Remote VASP serving residents in Andorra

Exchange between digital assets and fiat currencies: This covers cryptocurrency exchanges that allow users to buy and sell crypto with traditional money (EUR, USD, etc.).

Exchange between one or more digital assets: This covers crypto-to-crypto exchanges, but modern regulatory frameworks now also include fiat-to-crypto transactions, crypto ETF/ETP creation and redemption models, and broker-dealer or clearing functions as part of digital asset exchange definitions.

Custody and administration of digital assets on behalf of third parties: This covers services where an entity holds or controls private keys for virtual assets on behalf of clients.

Transfer of digital assets is subject to active regulatory development and finalization, with basis transfer rules still being refined and not yet settled like traditional securities.

AML/KYC (Anti-Money Laundering / Know Your Customer):

Key AML/KYC requirements in jurisdiction AD are undergoing fundamental reform under FinCEN's April 7, 2026, Notice of Proposed Rulemaking, shifting from static checklists toward risk-based, effective programs; existing requirements under the BSA and CDD Rule remain in effect until final rules are adopted.

Customer Due Diligence (CDD): Implementing appropriate risk-based procedures for identifying and verifying the identity of clients (individuals and legal entities).

Ongoing Monitoring: Continuous monitoring of business relationships and transactions to detect unusual or suspicious activities.

Risk Assessment: Conducting a comprehensive risk assessment of their business, clients, products, and geographies.

Suspicious Activity Reporting (SAR): Reporting suspicious transactions to the Unitat d'Inteligència Financera d'Andorra (UIFAND).

Record Keeping: Maintaining records of client identification, transactions, and due diligence for a specified period.

Designation of an AML Officer: Appointing a qualified AML officer responsible for overseeing compliance.

A significant local presence is typically required. This often includes:

Physical office: Establishing an operational base in Andorra.

There is no specific EUR 125,000 threshold for custody and administration services for virtual assets under Andorra’s Law 24/2022; licensing is based on compliance requirements rather than a fixed monetary amount.

Higher amounts may be required depending on the volume and complexity of operations, or if combined with other licensed activities.

Law 14/2017 of 22 June on the prevention and fight against money laundering and the financing of terrorism: This is Andorra's principal AML/CFT law, establishing the general obligations for all obliged entities. It has been subsequently amended to incorporate international recommendations.

Law 9/2023 of 23 March on digital assets: This specific law regulates virtual assets and their service providers, bringing VASPs under the scope of Law 14/2017 and defining the specific licensing and operational requirements for these entities. This law formally identifies VASPs as obliged entities for AML/CFT purposes.

Exchange between virtual assets and fiat currencies.

Exchange between one or more forms of virtual assets.

Transfer of virtual assets.

Custody and/or administration of virtual assets or instruments enabling control over virtual assets.

Identification and Verification:

Natural persons in Andorra must have their identity verified using reliable, independent source documents, data, or information (e.g., official ID cards, passports), and Andorra now permits digital and remote identity verification methods such as document scanning and biometric liveness checks under its UIFAND-compliant AML framework.

Beneficial Ownership (BO):

Identify and take reasonable measures to verify the identity of the beneficial owner(s) of legal entities. This includes understanding the ownership and control structure. The threshold for beneficial ownership is typically 25% or more of the shares or voting rights, or control through other means.

VASPs must apply a risk-based approach to CDD. This means the intensity of CDD measures should be proportionate to the assessed ML/TF risks.

Simplified Due Diligence (SDD): May be applied in low-risk situations, where specific conditions are met and there is sufficient assurance that the ML/TF risks are genuinely lower.

Requirement: Any entity providing custody services for virtual assets on behalf of third parties is considered a "Virtual Asset Service Provider" (VASP) under Ley 28/2022 and must be authorized by the Autoritat Financera Andorrana (AFA).

Ley 28/2022, de 15 de desembre, de representació digital d'actius: Articles 3.16, 5, 8, 9, and subsequent articles detailing VASP authorization.

Autoritat Financera Andorrana (AFA): Regulator responsible for VASP authorization.

Ley 28/2022 is relatively new, having been approved in December 2022 and entering into force in May 2023.