Centralized exchange in Marshall Islands

Define "digital assets" and "virtual asset service providers" (VASPs).

Establish a licensing regime for VASPs.

Impose Anti-Money Laundering (AML) and Counter-Financing of Terrorism (CFT) obligations on VASPs.

Empower the MIIFSA to regulate and supervise the virtual asset sector.

Exchanges (Virtual Asset Trading Platforms): Providing services for the exchange between virtual assets and fiat currencies, or between one or more forms of virtual assets.

Custody Providers (Virtual Asset Custody Wallets): Safekeeping or administration of virtual assets or instruments enabling control over virtual assets on behalf of others.

Legal Entity: The applicant must be a properly incorporated legal entity in the Marshall Islands (e.g., an International Business Company or similar).

The Digital Assets Act generally requires VASPs to maintain adequate capital commensurate with the nature, scale, and complexity of their operations and the risks they undertake.

Specific minimum capital thresholds are typically set out in subsidiary regulations issued by the MIIFSA. These are designed to ensure financial stability and protect consumers. You would need to consult the latest MIIFSA guidance for exact figures.

This is a cornerstone requirement. VASPs must implement robust Anti-Money Laundering (AML) and Know Your Customer (KYC) policies and procedures.

These must align with the Marshall Islands Anti-Money Laundering and Counter-Financing of Terrorism Act and international FATF standards.

Customer due diligence (CDD) and enhanced CDD (EDD) for higher-risk clients.

Ongoing monitoring of transactions.

Reporting of suspicious transactions (STRs) to the Financial Intelligence Unit (FIU).

Appointment of a qualified Compliance Officer and a Money Laundering Reporting Officer (MLRO).

A registered office in the Marshall Islands.

A registered agent who is authorized to act on behalf of the company.

Potentially, a requirement for local management or key personnel, or at least clear lines of communication and control demonstrable to MIIFSA. The degree of local operational presence can depend on the scale and nature of the proposed activities.

Fit and Proper Persons: All directors, senior management, shareholders, and beneficial owners must undergo a "fit and proper" assessment. This includes background checks for criminal records, financial solvency, and professional competence.

Technology & Security: Robust cybersecurity frameworks, data protection measures, and secure operational procedures are essential to protect virtual assets and customer data. This includes audit trails, disaster recovery plans, and business continuity plans.

Anti-Money Laundering and Counter-Terrorism Financing Act 2018 (AML/CTF Act 2018): This Act forms the cornerstone of the RMI's regulatory regime. It mandates financial institutions, including VASPs, to implement robust AML/CTF programs, which explicitly cover sanctions compliance.

Financial Intelligence Unit Act 2006 (as amended): Establishes the RMI Financial Intelligence Unit (FIU), which is the primary body responsible for receiving, analyzing, and disseminating financial intelligence related to money laundering, terrorism financing, and other serious offenses, including sanctions violations.

UN Sanctions Compliance:

The AML/CTF Act 2018 explicitly mandates compliance with UN sanctions. This means VASPs must screen against the UNSC Consolidated List, which includes individuals and entities designated under various UN sanctions regimes (e.g., related to terrorism, proliferation, specific countries like North Korea, Iran, etc.).

VASPs must freeze assets of sanctioned individuals/entities and report such findings to the FIU.

OFAC Sanctions Compliance:

Practical Necessity: Any VASP transacting in USD, dealing with US persons or entities, or having any nexus to the US financial system (e.g., through correspondent banking relationships, cloud providers, software vendors) must comply with OFAC sanctions to avoid secondary sanctions or blocking by US financial institutions.

Develop and implement a risk-based sanctions screening program. This involves screening all customers (at onboarding and ongoing), beneficial owners, and transactions against relevant sanctions lists.

Screen against the following lists at a minimum:

UN Security Council Consolidated List: This list includes individuals and entities subject to asset freezes, travel bans, and arms embargoes imposed by the UN.

OFAC Specially Designated Nationals and Blocked Persons (SDN) List: This is the primary list for US sanctions. VASPs should also be aware of other OFAC lists (e.g., Sectoral Sanctions Identifications List, Foreign Sanctions Evaders List).

EU Consolidated List of persons, groups and entities subject to EU financial sanctions:

Establish policies and procedures for identifying, reporting, and freezing assets related to sanctioned individuals or entities, and for rejecting or blocking prohibited transactions.

Adopted: Yes, the Marshall Islands has enacted specific legislation to regulate Virtual Asset Service Providers (VASPs) and incorporate FATF AML/CFT standards, including the Travel Rule.

Financial Services Authority (Virtual Asset Service Providers) Act 2022: This Act establishes the regulatory framework for VASPs, requiring them to be licensed and subject to AML/CFT obligations. It explicitly addresses the Travel Rule requirements.

Anti-Money Laundering and Countering the Financing of Terrorism Act 2019: This is the overarching AML/CFT law that applies to all reporting entities, including VASPs under the new framework.

Effective Date: The Virtual Asset Service Providers Act 2022 was assented to on September 26, 2022, and became effective on October 1, 2022, for licensing purposes. The AML/CFT obligations, including the Travel Rule, would have become applicable to licensed VASPs from that date or as regulations/guidance are issued.

The Virtual Asset Service Providers Act 2022, particularly Section 20 ("Transfer of virtual assets"), states that a VASP must "collect and retain the required originator and beneficiary information... in accordance with the FATF Recommendations and any applicable regulations issued by the Authority."

US$1,000 (or €1,000) for cross-border transfers.

US$3,000 (or €3,000) for domestic transfers.

Section 20 of the VASP Act 2022 mandates that a VASP must:

"collect and retain the required originator and beneficiary information in respect of any transfer of virtual assets, regardless of the value of the transfer..." (subject to the thresholds mentioned above as per FATF recommendations).

"provide the required originator and beneficiary information to the beneficiary VASP, if any."

Virtual Asset Service Providers Act 2022:

Section 28 (Offences): A VASP or person who fails to comply with any provision of the Act (e.g., licensing requirements, AML/CFT obligations including the Travel Rule) commits an offence.

Individuals: Liable on conviction to a fine not exceeding US$250,000 or imprisonment for a term not exceeding 5 years, or both.

Legal Persons (Companies): Liable on conviction to a fine not exceeding US$1,000,000.

Limited Public Enforcement Record: The Marshall Islands is a smaller jurisdiction. While it has laws related to financial activities and anti-money laundering (AML) / combating the financing of terrorism (CFT), and has even explored innovative digital asset legislation (like the controversial Digital Assets Act of 2018 to create a sovereign digital currency, the SOV, which has largely stalled due to international pressure), its financial regulatory bodies do not have a robust public record of enforcement actions, particularly for complex and high-profile cryptocurrency cases, in the same way major financial hubs (like the US, UK, or EU) do.

Role as a Corporate Registry: Many cryptocurrency companies choose to incorporate in the Marshall Islands due to its flexible corporate registry (the Marshall Islands Trust Company Complex, or RMI-TCC). However, their primary operations and therefore primary regulatory oversight and enforcement actions often come from the jurisdictions where they primarily conduct business or where their customers are located, rather than from the RMI itself. For example, a company registered in RMI might face enforcement from the U.S. SEC or DOJ for activities impacting U.S. persons.

Relevant Regulatory Bodies (without specific public crypto enforcement actions):

Office of the Banking Commissioner (OBC): Responsible for regulating financial institutions.

Financial Intelligence Unit (FIU): Deals with AML/CFT matters and suspicious transaction reports. They would investigate financial crimes, but their enforcement actions are typically less public than those of a securities regulator.

Marshall Islands Trust Company Complex (RMI-TCC): While not a financial regulator in the traditional sense, it manages the corporate registry and could delist companies for non-compliance with corporate laws.

Marshall Islands Financial Intelligence Unit (FIU):