DeFi protocol frontend in Kiribati

Registration, Not Licensing (for Crypto-specific activities): Kiribati currently operates on a de facto registration regime under its AML/CTF laws for virtual asset activities, rather than a specific licensing regime. This means that entities dealing with virtual assets are primarily required to comply with AML/CTF obligations and register with the FIU (if they fall under the definition of an "accountable institution"), rather than obtaining a bespoke crypto-specific license.

General Business Licensing: All businesses operating in Kiribati, regardless of their sector, must still undergo general business registration and licensing with the Registrar of Companies and comply with general business laws.

Kiribati Financial Intelligence Unit (FIU): Responsible for enforcing the AML/CTF Act, receiving suspicious transaction reports, and providing guidance on AML/CTF compliance.

Likely Treatment: Would most likely be considered a "money or value transfer service" or a "virtual asset service provider" (VASP) under the scope of the AML/CTF Act. This would trigger obligations as an "accountable institution."

Requirements: Compliance with AML/CTF Act, including registration with the FIU (if applicable), and general business registration.

Specific Crypto Capital: There are no specific minimum capital requirements defined for virtual asset service providers in Kiribati.

AML/KYC Requirements: This is the most crucial aspect.

Mandatory: Any entity falling under the scope of the AML/CTF Act (including VASPs by interpretation) would be obligated to implement robust AML/KYC procedures.

Anti-Money Laundering and Counter-Terrorist Financing Act 2018 (as amended): This is the core AML/CFT legislation. While it might not explicitly mention "virtual assets" or "stablecoins," financial institutions and designated non-financial businesses and professions (DNFBPs) are expected to report suspicious transactions. If stablecoin activities were deemed to fall under "financial services" broadly, they could be captured.

Identification and Verification:

Individuals: Obtain and verify the customer's name, residential address, date of birth, and an identification number (e.g., passport, national ID card). Verification typically requires reliable, independent source documents or data.

Legal Entities (Companies, Trusts): Obtain and verify the legal name, legal form, proof of existence, powers that regulate and bind the legal person or arrangement, and the names of relevant persons holding senior management positions. Identification and verification of beneficial owners (those ultimately owning or controlling 25% or more of the entity) are mandatory.

Ongoing Monitoring: Continuously monitoring the business relationship and transactions to ensure they are consistent with the VASP's knowledge of the customer, their business and risk profile, including, where necessary, the source of funds.

Risk-Based Approach: VASPs must apply a risk-based approach, meaning:

Simplified Due Diligence (SDD): May be applied in lower-risk situations, where specific conditions are met and approved by the FIU.

Enhanced Due Diligence (EDD): Must be applied in higher-risk situations, such as relationships with politically exposed persons (PEPs), cross-border correspondent relationships, or transactions involving high-risk jurisdictions or complex, unusual transactions. EDD includes more intensive verification, increased monitoring, and senior management approval.

Obligation to Report: VASPs must report any transaction (or attempted transaction) where they know, suspect, or have reasonable grounds to suspect that the transaction involves proceeds of criminal activity or relates to terrorist financing.

Reporting Authority: All STRs must be submitted to the Financial Intelligence Unit of Kiribati (FIU Kiribati).

No Tipping-Off: VASPs and their employees are prohibited from disclosing to the customer or any third party that an STR has been filed or that an investigation is underway.

Customer Identification Records: All documents and information obtained during the CDD process (identification documents, beneficial ownership information, business relationship details).

Transaction Records: Records of all domestic and international transactions, including the amount, currency, date, and parties involved (originator and beneficiary information).

Correspondence: Records of all correspondence and analyses related to CDD, business relationships, and transactions.

Financial Intelligence Unit of Kiribati (FIU Kiribati)

Travel Rule: While not explicitly mentioned in Kiribati's 2017 Act, the FATF "Travel Rule" (Recommendation 16 for wire transfers, extended to virtual asset transfers) requires VASPs to obtain and transmit originator and beneficiary information for virtual asset transfers above a certain threshold. VASPs should be prepared to implement this.

Regulatory Ambiguity: The lack of specific VASP legislation means there can be ambiguity. VASPs should proactively engage with the FIU Kiribati to seek clarification on their obligations and how the existing framework applies to their specific business model.

FATF Standards: Kiribati is expected to align with FATF standards. This means VASPs should design their AML/CFT programs based on the global best practices outlined in the FATF Recommendations and guidance for virtual assets, even if not explicitly codified in Kiribati law yet.

Nascent Regulatory Environment: Kiribati is a small island nation with a developing financial sector. Its regulatory frameworks for emerging technologies like cryptocurrency are either nascent or non-existent. There is no specific legislation or dedicated body for crypto regulation in place.

Limited Crypto Activity: The level of cryptocurrency adoption and activity within Kiribati is generally very low compared to larger economies, meaning fewer potential targets for enforcement.

Customer Due Diligence (CDD): Identifying and verifying the identity of customers.

Record Keeping: Maintaining records of transactions and CDD information.

Suspicious Transaction Reporting (STR): Reporting transactions suspected of being linked to money laundering or terrorist financing to the Financial Intelligence Unit (FIU).

No specific rules. Given the absence of a dedicated framework, there are no explicit mandates for the segregation of client digital assets from a custodian's proprietary assets. In traditional finance, this is a cornerstone of investor protection, but it has not been extended to digital assets through specific legislation in Kiribati.

No specific requirements. There are no known legislative or regulatory requirements mandating insurance or bonding for digital asset custodians operating in Kiribati.

No specific mandates. Kiribati's regulatory environment does not impose technical requirements such as the use of cold storage for digital assets. Decisions regarding storage methods (hot, warm, cold) would be left to the operational discretion of the service provider.