On-shore VASP in Isle of Man

Regulator: Isle of Man Financial Services Authority (IOMFSA)

The Designated Business (Registration and Oversight) Act 2015 (DBROA): This Act provides the framework for the registration and oversight of businesses engaged in certain activities, including those involving virtual assets.

AML/CFT Code 2015: https://www.legislation.gov.im/cms/images/LEGISLATION/PRINCIPAL/2015/2015-0029/Anti-MoneyLaunderingandCounteringtheFinancingofTerrorismCode2015_1.pdf

AML/CFT Handbook: The IOM FSA publishes a comprehensive handbook that provides guidance on how Designated Businesses should comply with their AML/CFT obligations.

Virtual Asset Service Providers (VASPs): A person carrying on the business of providing any of the following services to, or on behalf of, another person:

AML/KYC Compliance: This is the cornerstone of the IOM's regulatory approach. Registered businesses must implement robust AML/CFT policies and procedures, including:

Risk-Based Approach: Identifying, assessing, and understanding money laundering and terrorist financing risks.

Customer Due Diligence (CDD):

Identifying and verifying the identity of customers and beneficial owners.

Understanding the purpose and intended nature of the business relationship.

Ongoing monitoring of business relationships.

Designated Business Registration: Any entity carrying on a "designated business" activity involving virtual assets must register with the IOM FSA. This explicitly includes providing safe custody or storage of virtual assets.

Fit and proper persons (directors, beneficial owners, key personnel).

Robust governance arrangements.

Adequate financial resources.

Comprehensive AML/CFT policies, procedures, and controls.

Operational resilience and risk management frameworks.

AML/CFT Code 2019: Requires designated businesses to have robust internal controls, record-keeping, and risk management systems. This implicitly demands a clear distinction and proper accounting for client assets versus firm assets to prevent commingling and facilitate accurate reporting.

General Principles: The IOM FSA expects firms to protect client assets. This means:

Maintaining separate accounts or records that clearly distinguish client virtual assets from the firm's own assets.

Implementing internal controls to prevent the misuse or misappropriation of client assets.

Ensuring that client assets are not used to satisfy the firm's debts or liabilities.

Having clear procedures for the return of client assets in case of business failure or cessation.

FSA's Expectations on Operational Risk: The FSA emphasizes that firms must have adequate systems and controls to manage operational risks, including those related to the safekeeping of client assets.

FSA's View: While not explicitly mandated, the FSA would expect a prudent firm providing custody services for valuable digital assets to seriously consider and obtain appropriate insurance coverage (e.g., cyber insurance, crime insurance, professional indemnity) as part of its overall risk mitigation strategy. The absence of such consideration would likely be viewed negatively during supervision.

Security and Operational Resilience: The FSA expects firms to implement "appropriate technical and organisational measures" to ensure the security, integrity, and availability of virtual assets and associated systems. This includes:

Trading Profits: Companies whose primary business activities involve cryptocurrency (e.g., exchanges, custodial services, development of crypto projects, professional mining operations, active crypto trading) will have their profits from these activities subject to corporate income tax.

Corporate Income Tax Rates (2023/24):

Supply of Cryptocurrencies (e.g., Bitcoin, Ether): The actual buying and selling of cryptocurrencies that function as a means of payment or exchange are generally exempt from VAT. This aligns with the EU and UK position, treating them similarly to currency or securities for VAT purposes.

Exchange Services: Fees charged by cryptocurrency exchanges for facilitating trades or converting crypto to fiat (and vice versa) are generally considered taxable services and are subject to the standard rate of VAT (currently 20%).

Wallet Services: If a fee is charged for wallet services, this would typically be subject to VAT.

Preventative and Supervisory Approach: The IOMFSA often emphasizes a proactive supervisory approach, working with licensed entities to rectify issues before they escalate to formal public enforcement actions with substantial fines. This approach may result in fewer public "headline" enforcement actions.

Outcome: No specific, publicly documented cases matching all criteria were found within the specified timeframe.