Custodial wallet / SaaS in Moldova
Hosted wallet provider that holds keys on behalf of end users, often white-labeled to businesses (custody as a service).
Custodial SaaS is conditionally permitted in Moldova with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- VASPs (including custodial wallet/SaaS providers) must register as reporting entities under Law No. 308/2017 (md.aml.law-no-308-of-22)
- Must obtain a VASP license from the National Bank of Moldova (BNM) per Law No. 182/2022 (md.aml.designates-the-national-bank-of)
- CDD obligations: obtain and verify name, date of birth, address, and identification number for natural persons (md.aml.natural-persons-obtain-and-verify)
- CDD obligations: obtain and verify legal entity name, legal form, address, registration number, and director/authorized person names (md.aml.legal-entities-obtain-and-verify)
- UBO identification: identify and verify ultimate beneficial owners, understand ownership and control structure (md.aml.beneficial-ownership-ubo-identify-and)
- Business purpose due diligence: understand the intended nature and purpose of the business relationship (md.aml.purpose-and-intended-nature-of)
- Ongoing transaction monitoring: continuously monitor to ensure consistency with customer risk profile (md.aml.ongoing-monitoring-continuously-monitor-the)
- Risk-based approach: classify customers as low, medium, or high risk; apply SDD for low risk and EDD for high risk (md.aml.risk-based-approach-rba)
- EDD required for PEPs, complex/unusually large transactions, and unusual transaction patterns (md.aml.transactions-involving-politically-exposed-persons, md.aml.complex-unusually-large-transactions-or)
- Suspicious transaction reporting to the FIU (md.aml.it-defines-the-general-obligations)
Key Restrictions
- Must be licensed as a VASP by the National Bank of Moldova (BNM) before operations (md.aml.establishes-a-licensing-regime-for)
- Must maintain a local entity incorporated in Moldova — no passporting or remote registration available (md.aml.designates-the-national-bank-of)
- Custody/segregation/proof-of-reserves rules are not explicitly detailed in the provided facts — regulatory gap on custodian-specific requirements
- The SaaS provider (VASP licensee) bears primary AML/CFT obligations; white-label clients' obligations are not clearly delineated in the facts
- Geofencing or compliance measures to avoid serving sanctioned jurisdictions and comply with FATF travel rule expected
Key Risks
- Regulatory framework is very new (Law No. 182/2022 with amendments effective mid-2024); implementing regulations and BNM guidance on custodian-specific rules (segregation, insurance, proof-of-reserves) may be incomplete or untested (md.enforcement.outcome-a-new-regulatory-framework)
- No specific custody/qualified-custodian regime yet articulated for crypto custodial wallet providers — regulatory expectations may evolve rapidly
- Enforcement precedent is limited to criminal prosecutions of individuals; no track record of supervisory enforcement against licensed VASPs (md.enforcement.example-illustrative-of-typical-criminal)
- Ambiguity on whether the white-label client or the SaaS provider is the 'reporting entity' for AML purposes could create compliance gaps
- Language barrier — primary regulatory texts are in Romanian/Russian, which may increase compliance cost for foreign operators (md.aml.while-direct-links-to-consolidated)
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Law No. 308 of 22 December 2017 on preventing and combating money laundering and terrorist financing (Legea Nr. 308 din 22.12.2017 privind prevenirea și combaterea spălării banilor și finanțării terorismului):
This is Moldova's primary AML/CFT law.
It defines the general obligations for reporting entities, the role of the Financial Intelligence Unit (FIU), and the overall framework for AML/CFT compliance.
Crucially, this law was amended to include VASPs as "reporting entities" (subiecți raportori) following the adoption of Law No. 182.
Law No. 182 of 21 July 2022 on the regulation of virtual assets (Legea Nr. 182 din 21.07.2022 privind reglementarea activelor virtuale):
This is the cornerstone legislation specifically addressing virtual assets and VASPs in Moldova.
It transposed relevant provisions of the EU's 5th AML Directive (5AMLD) concerning virtual assets and aligns with FATF Recommendation 15 on new technologies.
Defines "virtual assets" and "virtual asset service providers" (VASPs).
Establishes a licensing regime for VASPs.
Designates the National Bank of Moldova (BNM) as the supervisory authority for VASPs.
Mandates VASPs to comply with AML/CFT obligations as per Law No. 308.
Identification and Verification of Identity:
Natural Persons: Obtain and verify the customer's name, date of birth, address, and an identification number (e.g., passport, ID card number). Verification must be based on reliable, independent source documents, data, or information.
Legal Entities: Obtain and verify the legal entity's name, legal form, address, registration number, and the names of directors/authorized persons.
Beneficial Ownership (UBO): Identify and verify the identity of the ultimate beneficial owner(s) of the customer, understanding the ownership and control structure.
Purpose and Intended Nature of the Business Relationship: Understand the reasons for the customer's transactions and the expected activity.
Ongoing Monitoring: Continuously monitor the business relationship and transactions to ensure they are consistent with the VASP's knowledge of the customer, their business, and risk profile. This includes scrutinizing transactions to ensure they are not suspicious.
Risk-Based Approach (RBA):
Simplified Due Diligence (SDD): May be applied in specific low-risk situations, with reduced intensity of CDD measures.
Enhanced Due Diligence (EDD): Must be applied in higher-risk situations, including:
Transactions involving politically exposed persons (PEPs).
Complex, unusually large transactions, or unusual patterns of transactions.
Moldova has already made notable improvements to its AML/CFT regime and is now in a phase of further enhancement and risk mitigation, with international partners calling for continued strengthening rather than initial framework development.
Regulator: National Bank of Moldova (BNM), General Prosecutor's Office, Financial Intelligence Unit (FIU), National Anticorruption Center (CNA).
Activity: Moldova has been working to align its legislation with FATF recommendations regarding virtual assets. The December 2023 amendments are a direct result of this.
Outcome: A new regulatory framework for VASPs, requiring registration, AML/CFT compliance, and supervision, will come into effect in mid-2024. This sets the stage for future enforcement actions.
Moldova.org (Dec 2023): "Moldova adopts Law on Virtual Assets to comply with international standards" - https://moldova.org/2023/12/28/moldova-adopts-law-on-virtual-assets-to-comply-with-international-standards/
Criminal Investigations Involving Cryptocurrency:
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — custodial wallet / SaaS providers can operate in Moldova only after obtaining a VASP license from the National Bank of Moldova under Law No. 182/2022, with full AML/CFT obligations under Law No. 308/2017, but the framework is new (effective mid-2024) and lacks codified custodian-specific rules on segregation, insurance, and proof-of-reserves.
Questions this verdict aims to answer
- What custody license / qualified-custodian status applies?
- What segregation, insurance, and proof-of-reserves rules apply?
- What AML obligations attach to the SaaS vs the white-label client?