Self-custodial wallet / non-custodial software in Djibouti
Publisher of software where users hold their own private keys. The publisher never holds, controls, or has access to user funds.
Self-custodial wallet is conditionally permitted in Djibouti without local incorporation, subject to AML obligations and low licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- No
- Licensing burden
- Low
- Last updated
- 2026-07-13
AML Obligations
- Software publishers with no custody or control over user assets are unlikely to be classified as VASPs under Djibouti's current framework, which lacks a dedicated crypto regime. However, if the software is deemed to facilitate virtual asset transfers on behalf of users (e.g., built-in swap/transfer features generating revenue), the publisher may fall under the AML/CFT obligations of Law No. 128/AN/18/8ème L which extends to VASPs.
- If classified as a VASP: must implement a risk-based approach to identify, assess, and mitigate ML/TF risks (dj.aml.implement-a-risk-based-approach-to).
- If classified as a VASP: must comply with the FATF Travel Rule for virtual asset transfers above threshold (dj.aml.comply-with-the-fatf-travel).
- If classified as a VASP: must conduct CDD including identity verification for individuals and legal entities, and identify UBOs (dj.aml.identifying-and-verifying-the-identity, dj.aml.for-individuals-obtaining-name-address, dj.aml.for-legal-entities-companies-trusts, dj.aml.identifying-and-verifying-the-ultimate).
- If classified as a VASP: must perform ongoing monitoring and submit STRs to the CTRF (FIU) promptly (dj.aml.ongoing-monitoring-continuously-monitoring-the, dj.aml.report-any-suspicious-transaction-including).
- If classified as a VASP: must retain identity records and transaction records for at least 5 years (dj.aml.identity-records-all-records-obtained, dj.aml.transaction-records-records-of-transactions).
- If classified as a VASP: must apply EDD for PEPs, high-risk jurisdictions, unusual transaction patterns, and anonymity-favoring products (dj.aml.enhanced-due-diligence-edd-required, dj.aml.politically-exposed-persons-peps, dj.aml.customers-from-high-risk-jurisdictions-as, dj.aml.complex-unusually-large-or-unusual, dj.aml.customers-involved-in-new-technologies).
- SDD permitted for lower-risk scenarios as defined by the VASP's risk assessment (dj.aml.simplified-due-diligence-sdd-permitted).
Key Restrictions
- No specific licensing regime for non-custodial software publishers exists — the operator is not subject to a custodial license requirement (dj.custody.no-specific-custodial-license-for).
- Publishing software where the publisher never holds, controls, or has access to user funds likely falls outside the scope of 'financial sector' activity requiring Central Bank authorization under current Djiboutian law.
- If the software includes integrated swapping or transfer functionality that is intermediated by the publisher, it could be treated as a VASP activity under FATF-interpreted definitions, even without custody.
- No pending legislation specifically addressing non-custodial software or wallet providers has been publicly announced (dj.custody.there-is-no-publicly-announced).
Key Risks
- Regulatory ambiguity: Djibouti has no dedicated crypto or VASP framework, creating uncertainty over whether a non-custodial wallet publisher is subject to AML/CFT obligations (dj.enforcement.absence-of-specific-laws-as).
- Risk of reclassification: FATF's expanded definition of VASP could capture wallet providers offering integrated exchange/swap features, potentially triggering retroactive enforcement.
- Enforcement unpredictability: The BCD has issued general warnings but no specific crypto enforcement actions; posture could change without notice (dj.enforcement.regulatory-stance-the-bcd-has).
- Low market adoption and limited local legal infrastructure mean operators may face practical difficulties in establishing compliant CDD processes without local banking relationships.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Law No. 128/AN/18/8ème L of July 18, 2018, modifying and completing Law No. 136/AN/07/5ème L on Money Laundering, Terrorist Financing and Proliferation Financing.
Be subject to the same AML/CFT obligations as traditional financial institutions. This means adhering to the principles outlined in Law No. 128/AN/18/8ème L.
Implement a risk-based approach to identify, assess, and mitigate money laundering and terrorist financing risks associated with their virtual asset products, services, customers, and delivery channels.
Comply with the FATF Travel Rule, which requires VASPs to obtain and transmit originator and beneficiary information for virtual asset transfers above a certain threshold.
For individuals: Obtaining name, address, date of birth, nationality, and a unique identification number (e.g., national ID card, passport). Verification typically requires official, independent documents.
For legal entities (companies, trusts, foundations): Obtaining legal name, legal form, proof of existence, powers that regulate the entity and bind it, address of registered office, and names of individuals who are authorized to act on behalf of the entity. Verification requires official registration documents.
Identifying and Verifying the Ultimate Beneficial Owner (UBO): Taking reasonable measures to understand the ownership and control structure of the customer and identify the natural persons who ultimately own or control the customer. This often applies for entities where control is 25% or more.
Ongoing Monitoring: Continuously monitoring the business relationship and transactions undertaken by the customer to ensure they are consistent with the VASP's knowledge of the customer, their business, and risk profile.
Report any suspicious transaction (including attempted transactions) where they know, suspect, or have reasonable grounds to suspect that funds are the proceeds of a criminal activity or are related to terrorist financing.
Identity records: All records obtained through CDD procedures (copies of identification documents, account files, business correspondence) for at least five (5) years after the business relationship is terminated.
Transaction records: Records of transactions, including the amounts, currencies, and names/addresses of participants, for at least five (5) years from the date of the transaction.
Enhanced Due Diligence (EDD): Required for higher-risk scenarios, including:
Customers from high-risk jurisdictions (as identified by FATF or national authorities)
Customers involved in new technologies or products that favor anonymity.
Simplified Due Diligence (SDD): Permitted for lower-risk scenarios, as defined by the VASP's risk assessment and regulator's guidance.
No specific custodial license for digital assets currently exists. Djibouti does not have a dedicated regulatory regime that requires entities providing crypto custody services to obtain a specific license.
Any entity wishing to operate in the financial sector would generally need to comply with the broader banking and financial services laws regulated by the Central Bank. However, these laws typically do not explicitly cover digital asset custody.
There is no publicly announced or readily available information regarding pending specific custody legislation for digital assets in Djibouti.
Absence of Specific Laws: As of my last update, Djibouti lacks a dedicated legal and regulatory framework for cryptocurrencies. This means there are no specific crypto laws to enforce.
Regulatory Stance: The BCD has generally focused on issuing warnings about the risks associated with unregulated financial activities, but these are broad advisories rather than specific enforcement actions against crypto firms or individuals.
Limited Crypto Adoption: The overall adoption and usage of cryptocurrencies in Djibouti are relatively low compared to more developed economies.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- low
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — A non-custodial wallet software publisher is likely not subject to specific regulation in Djibouti because no dedicated crypto/VASP framework exists and the publisher never holds user funds; however, if integrated swap/transfer features cause the software to be treated as a VASP under FATF-interpreted classifications, full AML/CFT obligations under Law No. 128/AN/18/8ème L would attach, including CDD, Travel Rule compliance, STR filing, and 5-year record-keeping.
Questions this verdict aims to answer
- Does software publishing trigger VASP / MSB classification?
- Do AML obligations attach when no custody exists?
- What disclosure or consumer-protection rules apply?