Self-custodial wallet / non-custodial software in Iran
Publisher of software where users hold their own private keys. The publisher never holds, controls, or has access to user funds.
Self-custodial wallet is conditionally permitted in Iran without local incorporation, subject to AML obligations and none licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- No
- Licensing burden
- None
- Last updated
- 2026-07-13
AML Obligations
- No AML obligations attach to the publisher of self-custodial wallet software because the publisher never holds, controls, or has access to user funds and thus does not qualify as a reporting entity under the Law on Combating Money Laundering (LCML) or CBI directives.
- Entities deemed VASPs under Iranian law would be subject to KYC obligations (national ID number, contact info, verification via official documents for natural persons; registration number, legal form, address, beneficial owner details for legal persons), but software-only self-custodial wallet publishers do not trigger these thresholds.
Key Restrictions
- Self-custodial wallet software publishers cannot facilitate domestic payments in crypto, as the CBI prohibits use of cryptocurrencies for domestic payments.
- Any connection with sanctioned Iranian entities or individuals would expose the publisher to severe international sanctions risk (primarily US sanctions); geofencing Iran is a practical necessity.
- The publisher must not provide custodial, exchange, or transfer services — any such functionality would trigger VASP classification under CBI's evolving regulatory framework.
- FATF 'Call for Action' against Iran creates enhanced due diligence expectations from counterparties, though does not directly impose obligations on the software publisher.
Key Risks
- International sanctions exposure: Even publishing open-source software that is accessible in Iran could be viewed as providing services to a sanctioned jurisdiction, creating US/EU sanctions compliance risk.
- Regulatory ambiguity: Iran's crypto framework focuses on mining and regulated exchanges; self-custodial software is not explicitly addressed, leaving the publisher in a grey area with potential retroactive classification risk.
- FATF blacklisting: Iran's FATF status means international financial counterparties may refuse interactions with any entity connected to Iran, impacting development tooling, banking, and payment rails for the publisher.
- Enforcement precedent focuses on mining, not software — but this lack of precedent also means no safe harbor exists for wallet software.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
FATF Blacklisting: Iran is currently on the FATF's "Public Statement – High-Risk Jurisdictions Subject to a Call for Action," meaning it is subject to a call for countries to apply enhanced due diligence and, in the most serious cases, countermeasures to protect the international financial system from the ongoing money laundering, terrorist financing, and proliferation financing (ML/TF/PF) risks emanating from Iran. This significantly impacts any international VASP's ability or willingness to operate in or with Iran.
International Sanctions: Iran is under extensive international sanctions (primarily from the US), which prohibit most financial transactions involving Iranian entities or individuals, further complicating VASP operations.
Evolving Domestic Stance: Iran's stance on cryptocurrencies has evolved from outright bans to allowing regulated mining and exploring the use of crypto for bypassing sanctions (e.g., import payments), while generally maintaining strict controls over public trading and use for domestic payments.
Central Bank of Iran (CBI) Regulations and Directives:
Early Stance (2018): The CBI initially banned all dealings in cryptocurrencies by banks and financial institutions, citing money laundering risks.
Evolving Stance (2019-Present): The CBI later allowed cryptocurrency mining as an industrial activity, requiring miners to obtain licenses and sell their mined crypto to the CBI for import financing. However, the use of cryptocurrencies for domestic payments is generally prohibited, and public trading platforms for major cryptocurrencies face significant restrictions or are not officially sanctioned in a broad retail sense.
Applying Existing AML: The CBI's stance implies that any entity authorized to deal with virtual assets (e.g., licensed miners selling to CBI, or potentially future regulated exchanges) would be subject to existing AML/CFT laws and CBI directives regarding KYC, transaction monitoring, and reporting.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a self-custodial wallet software publisher does not trigger VASP/AML obligations in Iran since it never holds, controls, or accesses user funds, but must geofence Iran users to avoid sanctions exposure and must not include domestic-payment or custodial features that would bring the software under CBI regulation.
Questions this verdict aims to answer
- Does software publishing trigger VASP / MSB classification?
- Do AML obligations attach when no custody exists?
- What disclosure or consumer-protection rules apply?