Custodial wallet / SaaS in Belize

Belize's Virtual Assets Services Act, 2024 remains in force, but its security, operational resilience, and risk management sections are now supplemented and partially superseded by the Digital Asset Services Licensing Regulations, 2025, which imposes a new licensing framework that overrides earlier provisions.

International Financial Services Commission (Virtual Assets) Regulations, 2024

Application Process: Submission of a detailed application to the Financial Services Commission (FSC), formerly the IFSC.

Fit and Proper Test: Directors, senior management, and significant shareholders must undergo a "fit and proper" assessment, considering their competence, integrity, and financial soundness.

Minimum Capital Requirements: VASPs must meet prescribed minimum paid-up capital requirements, which are stipulated in the Regulations and vary depending on the services offered.

Business Plan: Submission of a comprehensive business plan detailing operations, organizational structure, internal controls, risk management framework, technology infrastructure, and security measures.

AML/CFT Compliance: Robust Anti-Money Laundering (AML) and Counter-Financing of Terrorism (CFT) policies and procedures must be in place, compliant with Belizean laws (e.g., Money Laundering and Terrorism (Prevention) Act) and international FATF standards. This includes customer due diligence (CDD), record-keeping, suspicious transaction reporting, and internal controls.

Risk Management Framework: Detailed policies for identifying, assessing, monitoring, and mitigating risks associated with virtual asset services, including technological, operational, cybersecurity, and market risks.

Corporate Governance: Establishment of sound corporate governance arrangements, including clear lines of responsibility, oversight by the board, and internal audit functions.

Information Technology (IT) & Cybersecurity: Implementation of robust IT systems and cybersecurity measures to protect virtual assets, client data, and operational integrity.

Separate Accounts: A licensed VASP providing custody services must hold client virtual assets in accounts separate from its own assets.

No Commingling: Client assets must not be commingled with the VASP's proprietary assets.

Trustee Capacity: The VASP must hold client virtual assets in trust or a similar fiduciary capacity, ensuring they are protected in the event of the VASP's insolvency or bankruptcy.

Record-Keeping: Detailed and accurate records of all client virtual assets must be maintained, clearly identifying ownership.

Financial Resources: VASPs are expected to maintain adequate financial resources, including sufficient capital, to cover operational risks and potential liabilities.

Risk Management: The comprehensive risk management framework required will likely necessitate considerations for covering potential losses due to cyber-attacks, operational failures, or misconduct. This often implies the need for appropriate insurance coverage (e.g., cybersecurity insurance, professional indemnity insurance), even if not explicitly mandated for a specific amount in the law.

IFSC Discretion: The IFSC may, at its discretion, impose specific insurance or bonding requirements on individual licensees based on their business model, scale of operations, and risk profile.

Robust Security Measures: Licensed VASPs must implement stringent security measures to protect virtual assets from theft, loss, or unauthorized access. This includes cybersecurity protocols, cryptographic security, access controls, and data integrity.

Financial Intelligence Unit (FIU) of Belize

Role: The FIU is the central national agency responsible for receiving, analyzing, and disseminating suspicious transaction reports (STRs) to law enforcement agencies.

Virtual Asset Services Act, 2023 (VASA)

Money Laundering and Terrorism (Prevention) Act (MLTPA) [Revised Edition 2011 & subsequent amendments]:

Financial Intelligence Unit Act

Identification and Verification:

Legal Persons/Arrangements (e.g., companies, trusts):

Purpose and Intended Nature of Business Relationship: Understand the purpose and intended nature of the business relationship (e.g., why the customer wants to use the VASP's services, expected transaction volumes and types).

Source of Funds/Wealth: For higher-risk customers or transactions, VASPs must take reasonable measures to establish the source of funds or source of wealth.

Continuously monitor the business relationship and transactions to ensure they are consistent with the VASP's knowledge of the customer, their business, and risk profile.

Risk-Based Approach: VASPs must apply a risk-based approach to CDD, meaning that the intensity and nature of CDD measures should be commensurate with the money laundering and terrorism financing risks identified. This involves:

Simplified CDD (SCDD): For lower-risk situations, if permitted by regulations.

Enhanced CDD (ECDD): For higher-risk situations, such as customers from high-risk jurisdictions, Politically Exposed Persons (PEPs), or complex transactions. This includes obtaining additional information, increased frequency of monitoring, and requiring senior management approval for establishing or continuing relationships.

The primary regulator for financial services in Belize, including licensing and oversight of investment businesses, securities dealing, and collective investment schemes, is now the Financial Services Commission (FSC), which replaced the International Financial Services Commission (IFSC).