Self-custodial wallet / non-custodial software in Isle of Man
Publisher of software where users hold their own private keys. The publisher never holds, controls, or has access to user funds.
Self-custodial wallet is conditionally permitted in Isle of Man without local incorporation, subject to AML obligations and low licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- No
- Licensing burden
- Low
- Last updated
- 2026-07-13
AML Obligations
- Registration requirement under DBROA 2015 if the activity constitutes a 'designated business' — but a pure non-custodial software publisher (no access to private keys, no custody, no transmission) is unlikely to meet the VASP definition under IOM law.
- If the publisher crosses into 'transmitting' or 'providing safe custody or storage' (e.g., by integrating with a cloud key-storage service), it would trigger designated business registration and the full AML/CFT Code 2019 obligations: CDD, risk-based approach, ongoing monitoring, record-keeping.
- No AML obligations attach strictly from publishing self-custodial wallet software where the publisher never holds, controls, or has access to user private keys or funds.
Key Restrictions
- The publisher must not hold, control, or have access to user private keys or funds — doing so would trigger VASP classification requiring registration.
- Any service layer (e.g., hosted wallet infrastructure, transaction relay/broadcasting services offered as a service rather than purely local software) may be deemed 'transmitting' or 'providing safe custody' and thus constitute a designated business activity.
- The IOMFSA broadly defines VASP activities to include 'issuing, transmitting, transferring, providing safe custody or storage, administering, managing... virtual assets' — software-only publishing is outside this scope; bundling ancillary services may bring it in.
Key Risks
- Grey-area risk: if the wallet software includes non-custodial but integrated services (e.g., fiat on-ramp, swap APIs, transaction relay) that the publisher facilitates, the IOMFSA could reclassify the operator as a VASP.
- Regulatory ambiguity: the IOM's VASP definition is broad ('otherwise dealing with virtual assets') and could be interpreted expansively; no published guidance specifically addresses pure non-custodial software publishers.
- Enforcement precedent: IOMFSA frequently issues warnings against unlicensed activity; a publisher offering wallet software to IOM residents without any custody could nonetheless attract scrutiny if the regulator deems the activity a 'designated business'.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
The Designated Business (Registration and Oversight) Act 2015 (DBROA): This Act provides the framework for the registration and oversight of businesses engaged in certain activities, including those involving virtual assets.
DBROA 2015: https://www.legislation.gov.im/cms/images/LEGISLATION/PRINCIPAL/2015/2015-0027/DesignatedBusinessRegistrationandOversightAct2015_1.pdf
Virtual Asset Service Providers (VASPs): A person carrying on the business of providing any of the following services to, or on behalf of, another person:
Exchanges: Exchanging virtual assets for fiat currencies, or one or more forms of virtual assets. This covers both fiat-to-crypto and crypto-to-crypto exchanges.
Custody Providers: Safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets. This includes businesses that hold private keys on behalf of clients.
Payment Processors: Services related to the transfer of virtual assets. This covers facilitating payments in crypto, or services that move virtual assets from one address or account to another.
Other VASP Activities: Participation in and provision of financial services related to an issuer’s offer or sale of a virtual asset.
Designated Business Registration: Any entity carrying on a "designated business" activity involving virtual assets must register with the IOM FSA. This explicitly includes providing safe custody or storage of virtual assets.
Virtual Asset Activities Covered: The definition of "virtual assets" and the activities that constitute "designated business" are broad and cover:
Exchanging, or arranging or making arrangements for the exchange of, virtual assets for fiat currencies or other virtual assets.
Issuing, transmitting, transferring, providing safe custody or storage, administering, managing, lending, buying, selling, or otherwise dealing with virtual assets.
AML/KYC Compliance: This is the cornerstone of the IOM's regulatory approach. Registered businesses must implement robust AML/CFT policies and procedures, including:
Risk-Based Approach: Identifying, assessing, and understanding money laundering and terrorist financing risks.
Customer Due Diligence (CDD):
Identifying and verifying the identity of customers and beneficial owners.
Understanding the purpose and intended nature of the business relationship.
Ongoing monitoring of business relationships.
Regulator: Isle of Man Financial Services Authority (IOMFSA)
Evidence fact im.licensing.public-warnings-and-unlicensed-activity-the not found (may have been renamed).
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a pure non-custodial wallet software publisher (no access to private keys, no custody, no transmission services) does not trigger VASP/designated-business registration under IOM law, but any ancillary service layer (relay, swap, fiat on-ramp) or holding of keys would cross the threshold, requiring registration under DBROA 2015 and full AML/CFT compliance.
Questions this verdict aims to answer
- Does software publishing trigger VASP / MSB classification?
- Do AML obligations attach when no custody exists?
- What disclosure or consumer-protection rules apply?