Self-custodial wallet / non-custodial software in Kiribati

Registration, Not Licensing (for Crypto-specific activities): Kiribati currently operates on a de facto registration regime under its AML/CTF laws for virtual asset activities, rather than a specific licensing regime. This means that entities dealing with virtual assets are primarily required to comply with AML/CTF obligations and register with the FIU (if they fall under the definition of an "accountable institution"), rather than obtaining a bespoke crypto-specific license.

General Business Licensing: All businesses operating in Kiribati, regardless of their sector, must still undergo general business registration and licensing with the Registrar of Companies and comply with general business laws.

Kiribati Financial Intelligence Unit (FIU): Responsible for enforcing the AML/CTF Act, receiving suspicious transaction reports, and providing guidance on AML/CTF compliance.

Likely Treatment: Would most likely be considered a "money or value transfer service" or a "virtual asset service provider" (VASP) under the scope of the AML/CTF Act. This would trigger obligations as an "accountable institution."

Requirements: Compliance with AML/CTF Act, including registration with the FIU (if applicable), and general business registration.

Mandatory: Any entity falling under the scope of the AML/CTF Act (including VASPs by interpretation) would be obligated to implement robust AML/KYC procedures.

Customer Due Diligence (CDD): Identifying and verifying the identity of customers, including beneficial owners.

Ongoing Monitoring: Monitoring business relationships and transactions.

Record-Keeping: Maintaining records of transactions and customer data for a specified period.

Suspicious Transaction Reporting (STR): Reporting suspicious activities to the Kiribati FIU.

Anti-Money Laundering and Counter-Terrorist Financing Act 2018 (as amended): This is the core AML/CFT legislation. While it might not explicitly mention "virtual assets" or "stablecoins," financial institutions and designated non-financial businesses and professions (DNFBPs) are expected to report suspicious transactions. If stablecoin activities were deemed to fall under "financial services" broadly, they could be captured.

Identification and Verification:

Ongoing Monitoring: Continuously monitoring the business relationship and transactions to ensure they are consistent with the VASP's knowledge of the customer, their business and risk profile, including, where necessary, the source of funds.

Risk-Based Approach: VASPs must apply a risk-based approach, meaning:

Obligation to Report: VASPs must report any transaction (or attempted transaction) where they know, suspect, or have reasonable grounds to suspect that the transaction involves proceeds of criminal activity or relates to terrorist financing.

No Tipping-Off: VASPs and their employees are prohibited from disclosing to the customer or any third party that an STR has been filed or that an investigation is underway.

Customer Identification Records: All documents and information obtained during the CDD process (identification documents, beneficial ownership information, business relationship details).

Transaction Records: Records of all domestic and international transactions, including the amount, currency, date, and parties involved (originator and beneficiary information).

Financial Intelligence Unit of Kiribati (FIU Kiribati)

Regulatory Ambiguity: The lack of specific VASP legislation means there can be ambiguity. VASPs should proactively engage with the FIU Kiribati to seek clarification on their obligations and how the existing framework applies to their specific business model.

FATF Standards: Kiribati is expected to align with FATF standards. This means VASPs should design their AML/CFT programs based on the global best practices outlined in the FATF Recommendations and guidance for virtual assets, even if not explicitly codified in Kiribati law yet.

Travel Rule: While not explicitly mentioned in Kiribati's 2017 Act, the FATF "Travel Rule" (Recommendation 16 for wire transfers, extended to virtual asset transfers) requires VASPs to obtain and transmit originator and beneficiary information for virtual asset transfers above a certain threshold. VASPs should be prepared to implement this.

Nascent Regulatory Environment: Kiribati is a small island nation with a developing financial sector. Its regulatory frameworks for emerging technologies like cryptocurrency are either nascent or non-existent. There is no specific legislation or dedicated body for crypto regulation in place.

Limited Crypto Activity: The level of cryptocurrency adoption and activity within Kiribati is generally very low compared to larger economies, meaning fewer potential targets for enforcement.

None specifically for crypto custody. There is no public record of a licensing regime exclusively for digital asset custodians in Kiribati. General financial services licenses might exist, but these typically cover traditional banking, insurance, or investment services and would not explicitly apply to crypto custody unless specifically amended.

No specific rules. Given the absence of a dedicated framework, there are no explicit mandates for the segregation of client digital assets from a custodian's proprietary assets. In traditional finance, this is a cornerstone of investor protection, but it has not been extended to digital assets through specific legislation in Kiribati.