Crypto-funded debit card in Labuan (Malaysia)

Labuan Financial Services and Securities Act 2010 (LFSSA 2010)

Guidance Note on the Offering and Trading of Digital Assets in Labuan IBFC (the DA Guidance Note): This is the most crucial document, specifically outlining the regulatory requirements for digital asset businesses. It was initially issued in 2019 and may undergo updates.

Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA 2001): The national AML/CFT law applicable to Labuan entities.

LFSA's Guidelines on AML/CFT: Specific guidelines issued by LFSA to complement AMLA 2001.

For Digital Asset Exchanges (DAX):

Required License: A Labuan company intending to operate a digital asset exchange (i.e., operating a trading platform, brokering, dealing, or acting as an intermediary for digital assets) must obtain a license as a Labuan Digital Asset Exchange or generally fall under the scope of a Labuan Digital Asset Business as defined in the DA Guidance Note.

This license permits the licensee to:

For Custody Providers:

Required License: Standalone digital asset custody services often fall under the broader definition of a Labuan Digital Asset Business regulated by the LFSA, or it may be an ancillary service provided by a licensed Labuan Digital Asset Exchange.

The DA Guidance Note explicitly covers aspects related to the custody of digital assets, requiring robust security, operational resilience, and client asset segregation. While there isn't a separate, specific "custody license" distinct from the "Digital Asset Business" umbrella, providing custody is a regulated activity within that framework.

For Payment Processors (involving Digital Assets):

Required License: This category is more nuanced:

Crypto-to-Crypto or Crypto-only Payments: If the service solely involves processing payments in digital assets without converting to or from fiat currency, it would likely fall under the scope of a Labuan Digital Asset Business or specific approvals from LFSA under the DA Guidance Note, focusing on the transfer and settlement aspects of digital assets.

Fiat-to-Crypto / Crypto-to-Fiat Payments (Remittance/Money Changing): If the payment processor facilitates the exchange of fiat currency for digital assets, or vice-versa, or offers remittance-like services using digital assets, it would typically require a Labuan Money Broking License in addition to or in conjunction with being regulated as a digital asset business. A Labuan Money Broking license covers money changing and remittance services.

It is crucial to clarify the exact nature of the payment processing activity with LFSA during the pre-application stage.

For a Labuan Money Broking license (if applicable for payment processing), the minimum paid-up capital is RM250,000 (approx. USD 50,000-60,000, subject to exchange rates).

For full-fledged digital asset exchanges or complex operations, LFSA will expect significantly higher capital, potentially in the range of RM 500,000 to RM 1,000,000 or more, depending on the business model and risk assessment.

Strict compliance with AMLA 2001 and LFSA's AML/CFT guidelines.

Implementation of comprehensive Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD) procedures.

Robust transaction monitoring systems.

Reporting of suspicious transactions (STRs) to the Financial Intelligence Unit (FIU) of Bank Negara Malaysia.

Labuan Financial Services Authority (Labuan FSA)

Bank Negara Malaysia (BNM) - Financial Intelligence Unit (FIU)

Role: While Labuan FSA is the primary regulator, BNM's FIU is the body to which suspicious transaction reports (STRs) are submitted. It acts as Malaysia's central agency for receiving, analysing, and disseminating financial intelligence.

Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA 2001): This is the cornerstone legislation. It imposes obligations on reporting institutions (which include VASPs) to detect, deter, and report suspicious transactions, and to implement robust AML/CFT measures, including sanctions screening.

Description: This is the overarching national legislation in Malaysia that provides the legal framework for combating money laundering and terrorism financing. It defines "reporting institutions" (which include VASPs) and outlines their obligations, including CDD, record-keeping, and STRs.

Labuan FSA Guidelines on Digital Asset Businesses (2020, with subsequent updates)

Labuan FSA Guidelines on Anti-Money Laundering and Countering Financing of Terrorism (AML/CFT)

Customer Due Diligence (CDD) / Know Your Customer (KYC)

Risk-Based Approach: VASPs must adopt a risk-based approach to CDD, meaning the intensity of verification should be commensurate with the assessed money laundering/terrorism financing risk of the customer, product, service, or transaction.

Identification and Verification:

Natural Persons: Obtain and verify identity through reliable, independent sources (e.g., government-issued ID, proof of address, date of birth, nationality).

Legal Entities: Obtain and verify legal name, legal form, proof of existence, powers that bind the entity, names of relevant persons (directors, senior management), and crucially, the beneficial owners.

Beneficial Ownership: Identify and take reasonable measures to verify the identity of the beneficial owner(s) – the natural person(s) who ultimately own or control the customer, or the natural person(s) on whose behalf a transaction is being conducted. This is particularly critical for VASPs dealing with potentially opaque structures.

Purpose and Intended Nature of Business Relationship: Understand the purpose and intended nature of the business relationship or occasional transaction.

Ongoing Monitoring: Regularly scrutinize transactions undertaken throughout the course of the relationship to ensure consistency with the VASP’s knowledge of the customer, their business, and risk profile. This includes reviewing CDD information periodically.

Enhanced Due Diligence (EDD): Apply EDD for higher-risk customers and transactions, including:

Politically Exposed Persons (PEPs)

Customers from high-risk jurisdictions (as identified by FATF or Labuan FSA)

Labuan Business Activity Tax Act 1990 (LBATA):

3% of net audited profit; OR

A fixed sum of RM20,000 (Ringgit Malaysia Twenty Thousand) if the Labuan entity meets the substance requirements (e.g., adequate full-time employees, annual operating expenditure) and elects this option.

Substance Requirements: For a Labuan entity to qualify for the preferential 3% tax rate or fixed sum, it must comply with substance requirements set by the Labuan Financial Services Authority (LFSA) under the Labuan Business Activity Tax (Requirements for Labuan Business Activity) Regulations 2018. This includes having an adequate number of full-time employees in Labuan and an adequate amount of annual operating expenditure in Labuan, proportionate to the level of activity.

If cryptocurrency is held purely as a personal investment and disposed of for profit, this profit is generally not subject to capital gains tax in Malaysia (and by extension, Labuan, given the absence of a specific Labuan CGT regime).

However, if the trading of cryptocurrency is deemed to be a business activity (e.g., frequent, organized, with a view to generating regular profits, employing capital and resources), then the profits are considered income and subject to income tax (see below). The distinction between a "capital gain" and "trading income" is a matter of facts and circumstances, often determined by "badges of trade" principles.

Service Tax: Service Tax is imposed on taxable services provided by a taxable person in Malaysia.

The Royal Malaysian Customs Department (RMCD) has indicated that exchange services (brokerage, matching services) involving cryptocurrency could be subject to Service Tax if provided by a taxable person.

Legal Basis: While OFAC (U.S.) and EU sanctions are not directly enforceable as Malaysian law, compliance is critical and practically mandatory for Labuan VASPs due to several factors: