On-shore VASP in Labuan (Malaysia)
Locally-incorporated VASP that operates under full local jurisdiction, holding all required licenses and registrations.
On-shore VASP is conditionally permitted in Labuan (Malaysia) with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- CDD/KYC under AMLA 2001 — obtain and verify identity of natural persons (govt-issued ID, proof of address), legal entities (legal name, proof of existence, beneficial owners), and purpose of business relationship.
- Risk-based approach: intensity of CDD must match assessed ML/TF risk (lb.aml.risk-based-approach-vasps-must-adopt).
- Enhanced Due Diligence (EDD) for PEPs, customers from high-risk FATF jurisdictions, and other higher-risk scenarios (lb.aml.enhanced-due-diligence-edd-apply).
- Ongoing monitoring — regularly scrutinize transactions for consistency with customer and risk profile (lb.aml.ongoing-monitoring-regularly-scrutinize-transactions).
- Suspicious Transaction Reports (STRs) to BNM's Financial Intelligence Unit (FIU) under AMLA 2001 (lb.aml.reporting-of-suspicious-transactions-strs).
- Record-keeping obligations under AMLA 2001 and LFSA AML/CFT Guidelines.
- Implementation of robust transaction monitoring systems (lb.licensing.robust-transaction-monitoring-systems).
- Beneficial ownership identification — take reasonable measures to identify natural persons who ultimately own or control the customer (lb.aml.beneficial-ownership-identify-and-take).
Key Restrictions
- Must be incorporated as a Labuan company under the Labuan Companies Act 1990 (lb.custody.entity-type-must-be-incorporated).
- Must maintain substantive physical presence in Labuan (lb.custody.physical-presence-must-have-a).
- Must maintain adequate paid-up capital as determined by LFSA based on business nature, scale, and complexity — expected range RM 500,000–RM 1,000,000+ for full-fledged DAX/complex operations (lb.licensing.for-full-fledged-digital-asset-exchanges; lb.custody.capital-requirements-maintain-adequate-paid-up).
- Client digital assets must be segregated from proprietary assets in designated accounts/wallets — no commingling (lb.custody.section-531-e-the-entity).
- Cold storage required for a significant portion of digital assets; multi-signature wallets and robust private key management mandated (lb.custody.section-531-g-the-entity).
- Directors, controllers, and key management must meet LFSA's fit and proper criteria (lb.custody.fit-and-proper-criteria-directors).
- Must submit a comprehensive business plan covering services, target market, operations, risk management, and tech infrastructure (lb.custody.business-plan-submission-of-a).
Key Risks
- Regulatory ambiguity around whether fiat-to-crypto payment processing requires an additional Labuan Money Broking license — must clarify with LFSA at pre-application stage (lb.licensing.fiat-to-crypto-crypto-to-fiat-payments-remittancemoney-changing).
- Tax treatment of crypto trading vs. personal investment is fact-dependent — profits deemed 'business income' are taxed at 3% (or RM 20,000 fixed sum under LBATA), but mischaracterization could trigger IRB scrutiny (lb.tax.labuan-business-activity-tax-act).
- Substance requirements (adequate employees, operating expenditure) must be demonstrably met to qualify for preferential tax treatment — failure risks full Malaysian corporate tax rates (lb.tax.substance-requirements-for-a-labuan).
- OFAC/EU sanctions not directly enforceable as Malaysian law but practically mandatory for Labuan VASPs to maintain correspondent banking and international credibility (lb.enforcement.legal-basis-while-ofac-us).
- Capital requirements are not fixed in regulation but determined case-by-case by LFSA, creating uncertainty in budgeting for license application.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Labuan Financial Services and Securities Act 2010 (LFSSA 2010)
Guidance Note on the Offering and Trading of Digital Assets in Labuan IBFC (the DA Guidance Note): This is the most crucial document, specifically outlining the regulatory requirements for digital asset businesses. It was initially issued in 2019 and may undergo updates.
For Digital Asset Exchanges (DAX):
Required License: A Labuan company intending to operate a digital asset exchange (i.e., operating a trading platform, brokering, dealing, or acting as an intermediary for digital assets) must obtain a license as a Labuan Digital Asset Exchange or generally fall under the scope of a Labuan Digital Asset Business as defined in the DA Guidance Note.
For Custody Providers:
For Payment Processors (involving Digital Assets):
Fiat-to-Crypto / Crypto-to-Fiat Payments (Remittance/Money Changing): If the payment processor facilitates the exchange of fiat currency for digital assets, or vice-versa, or offers remittance-like services using digital assets, it would typically require a Labuan Money Broking License in addition to or in conjunction with being regulated as a digital asset business. A Labuan Money Broking license covers money changing and remittance services.
For full-fledged digital asset exchanges or complex operations, LFSA will expect significantly higher capital, potentially in the range of RM 500,000 to RM 1,000,000 or more, depending on the business model and risk assessment.
Strict compliance with AMLA 2001 and LFSA's AML/CFT guidelines.
Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA 2001): This is the cornerstone legislation. It imposes obligations on reporting institutions (which include VASPs) to detect, deter, and report suspicious transactions, and to implement robust AML/CFT measures, including sanctions screening.
Labuan FSA Guidelines on Digital Asset Businesses (2020, with subsequent updates)
Labuan FSA Guidelines on Anti-Money Laundering and Countering Financing of Terrorism (AML/CFT)
Customer Due Diligence (CDD) / Know Your Customer (KYC)
Risk-Based Approach: VASPs must adopt a risk-based approach to CDD, meaning the intensity of verification should be commensurate with the assessed money laundering/terrorism financing risk of the customer, product, service, or transaction.
Enhanced Due Diligence (EDD): Apply EDD for higher-risk customers and transactions, including:
Evidence fact lb.aml.reporting-of-suspicious-transactions-strs not found (may have been renamed).
Beneficial Ownership: Identify and take reasonable measures to verify the identity of the beneficial owner(s) – the natural person(s) who ultimately own or control the customer, or the natural person(s) on whose behalf a transaction is being conducted. This is particularly critical for VASPs dealing with potentially opaque structures.
Ongoing Monitoring: Regularly scrutinize transactions undertaken throughout the course of the relationship to ensure consistency with the VASP’s knowledge of the customer, their business, and risk profile. This includes reviewing CDD information periodically.
Entity Type: Must be incorporated or registered as a Labuan company under the Labuan Companies Act 1990.
Physical Presence: Must have a substantive presence in Labuan.
Capital Requirements: Maintain adequate paid-up capital and working capital, as determined by LFSA based on the nature, scale, and complexity of the business (Section 4.1.3 & 5.1).
Fit and Proper Criteria: Directors, controllers, and key management personnel must meet LFSA's "fit and proper" criteria (Section 4.1.5 & 4.1.6).
Business Plan: Submission of a comprehensive business plan detailing services offered, target market, operational procedures, risk management framework, and technology infrastructure.
Section 5.3.1 (e): "The entity shall establish robust internal controls and safeguards to segregate and protect clients' assets from its own assets. Client funds and digital assets must be held in designated segregated accounts or wallets and must not be commingled with the company's proprietary assets."
Section 5.3.1 (g): "The entity shall implement appropriate and comprehensive cybersecurity measures and controls to safeguard clients' digital assets from theft, loss, and unauthorised access, which include, but are not limited to, the use of secure private key management, multi-signature wallets, and cold storage for a significant portion of digital assets."
Labuan Business Activity Tax Act 1990 (LBATA):
Substance Requirements: For a Labuan entity to qualify for the preferential 3% tax rate or fixed sum, it must comply with substance requirements set by the Labuan Financial Services Authority (LFSA) under the Labuan Business Activity Tax (Requirements for Labuan Business Activity) Regulations 2018. This includes having an adequate number of full-time employees in Labuan and an adequate amount of annual operating expenditure in Labuan, proportionate to the level of activity.
Legal Basis: While OFAC (U.S.) and EU sanctions are not directly enforceable as Malaysian law, compliance is critical and practically mandatory for Labuan VASPs due to several factors:
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — an on-shore VASP in Labuan (LB) must be a locally-incorporated Labuan company with substantive physical presence, obtain a Labuan Digital Asset Business license (or specific DAX/custody license) from LFSA with case-by-case capital requirements (typically RM 500,000+), comply with AMLA 2001 AML/CFT obligations including CDD/EDD/STR reporting to BNM's FIU, implement client asset segregation and cold storage, and meet fit-and-proper criteria for management, with profits taxed at 3% under LBATA subject to substance requirements.
Questions this verdict aims to answer
- What license(s) are required to operate locally?
- What capital, governance, and reporting obligations apply?
- What is the application process and timeline?