regulated activities.

A regulatory sandbox is available, allowing financial services products to be tested in a controlled environment with reduced risks to consumers.  The IOMFSA has the power to apply exceptions or modifications to rules by imposing relevant conditions on a financial services licence as a means of mitigating the risks to the public whilst permitting limited testing.  Currently the power to apply exceptions or modifications is limited to persons carrying on activities that would otherwise be licensed under the FSA08, however the IOMFSA published a consultation paper in April 2024 which would see the sandbox opened up to insurers.

3.4 What, if any, regulatory hurdles must fintech businesses (or financial services businesses offering fintech products and services) which are established outside the isle of man overcome in order to access new customers in the isle of man?

There are no mutual passporting rights into or out of the Isle of Man, so whether a business licensed in another jurisdiction can offer products and services to customers in the Isle of Man will depend upon the specific circumstances. If the business is deemed to be carrying out a regulated activity “in or from” the Isle of Man, then authorisation may be required.

4. Other Regulatory Regimes / Non-Financial Regulation

4.1 Does the isle of man regulate the collection/use/transmission of personal data, and if yes, what is the legal basis for such regulation and how does this apply to fintech businesses operating in the isle of man?

Yes, the Isle of Man has implemented the European General Data Protection Regulation (GDPR) into domestic law by way of the Data Protection Act 2018 and secondary legislation made thereunder (referred to as the Applied GDPR).

Fintech businesses operating in the Isle of Man must comply with the Applied GDPR if they control or process personal data, and the same principles and conditions apply (with minor jurisdiction-specific modifications) under the Applied GDPR as under the GDPR itself.

4.2 Do your data privacy laws apply to organisations established outside of the isle of man?  Do your data privacy laws restrict international transfers of data?

Yes, the Applied GDPR applies to: (i) controllers and processors established in the Isle of Man processing data in the context of that establishment; (ii) controllers and processors not established in the Isle of Man but who use equipment in the Isle of Man for processing data otherwise than for the purposes of transit through the Isle of Man; and (iii) other controllers and  processors who process personal data relating to a person in the Isle of Man where such processing is for the purpose of offering goods or services to individuals in the Isle of Man or to monitor individuals’ behaviour in the Isle of Man.

Personal data may only be transferred overseas or to an international organisation if: (a) the transfer is to a territory within the EEA; (b) the European Commission has made an adequacy decision in respect of the importing jurisdiction; (c) appropriate safeguards are in place, such as the European Commission’s Standard Contractual Clauses; or (d) a specified derogation set out in the Applied GDPR applies.

4.3 Please briefly describe the sanctions that apply for failing to comply with your data privacy laws.

The sanctions available to the Isle of Man Information Commissioner are the same as those available in other jurisdictions under the GDPR (issuing warnings, enforcement notices, bans on processing and/or financial penalties), save that the maximum fine which can be levied is £1 million.

4.4 Does your jurisdiction have cyber security laws or regulations that may apply to fintech businesses operating in the isle of man?

Under the Applied GDPR, businesses that control or process personal data must implement “appropriate technical and organisational measures” to ensure a level of security appropriate to the risk taking into account: (i) the state of the art; (ii) the costs of implementation; (iii) the nature, scope, context and purposes of processing; and (iv) the risk of varying likelihood and severity for the rights and freedoms of individuals.

In addition, businesses that are licensed under the FSA08 or authorised under the Insurance Act 2008 are subject to requirements to ensure business continuity and to notify the IOMFSA of material outsourcing arrangements and breaches.

All businesses that fall within the remit of the AML/CFT Code are required to carry out technology risk assessments to ensure that they fully understand the money laundering and terrorist financing (ML/TF) risks of any technology they use and the impact such technology may have on their compliance with AML/CFT requirements.

4.5 Please describe any AML and other financial crime requirements that may apply to fintech businesses in the isle of man.

The AML/CFT Code sets out prescriptive requirements which include, amongst other things, appointing a Money Laundering Reporting Officer (MLRO), collecting and monitoring customer due diligence, and establishing and operating a number of procedures and controls.  se include requirements to carry out and regularly review:

• a business risk assessment to estimate the risk of ML/TF posed by its business and customers;
• a technology risk assessment to estimate the risk of ML/TF posed by any technology used in its business; and
• for each customer, a customer risk assessment which estimates the risk of ML/TF posed by the customer.

Businesses operating in the Isle of Man must also comply with anti-bribery laws, proceeds of crime and anti-terrorism laws and with international sanctions (the Isle of Man applies sanctions made by the UK and the UN).

4.6  Are there any other regulatory regimes that may apply to fintech businesses operating in the isle of man (for example, AI)?

No, not at the present time, although as noted at question 3.2, the IOMFSA issued a discussion paper in February 2024 seeking views on potential approaches to further regulation of crypto-assets.

5. Accessing Talent

5.1 In broad terms, what is the legal framework around the hiring and dismissal of staff in the isle of man?  Are there any particularly onerous requirements or restrictions that are frequently encountered by businesses?

The legal framework governing employment on the Isle of Man consists of the Employment Act 2006 (Employment Act) and the Equality Act 2017 (Equality Act).

The Equality Act offers protection to employees and other workers through nine protected characteristics: age; disability; gender reassignment; marriage and civil partnership; pregnancy and maternity; race; religion or belief; sex; and sexual orientation.  Employers must not discriminate against individuals on the grounds of any protected characteristic, for trade union membership or for any criminal convictions.

The framework for dismissal provides that employers are required to provide a period of notice to an employee who has been continuously employed for one month or more, such notice periods vary depending on length of employment.  Employees have the right not to be unfairly dismissed by an employer; such unfair dismissals may be presented to the Employment and Equality Tribunal.

5.2  What, if any, mandatory employment benefits must be provided to staff?

It is important to note that there are differences between a “worker” and an “employee” in the Isle of Man.  Such differences between the two employment statuses include the mandatory employment benefits to which they are entitled.

Workers have the right to minimum wage, paid annual leave and equal pay.  They also have protection from whistleblowing and discrimination on grounds of protected characteristics.

In addition to the above, employees are further entitled to, alongside certain other rights: time off with pay for trade union activities and for ante-natal care; alternative work or remuneration if suspended on maternity grounds; maternity/paternity leave; adoption leave; request flexible working; a minimum period of notice on termination of employment; and protection from unfair dismissal.  Periods of maternity leave are calculated in line with the regulations made by the Department for Enterprise.

Further, as of 1 April 2024, both employees and now workers now have the “right to a written statement and itemised pay statement”, forming part of ongoing reforms to the Employment Act.

5.3  What, if any, hurdles must businesses overcome to bring employees from outside the isle of man into the isle of man?  Is there a special route for obtaining permission for individuals who wish to work for fintech businesses?

An individual only has automatic permission to work in the Isle of Man if they are an “Isle of Man worker” and must otherwise apply for a work permit.  Certain exemptions exist, including employment in ICT and e-business if certain conditions are met.

However, with a governmental push to entice employees from outside jurisdictions, under the Employee Relocation Incentive, a grant of up to £10,000 is available to expanding businesses for the purpose of relocating an employee to the Isle of Man.

6. Technology

The guide was first published in The International Comparative Legal Guide to: Fintech 2024, by Global Legal Group, London.