← Regulations / Djibouti / Operating Models / Self-custodial wallet

Self-custodial wallet / non-custodial software in Djibouti

Publisher of software where users hold their own private keys. The publisher never holds, controls, or has access to user funds.

Conditional AI-Generated · Unreviewed

Self-custodial wallet is conditionally permitted in Djibouti without local incorporation, subject to AML obligations and low licensing burden.

Verdict Details

Permitted
conditional
Local entity required
No
Licensing burden
Low
Last updated
2026-07-13

AML Obligations

  • Software publishers with no custody or control over user assets are unlikely to be classified as VASPs under Djibouti's current framework, which lacks a dedicated crypto regime. However, if the software is deemed to facilitate virtual asset transfers on behalf of users (e.g., built-in swap/transfer features generating revenue), the publisher may fall under the AML/CFT obligations of Law No. 128/AN/18/8ème L which extends to VASPs.
  • If classified as a VASP: must implement a risk-based approach to identify, assess, and mitigate ML/TF risks (dj.aml.implement-a-risk-based-approach-to).
  • If classified as a VASP: must comply with the FATF Travel Rule for virtual asset transfers above threshold (dj.aml.comply-with-the-fatf-travel).
  • If classified as a VASP: must conduct CDD including identity verification for individuals and legal entities, and identify UBOs (dj.aml.identifying-and-verifying-the-identity, dj.aml.for-individuals-obtaining-name-address, dj.aml.for-legal-entities-companies-trusts, dj.aml.identifying-and-verifying-the-ultimate).
  • If classified as a VASP: must perform ongoing monitoring and submit STRs to the CTRF (FIU) promptly (dj.aml.ongoing-monitoring-continuously-monitoring-the, dj.aml.report-any-suspicious-transaction-including).
  • If classified as a VASP: must retain identity records and transaction records for at least 5 years (dj.aml.identity-records-all-records-obtained, dj.aml.transaction-records-records-of-transactions).
  • If classified as a VASP: must apply EDD for PEPs, high-risk jurisdictions, unusual transaction patterns, and anonymity-favoring products (dj.aml.enhanced-due-diligence-edd-required, dj.aml.politically-exposed-persons-peps, dj.aml.customers-from-high-risk-jurisdictions-as, dj.aml.complex-unusually-large-or-unusual, dj.aml.customers-involved-in-new-technologies).
  • SDD permitted for lower-risk scenarios as defined by the VASP's risk assessment (dj.aml.simplified-due-diligence-sdd-permitted).

Key Restrictions

  • No specific licensing regime for non-custodial software publishers exists — the operator is not subject to a custodial license requirement (dj.custody.no-specific-custodial-license-for).
  • Publishing software where the publisher never holds, controls, or has access to user funds likely falls outside the scope of 'financial sector' activity requiring Central Bank authorization under current Djiboutian law.
  • If the software includes integrated swapping or transfer functionality that is intermediated by the publisher, it could be treated as a VASP activity under FATF-interpreted definitions, even without custody.
  • No pending legislation specifically addressing non-custodial software or wallet providers has been publicly announced (dj.custody.there-is-no-publicly-announced).

Key Risks

  • Regulatory ambiguity: Djibouti has no dedicated crypto or VASP framework, creating uncertainty over whether a non-custodial wallet publisher is subject to AML/CFT obligations (dj.enforcement.absence-of-specific-laws-as).
  • Risk of reclassification: FATF's expanded definition of VASP could capture wallet providers offering integrated exchange/swap features, potentially triggering retroactive enforcement.
  • Enforcement unpredictability: The BCD has issued general warnings but no specific crypto enforcement actions; posture could change without notice (dj.enforcement.regulatory-stance-the-bcd-has).
  • Low market adoption and limited local legal infrastructure mean operators may face practical difficulties in establishing compliant CDD processes without local banking relationships.

Evidence

This verdict synthesizes the following facts. Each fact links to its primary source(s).

aml 40% confidence

Law No. 128/AN/18/8ème L of July 18, 2018, modifying and completing Law No. 136/AN/07/5ème L on Money Laundering, Terrorist Financing and Proliferation Financing.

aml 40% confidence

Be subject to the same AML/CFT obligations as traditional financial institutions. This means adhering to the principles outlined in Law No. 128/AN/18/8ème L.

aml 40% confidence

Implement a risk-based approach to identify, assess, and mitigate money laundering and terrorist financing risks associated with their virtual asset products, services, customers, and delivery channels.

aml 40% confidence

Comply with the FATF Travel Rule, which requires VASPs to obtain and transmit originator and beneficiary information for virtual asset transfers above a certain threshold.

aml 40% confidence

Identifying and Verifying the Identity of the Customer:

aml 40% confidence

For individuals: Obtaining name, address, date of birth, nationality, and a unique identification number (e.g., national ID card, passport). Verification typically requires official, independent documents.

aml 40% confidence

For legal entities (companies, trusts, foundations): Obtaining legal name, legal form, proof of existence, powers that regulate the entity and bind it, address of registered office, and names of individuals who are authorized to act on behalf of the entity. Verification requires official registration documents.

aml 40% confidence

Identifying and Verifying the Ultimate Beneficial Owner (UBO): Taking reasonable measures to understand the ownership and control structure of the customer and identify the natural persons who ultimately own or control the customer. This often applies for entities where control is 25% or more.

aml 40% confidence

Ongoing Monitoring: Continuously monitoring the business relationship and transactions undertaken by the customer to ensure they are consistent with the VASP's knowledge of the customer, their business, and risk profile.

aml 40% confidence

Report any suspicious transaction (including attempted transactions) where they know, suspect, or have reasonable grounds to suspect that funds are the proceeds of a criminal activity or are related to terrorist financing.

aml 40% confidence

Identity records: All records obtained through CDD procedures (copies of identification documents, account files, business correspondence) for at least five (5) years after the business relationship is terminated.

aml 40% confidence

Transaction records: Records of transactions, including the amounts, currencies, and names/addresses of participants, for at least five (5) years from the date of the transaction.

aml 40% confidence

Enhanced Due Diligence (EDD): Required for higher-risk scenarios, including:

aml 40% confidence

Politically Exposed Persons (PEPs)

aml 40% confidence

Customers from high-risk jurisdictions (as identified by FATF or national authorities)

aml 40% confidence

Complex, unusually large, or unusual transaction patterns

aml 40% confidence

Customers involved in new technologies or products that favor anonymity.

aml 40% confidence

Simplified Due Diligence (SDD): Permitted for lower-risk scenarios, as defined by the VASP's risk assessment and regulator's guidance.

custody 40% confidence

No specific custodial license for digital assets currently exists. Djibouti does not have a dedicated regulatory regime that requires entities providing crypto custody services to obtain a specific license.

custody 40% confidence

Any entity wishing to operate in the financial sector would generally need to comply with the broader banking and financial services laws regulated by the Central Bank. However, these laws typically do not explicitly cover digital asset custody.

custody 40% confidence

There is no publicly announced or readily available information regarding pending specific custody legislation for digital assets in Djibouti.

enforcement 60% confidence

Absence of Specific Laws: As of my last update, Djibouti lacks a dedicated legal and regulatory framework for cryptocurrencies. This means there are no specific crypto laws to enforce.

enforcement 60% confidence

Regulatory Stance: The BCD has generally focused on issuing warnings about the risks associated with unregulated financial activities, but these are broad advisories rather than specific enforcement actions against crypto firms or individuals.

enforcement 60% confidence

Limited Crypto Adoption: The overall adoption and usage of cryptocurrencies in Djibouti are relatively low compared to more developed economies.

Verdict Attribution

Source:
AI-Generated · Unreviewed
AI synthesized:
2026-07-13 (deepseek-chat)
Last updated:
2026-07-13
Confidence:
low

This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.

Conditional — A non-custodial wallet software publisher is likely not subject to specific regulation in Djibouti because no dedicated crypto/VASP framework exists and the publisher never holds user funds; however, if integrated swap/transfer features cause the software to be treated as a VASP under FATF-interpreted classifications, full AML/CFT obligations under Law No. 128/AN/18/8ème L would attach, including CDD, Travel Rule compliance, STR filing, and 5-year record-keeping.

Questions this verdict aims to answer

  • Does software publishing trigger VASP / MSB classification?
  • Do AML obligations attach when no custody exists?
  • What disclosure or consumer-protection rules apply?