DeFi protocol frontend in Cambodia
Operates a web frontend or aggregator that interacts with permissionless smart contracts on behalf of users. May or may not screen users / restrict regions.
DeFi frontend is conditionally permitted in Cambodia with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- Customer Due Diligence (CDD) / KYC: Verify identity of customers and beneficial owners using reliable, independent source documents (kh.licensing.identification-and-verification-of-customers, kh.licensing.for-individuals-obtaining-and-verifying, kh.licensing.for-legal-entitiescorporations-obtaining-and)
- Enhanced Due Diligence (EDD) required for high-risk customers (PEPs, high-risk jurisdictions, new technologies with inherent anonymity) (kh.licensing.enhanced-due-diligence-edd-required)
- Screening customers against relevant national and international sanctions lists (UN Security Council sanctions) and PEP lists (kh.licensing.screening-customers-against-relevant-national, kh.aml.sanctioned-entity-screening-regularly-screen)
- Obligation to report suspicious transactions to the Cambodia Financial Intelligence Unit (CAFIU) without delay, typically within 24-48 hours (kh.licensing.obligation-to-report-any-vasp, kh.licensing.recipient-the-cambodia-financial-intelligence, kh.licensing.timeline-reports-must-be-made)
- No tipping-off prohibition — VASPs and employees must not disclose STR submissions to customers or third parties (kh.licensing.no-tipping-off-vasps-and-their)
- Conduct ongoing due diligence on business relationships and scrutinize transactions (kh.licensing.conducting-ongoing-due-diligence-on)
- Record-keeping of all transactions and CDD information for a specified period (kh.aml.record-keeping-maintain-records-of-all)
- Implement a risk-based approach to CDD, including Simplified Due Diligence for low-risk scenarios (kh.licensing.implementing-a-risk-based-approach-to, kh.licensing.simplified-due-diligence-sdd-permitted)
- UN sanctions screening against the UN Consolidated List (kh.aml.un-sanctions-cambodias-fiu-is, kh.aml.un-consolidated-list-httpswwwunorgsecuritycouncilsanctionsun-sc-consolidated-list)
Key Restrictions
- Issuance, circulation, and trading of cryptocurrencies and other virtual currencies are illegal unless authorized by the National Bank of Cambodia (NBC) — this applies to DeFi frontend operations that facilitate trading/swaps (kh.custody.the-issuance-circulation-and-trading, kh.custody.it-explicitly-stated-that-any)
- No specific licensing framework exists for crypto custodians or VASPs because the underlying activities are deemed illegal if not authorized by NBC, and NBC has not authorized private cryptocurrency activities (kh.custody.there-are-no-specific-custodial)
- The 2018 joint announcement prohibits financial institutions and the public from buying, selling, trading, mining, or using unauthorized virtual currencies (kh.aml.prohibition-on-issuance-trading-and)
- No legal definition of 'qualified custodian' for cryptocurrencies exists (kh.custody.qualified-custodian-definitions)
- Strict geofencing (Cambodia-wide block) may be required to avoid facilitating illegal activities for Cambodian residents
Key Risks
- Criminal prosecution risk: any person or entity issuing, circulating, or trading cryptocurrencies without NBC authorization 'shall be prosecuted in accordance with the applicable laws' (kh.custody.it-explicitly-stated-that-any)
- The original 2018 ban remains in effect and has been continuously reiterated by authorities, including as recently as 2022-2024 (kh.enforcement.reiteration-of-the-existing-ban, kh.enforcement.example-of-recent-reinforcement-2022, kh.enforcement.example-of-ongoing-concern-2023-2024)
- Cambodia's FATF grey-list status and continued AML/CFT scrutiny creates heightened enforcement risk (kh.enforcement.acams-today-article-discussing-cambodias)
- Even if a frontend does not take fees, merely facilitating user interaction with DeFi protocols could be construed as 'circulating' or 'trading' cryptocurrencies under the broad 2018 ban language (kh.custody.the-issuance-circulation-and-trading)
- International sanctions risk: OFAC and EU sanctions compliance is indirectly critical due to correspondent banking relationships and international on/off-ramp dependencies (kh.aml.correspondent-banking-international-trade-cambodian, kh.aml.freezing-of-funds-by-international, kh.aml.termination-of-correspondent-banking-relationships)
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
"The issuance, circulation, and trading of cryptocurrencies and other virtual currencies in Cambodia are illegal activities."
It explicitly stated that "any person or entity that issues, circulates, or trades cryptocurrencies or other virtual currencies without obtaining a license from the National Bank of Cambodia and other relevant authorities, shall be prosecuted in accordance with the applicable laws of the Kingdom of Cambodia."
There are no specific custodial licenses for cryptocurrencies/digital assets in Cambodia because the underlying activities (issuance, circulation, trading) are deemed illegal if not authorized by NBC. Since NBC has not authorized private cryptocurrency activities, no licensing mechanism exists for custody.
Joint Press Release on the Illegality of Unauthorized Trading Activities of Cryptocurrencies (National Bank of Cambodia, Securities and Exchange Commission of Cambodia, and General Commissariat of National Police, May 11, 2018):
Prohibition on Issuance, Trading, and Use: In May 2018, the NBC, in collaboration with the Securities and Exchange Regulator of Cambodia (SERC) and the General-Commissariat of National Police, issued a joint public announcement prohibiting financial institutions and the public from buying, selling, or trading cryptocurrencies.
Legal Reference: Joint Public Announcement on the Management of Digital Currency (May 2018) by the National Bank of Cambodia, Securities and Exchange Commission of Cambodia, and the General-Commissariat of National Police. (Direct English URL often difficult to find; commonly cited as "Joint Announcement on Digital Currency, 2018").
Law on Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT Law):
Prakas on the Implementation of the Law on Anti-Money Laundering and Combating the Financing of Terrorism (Prakas 285 on AML/CFT)
Obligation to Report: Any VASP that suspects or has reasonable grounds to suspect that funds or other assets, regardless of the amount, are derived from criminal activity, or are related to terrorist financing, must report promptly.
Recipient: The Cambodia Financial Intelligence Unit (CAFIU).
Timeline: Reports must be made without delay, typically within 24-48 hours of forming the suspicion.
Screening customers against relevant national and international sanctions lists (e.g., UN Security Council sanctions) and PEP lists.
Identification and Verification of Customers:
For Individuals: Obtaining and verifying proof of identity (e.g., national ID card, passport, driver's license), date of birth, address, and nationality.
For Legal Entities/Corporations: Obtaining and verifying legal name, address, proof of incorporation/registration (e.g., certificate of incorporation, business license), names of directors/senior management, and beneficial owners.
Enhanced Due Diligence (EDD): Required for high-risk customers, business relationships, or transactions (e.g., Politically Exposed Persons - PEPs, customers from high-risk jurisdictions, complex or unusually large transactions, new technologies with inherent anonymity).
Simplified Due Diligence (SDD): Permitted in low-risk situations, with sufficient measures to mitigate any potential risks.
No Tipping-Off: VASPs and their employees are prohibited from disclosing to the customer or to third parties that an STR has been or will be submitted.
Conducting ongoing due diligence on the business relationship and scrutinizing transactions undertaken throughout the course of that relationship to ensure that the transactions are consistent with the VASP's knowledge of the customer, their business, and risk profile, including, where necessary, the source of funds.
UN Sanctions: Cambodia's FIU is responsible for disseminating and ensuring compliance with the UN Consolidated List.
UN Consolidated List: https://www.un.org/securitycouncil/sanctions/un-sc-consolidated-list
Sanctioned Entity Screening: Regularly screen customers, beneficial owners, and transaction counterparties against national (UN-derived) and international sanctions lists (OFAC, EU).
Record-Keeping: Maintain records of all transactions and CDD information for a specified period.
Correspondent Banking & International Trade: Cambodian banks, financial institutions, and businesses rely on correspondent banking relationships with international banks (which are subject to U.S. and EU jurisdiction). Non-compliance with OFAC or EU sanctions by Cambodian entities can lead to:
Reiteration of the existing ban and public warnings.
Example of recent reinforcement (2022): The NBC Governor reinforced the ban and warned against the risks of digital assets in various forums.
Example of ongoing concern (2023-2024): Cambodian authorities continue to monitor and warn against the use of unauthorized digital assets, often linking it to broader financial stability and anti-money laundering efforts.
ACAMS Today article discussing Cambodia's FATF actions and virtual assets: https://www.acamstoday.org/cambodias-fatf-grey-list-exit/ (Published Dec 2023 – highlights continued monitoring of virtual assets as part of AML/CFT efforts, implying continued enforcement of existing prohibitions rather than new regulatory frameworks.)
Original 2018/2019 Ban (Context):
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — operating a DeFi protocol frontend that serves Cambodian residents is effectively illegal under the 2018 joint ban on issuing, circulating, and trading cryptocurrencies, unless the operator obtains an authorization from the NBC (which has not been granted for any private crypto activity); even pure frontends facilitating swaps face prosecution risk, and full KYC/AML/UN-sanctions screening obligations under the 2020 AML/CFT Law apply if any compliant structure were conceivable.
Questions this verdict aims to answer
- Is operating the frontend a regulated activity even if the protocol is decentralized?
- What geofencing or KYC obligations apply?
- Does fee-taking change classification?