Centralized exchange in Andorra

Exchange between digital assets and fiat currencies: This covers cryptocurrency exchanges that allow users to buy and sell crypto with traditional money (EUR, USD, etc.).

Exchange between one or more digital assets: This covers crypto-to-crypto exchanges, but modern regulatory frameworks now also include fiat-to-crypto transactions, crypto ETF/ETP creation and redemption models, and broker-dealer or clearing functions as part of digital asset exchange definitions.

Custody and administration of digital assets on behalf of third parties: This covers services where an entity holds or controls private keys for virtual assets on behalf of clients.

Transfer of digital assets is subject to active regulatory development and finalization, with basis transfer rules still being refined and not yet settled like traditional securities.

Law 14/2017 of 22 June on the prevention and fight against money laundering and the financing of terrorism: This is Andorra's principal AML/CFT law, establishing the general obligations for all obliged entities. It has been subsequently amended to incorporate international recommendations.

Law 9/2023 of 23 March on digital assets: This specific law regulates virtual assets and their service providers, bringing VASPs under the scope of Law 14/2017 and defining the specific licensing and operational requirements for these entities. This law formally identifies VASPs as obliged entities for AML/CFT purposes.

Exchange between virtual assets and fiat currencies.

Exchange between one or more forms of virtual assets.

Transfer of virtual assets.

Custody and/or administration of virtual assets or instruments enabling control over virtual assets.

Requirement: Any entity providing custody services for virtual assets on behalf of third parties is considered a "Virtual Asset Service Provider" (VASP) under Ley 28/2022 and must be authorized by the Autoritat Financera Andorrana (AFA).

Definition of Custody: Article 3, point 16 of Ley 28/2022 defines "custodia de activos virtuales" (custody of virtual assets) as the safekeeping or administration of virtual assets or instruments enabling control over them on behalf of third parties.

Ley 28/2022, de 15 de desembre, de representació digital d'actius: Articles 3.16, 5, 8, 9, and subsequent articles detailing VASP authorization.

Autoritat Financera Andorrana (AFA): Regulator responsible for VASP authorization.

While Ley 28/2022 does not explicitly use the term "segregation" in the same prescriptive way as traditional finance for client funds, the underlying principles of safeguarding client assets and acting in their best interest are inherent.

Authorized VASPs providing custody services are subject to fiduciary duties and robust internal control requirements. This implies that client assets must be clearly identifiable, protected from the custodian's own assets, and not be used for proprietary trading or commingled in a way that risks their availability to the client.

Detailed rules on how client virtual assets must be held, distinguished from the custodian's own assets, and protected in the event of insolvency, will be specified in secondary regulations and AFA guidance. This is a common practice where the foundational law sets the principle, and the regulator provides the operational details.

There is no specific EUR 125,000 threshold for custody and administration services for virtual assets under Andorra’s Law 24/2022; licensing is based on compliance requirements rather than a fixed monetary amount.

Higher amounts may be required depending on the volume and complexity of operations, or if combined with other licensed activities.

A significant local presence is typically required. This often includes:

Physical office: Establishing an operational base in Andorra.

AML/KYC (Anti-Money Laundering / Know Your Customer):

Andorra is committed to international AML/CFT standards, including those set by the Financial Action Task Force (FATF). VASPs are subject to strict AML/KYC obligations, which align with Law 14/2017, of 22 June, on preventing money laundering and terrorist financing.

Customer Due Diligence (CDD): Implementing appropriate risk-based procedures for identifying and verifying the identity of clients (individuals and legal entities).

Ongoing Monitoring: Continuous monitoring of business relationships and transactions to detect unusual or suspicious activities.

Risk Assessment: Conducting a comprehensive risk assessment of their business, clients, products, and geographies.

Suspicious Activity Reporting (SAR): Reporting suspicious transactions to the Unitat d'Inteligència Financera d'Andorra (UIFAND).

Record Keeping: Maintaining records of client identification, transactions, and due diligence for a specified period.

Designation of an AML Officer: Appointing a qualified AML officer responsible for overseeing compliance.

Identification and Verification:

Beneficial Ownership (BO):

Conduct ongoing due diligence on the business relationship, including scrutinizing transactions undertaken throughout the course of that relationship to ensure that the transactions are consistent with the obliged entity’s knowledge of the customer, their business, and risk profile.

VASPs must apply a risk-based approach to CDD. This means the intensity of CDD measures should be proportionate to the assessed ML/TF risks.

The AFA will assess the suitability and professionalism of the management and shareholders.

The process involves following a risk-based regulatory review or compliance process focused on operational procedures, security controls, and compliance requirements, rather than necessarily submitting a single comprehensive application outlining every aspect of the business model.

Ley 28/2022 is relatively new, having been approved in December 2022 and entering into force in May 2023.