Custodial wallet / SaaS in Isle of Man

Regulator: Isle of Man Financial Services Authority (IOMFSA)

The Designated Business (Registration and Oversight) Act 2015 (DBROA): This Act provides the framework for the registration and oversight of businesses engaged in certain activities, including those involving virtual assets.

Virtual Asset Service Providers (VASPs): A person carrying on the business of providing any of the following services to, or on behalf of, another person:

Custody Providers: Safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets. This includes businesses that hold private keys on behalf of clients.

AML/KYC Compliance: This is the cornerstone of the IOM's regulatory approach. Registered businesses must implement robust AML/CFT policies and procedures, including:

Risk-Based Approach: Identifying, assessing, and understanding money laundering and terrorist financing risks.

Customer Due Diligence (CDD):

Identifying and verifying the identity of customers and beneficial owners.

Understanding the purpose and intended nature of the business relationship.

Ongoing monitoring of business relationships.

Designated Business Registration: Any entity carrying on a "designated business" activity involving virtual assets must register with the IOM FSA. This explicitly includes providing safe custody or storage of virtual assets.

AML/CFT Code 2019: Requires designated businesses to have robust internal controls, record-keeping, and risk management systems. This implicitly demands a clear distinction and proper accounting for client assets versus firm assets to prevent commingling and facilitate accurate reporting.

Maintaining separate accounts or records that clearly distinguish client virtual assets from the firm's own assets.

Implementing internal controls to prevent the misuse or misappropriation of client assets.

Ensuring that client assets are not used to satisfy the firm's debts or liabilities.

Having clear procedures for the return of client assets in case of business failure or cessation.

FSA's View: While not explicitly mandated, the FSA would expect a prudent firm providing custody services for valuable digital assets to seriously consider and obtain appropriate insurance coverage (e.g., cyber insurance, crime insurance, professional indemnity) as part of its overall risk mitigation strategy. The absence of such consideration would likely be viewed negatively during supervision.

Security and Operational Resilience: The FSA expects firms to implement "appropriate technical and organisational measures" to ensure the security, integrity, and availability of virtual assets and associated systems. This includes:

Fit and proper persons (directors, beneficial owners, key personnel).

Robust governance arrangements.

Adequate financial resources.

Operational resilience and risk management frameworks.

Outcome: No specific, publicly documented cases matching all criteria were found within the specified timeframe.

Warnings Against Unlicensed Activity: The IOMFSA frequently issues public warnings against entities operating without a license or targeting Isle of Man residents without proper authorisation. These are a form of enforcement but are directed at unregistered entities rather than penalties for registered DLT firms.