The call usually starts the same way. A founder has traction, a cap table that looks tidy enough, and a question that decides the next 18 months: can we start under a Bermuda test licence and graduate to full authorisation without breaking the business?
In late July 2026, Bermuda quietly answered with activity, not slogans. A new test licence showed up on the register, a modified licence the very next day, and a fresh consultation on how recognised stablecoins could sit inside insurance, ILS and fund structures. The roadmap is there, on paper and in motion.
If you need a clean path from sandbox to scale, this is what the island is actually doing, and what it expects from you at each step.
Bermuda built a licensing ladder for digital asset businesses under its Digital Asset Business Act, often shortened to DABA. Instead of a binary yes or no, it gives firms a way to start limited operations under supervision, then expand as controls and business maturity improve.
The design choice is deliberate: let innovation into the perimeter early, then turn the compliance dial up as real risk appears.
Three licence classes sit at the core. Class T is the test environment. Class M is a modified licence with more room to operate but with conditions. Class F is the full licence. In July 2026, you can see this ladder in use: Excellar International SAC Ltd popped onto the public register with Class T on 22 July 2026, and Kimber Digital Assets Bermuda ISAC Ltd followed with Class M on 23 July 2026. Both entries are visible on the Bermuda Monetary Authority’s regulated entities list, with activity scopes stated on record Bermuda Monetary Authority — Regulated Entities.
At the same time, the BMA opened a consultation on 20 July 2026 about recognised stablecoins inside Bermuda insurance, ILS and funds. Comments run to 30 September 2026. It is a window into how the regulator thinks about tokenised cash-like assets moving across the traditional finance stack Bermuda Monetary Authority (Consultation Paper PDF).
Inside Bermuda’s DABA: Classes T, M and F in plain English
Class T: test with training wheels
Class T lets you run a limited live pilot with real clients and real assets, under tight constraints. Think controlled onboarding, caps on volumes, targeted activities, and pre-agreed safeguards. The regulator uses it to watch how your systems behave when money actually moves.
A current example on the register is Excellar International SAC Ltd, effective 22 July 2026. The entry shows permissions including issuing or redeeming digital assets, custodial wallet services, and lending or repo services within the test remit. The listing is on the BMA’s site for anyone to check Bermuda Monetary Authority — Regulated Entities.
Class M: modified authorisation, still conditional
Class M is what you seek once the pilot proves the basics work. You can scale client numbers and activities, but you accept conditions tailored to your risk profile. That might include certain asset restrictions, tighter reporting, or caps that lift only after defined milestones.
On 23 July 2026, Kimber Digital Assets Bermuda ISAC Ltd appeared as Class M, with permissions to issue, sell or redeem digital assets and to operate as a digital asset services vendor, evidence that this sandbox rung is active in mid‑2026 Bermuda Monetary Authority — Regulated Entities.
Class F: the final stop
Class F is the full licence. You are now a permanent resident of the regulated perimeter. Controls are baked in, independent audits live on a schedule, and capital, governance and risk standards meet the bar the authority expects of mature financial businesses.
From application to approval: steps that actually happen
This is the usual flow firms describe when moving up the ladder. The exact timetable depends on your business model, operational readiness, and how clean your answers are when the BMA starts asking questions.
Pre‑application engagement. You meet the supervisor, sanity check your plan, and confirm whether Class T or straight-to-Class M makes sense. Early clarity here saves months later.
Formal application. You submit governance charts, key personnel, AML/ATF frameworks, custody architecture, cyber controls, financials, and runbooks for incidents. Expect detailed follow‑ups.
Class T pilot. If granted, you operate with defined limits. You log everything. You show that onboarding, transaction monitoring, wallet policies, and reconciliations work under stress.
Conditions uplift to Class M. With evidence in hand, you seek a modified licence. The BMA often ties conditions to objective facts: a penetration test, an independent custody review, or enhanced reporting for a period.
Class F transition. Once your risk controls look routine, you apply to lift conditions entirely. Governance independence, financial resources, and audit cycles matter a lot at this point.
Ongoing supervision. Reporting, site visits, external audits and change notifications become part of the furniture. A licence is not a finish line, it is the start of being examined as a financial firm.
Mid‑2026 moves: stablecoins and sandbox activity
Why the stablecoin consultation matters
On 20 July 2026, the BMA published a consultation on how recognised stablecoins could be used in Bermuda insurance, insurance‑linked securities and investment funds, with comments due by 30 September 2026. The paper signals the regulator is thinking about operational settlement, collateral management, and how tokenised cash fits with prudential rules. It is not just a crypto topic. It is about plumbing for risk transfer and fund operations Bermuda Monetary Authority (Consultation Paper PDF).
Live evidence the sandbox is working
Registers tell the real story. In July 2026, Excellar International SAC Ltd appeared with Class T and Kimber Digital Assets Bermuda ISAC Ltd with Class M. Both show permitted activities on record, underscoring that the two early rungs are not museum pieces. They are being used by real firms as of those dates Bermuda Monetary Authority — Regulated Entities.
What the BMA expects in practice
Governance that actually governs
Boards with relevant experience, documented decision processes, and independence where it counts. Minutes that read like the board understood the risks and made trade‑offs, not rubber stamps.
AML/ATF that catches bad patterns
Risk‑based onboarding, sanctions screening, ongoing monitoring, and escalation that works at 2 a.m. when a flagged flow appears. Policies must match your products, clients and geographies.
Custody, keys and segregation
Clear key management, multi‑sig or threshold schemes with dual control, wallet segregation, and reconciliations that tie out. If you lend or run repo, the movement of collateral needs to be crystal clear.
Operational resilience
Incident response playbooks, tested disaster recovery, vendor oversight, and change‑management that does not let a developer hot‑patch a production wallet on a Friday night.
Disclosures and client protection
Terms that explain risks in straight language, fee transparency, suitability where relevant, and a complaints process that is visible and real. If you market yield, back it with how the risk is taken and who absorbs losses.
Licence classes compared at a glance
Every firm’s conditions differ, but the broad shape of the three classes is consistent. Here is a plain‑English snapshot.
Feature Class T (Test) Class M (Modified) Class F (Full) Purpose Pilot real services with strict limits Scale with conditions tailored to risk Operate fully within the perimeter Client scope Restricted, pre‑approved cohorts Broader, with some exclusions Broadest, per business model Typical duration Short, milestone‑driven Interim until conditions lifted Ongoing, subject to supervision Reporting Frequent, granular pilot metrics Enhanced periodic reports Standard regulatory reporting Common conditions Caps on volumes, assets, users Asset limits, controls attestations Full control framework embedded Good fit for New models needing live data Proven models scaling responsibly Mature firms with stable controls
Who this affects and why it matters
Founders and operators
If you are building exchange, custody, brokerage, lending, or token issuance services, Class T gets you into production while you finish the heavy lifts. Class M gives you time to build up governance muscle. Class F is the goal if you want institutional clients and stable bank relationships.
Investors and counterparties
Licence class signals maturity. A Class T outfit can be promising, but diligence the limits. A Class M firm is putting controls into muscle memory, which can de‑risk a round. A Class F platform might be nearer to steady state, but the bar is higher and change is slower by design.
Traditional finance in Bermuda
The stablecoin consultation shows where the bridge may form next. If recognised stablecoins become clean building blocks for insurance and funds, expect more tokenised settlement and collateral flows to live inside regulated structures in Bermuda. That could make Class F providers that handle custody and payments more essential to local financial plumbing.
Outlook: what could be next
The regulator’s calendar tells you what to watch. The July 2026 consultation on recognised stablecoins suggests coming guidance on which tokens qualify, how they are held, and what controls insurers and funds must demonstrate. If that lands cleanly, it could reduce friction for Bermuda structures that want on‑chain settlement rails while staying inside conservative risk appetites Bermuda Monetary Authority (Consultation Paper PDF).
On licensing, expect more Class T and Class M activity to show up in the public register through 2026 as firms tune their models. Not every applicant will graduate. Some pilots will stall, and that is fine. The point of a sandbox is to let failure be small and instructive.
Risks & What Could Go Wrong
Scope creep inside a pilot. Teams push beyond Class T limits to meet revenue targets. That invites enforcement and delays upgrades.
Weak custody hygiene. Key management and wallet segregation that work in a demo can buckle under real client flows. Breaches during Class T can set you back quarters.
Over‑reliance on a single stablecoin. If future guidance narrows what is recognised, parts of your flow might need re‑plumbing on short notice.
Talent gaps. Governance and AML expertise are scarce. An under‑powered board or compliance function will show, and supervisors notice.
Vendor risk. Cloud, analytics, or blockchain service providers can change terms or suffer outages. Without redundancy, your risk profile spikes.
Regulatory drift across borders. If you serve clients in multiple jurisdictions, changes elsewhere can force product changes that collide with your Bermuda conditions.
The fastest way to a full licence is boring reliability. Flashy roadmaps do not offset weak controls once real money moves.
Frequently Asked Questions
What is the difference between Class T, Class M and Class F?
Class T is a test licence for limited live pilots under tight constraints. Class M is a modified licence for scaling with conditions tailored to risk. Class F is the full licence for ongoing operations under the complete rule set. Firms often progress T to M to F as controls mature.
How long does it take to move from a test licence to full?
There is no fixed clock. Timelines depend on your model, evidence from the pilot, and how fast you close gaps the supervisor flags. Clean documentation and predictable operations shorten the path. Significant control rebuilds extend it.
Do I have to use Class T first?
Not always. Some firms with proven models and robust controls may apply for Class M directly. The starting point is part of early engagement with the BMA. The authority will consider your readiness and risk profile.
What kinds of activities are typically covered?
Common areas include issuing or redeeming digital assets, operating custodial wallets, running exchanges or broker services, and lending or repurchase transactions. Your exact permissions are listed in your licence and, for transparency, entries appear on the BMA’s public register.
Why is the July 2026 stablecoin consultation important?
It shows the BMA is integrating recognised stablecoins into mainstream Bermuda structures like insurance, ILS and funds. That could enable tokenised settlement and collateral while keeping prudential safeguards. It is a signal about the next phase of real‑world adoption in regulated finance.
What is the biggest mistake teams make in Class T?
Underestimating how much operational logging, reconciliation and incident handling matter. A beautiful product demo is not persuasive if your audit trails are thin or your incident playbook is theoretical. Prove you can run the shop when things go sideways.
Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.