Self-custodial wallet / non-custodial software in Labuan (Malaysia)
Publisher of software where users hold their own private keys. The publisher never holds, controls, or has access to user funds.
Self-custodial wallet is conditionally permitted in Labuan (Malaysia) with a local entity, subject to AML obligations and medium licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- Medium
- Last updated
- 2026-07-13
AML Obligations
- VASPs (including digital asset businesses) must comply with AMLA 2001 as reporting institutions — this includes CDD/KYC, ongoing monitoring, and STR reporting.
- Customer Due Diligence (CDD) must be conducted on a risk-based approach — obtain and verify identity of natural persons (govt-issued ID, proof of address) and legal entities (legal name, form, beneficial ownership).
- Beneficial ownership identification is mandatory — must identify and verify the natural persons who ultimately own or control the customer.
- Enhanced Due Diligence (EDD) applies for PEPs, customers from high-risk jurisdictions, and other higher-risk scenarios.
- Suspicious Transaction Reports (STRs) must be filed with Bank Negara Malaysia's Financial Intelligence Unit (FIU).
- Ongoing transaction monitoring is required — transactions must be scrutinised for consistency with the customer's profile and risk level.
- Record-keeping obligations under AMLA 2001 apply to all reporting institutions.
Key Restrictions
- A self-custodial wallet publisher that never holds, controls, or has access to user funds does not appear to fall within the definition of a Labuan Digital Asset Business under the DA Guidance Note — the licensing framework targets entities that operate platforms, facilitate trading, or provide custody of digital assets.
- If the wallet publisher merely distributes software and does not provide any custodial, exchange, or intermediary services, it likely does not trigger VASP licensing requirements in Labuan.
- However, any ancillary services (e.g., integrated swap/swap API, staking-as-a-service, or any form of transaction facilitation) could bring the operator under the licensing scope.
- If the operator establishes a Labuan entity for other reasons, it must comply with Labuan Companies Act 1990 incorporation requirements and maintain substantive physical presence in Labuan.
- Fit and proper criteria apply to directors and key management if a license is required.
Key Risks
- Regulatory ambiguity: The DA Guidance Note does not explicitly address non-custodial software-only wallet publishers — leading to legal uncertainty about whether such activity is regulated at all.
- Mission creep risk: If the wallet software includes integrated features (swap, staking, on-ramp/off-ramp) that involve custody or order matching, the operator may inadvertently fall under the DAX or custody licensing regime.
- Enforcement precedent: Labuan FSA has not publicly clarified the treatment of non-custodial wallet software; regulatory interpretation could shift with future FATF guidance updates.
- Sanctions compliance pressure: While OFAC/EU sanctions are not directly enforceable as Malaysian law, Labuan VASPs face practical pressure to comply with international sanctions regimes given cross-border financial exposure.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Guidance Note on the Offering and Trading of Digital Assets in Labuan IBFC (the DA Guidance Note): This is the most crucial document, specifically outlining the regulatory requirements for digital asset businesses. It was initially issued in 2019 and may undergo updates.
Required License: A Labuan company intending to operate a digital asset exchange (i.e., operating a trading platform, brokering, dealing, or acting as an intermediary for digital assets) must obtain a license as a Labuan Digital Asset Exchange or generally fall under the scope of a Labuan Digital Asset Business as defined in the DA Guidance Note.
This license permits the licensee to:
For Custody Providers:
Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA 2001): This is the cornerstone legislation. It imposes obligations on reporting institutions (which include VASPs) to detect, deter, and report suspicious transactions, and to implement robust AML/CFT measures, including sanctions screening.
Customer Due Diligence (CDD) / Know Your Customer (KYC)
Risk-Based Approach: VASPs must adopt a risk-based approach to CDD, meaning the intensity of verification should be commensurate with the assessed money laundering/terrorism financing risk of the customer, product, service, or transaction.
Identification and Verification:
Beneficial Ownership: Identify and take reasonable measures to verify the identity of the beneficial owner(s) – the natural person(s) who ultimately own or control the customer, or the natural person(s) on whose behalf a transaction is being conducted. This is particularly critical for VASPs dealing with potentially opaque structures.
Enhanced Due Diligence (EDD): Apply EDD for higher-risk customers and transactions, including:
Evidence fact lb.aml.reporting-of-suspicious-transactions-strs not found (may have been renamed).
Entity Type: Must be incorporated or registered as a Labuan company under the Labuan Companies Act 1990.
Physical Presence: Must have a substantive presence in Labuan.
Legal Basis: Implemented through the Financial Sanctions Act 2009 and specific Financial Sanctions Orders issued by the Minister of Finance.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a pure self-custodial wallet publisher (no custody, no order matching, no exchange services) likely does not trigger VASP licensing under the Labuan DA Guidance Note, but any integrated financial services features would bring the activity under LFSA's digital asset business licensing regime with AML obligations.
Questions this verdict aims to answer
- Does software publishing trigger VASP / MSB classification?
- Do AML obligations attach when no custody exists?
- What disclosure or consumer-protection rules apply?