Custodial wallet / SaaS in Monaco

SICCFIN (Service d'Information et de Contrôle sur les Circuits Financiers): This is Monaco's Financial Intelligence Unit (FIU) and the primary authority for AML/CFT supervision. SICCFIN is responsible for defining and overseeing the AML/CFT obligations of VASPs.

CCAF (Commission de Contrôle des Activités Financières): The financial markets supervisory authority in Monaco. While not directly responsible for "crypto licenses" in the broader sense, the CCAF would be involved if a virtual asset activity falls under the scope of existing regulated financial services (e.g., if a crypto asset is deemed a security, or if investment advice related to crypto is provided).

Custody Providers (Virtual Asset Service Providers - VASP):

Scope: This includes entities that provide safekeeping or administration of virtual assets or instruments enabling control over virtual assets (e.g., private keys) on behalf of clients.

Requirement: Registration with SICCFIN for AML/CFT purposes.

A local entity (e.g., a Monégasque company) is generally required to operate as a VASP in Monaco.

The entity must have a physical presence, management, and operational substance within the Principality.

For pure AML/CFT registration with SICCFIN, there are generally no specific prescribed minimum capital requirements directly stemming from the AML law itself for VASPs, unlike for CCAF-regulated entities.

However, the entity must demonstrate financial solvency and sufficient resources to operate its business responsibly and comply with its obligations. If a CCAF license is also required for certain activities, then specific capital requirements will apply for those licensed activities.

Fit & Proper Requirements:

Management and key personnel of the VASP must demonstrate competence, integrity, and good repute.

Shareholders and beneficial owners are also subject to scrutiny.

Customer Due Diligence (CDD): Implementing robust procedures for identifying and verifying the identity of clients (Know Your Customer - KYC), including beneficial owners, and understanding the purpose and intended nature of the business relationship.

Ongoing Monitoring: Continuous monitoring of business relationships and transactions to ensure consistency with the institution's knowledge of the customer and their risk profile.

Record-Keeping: Maintaining records of customer identification data, transactions, and risk assessments for a specified period (typically 5-10 years).

Suspicious Transaction Reporting (STR): Establishing internal procedures for identifying and reporting suspicious transactions to SICCFIN.

Risk Assessment: Implementing a comprehensive, risk-based approach to AML/CFT, including institutional risk assessments and client risk profiling.

Internal Controls: Developing and implementing internal AML/CFT policies, procedures, and controls, including the appointment of an AML/CFT Compliance Officer.

If handling traditional fiat payments (e.g., processing card payments, traditional money remittance): These activities fall under existing payment services regulations. Depending on the exact nature, a license or authorization from the CCAF might be required if the activity constitutes a regulated financial service.

Establish a Local Entity: Incorporate a company in Monaco in accordance with Monégasque company law.

Develop Compliance Framework: Draft comprehensive internal AML/CFT policies and procedures, risk assessment frameworks, and client due diligence protocols, all tailored to the VASP's specific business model and compliant with Monégasque law and FATF standards.

Loi n° 1.362 du 3 août 2009 relative à la lutte contre le blanchiment de capitaux, le financement du terrorisme et la corruption (consolidated version often available through legal databases): Access via Journal de Monaco – search for "Loi 1.362" and its modifications for the most up-to-date text

Ordonnance Souveraine n° 8.182 du 10 mars 2021 portant modification de l'ordonnance souveraine n° 2.318 du 3 août 2009 d'application de la loi n° 1.362 du 3 août 2009 modifiée, relative à la lutte contre le blanchiment de capitaux, le financement du terrorisme et la corruption, modifiée (Sovereign Ordinance No. 8.182 of March 10, 2021 amending Sovereign Ordinance No. 2.318 of August 3, 2009 implementing Law No. 1.362 of August 3, 2009, as amended, on the fight against money laundering, terrorist financing, and corruption)

Identification and Verification of the Client:

Natural Persons: Obtain and verify the client's name, address, date and place of birth, nationality, and a unique identification number (e.g., passport or national ID card number). Verification must be based on reliable, independent source documents or data.

Legal Entities: Obtain and verify the name, legal form, address of the registered office, company registration number (if applicable), articles of association, and proof of legal existence and powers.

Non-Face-to-Face Relationships: Enhanced measures are required to mitigate the higher risk associated with non-face-to-face onboarding.

Identification of the Beneficial Owner (BO):

Identify the natural person(s) who ultimately own or control the client, directly or indirectly. For legal entities, this typically means anyone holding 25% or more of the shares or voting rights, or otherwise exercising control.

Verify the identity of the beneficial owner(s) using reliable, independent source documents or data.

Ongoing Monitoring of the Business Relationship:

Update client identification data and beneficial ownership information immediately upon any change, not merely on a regular basis.

Enhanced Due Diligence (EDD):

When Required: In situations presenting a higher risk of money laundering or terrorist financing. This includes, but is not limited to:

Politically Exposed Persons (PEPs), their family members, and close associates.

Monaco is itself identified as a high-risk third country by the EU and is under increased monitoring by the FATF

Complex, unusually large transactions, or unusual patterns of transactions that have no apparent economic or lawful purpose.

Non-face-to-face business relationships where the risk factors are not mitigated.

Relationships involving new technologies or products that favor anonymity.