Custodial wallet / SaaS in Comoros

Overall Regulatory Landscape: The primary financial regulator in Comoros is the Banque Centrale des Comores (BCC), which oversees traditional banking and financial services. Comoros is also a member of the Eastern and Southern Africa Anti-Money Laundering Group (ESAAMLG), indicating a commitment to international AML/CFT standards. However, these standards typically recommend, rather than mandate, specific digital asset custody rules for individual member states unless adopted into national law.

None Specific: There are no specific licensing requirements for cryptocurrency custodians in Comoros as there is no specific legal definition or framework for such entities. Entities operating in the crypto space would likely fall into an unregulated category or might be subject to existing general financial services laws if their activities could be broadly interpreted as such (though this is unlikely for pure crypto custody without specific legal amendments).

None Specific for Digital Assets: Since there are no specific custody laws, there are no explicit rules mandating the segregation of client digital assets from a custodian's proprietary assets. Traditional financial institutions under BCC oversight are subject to segregation rules for fiat currencies and securities, but these do not extend to digital assets without specific legislation.

None Specific: There are no specific licensing requirements for cryptocurrency custodians in Comoros as there is no specific legal definition or framework for such entities. Entities operating in the crypto space would likely fall into an unregulated category or might be subject to existing general financial services laws if their activities could be broadly interpreted as such (though this is unlikely for pure crypto custody without specific legal amendments).

None: There are no specific mandates or requirements for the use of cold storage or any particular security measures for digital assets.

None: There is no legal definition of a "qualified custodian" in the context of digital assets within Comorian law.

Anjouan Offshore Finance Authority (AOFA): This is the primary authority responsible for licensing offshore financial services, including what are often adapted for cryptocurrency businesses.

Specific Crypto Law vs. General Financial Services License:

Instead, virtual asset businesses seeking to operate from Comoros (via Anjouan) typically apply for a general financial services license or a Money Service Business (MSB) license under the AOFA framework. These licenses are then interpreted and adapted to cover crypto-related activities.

Custody Providers: Would also fall under the broader Financial Services License, as they manage and secure virtual assets on behalf of clients. Specific conditions regarding security, insurance, and segregation of assets might be imposed.

The capital requirement is typically modest compared to many other jurisdictions. For a general Financial Services or MSB license from AOFA, the minimum paid-up capital requirement can be around USD 10,000 to USD 50,000, though this can vary. It's often required to be deposited in a local bank account or an account approved by the AOFA.

Comoros is currently on the FATF (Financial Action Task Force) "grey list" (Jurisdictions under increased monitoring). This means it is actively working with the FATF to address strategic deficiencies in its AML/CFT regimes.

Businesses must formally apply for a license.

They must meet specific criteria and undergo due diligence by the AOFA.

Registered Office: All licensed entities must have a registered office address in Anjouan.

Local Agent/Representative: It's common to require a local registered agent or representative who acts as a liaison with the AOFA.

Customer Due Diligence (CDD): Verification of identity for all clients (individuals and corporate).

Enhanced Due Diligence (EDD): For high-risk clients or transactions.

Monitoring: Ongoing monitoring of transactions for suspicious activities.

Reporting: Reporting of suspicious transactions (STRs) to the local Financial Intelligence Unit (FIU), which is likely the National Financial Intelligence Processing Unit (Unité Nationale de Traitement des Renseignements Financiers - UNTRF).

Compliance Officer: Appointment of a qualified AML/CFT Compliance Officer.

Record Keeping: Maintaining records of transactions and client identification for a prescribed period.

Ordinance No. 19-001/PR of 26 July 2019 on the Fight Against Money Laundering and Terrorist Financing: This is the most recent foundational AML/CFT law in Comoros. It replaced previous legislation (like Law No. 11-002/AF of 29 March 2011) and aims to align the Comorian framework with international standards set by FATF.

Note: While this Ordinance may not explicitly name "virtual assets" or "cryptocurrency," the broad definitions of "financial activity," "financial institutions," and "designated non-financial businesses and professions (DNFBPs)" are generally interpreted to encompass activities related to virtual assets and VASPs, especially given FATF Recommendation 15.

Be subject to licensing or registration: Depending on the specific interpretation and future regulations, VASPs are expected to be licensed or registered by the relevant authorities (e.g., the Central Bank).

Implement AML/CFT requirements: VASPs must comply with all AML/CFT obligations applicable to financial institutions, including customer due diligence, record-keeping, and suspicious transaction reporting.

Identification and Verification:

For natural persons: Obtain and verify the customer's identity using reliable, independent source documents, data, or information (e.g., full name, address, date and place of birth, nationality, unique identification number from an official document like a passport or national ID card).

For legal entities: Obtain and verify the identity of the legal entity (e.g., name, legal form, address, directors, beneficial owners, proof of incorporation). Understand the ownership and control structure.

Beneficial Ownership: Identify and take reasonable measures to verify the identity of the beneficial owner(s) of the customer, including for legal persons and arrangements.

Purpose and Intended Nature of Business Relationship: Understand the purpose and intended nature of the business relationship or occasional transaction.

Ongoing Monitoring: Conduct ongoing due diligence on the business relationship and scrutinize transactions undertaken throughout the course of that relationship to ensure that the transactions are consistent with the obliged entity's knowledge of the customer, their business, and risk profile, including, where necessary, the source of funds.

Enhanced Due Diligence (EDD): Apply EDD measures to higher-risk situations, which may include:

Politically Exposed Persons (PEPs).

Customers from high-risk jurisdictions.

Transactions involving complex or unusually large amounts.

Non-face-to-face business relationships.

Transactions involving new technologies and products (e.g., certain virtual assets).

Source of Funds/Wealth: For high-risk clients or transactions, VASPs should take reasonable measures to establish the source of funds or source of wealth.

Obligation to Report: VASPs are obligated to report any transaction (or attempted transaction), regardless of the amount, where there are reasonable grounds to suspect that the funds are the proceeds of a crime or are related to terrorist financing.

Reporting Authority: All STRs must be submitted to the National Financial Information Processing Unit (Cellule Nationale de Traitement des Informations Financières - CNTIF), which is Comoros' Financial Intelligence Unit (FIU).

No Tipping-Off: VASPs and their employees are prohibited from disclosing to the customer or to third parties that an STR has been filed or that an investigation is underway.

Customer Identification Data: All documents and information used for CDD, including verification records.

Account Files: Records related to customer accounts and business relationships.

Business Correspondence: Relevant correspondence with customers.

Transaction Records: Records of all transactions (date, type, amount, currency, parties involved, payment methods, digital wallet addresses, transaction hashes).

STRs and Internal Reports: Copies of all STRs filed and any internal reports related to suspicious activities.

Developing Regulatory Landscape: Comoros is a small, developing island nation. Its financial regulatory framework is still maturing, and specific legislation or dedicated enforcement mechanisms for complex digital assets like cryptocurrencies are likely not yet robust or fully established.

Lack of Transparency/Public Disclosure: Even if minor enforcement actions or investigations were to occur, they are unlikely to be publicly disclosed with the level of detail requested (penalty amounts, specific dates, outcomes, public reports) in a country with less developed financial transparency standards compared to major global financial hubs.

Limited Scale of Crypto Activity: It's also possible that the scale of cryptocurrency operations or significant violations within Comoros has not yet reached a level that would trigger major, publicly reported enforcement actions.