Custodial wallet / SaaS in Bhutan

Bhutan’s Gelephu Mindfulness City has introduced a fast-track licensing pathway for crypto firms, including custodial services, which streamlines approval and banking access.

No specific "digital asset custody license" currently exists.

Entities providing virtual asset services in Bhutan, including custody, are subject to a specific Digital Asset Trading and Custody Services License regime, not merely AML/CFT registration. This licensing framework inherently includes AML/CFT obligations such as customer due diligence, transaction monitoring, and suspicious transaction reporting, but the primary regulatory obligation is the specialized license, not just AML/CFT requirements alone.

Bhutan's AML/CFT framework, originally under the 2018 Act, has evolved through the completion of a Second National Risk Assessment, with VASPs covered if designated as financial institutions or DNFBPs by the FIU or RMA. The regulatory landscape is now more developed than the initial 2018 Act alone.

Segregation of Client Assets Rules:

No specific rules for digital asset custody.

No specific insurance or bonding requirements for digital asset custodians.

Cold Storage Mandates:

No specific mandates for the use of cold storage.

Qualified Custodian Definitions:

No specific definition for a "qualified custodian" concerning digital assets.

Public information exists on specific pending digital asset custody legislation in Bhutan, as BTSE Bhutan received in-principle approval for a digital asset trading and custody services license in May 2026.

Bhutan has been exploring a Central Bank Digital Currency (CBDC), the "digital Ngultrum," which is a separate initiative from regulating private cryptocurrencies and their custody.

For the Public and Licensed Financial Institutions: The Royal Monetary Authority of Bhutan (RMA) has adopted a cautious and prohibitive stance. There is no legal framework to permit or regulate private crypto trading, exchanges, or virtual asset service providers (VASPs) for the general public. Licensed financial institutions (banks, non-bank financial institutions) are generally prohibited from dealing with virtual assets, processing transactions related to them, or providing services to crypto businesses. This effectively acts as a de facto ban on public participation in the unregulated crypto market.

For State-Owned Entities: In contrast, Bhutan has strategically engaged with cryptocurrency through Druk Holdings & Investments (DHI), the sovereign wealth fund. DHI has been involved in Bitcoin mining and holds significant crypto assets, indicating a state-controlled, strategic adoption rather than an open market approach.

Anti-Money Laundering and Countering Financing of Terrorism Act of Bhutan (AMLCFT Act) 2018: This is the cornerstone legislation for AML/CFT in Bhutan. While it may not explicitly name "cryptocurrency" or "virtual assets" in all its provisions, its broad definitions and regulatory scope are intended to cover evolving financial instruments and services that fall under the FATF's purview.

AML/CFT Guidelines for Financial Institutions (2018): Issued by the RMA, these guidelines provide detailed instructions and requirements for financial institutions to implement the provisions of the AML/CFT Act. While not specifically named for VASPs, these guidelines generally apply to any entity falling under the scope of "financial institutions" or "reporting entities" for AML/CFT purposes.

Identification and Verification:

Beneficial Ownership: Identifying and verifying the natural persons who ultimately own or control the customer, or the natural person on whose behalf a transaction is being conducted.

Ongoing Due Diligence: Conducting ongoing monitoring of the business relationship and transactions to ensure they are consistent with the entity's knowledge of the customer, their business, and risk profile, including the source of funds.

Obligation to Report: Any transaction (regardless of amount) where there are reasonable grounds to suspect that it may be linked to money laundering, terrorist financing, or other criminal activity must be reported.

Duration: Records must generally be kept for a minimum of five (5) years after the business relationship has ended or after the date of the transaction.

FATF "Travel Rule": The FATF's Interpretive Note 15 (Recommendation 16) requires VASPs to obtain and transmit originator and beneficiary information for virtual asset transfers. While not explicitly codified in Bhutanese law for VASPs, the RMA would likely expect VASPs to comply with this as part of their broader AML/CFT obligations, consistent with international standards.