Custodial wallet / SaaS in Iran
Hosted wallet provider that holds keys on behalf of end users, often white-labeled to businesses (custody as a service).
Custodial SaaS is conditionally permitted in Iran with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- Any authorized entity dealing with virtual assets must comply with the Law on Combating Money Laundering (LCML) and Law on Combating the Financing of Terrorism (LCFT), including KYC, transaction monitoring, and reporting to the FIU via the Supreme Council for Combating Money Laundering and Financing of Terrorism.
- KYC for natural persons: National ID number (National Code for Iranians), contact information, verification through official documents (National ID card, passport).
- KYC for legal persons: Legal name and trade name, registration number and date, legal form, registered address, details of directors/senior management/beneficial owners (25% or more), verification through official corporate documents.
- Ongoing transaction monitoring and suspicious transaction reporting (STR) obligations under LCML and LCFT.
- Sanctions screening obligations under LCFT and international sanctions frameworks (US OFAC sanctions on Iran).
- CBI directives require KYC, transaction monitoring, and reporting for any entity authorized to deal with virtual assets.
Key Restrictions
- CBI initially banned all cryptocurrency dealings by banks and financial institutions (2018) — custodial wallet/SaaS operators cannot be structured as banks or traditional FIs.
- Use of cryptocurrencies for domestic payments is generally prohibited by CBI.
- Public trading of cryptocurrencies is severely restricted; custodial wallet services may only be permissible for authorized/regulated entities.
- Extensive US and international sanctions (OFAC, FATF) effectively prohibit most financial transactions involving Iranian entities or persons — operating from or servicing Iranian residents carries severe cross-border legal risk.
- FATF blacklisting (High-Risk Jurisdiction Subject to a Call for Action) imposes enhanced due diligence requirements from foreign counterparties and limits international banking/correspondent relationships.
Key Risks
- ["Extreme sanctions exposure: US OFAC sanctions make it virtually impossible for Iranian-linked custodial wallet operators to access USD banking, foreign exchange listings, or international partnerships.", "FATF blacklisting means foreign VASPs and financial institutions must apply countermeasures, creating isolation from the global crypto financial system.", "Regulatory ambiguity: No formal licensing framework exists for custodial wallet providers or crypto custody services — current regulatory coverage focuses on mining licensing and general AML law application.", "Enforcement risk is real but primarily focused on unlicensed mining — custodial wallet enforcement precedent is absent in the facts provided.", "Domestic payment prohibition prevents use of custodial wallets for internal Iranian commerce, limiting addressable use cases to cross-border/trade-finance scenarios (which carry sanctions risk)."]
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
FATF Blacklisting: Iran is currently on the FATF's "Public Statement – High-Risk Jurisdictions Subject to a Call for Action," meaning it is subject to a call for countries to apply enhanced due diligence and, in the most serious cases, countermeasures to protect the international financial system from the ongoing money laundering, terrorist financing, and proliferation financing (ML/TF/PF) risks emanating from Iran. This significantly impacts any international VASP's ability or willingness to operate in or with Iran.
International Sanctions: Iran is under extensive international sanctions (primarily from the US), which prohibit most financial transactions involving Iranian entities or individuals, further complicating VASP operations.
Evolving Domestic Stance: Iran's stance on cryptocurrencies has evolved from outright bans to allowing regulated mining and exploring the use of crypto for bypassing sanctions (e.g., import payments), while generally maintaining strict controls over public trading and use for domestic payments.
Legislation Name: "Law on Combating Money Laundering" (Qanun Mobaraze ba Pulshui), initially passed in 2008 and amended in 2019.
Purpose: This is the foundational AML law in Iran, establishing general obligations for reporting entities (which would include any authorized financial service providers, including VASPs if fully integrated into the financial system).
Key Provisions: Defines money laundering offenses, sets reporting obligations, establishes the Supreme Council for Combating Money Laundering and Financing of Terrorism, and outlines the role of the Financial Intelligence Unit (FIU).
Law on Combating the Financing of Terrorism (LCFT):
Legislation Name: "Law on Combating Money Laundering" (Qanun Mobaraze ba Pulshui), initially passed in 2008 and amended in 2019.
Purpose: Addresses the financing of terrorism. Any VASP, if operating, would be subject to its provisions, especially regarding sanctions screening and suspicious transaction reporting.
Central Bank of Iran (CBI) Regulations and Directives:
The CBI is the primary regulator for financial services and has issued directives concerning virtual assets.
Early Stance (2018): The CBI initially banned all dealings in cryptocurrencies by banks and financial institutions, citing money laundering risks.
Evolving Stance (2019-Present): The CBI later allowed cryptocurrency mining as an industrial activity, requiring miners to obtain licenses and sell their mined crypto to the CBI for import financing. However, the use of cryptocurrencies for domestic payments is generally prohibited, and public trading platforms for major cryptocurrencies face significant restrictions or are not officially sanctioned in a broad retail sense.
Applying Existing AML: The CBI's stance implies that any entity authorized to deal with virtual assets (e.g., licensed miners selling to CBI, or potentially future regulated exchanges) would be subject to existing AML/CFT laws and CBI directives regarding KYC, transaction monitoring, and reporting.
National ID number (National Code for Iranians)
Verification through official documents (e.g., National ID card, passport).
Registered address and principal place of business
Details of directors, senior management, and beneficial owners (shareholders owning 25% or more, or controlling persons).
Verification through official corporate documents (e.g., certificate of incorporation, articles of association).
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- low
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a custodial wallet/SaaS operator is theoretically possible in Iran under CBI oversight and general AML laws, but no dedicated custody licensing framework exists, US/international sanctions create severe barriers, and FATF blacklisting isolates the jurisdiction, making practical operation extremely high-risk and legally ambiguous.
Questions this verdict aims to answer
- What custody license / qualified-custodian status applies?
- What segregation, insurance, and proof-of-reserves rules apply?
- What AML obligations attach to the SaaS vs the white-label client?