Custodial wallet / SaaS in Iceland

VASP Registration: Any entity providing services related to virtual assets, including the safekeeping and/or administration of virtual assets on behalf of customers (i.e., custody), is required to register as a Virtual Asset Service Provider (VASP) with the Central Bank of Iceland. This is not a "license" in the traditional sense of financial services but rather an AML/CFT registration that imposes significant obligations.

The registration is mandated by the Act on measures to combat money laundering and terrorist financing No. 140/2018, which transposes EU AML Directives (AMLD5, soon AMLD6) into Icelandic law.

Scope: This typically covers situations where the custodian holds private keys and has control over clients' virtual assets.

Regulator: The primary financial regulator is now the Seðlabanki Íslands (Central Bank of Iceland), which absorbed the functions of the former Financial Supervisory Authority (Fjármálaeftirlitið, FME) in January 2020. It is responsible for supervising financial undertakings, including those dealing with virtual assets, primarily from an AML/CFT perspective.

Central Bank of Iceland (Seðlabanki Íslands) on Virtual Assets:

Act on measures to combat money laundering and terrorist financing No. 140/2018: https://www.althingi.is/lagas/nuna/2018140.html (Icelandic original)

While not explicitly detailed solely for crypto-asset custody in current Icelandic law, general principles of financial services and AML/CFT best practices would strongly suggest the need for segregation. VASPs are expected to maintain clear records of ownership and transactions, and commingling of funds/assets would violate these principles and increase AML/CFT risks.

The AML Act requires VASPs to keep records of transactions and to identify beneficial owners, indirectly supporting the need for clear asset ownership distinctions.

There are no specific insurance or bonding requirements mandated for crypto custodians under the current AML-focused VASP registration framework. General business insurance would be expected, but no specific prudential safeguards for crypto custody are prescribed.

There are no specific legal mandates for the use of cold storage for crypto assets under current Icelandic law. However, robust security measures are expected as part of general operational risk management and AML/CFT compliance (e.g., preventing theft that could facilitate money laundering). Industry best practices for secure custody overwhelmingly recommend cold storage for the majority of assets.

The term "qualified custodian" is not formally defined in Icelandic law specifically for crypto assets. A VASP registered with the Central Bank of Iceland to provide virtual asset services, including custody, would be the closest equivalent under the current framework.

MiCA Authorization: Under MiCA, "custody and administration of crypto-assets on behalf of clients" is explicitly defined as a crypto-asset service (Article 3, point 16). Providers of this service will be required to obtain authorization from their competent national authority (in Iceland, likely the Central Bank of Iceland) to operate as a Crypto-Asset Service Provider (CASP) (Article 59).

This authorization is a full financial services license, distinct from the current AML registration.

Mandatory Segregation: MiCA explicitly mandates strict segregation of client assets.

Article 67 (Obligations of crypto-asset service providers providing custody and administration of crypto-assets on behalf of clients), point 1: "A crypto-asset service provider providing custody and administration of crypto-assets on behalf of clients shall ensure that the crypto-assets of its clients are segregated from its own assets and from the assets of other clients."

Prudential Safeguards: MiCA (Article 66, point 10 and Article 67, point 7) requires CASPs to have robust prudential safeguards. These safeguards can take the form of:

Own funds (capital requirements).

An insurance policy.

The amount of prudential safeguards depends on the services provided and the nature, scale, and complexity of operations, with specific thresholds set out in Annex IV.

MiCA does not mandate cold storage specifically but requires CASPs to implement robust security measures for the safekeeping of crypto-assets.

Article 67, point 2: "A crypto-asset service provider providing custody and administration of crypto-assets on behalf of clients shall establish, implement and maintain robust security policies and procedures regarding the access to, and the protection of, the crypto-assets, private cryptographic keys and, where applicable, the means of access to the crypto-assets of its clients."

This implies that CASPs must adopt industry-leading security practices, which in most cases for the majority of assets, would involve cold storage or highly secure offline solutions.

Under MiCA, an authorized Crypto-Asset Service Provider (CASP) that has obtained the specific authorization to provide "custody and administration of crypto-assets on behalf of clients" would essentially become the "qualified custodian." The authorization process ensures they meet the stringent capital, operational, security, governance, and organizational requirements laid out in MiCA.

No Publicly Announced Major Actions: Unlike larger countries where regulatory bodies regularly announce fines or other penalties against specific crypto firms for violations, Iceland has not had such public announcements in the last three years. This doesn't mean there are no regulatory activities, but rather that any actions taken may be less "significant" in the public domain (e.g., private warnings, compliance orders, or smaller, non-public fines) or against individuals rather than companies, or relate to older cases outside the requested timeframe.

AML/CFT Act in Iceland: Iceland has implemented the 5th Anti-Money Laundering Directive (AMLD5), which covers virtual asset service providers. The legal framework is primarily the Act on Measures Against Money Laundering and Terrorist Financing No. 140/2018.