Custodial wallet / SaaS in Jamaica

Bank of Jamaica (BOJ) – the central bank overseeing monetary policy and financial regulation

The Proceeds of Crime Act (POCA), 2007 (as amended): This is the cornerstone of Jamaica's AML framework. It criminalizes money laundering and provides for the investigation, prosecution, and confiscation of the proceeds of crime. It also places obligations on "financial institutions" and "designated non-financial businesses and professions" (DNFBPs) to implement AML/CFT measures. VASPs, depending on their activities, are typically considered under these categories.

The Terrorism Prevention Act (TPA), 2007 (as amended): This Act provides for the prevention, suppression, and punishment of terrorism, including the financing of terrorism.

The Financial Investigations Division Act (FIDA), 2010: This Act establishes the Financial Investigations Division (FID) as Jamaica's Financial Intelligence Unit (FIU), responsible for receiving, analyzing, and disseminating suspicious transaction reports.

Bank of Jamaica (BOJ)

Role: The BOJ is the central bank and the primary regulator for banks, payment service providers, and is increasingly taking on a supervisory role for fintech innovations, including virtual assets, especially those impacting monetary policy and financial stability. While specific VASP licensing frameworks are still under development, the BOJ issues guidance and directives that clarify how existing AML/CFT laws apply to virtual asset activities.

Financial Investigations Division (FID)

Identification and Verification of Customers:

Beneficial Ownership Identification:

Purpose and Intended Nature of Business Relationship:

Conducting ongoing due diligence on the business relationship and scrutiny of transactions undertaken throughout the course of that relationship. This includes ensuring that transactions are consistent with the VASP's knowledge of the customer, their business, and risk profile, including, where necessary, the source of funds.

Implementing a risk-based approach to CDD, meaning:

Simplified Due Diligence (SDD): May be applied where the risk of money laundering or terrorist financing is lower.

Enhanced Due Diligence (EDD): Must be applied in higher-risk situations, such as:

Transactions involving politically exposed persons (PEPs).

Cross-border correspondent relationships.

Customers from high-risk geographic locations.

Complex, unusual, or large transactions.

Relationships with unknown or unverified virtual asset wallet addresses.

No specific, standalone "crypto custody license" currently exists.

Existing Frameworks & Future Licensing:

FinTech Regulatory Sandbox: The Bank of Jamaica (BOJ) has established a FinTech Regulatory Sandbox which allows innovative financial services, including those involving digital assets (and potentially custody), to be tested under regulatory supervision for a limited period. Firms operating within the sandbox may receive temporary exemptions or waivers from certain regulatory requirements, allowing them to iterate and gain insights. Successful participants may then transition to a full regulatory regime once developed.

Existing Financial Services Licenses: Entities providing custody services that fall under the existing definitions of regulated activities (e.g., trust services, securities custody) might be required to obtain licenses from the FSC or BOJ under their respective mandates. However, the application of these traditional licenses to novel digital asset custody models is often ambiguous.

Future VASP Licensing: Jamaica is expected to introduce specific licensing requirements for Virtual Asset Service Providers (VASPs) in line with FATF recommendations. Under FATF definitions, "safeguarding or administering virtual assets or instruments enabling control over virtual assets" is a VASP activity. Therefore, a future VASP licensing regime will likely encompass dedicated requirements for digital asset custodians.

No explicit, dedicated rules for digital asset segregation: There are no specific regulations exclusively mandating the segregation of client digital assets for crypto custodians.

General Financial Principles: However, the principle of client asset segregation is a fundamental pillar of sound financial practice for regulated entities in Jamaica (e.g., banks, trust companies, securities brokers). Any firm operating under a BOJ or FSC license, or within the FinTech Sandbox, would be expected to demonstrate robust operational controls, including the segregation of client funds/assets from proprietary assets, to mitigate risks like commingling, insolvency, and fraud. This would be assessed as part of their operational risk management framework.

No explicit requirements for digital asset custodians: There are no specific regulations mandating insurance or bonding for digital asset custody providers.

Best Practice & Future Consideration: In a highly volatile and high-risk environment like digital assets, robust insurance (e.g., crime insurance, cyber insurance, professional indemnity) and/or bonding is considered a best practice by institutional custodians globally. It is highly probable that any future comprehensive VASP regulatory framework would consider requiring such protections.

No explicit regulatory mandate for cold storage: Jamaican regulations do not currently explicitly mandate the use of cold storage for digital assets held in custody.

Industry Best Practice & Security Assessment: Like insurance, the use of cold storage (offline storage) is an industry-standard best practice for securing a significant portion of digital assets to mitigate the risk of cyber theft. Any entity seeking to operate a digital asset custody service, especially within the BOJ's FinTech Sandbox, would be expected to demonstrate robust cybersecurity measures, which would almost certainly include the strategic use of cold storage and multi-signature technologies for asset protection. This falls under general operational security and risk management.

No specific definition for a "Qualified Custodian" in the digital asset context.

Implied Qualification: In the absence of a specific definition, a "qualified custodian" would generally be interpreted as an entity that is appropriately licensed and regulated by a relevant authority (e.g., BOJ for banking/payment services, FSC for securities or trust services) to hold assets on behalf of others, or an entity that has been approved to operate in the FinTech Sandbox for such activities. The intent is to ensure that assets are held by a reputable and supervised entity.

Development of VASP Framework: Jamaica is actively working towards establishing a comprehensive regulatory framework for Virtual Asset Service Providers (VASPs). Both the Bank of Jamaica and the Financial Services Commission have acknowledged the need for specific legislation to regulate the burgeoning digital asset space.

FATF Influence: As a member of the CFATF, Jamaica is committed to implementing FATF Recommendations, which require the regulation and supervision of VASPs, including those involved in virtual asset custody. This commitment strongly suggests that future legislation will define VASPs, require their licensing, and set out specific rules for their operation, which will cover custody services.

Ongoing Consultation: The BOJ and FSC have engaged in discussions and consultations regarding the future of digital asset regulation, which will likely lead to amendments to existing legislation or the introduction of new acts to address virtual assets comprehensively. While a specific "custody bill" may not be publicly identified, the broader VASP legislation is expected to address all aspects of VASP activities, including custody.

Proceeds of Crime Act (POCA): This is the foundational legislation for anti-money laundering.

Terrorism Prevention Act (TPA): This addresses the financing of terrorism and the implementation of UN Security Council resolutions related to terrorism.

Bank of Jamaica (BOJ) Guidance Note on Virtual Asset Service Providers (VASPs) for Anti-Money Laundering/Combating the Financing of Terrorism (AML/CFT) Purposes: This is the most crucial document specifically addressing VASPs' obligations.

Safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets.

Evolving Regulatory Landscape: Jamaica does not yet have a comprehensive, dedicated regulatory framework specifically for cryptocurrencies and virtual asset service providers (VASPs). Enforcement would largely fall under existing laws such as anti-money laundering/counter-financing of terrorism (AML/CFT) laws, fraud statutes, or securities regulations if a crypto asset were deemed a security. The lack of specific licensing requirements for most crypto activities means fewer direct "licensing violation" cases.

Bank of Jamaica (BOJ):

Stance on Crypto: Cautious. While supporting innovation, the BOJ has repeatedly warned the public about the risks of unregulated cryptocurrencies, emphasizing their volatility and lack of consumer protection. They have clarified that cryptocurrencies are not legal tender in Jamaica.

Financial Investigations Division (FID):

Financial Services Commission (FSC):