Custodial wallet / SaaS in Andorra

Requirement: Any entity providing custody services for virtual assets on behalf of third parties is considered a "Virtual Asset Service Provider" (VASP) under Ley 28/2022 and must be authorized by the Autoritat Financera Andorrana (AFA).

Definition of Custody: Article 3, point 16 of Ley 28/2022 defines "custodia de activos virtuales" (custody of virtual assets) as the safekeeping or administration of virtual assets or instruments enabling control over them on behalf of third parties.

Applicants must comply with stringent requirements covering corporate governance, internal controls, risk management, financial resources (including minimum capital), anti-money laundering (AML) and counter-terrorist financing (CFT) policies, and operational integrity.

Ley 28/2022, de 15 de desembre, de representació digital d'actius: Articles 3.16, 5, 8, 9, and subsequent articles detailing VASP authorization.

Autoritat Financera Andorrana (AFA): Regulator responsible for VASP authorization.

Authorized VASPs providing custody services are subject to fiduciary duties and robust internal control requirements. This implies that client assets must be clearly identifiable, protected from the custodian's own assets, and not be used for proprietary trading or commingled in a way that risks their availability to the client.

Detailed rules on how client virtual assets must be held, distinguished from the custodian's own assets, and protected in the event of insolvency, will be specified in secondary regulations and AFA guidance. This is a common practice where the foundational law sets the principle, and the regulator provides the operational details.

The AFA, in its assessment of a VASP's operational security and risk management policies, would expect state-of-the-art cybersecurity protocols, which typically incorporate cold, warm, and hot storage strategies with multi-signature authorization or multi-party computation (MPC), and robust disaster recovery plans, tailored to jurisdiction-specific risks.

It is highly probable that the AFA, through secondary regulations, will require VASPs providing custody services to hold specific professional indemnity insurance or equivalent guarantees (e.g., capital buffers, guarantees from parent companies, or specific bonding) to cover potential operational risks, cyberattacks, or negligence resulting in loss of client assets. This is standard practice for regulated financial services and high-risk activities.

Ley 28/2022 is relatively new, having been approved in December 2022 and entering into force in May 2023.

Custody and administration of digital assets on behalf of third parties: This covers services where an entity holds or controls private keys for virtual assets on behalf of clients.

There is no specific EUR 125,000 threshold for custody and administration services for virtual assets under Andorra’s Law 24/2022; licensing is based on compliance requirements rather than a fixed monetary amount.

Higher amounts may be required depending on the volume and complexity of operations, or if combined with other licensed activities.

In addition to initial capital, VASPs must maintain sufficient regulatory capital to cover operational risks and ensure continuous solvency.

Physical office: Establishing an operational base in Andorra.

AML/KYC (Anti-Money Laundering / Know Your Customer):

Customer Due Diligence (CDD): Implementing appropriate risk-based procedures for identifying and verifying the identity of clients (individuals and legal entities).

Ongoing Monitoring: Continuous monitoring of business relationships and transactions to detect unusual or suspicious activities.

Risk Assessment: Conducting a comprehensive risk assessment of their business, clients, products, and geographies.

Suspicious Activity Reporting (SAR): Reporting suspicious transactions to the Unitat d'Inteligència Financera d'Andorra (UIFAND).

Record Keeping: Maintaining records of client identification, transactions, and due diligence for a specified period.

Designation of an AML Officer: Appointing a qualified AML officer responsible for overseeing compliance.

Law 14/2017 of 22 June on the prevention and fight against money laundering and the financing of terrorism: This is Andorra's principal AML/CFT law, establishing the general obligations for all obliged entities. It has been subsequently amended to incorporate international recommendations.

Law 9/2023 of 23 March on digital assets: This specific law regulates virtual assets and their service providers, bringing VASPs under the scope of Law 14/2017 and defining the specific licensing and operational requirements for these entities. This law formally identifies VASPs as obliged entities for AML/CFT purposes.

Custody and/or administration of virtual assets or instruments enabling control over virtual assets.

Identification and Verification:

Beneficial Ownership (BO):

Conduct ongoing due diligence on the business relationship, including scrutinizing transactions undertaken throughout the course of that relationship to ensure that the transactions are consistent with the obliged entity’s knowledge of the customer, their business, and risk profile.

VASPs must apply a risk-based approach to CDD. This means the intensity of CDD measures should be proportionate to the assessed ML/TF risks.