Remote VASP serving residents in Labuan (Malaysia)
Foreign-incorporated entity that offers exchange, custody, or transfer services to residents of a jurisdiction without establishing a local entity or office.
Remote VASP is conditionally permitted in Labuan (Malaysia) with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- Must comply with the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA 2001) as a reporting institution
- Implement risk-based Customer Due Diligence (CDD) - verify identity through reliable, independent sources for natural persons and legal entities
- Identify and verify beneficial owners of legal entity customers
- Understand purpose and intended nature of business relationships
- Ongoing transaction monitoring to ensure consistency with customer knowledge and risk profile
- Apply Enhanced Due Diligence (EDD) for PEPs, high-risk jurisdictions (FATF or Labuan FSA identified), and other high-risk scenarios
- Report suspicious transactions (STRs) to Bank Negara Malaysia's Financial Intelligence Unit (FIU)
- Maintain robust transaction monitoring systems
- Implement secure private key management, multi-signature wallets, and cold storage for client digital assets
- Maintain strict client asset segregation - client assets must not be commingled with proprietary assets
- Adhere to Labuan FSA Guidelines on AML/CFT for detailed compliance instructions
Key Restrictions
- Must be incorporated as a Labuan company under the Labuan Companies Act 1990 — foreign-entity remote operation without local establishment is not permitted
- Must have substantive physical presence in Labuan IBFC
- Must obtain a specific license from Labuan FSA as a Labuan Digital Asset Business / Digital Asset Exchange under the DA Guidance Note
- Capital requirements are assessed on a case-by-case basis by LFSA based on business scale and risk; can range from RM 500,000 to RM 1,000,000+ for full exchanges
- Directors, controllers, and key management must meet LFSA 'fit and proper' criteria
- Cross-border / remote-only service to residents from a foreign-incorporated entity without Labuan licensing is not lawful — triggers unlicensed operation risk
Key Risks
- Enforcement risk for unlicensed remote operators is material — offering services to residents without a Labuan license and without a Labuan-incorporated entity is unauthorized under LFSSA 2010 and the DA Guidance Note
- Sanctions compliance risk: While OFAC/EU sanctions not directly enforceable as Malaysian law, compliance is critical and practically mandatory for Labuan VASPs
- Regulatory ambiguity exists around payment processing involving digital assets — LFSA requires pre-application clarification on whether a Money Broking license is also needed
- Capital adequacy expectations are not fixed in law, creating uncertainty for new entrants on required capital quantum
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Labuan Financial Services and Securities Act 2010 (LFSSA 2010)
Guidance Note on the Offering and Trading of Digital Assets in Labuan IBFC (the DA Guidance Note): This is the most crucial document, specifically outlining the regulatory requirements for digital asset businesses. It was initially issued in 2019 and may undergo updates.
Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA 2001): The national AML/CFT law applicable to Labuan entities.
LFSA's Guidelines on AML/CFT: Specific guidelines issued by LFSA to complement AMLA 2001.
For Digital Asset Exchanges (DAX):
Required License: A Labuan company intending to operate a digital asset exchange (i.e., operating a trading platform, brokering, dealing, or acting as an intermediary for digital assets) must obtain a license as a Labuan Digital Asset Exchange or generally fall under the scope of a Labuan Digital Asset Business as defined in the DA Guidance Note.
For Custody Providers:
Strict compliance with AMLA 2001 and LFSA's AML/CFT guidelines.
Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA 2001): This is the cornerstone legislation. It imposes obligations on reporting institutions (which include VASPs) to detect, deter, and report suspicious transactions, and to implement robust AML/CFT measures, including sanctions screening.
Labuan FSA Guidelines on Digital Asset Businesses (2020, with subsequent updates)
Labuan FSA Guidelines on Anti-Money Laundering and Countering Financing of Terrorism (AML/CFT)
Customer Due Diligence (CDD) / Know Your Customer (KYC)
Risk-Based Approach: VASPs must adopt a risk-based approach to CDD, meaning the intensity of verification should be commensurate with the assessed money laundering/terrorism financing risk of the customer, product, service, or transaction.
Identification and Verification:
Beneficial Ownership: Identify and take reasonable measures to verify the identity of the beneficial owner(s) – the natural person(s) who ultimately own or control the customer, or the natural person(s) on whose behalf a transaction is being conducted. This is particularly critical for VASPs dealing with potentially opaque structures.
Purpose and Intended Nature of Business Relationship: Understand the purpose and intended nature of the business relationship or occasional transaction.
Ongoing Monitoring: Regularly scrutinize transactions undertaken throughout the course of the relationship to ensure consistency with the VASP’s knowledge of the customer, their business, and risk profile. This includes reviewing CDD information periodically.
Enhanced Due Diligence (EDD): Apply EDD for higher-risk customers and transactions, including:
Entity Type: Must be incorporated or registered as a Labuan company under the Labuan Companies Act 1990.
Physical Presence: Must have a substantive presence in Labuan.
Fit and Proper Criteria: Directors, controllers, and key management personnel must meet LFSA's "fit and proper" criteria (Section 4.1.5 & 4.1.6).
Capital Requirements: Maintain adequate paid-up capital and working capital, as determined by LFSA based on the nature, scale, and complexity of the business (Section 4.1.3 & 5.1).
Section 5.3.1 (e): "The entity shall establish robust internal controls and safeguards to segregate and protect clients' assets from its own assets. Client funds and digital assets must be held in designated segregated accounts or wallets and must not be commingled with the company's proprietary assets."
Section 5.3.1 (g): "The entity shall implement appropriate and comprehensive cybersecurity measures and controls to safeguard clients' digital assets from theft, loss, and unauthorised access, which include, but are not limited to, the use of secure private key management, multi-signature wallets, and cold storage for a significant portion of digital assets."
Legal Basis: While OFAC (U.S.) and EU sanctions are not directly enforceable as Malaysian law, compliance is critical and practically mandatory for Labuan VASPs due to several factors:
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a non-resident remote VASP may not serve Labuan residents from abroad without a local presence; the operator must incorporate as a Labuan company, maintain substantive physical presence in Labuan IBFC, obtain a Digital Asset Business license from Labuan FSA with case-specific capital requirements, and comply fully with AMLA 2001 AML/CFT obligations.
Questions this verdict aims to answer
- May a non-resident provider serve residents from abroad?
- Does cross-border service trigger licensing, registration, or AML obligations?
- What enforcement risk exists for unlicensed remote operators?