DeFi protocol frontend in Andorra

Exchange between digital assets and fiat currencies: This covers cryptocurrency exchanges that allow users to buy and sell crypto with traditional money (EUR, USD, etc.).

Exchange between one or more digital assets: This covers crypto-to-crypto exchanges, but modern regulatory frameworks now also include fiat-to-crypto transactions, crypto ETF/ETP creation and redemption models, and broker-dealer or clearing functions as part of digital asset exchange definitions.

Custody and administration of digital assets on behalf of third parties: This covers services where an entity holds or controls private keys for virtual assets on behalf of clients.

If a payment processor's activities involve the direct handling, exchange, or custody of digital assets (e.g., accepting crypto payments on behalf of merchants and converting them to fiat, or holding crypto for settlement), they will fall under the VASP licensing requirements for exchange and/or custody services.

Transfer of digital assets is subject to active regulatory development and finalization, with basis transfer rules still being refined and not yet settled like traditional securities.

Provision of financial advice related to digital assets is now subject to specific statutory registration and compliance obligations under the Digital Asset Market Clarity Act and IRS mandatory reporting requirements, making the prior generic advisory claim outdated.

There is no specific EUR 125,000 threshold for custody and administration services for virtual assets under Andorra’s Law 24/2022; licensing is based on compliance requirements rather than a fixed monetary amount.

Higher amounts may be required depending on the volume and complexity of operations, or if combined with other licensed activities.

AML/KYC (Anti-Money Laundering / Know Your Customer):

Andorra is committed to international AML/CFT standards, including those set by the Financial Action Task Force (FATF). VASPs are subject to strict AML/KYC obligations, which align with Law 14/2017, of 22 June, on preventing money laundering and terrorist financing.

Customer Due Diligence (CDD): Implementing appropriate risk-based procedures for identifying and verifying the identity of clients (individuals and legal entities).

Ongoing Monitoring: Continuous monitoring of business relationships and transactions to detect unusual or suspicious activities.

Risk Assessment: Conducting a comprehensive risk assessment of their business, clients, products, and geographies.

Suspicious Activity Reporting (SAR): Reporting suspicious transactions to the Unitat d'Inteligència Financera d'Andorra (UIFAND).

Record Keeping: Maintaining records of client identification, transactions, and due diligence for a specified period.

Designation of an AML Officer: Appointing a qualified AML officer responsible for overseeing compliance.

A significant local presence is typically required. This often includes:

Physical office: Establishing an operational base in Andorra.

Law 14/2017 of 22 June on the prevention and fight against money laundering and the financing of terrorism: This is Andorra's principal AML/CFT law, establishing the general obligations for all obliged entities. It has been subsequently amended to incorporate international recommendations.

Law 9/2023 of 23 March on digital assets: This specific law regulates virtual assets and their service providers, bringing VASPs under the scope of Law 14/2017 and defining the specific licensing and operational requirements for these entities. This law formally identifies VASPs as obliged entities for AML/CFT purposes.

Exchange between virtual assets and fiat currencies.

Exchange between one or more forms of virtual assets.

Transfer of virtual assets.

Custody and/or administration of virtual assets or instruments enabling control over virtual assets.

Participation in and provision of financial services related to an issuer's offer and/or sale of a virtual asset.

Identification and Verification:

Natural persons in Andorra must have their identity verified using reliable, independent source documents, data, or information (e.g., official ID cards, passports), and Andorra now permits digital and remote identity verification methods such as document scanning and biometric liveness checks under its UIFAND-compliant AML framework.

Legal Entities: Obtain and verify the client's legal existence and structure, including:

Beneficial Ownership (BO):

Identify and take reasonable measures to verify the identity of the beneficial owner(s) of legal entities. This includes understanding the ownership and control structure. The threshold for beneficial ownership is typically 25% or more of the shares or voting rights, or control through other means.

Conduct ongoing due diligence on the business relationship, including scrutinizing transactions undertaken throughout the course of that relationship to ensure that the transactions are consistent with the obliged entity’s knowledge of the customer, their business, and risk profile.

Requirement: Any entity providing custody services for virtual assets on behalf of third parties is considered a "Virtual Asset Service Provider" (VASP) under Ley 28/2022 and must be authorized by the Autoritat Financera Andorrana (AFA).

Definition of Custody: Article 3, point 16 of Ley 28/2022 defines "custodia de activos virtuales" (custody of virtual assets) as the safekeeping or administration of virtual assets or instruments enabling control over them on behalf of third parties.

Ley 28/2022, de 15 de desembre, de representació digital d'actius: Articles 3.16, 5, 8, 9, and subsequent articles detailing VASP authorization.

Autoritat Financera Andorrana (AFA): Regulator responsible for VASP authorization.

Ley 28/2022 is relatively new, having been approved in December 2022 and entering into force in May 2023.