Bermuda: technology regulation at a glance

Framework: Digital Asset Business Act 2018 (DABA) and Digital Asset Issuance Act 2020 (DAIA), supervised by the Bermuda Monetary Authority (BMA); supplemented by the Companies and LLC (Initial Coin Offering) Amendment Act 2018 and the Digital Asset Business (Custody of Client Assets) Rules 2025

Bermuda operates one of the world's earliest and most comprehensive dedicated crypto regulatory regimes. Digital asset businesses (issuers, exchanges, custodians, payment providers, wallet operators) must be licensed by the BMA under DABA 2018, while token issuances are separately regulated under DAIA 2020 and the 2018 ICO Amendment Act. The framework has been progressively expanded — including 2024 stablecoin guidance and the Custody of Client Assets Rules 2025 — with no domestic tax on crypto for individuals.

Framework: Government of Bermuda Artificial Intelligence (AI) Policy (adopted March 2025, applying to public sector use) complemented by the Bermuda Monetary Authority (BMA) Discussion Paper on the Responsible Use of AI in Bermuda's Financial Services Sector (30 July 2025, still in consultation). No comprehensive AI statute is in force; the Personal Information Protection Act (PIPA) and existing sectoral rules apply where AI processes personal data.

Bermuda does not have a dedicated, binding AI law. In March 2025 the Government adopted an internal AI Policy for public-sector use built on 'human-in-the-loop', PIPA/PATI compliance, explainability and audit principles, and in July 2025 the Bermuda Monetary Authority issued a discussion paper on responsible AI in financial services outlining a principles-based, proportionate approach (final proposal expected in Q3 2026). AI activities are otherwise governed indirectly through PIPA (data protection), existing prudential/conduct rules and general law.

Framework: Personal Information Protection Act 2016 (PIPA), fully in force since 1 January 2025; supervised by the Office of the Privacy Commissioner for Bermuda (PrivCom).

Bermuda has an omnibus, GDPR-influenced personal data protection regime under the Personal Information Protection Act 2016 (PIPA), which came into full force on 1 January 2025 after a long implementation period. The Act is enforced by an independent supervisory authority, the Office of the Privacy Commissioner for Bermuda (PrivCom), and applies to any organisation that uses personal information in Bermuda, including with extraterritorial reach.

Framework: Bermuda Monetary Authority (BMA) under the Money Service Business Act 2016 (payments/remittance/e-money-type services) and the Digital Asset Business Act 2018 plus Digital Asset Issuance Act 2020 (crypto/fintech); a modernising Payment Services Act is proposed.

Bermuda has clear, in-force licensing regimes administered by the Bermuda Monetary Authority: money service businesses are licensed under the Money Service Business Act 2016, and digital-asset/fintech firms under the pioneering Digital Asset Business Act 2018 (with T/M/F licence tiers) and Digital Asset Issuance Act 2020. The BMA is actively replacing the MSB Act with a modern, tiered Payment Services Act (consulted in 2025, advancing as of December 2025) to better capture digital wallets, e-money and platform-based payments, but that new statute is not yet in force.

Framework: Bermuda Immigration and Protection Act 1956; Permission to Reside (multi-year) and Economic Investment Residential Certificate (EIRC) policies administered by the Department of Immigration and Ministry of Economy & Labour

Bermuda's dedicated remote-worker visa, the 'Work from Bermuda' (WFB) One-Year Residential Certificate launched in 2020, officially concluded on 28 February 2025 and is no longer being issued. In its place, the Government has transitioned back to multi-year Permission to Reside (up to five years) for individuals not employed locally, alongside the Economic Investment Residential Certificate (EIRC) for high-net-worth applicants; there is no dedicated digital-nomad visa in force in 2026.

Framework: Patchwork of sectoral laws: Electronic Communications Act 2011 (offensive/harassing messages), Criminal Code (child exploitation/luring, as amended by the Criminal Code Amendment Act 2020), Personal Information Protection Act 2016 (PIPA, fully in force 1 Jan 2025) for children's data, and the Cybersecurity Act 2024 for critical-infrastructure cyber security. No dedicated online-safety/platform-liability statute akin to the UK OSA or EU DSA.

Bermuda has no comprehensive online safety or platform-liability regime. Instead, online harms are addressed through a patchwork of criminal-law, telecommunications and data-protection provisions — most notably the Electronic Communications Act 2011, which criminalises grossly offensive, indecent, obscene or menacing messages sent via public electronic communications services, and Criminal Code offences targeting online luring/exploitation of minors. There is no general statutory duty of care for platforms and no mandatory age-verification regime for user-to-user or pornography services.

Framework: Cybersecurity Act 2024 (assented 24 June 2024, commencement staged); Computer Misuse Act 2024; BMA Insurance Sector Operational Cyber Risk Management Code of Conduct (2020); Personal Information Protection Act 2016 (PIPA, in force 1 January 2025). Oversight split between the Minister of National Security / Cybersecurity Advisory Board (CNII), the Bermuda Monetary Authority (financial sector), and the Privacy Commissioner (PrivCom) for personal-data breaches.

Bermuda does not yet operate a single, cross-sector NIS2-style cybersecurity regime. The overarching Cybersecurity Act 2024 received Royal Assent on 24 June 2024 and creates a Critical National Information Infrastructure (CNII) framework with designated sector enforcement authorities, but it is being brought into force gradually and its main operational duties depend on Ministerial commencement and CNII designations. In practice, cyber obligations today are sectoral: the Bermuda Monetary Authority's binding Operational Cyber Risk Management Code for insurers, PIPA's breach-notification duties on all organisations handling personal information, and criminal offences under the Computer Misuse Act 2024.

Framework: Companies Act 1981 (as amended); administered by the Registrar of Companies (ROC) with prior consent from the Bermuda Monetary Authority (BMA). The Beneficial Ownership Act 2025 (effective November 2025) transferred the central beneficial-ownership register from the BMA to the ROC.

Bermuda offers a fast, foreigner-friendly route to incorporation through the 'exempted company', which permits 100% non-Bermudian ownership, has no meaningful minimum capital, and can be formed in roughly 2–4 weeks after BMA/ROC vetting. However, exempted companies are restricted from trading in Bermuda's domestic market — 'local companies' remain subject to the 60/40 rule (60% Bermudian ownership and directorship) unless a ministerial licence is obtained — and any foreign founder wishing to live and work on-island must separately secure a work permit or the Economic Investment Certificate.