On-shore VASP in Djibouti

Law No. 128/AN/18/8ème L of July 18, 2018, modifying and completing Law No. 136/AN/07/5ème L on Money Laundering, Terrorist Financing and Proliferation Financing.

Be subject to the same AML/CFT obligations as traditional financial institutions. This means adhering to the principles outlined in Law No. 128/AN/18/8ème L.

Implement a risk-based approach to identify, assess, and mitigate money laundering and terrorist financing risks associated with their virtual asset products, services, customers, and delivery channels.

Comply with the FATF Travel Rule, which requires VASPs to obtain and transmit originator and beneficiary information for virtual asset transfers above a certain threshold.

Identifying and Verifying the Identity of the Customer:

For individuals: Obtaining name, address, date of birth, nationality, and a unique identification number (e.g., national ID card, passport). Verification typically requires official, independent documents.

For legal entities (companies, trusts, foundations): Obtaining legal name, legal form, proof of existence, powers that regulate the entity and bind it, address of registered office, and names of individuals who are authorized to act on behalf of the entity. Verification requires official registration documents.

Identifying and Verifying the Ultimate Beneficial Owner (UBO): Taking reasonable measures to understand the ownership and control structure of the customer and identify the natural persons who ultimately own or control the customer. This often applies for entities where control is 25% or more.

Understanding the Purpose and Intended Nature of the Business Relationship: Collecting information about the customer's anticipated activity, source of funds, and source of wealth (especially for high-risk customers or large transactions).

Ongoing Monitoring: Continuously monitoring the business relationship and transactions undertaken by the customer to ensure they are consistent with the VASP's knowledge of the customer, their business, and risk profile.

Enhanced Due Diligence (EDD): Required for higher-risk scenarios, including:

Politically Exposed Persons (PEPs)

Customers from high-risk jurisdictions (as identified by FATF or national authorities)

Complex, unusually large, or unusual transaction patterns

Customers involved in new technologies or products that favor anonymity.

Simplified Due Diligence (SDD): Permitted for lower-risk scenarios, as defined by the VASP's risk assessment and regulator's guidance.

Report any suspicious transaction (including attempted transactions) where they know, suspect, or have reasonable grounds to suspect that funds are the proceeds of a criminal activity or are related to terrorist financing.

Submit STRs promptly to the Financial Intelligence Unit (FIU).

Refrain from "tipping off" the customer or any third party that an STR has been filed.

Identity records: All records obtained through CDD procedures (copies of identification documents, account files, business correspondence) for at least five (5) years after the business relationship is terminated.

Transaction records: Records of transactions, including the amounts, currencies, and names/addresses of participants, for at least five (5) years from the date of the transaction.

STRs and related internal documentation: Must also be kept for a similar period.

Banque Centrale de Djibouti (BCD) - The Central Bank of Djibouti:

The BCD is the main prudential regulator for financial institutions and is responsible for supervising their adherence to AML/CFT requirements. It issues regulations and guidance for the financial sector.

Cellule de Traitement des Renseignements Financiers (CTRF) - The Financial Intelligence Unit (FIU):

No specific custodial license for digital assets currently exists. Djibouti does not have a dedicated regulatory regime that requires entities providing crypto custody services to obtain a specific license.

Any entity wishing to operate in the financial sector would generally need to comply with the broader banking and financial services laws regulated by the Central Bank. However, these laws typically do not explicitly cover digital asset custody.

Banque Centrale de Djibouti (Central Bank of Djibouti): This is the primary regulatory authority for the financial sector. While they haven't issued specific crypto custody licenses, any future regulation would likely emanate from or be supervised by them.

No specific rules for the segregation of client digital assets are in place. In the absence of a dedicated regulatory framework for digital asset custody, there are no explicit legal mandates requiring custodians to segregate client digital assets from their proprietary assets.

No specific insurance or bonding requirements for digital asset custodians exist. Given the lack of a specific licensing regime, there are no mandated insurance or bonding coverages for crypto custody services.

No specific cold storage mandates. The technical specifics of how digital assets should be stored (e.g., the percentage to be held in cold storage versus hot storage) are not addressed in any current Djiboutian legislation.

No specific definition of a "qualified custodian" for digital assets. This concept, common in jurisdictions with mature crypto regulations (like the U.S. SEC's definition), does not exist in Djibouti's current legal framework.

Any income generated by a business from cryptocurrency activities (e.g., profits from trading, fees for crypto services, income from mining or staking operations) would be considered part of its ordinary commercial income and subject to the corporate income tax (IBIC), generally at 25%.

Crypto-Related Services: Services related to cryptocurrency (e.g., exchange fees charged by a Djiboutian service provider, advisory services on crypto, transaction processing fees) would likely be subject to the standard 10% VAT, as they constitute a service provided within Djibouti's jurisdiction.

Individuals: Djibouti generally does not impose a capital gains tax on individuals for the sale of movable assets (such as shares, bonds, or, by extension, cryptocurrencies) unless it constitutes a professional trading activity. If an individual makes a profit from selling cryptocurrency, it is highly likely that these gains would not be subject to capital gains tax.

Businesses: For businesses (companies or sole proprietorships) where the acquisition and sale of cryptocurrencies are part of their commercial activity, any profits derived from such sales would be considered part of their ordinary business income and would be subject to the corporate income tax (Impôt sur les Bénéfices Industriels et Commerciaux - IBIC). The IBIC rate is generally around 25%.

Regular Trading/Mining/Staking as a Business: If an individual engages in cryptocurrency activities (e.g., day trading, professional mining, or operating staking services) with a degree of regularity and organization that constitutes a professional or business activity, the profits generated would likely be considered professional income. This income would be subject to the General Income Tax (Impôt Général sur le Revenu - IGR), which has progressive rates up to 30% for the highest brackets.

Salary/Payments in Crypto: If an individual receives a salary or payment for services rendered in cryptocurrency, the fiat value of that cryptocurrency at the time of receipt would be considered taxable income and subject to the Tax on Salaries and Wages (Impôt sur les Traitements et Salaires - ITS), also with progressive rates up to 30%.

Airdrops, Forks, Bounties: The tax treatment of these is unclear without specific legislation. However, if they are received for services or as a regular form of compensation, they might be considered taxable income at their fair market value at the time of receipt.

Businesses: Businesses involved in cryptocurrency activities must adhere to standard accounting principles and include all income, expenses, and profits/losses from these activities in their financial statements and corporate income tax declarations. This includes maintaining proper records of all transactions, their valuations, and any gains or losses.

Regulator: The primary financial regulator in Djibouti is the Banque Centrale de Djibouti (BCD) (Central Bank of Djibouti).

Absence of Specific Laws: As of my last update, Djibouti lacks a dedicated legal and regulatory framework for cryptocurrencies. This means there are no specific crypto laws to enforce.

Regulatory Stance: The BCD has generally focused on issuing warnings about the risks associated with unregulated financial activities, but these are broad advisories rather than specific enforcement actions against crypto firms or individuals.

Limited Crypto Adoption: The overall adoption and usage of cryptocurrencies in Djibouti are relatively low compared to more developed economies.

Regulatory Focus: The BCD's regulatory priorities may be focused on traditional financial sectors and broader financial stability, rather than active enforcement in an unregulated crypto space.

Lack of Public Reporting: Even if smaller, general financial crime investigations indirectly involved crypto, they are typically not publicly reported as "cryptocurrency enforcement actions" unless specific crypto regulations were violated.