Custodial wallet / SaaS in Montenegro

Definition of VASP: Article 2(1)(7) defines a "virtual asset service provider" as a legal entity that, as its regular business activity, provides one or more of the virtual asset services specified in Article 18.

Custody Service: Article 18(1)(2) specifies "custody of digital assets for third parties" as a regulated virtual asset service.

Licensing Authority: The Capital Market Authority (KAP) is responsible for issuing, supervising, and revoking licenses for VASPs (Article 20).

Licensing Conditions (Article 21): Applicants for a VASP license must meet several conditions, including:

Legal entity established in Montenegro.

Adequate organizational structure, internal control mechanisms, and risk management systems.

Suitable professional qualifications and reputation of management and key personnel.

Adequate technical and security measures for the safekeeping and protection of digital assets.

Minimum capital requirements and guarantees for covering potential liabilities.

Measures for the protection of client assets.

Compliance with AML/CFT regulations.

Possession of a cybersecurity certificate.

Law on Blockchain, Digital Assets and Individual Digital Identifiers (Zakon o blokčejnu, digitalnoj imovini i individualnim digitalnim identitetima) - Official publication in the "Official Gazette of Montenegro," No. 80/23.

Article 21(1)(9) of the Law on Blockchain, Digital Assets and Individual Digital Identifiers explicitly requires VASPs to implement "measures for the protection of client assets." This typically implies segregation, ensuring that client assets are identifiable and separate from the VASP's own assets, to prevent commingling and protect clients in case of VASP insolvency. While the law doesn't detail how assets must be segregated (e.g., separate wallets, omnibus accounts with clear ledgering), the requirement for "measures for the protection of client assets" is the legal basis.

Article 21(1)(7) of the Law on Blockchain, Digital Assets and Individual Digital Identifiers states that a VASP must meet "minimum capital requirements" and provide "guarantees for the coverage of potential liabilities arising from the provision of virtual asset services."

These "guarantees" can take various forms, including professional indemnity insurance or other financial instruments designed to cover risks such as cyber-attacks, operational failures, or loss of client assets. The specific nature and amount of these guarantees are likely to be detailed in subordinate legislation or regulations issued by the Capital Market Authority.

EU Alignment (MiCA): Montenegro is an EU candidate country. The European Union's comprehensive Markets in Crypto-Assets Regulation (MiCA) came into full effect in December 2024 for VASPs. While Montenegro has passed its own law, it will eventually need to harmonize its legislation with MiCA as part of its EU accession process. This could lead to amendments or further refinement of the Montenegrin framework to fully align with MiCA's robust requirements for crypto-asset service providers (CASPs), including those offering custody. MiCA sets very detailed requirements for operational resilience, governance, client asset segregation, and liability for custody providers.

Custody providers are subject to AML/CTF obligations as "obligated entities."

If the virtual assets held in custody are deemed to be "securities" under Montenegrin law, then a license from the Capital Market Commission (KHOV) for providing investment services (e.g., safekeeping of financial instruments) might be required. This is a case-by-case assessment.

AML/KYC (Anti-Money Laundering / Know Your Customer): This is the most critical requirement for any VASP operating in Montenegro.

AML Officer: Appointment of a designated AML Officer and providing regular training to staff.

An entity generally needs to be incorporated in Montenegro to conduct business activities and be subject to local regulation.

A registered office and local management/personnel, including a local AML Officer, would typically be expected for AML compliance.

Company Registration: Establish a legal entity (e.g., LLC) in Montenegro with the Central Registry of Commercial Entities (CRPS).

AML Framework Implementation: Develop and implement comprehensive AML/CTF policies, procedures, and controls, appoint an AML Officer, and conduct a risk assessment.

Law on Prevention of Money Laundering and Terrorism Financing (Zakon o sprječavanju pranja novca i finansiranja terorizma): This is the primary legislation. While an official English translation with a direct URL might be hard to find, the official Montenegrin legal gazette (Službeni list Crne Gore) publishes it. The most relevant amendments were made in 2021 to address virtual assets.

Custody and/or administration of virtual assets or instruments enabling control over virtual assets.

Collect required originator and beneficiary information.

Transmit this information securely and reliably to the beneficiary VASP (or store it for non-VASP beneficiaries).

Screen transactions for sanctions compliance and suspicious activity.

Respond to requests for information from competent authorities.

Administrative Fines: Significant monetary penalties for legal entities and responsible persons within those entities.

Revocation of Licenses: Suspension or permanent revocation of operating licenses for VASPs.

Criminal Charges: In cases of severe or intentional non-compliance, particularly where money laundering or terrorism financing is involved, criminal charges can be brought against individuals and corporate officers.

Financial Intelligence Unit (FIU) of Montenegro (Uprava za sprečavanje pranja novca i finansiranja terorizma - USPNFT): This is the main supervisory body for AML/CFT compliance, including for VASPs. Their website may contain guidance.

MONEYVAL Follow-Up Report (May 2023): This report by Moneyval (Council of Europe anti-money laundering body) provides a detailed assessment of Montenegro's compliance with FATF Recommendations. It explicitly states Montenegro's compliance with Recommendation 15 (Virtual Assets and VASPs) and the implementation of the Travel Rule.

Entity Targeted: Do Kwon (and his associate Hon Chang Joon). Violation Type (Montenegro Specific): Forgery of documents (using fake Costa Rican and Belgian passports for illegal entry and travel).

Do Kwon and his associate were convicted in Montenegro for using forged passports and served their sentences.