Key highlights include:

Licensing framework: DISPs will require a licence under the proposed Digital Identity Service Provider Business Act (DISPA). An entity shall require a licence if it carries on the business of both (a) identity proofing and enrolment with initial binding and credentialing; and (b) authentication and life-cycle management of those digital identities once they are issued. Licences are categorised into:

• Class F: Full licence for all DISP activities
• Class M: Modified licence for entities transitioning to full licensing
• Class T: Test licence for pilot projects

Regulatory oversight: The framework mandates compliance with prudential standards, cybersecurity measures and financial reporting. DISPs must maintain a principal place of business in Bermuda and appoint a BMA approved senior representative who maintains a physical presence in Bermuda for local oversight.

Consumer protection: Provisions include minimum net asset requirements, secure client data management and penalties for non-compliance. Unauthorised use of the term "digital identity service provider business" is prohibited.

Stakeholder feedback: The BMA invites comments on the framework by 2 September 2025, to refine the regime and ensure it supports Bermuda’s digital identity ecosystem effectively.

The consultation paper can be accessed here.