Remote VASP serving residents in Comoros

Anjouan Offshore Finance Authority (AOFA): This is the primary authority responsible for licensing offshore financial services, including what are often adapted for cryptocurrency businesses.

Specific Crypto Law vs. General Financial Services License:

The Union of the Comoros does not have a dedicated, comprehensive law specifically for virtual assets or cryptocurrencies akin to those in major financial hubs.

Instead, virtual asset businesses seeking to operate from Comoros (via Anjouan) typically apply for a general financial services license or a Money Service Business (MSB) license under the AOFA framework. These licenses are then interpreted and adapted to cover crypto-related activities.

Exchanges (Spot, Derivatives): Would typically require an AOFA Financial Services License or MSB license. This allows for the facilitation of transactions, trading, and conversion of virtual assets.

Payment Processors (Fiat-to-Crypto, Crypto-to-Fiat, Crypto-only): An MSB license is the most common route for these entities, as they facilitate money transfers and currency exchange, which crypto payments are increasingly seen to represent.

Businesses must formally apply for a license.

They must meet specific criteria and undergo due diligence by the AOFA.

Licenses are granted after approval, requiring ongoing compliance to maintain validity.

The capital requirement is typically modest compared to many other jurisdictions. For a general Financial Services or MSB license from AOFA, the minimum paid-up capital requirement can be around USD 10,000 to USD 50,000, though this can vary. It's often required to be deposited in a local bank account or an account approved by the AOFA.

Comoros is currently on the FATF (Financial Action Task Force) "grey list" (Jurisdictions under increased monitoring). This means it is actively working with the FATF to address strategic deficiencies in its AML/CFT regimes.

Despite this, licensed entities under AOFA are required to implement robust Anti-Money Laundering (AML) and Know Your Customer (KYC) policies and procedures, including:

Customer Due Diligence (CDD): Verification of identity for all clients (individuals and corporate).

Enhanced Due Diligence (EDD): For high-risk clients or transactions.

Monitoring: Ongoing monitoring of transactions for suspicious activities.

Reporting: Reporting of suspicious transactions (STRs) to the local Financial Intelligence Unit (FIU), which is likely the National Financial Intelligence Processing Unit (Unité Nationale de Traitement des Renseignements Financiers - UNTRF).

Compliance Officer: Appointment of a qualified AML/CFT Compliance Officer.

Record Keeping: Maintaining records of transactions and client identification for a prescribed period.

Registered Office: All licensed entities must have a registered office address in Anjouan.

Local Agent/Representative: It's common to require a local registered agent or representative who acts as a liaison with the AOFA.

Physical Presence/Staff: While a full physical office with local staff isn't always strictly mandated for the offshore structures, having an operational substance plan is increasingly important for reputational and compliance purposes.

Ordinance No. 19-001/PR of 26 July 2019 on the Fight Against Money Laundering and Terrorist Financing: This is the most recent foundational AML/CFT law in Comoros. It replaced previous legislation (like Law No. 11-002/AF of 29 March 2011) and aims to align the Comorian framework with international standards set by FATF.

Note: While this Ordinance may not explicitly name "virtual assets" or "cryptocurrency," the broad definitions of "financial activity," "financial institutions," and "designated non-financial businesses and professions (DNFBPs)" are generally interpreted to encompass activities related to virtual assets and VASPs, especially given FATF Recommendation 15.

Be subject to licensing or registration: Depending on the specific interpretation and future regulations, VASPs are expected to be licensed or registered by the relevant authorities (e.g., the Central Bank).

Implement AML/CFT requirements: VASPs must comply with all AML/CFT obligations applicable to financial institutions, including customer due diligence, record-keeping, and suspicious transaction reporting.

Identification and Verification:

For natural persons: Obtain and verify the customer's identity using reliable, independent source documents, data, or information (e.g., full name, address, date and place of birth, nationality, unique identification number from an official document like a passport or national ID card).

For legal entities: Obtain and verify the identity of the legal entity (e.g., name, legal form, address, directors, beneficial owners, proof of incorporation). Understand the ownership and control structure.

Beneficial Ownership: Identify and take reasonable measures to verify the identity of the beneficial owner(s) of the customer, including for legal persons and arrangements.

Purpose and Intended Nature of Business Relationship: Understand the purpose and intended nature of the business relationship or occasional transaction.

Ongoing Monitoring: Conduct ongoing due diligence on the business relationship and scrutinize transactions undertaken throughout the course of that relationship to ensure that the transactions are consistent with the obliged entity's knowledge of the customer, their business, and risk profile, including, where necessary, the source of funds.

Enhanced Due Diligence (EDD): Apply EDD measures to higher-risk situations, which may include:

Politically Exposed Persons (PEPs).

Customers from high-risk jurisdictions.

Transactions involving complex or unusually large amounts.

Non-face-to-face business relationships.

Transactions involving new technologies and products (e.g., certain virtual assets).

Source of Funds/Wealth: For high-risk clients or transactions, VASPs should take reasonable measures to establish the source of funds or source of wealth.

Obligation to Report: VASPs are obligated to report any transaction (or attempted transaction), regardless of the amount, where there are reasonable grounds to suspect that the funds are the proceeds of a crime or are related to terrorist financing.

Reporting Authority: All STRs must be submitted to the National Financial Information Processing Unit (Cellule Nationale de Traitement des Informations Financières - CNTIF), which is Comoros' Financial Intelligence Unit (FIU).

No Tipping-Off: VASPs and their employees are prohibited from disclosing to the customer or to third parties that an STR has been filed or that an investigation is underway.

Customer Identification Data: All documents and information used for CDD, including verification records.

Account Files: Records related to customer accounts and business relationships.

Business Correspondence: Relevant correspondence with customers.

Transaction Records: Records of all transactions (date, type, amount, currency, parties involved, payment methods, digital wallet addresses, transaction hashes).

STRs and Internal Reports: Copies of all STRs filed and any internal reports related to suspicious activities.

Developing Regulatory Landscape: Comoros is a small, developing island nation. Its financial regulatory framework is still maturing, and specific legislation or dedicated enforcement mechanisms for complex digital assets like cryptocurrencies are likely not yet robust or fully established.

Focus on Warnings, Not Enforcement: Like many emerging economies, the primary approach of its financial regulator (the Central Bank of Comoros – Banque Centrale des Comores, BCC) regarding cryptocurrencies has typically been to issue general warnings to the public about the risks associated with volatile and unregulated assets, rather than to conduct formal enforcement actions against specific entities. Such warnings are often generic and do not name specific actors or impose penalties.

Lack of Transparency/Public Disclosure: Even if minor enforcement actions or investigations were to occur, they are unlikely to be publicly disclosed with the level of detail requested (penalty amounts, specific dates, outcomes, public reports) in a country with less developed financial transparency standards compared to major global financial hubs.

Limited Scale of Crypto Activity: It's also possible that the scale of cryptocurrency operations or significant violations within Comoros has not yet reached a level that would trigger major, publicly reported enforcement actions.

None Specific: There are no specific licensing requirements for cryptocurrency custodians in Comoros as there is no specific legal definition or framework for such entities. Entities operating in the crypto space would likely fall into an unregulated category or might be subject to existing general financial services laws if their activities could be broadly interpreted as such (though this is unlikely for pure crypto custody without specific legal amendments).

None Specific for Digital Assets: Since there are no specific custody laws, there are no explicit rules mandating the segregation of client digital assets from a custodian's proprietary assets. Traditional financial institutions under BCC oversight are subject to segregation rules for fiat currencies and securities, but these do not extend to digital assets without specific legislation.

ESAAMLG: Comoros is a member of the Eastern and Southern Africa Anti-Money Laundering Group. ESAAMLG mutual evaluation reports sometimes touch on a country's readiness to regulate VASPs, but this reflects recommendations rather than implemented national laws.