Custodial wallet / SaaS in Marshall Islands

Define "digital assets" and "virtual asset service providers" (VASPs).

Establish a licensing regime for VASPs.

Impose Anti-Money Laundering (AML) and Counter-Financing of Terrorism (CFT) obligations on VASPs.

Empower the MIIFSA to regulate and supervise the virtual asset sector.

Custody Providers (Virtual Asset Custody Wallets): Safekeeping or administration of virtual assets or instruments enabling control over virtual assets on behalf of others.

Legal Entity: The applicant must be a properly incorporated legal entity in the Marshall Islands (e.g., an International Business Company or similar).

The Digital Assets Act generally requires VASPs to maintain adequate capital commensurate with the nature, scale, and complexity of their operations and the risks they undertake.

Specific minimum capital thresholds are typically set out in subsidiary regulations issued by the MIIFSA. These are designed to ensure financial stability and protect consumers. You would need to consult the latest MIIFSA guidance for exact figures.

This is a cornerstone requirement. VASPs must implement robust Anti-Money Laundering (AML) and Know Your Customer (KYC) policies and procedures.

These must align with the Marshall Islands Anti-Money Laundering and Counter-Financing of Terrorism Act and international FATF standards.

Customer due diligence (CDD) and enhanced CDD (EDD) for higher-risk clients.

Ongoing monitoring of transactions.

Reporting of suspicious transactions (STRs) to the Financial Intelligence Unit (FIU).

Appointment of a qualified Compliance Officer and a Money Laundering Reporting Officer (MLRO).

A registered office in the Marshall Islands.

A registered agent who is authorized to act on behalf of the company.

Potentially, a requirement for local management or key personnel, or at least clear lines of communication and control demonstrable to MIIFSA. The degree of local operational presence can depend on the scale and nature of the proposed activities.

Fit and Proper Persons: All directors, senior management, shareholders, and beneficial owners must undergo a "fit and proper" assessment. This includes background checks for criminal records, financial solvency, and professional competence.

Technology & Security: Robust cybersecurity frameworks, data protection measures, and secure operational procedures are essential to protect virtual assets and customer data. This includes audit trails, disaster recovery plans, and business continuity plans.

Anti-Money Laundering and Counter-Terrorism Financing Act 2018 (AML/CTF Act 2018): This Act forms the cornerstone of the RMI's regulatory regime. It mandates financial institutions, including VASPs, to implement robust AML/CTF programs, which explicitly cover sanctions compliance.

Financial Intelligence Unit Act 2006 (as amended): Establishes the RMI Financial Intelligence Unit (FIU), which is the primary body responsible for receiving, analyzing, and disseminating financial intelligence related to money laundering, terrorism financing, and other serious offenses, including sanctions violations.

UN Sanctions Compliance:

As a member state of the United Nations, the RMI is obligated to implement sanctions resolutions passed by the UN Security Council (UNSC).

The AML/CTF Act 2018 explicitly mandates compliance with UN sanctions. This means VASPs must screen against the UNSC Consolidated List, which includes individuals and entities designated under various UN sanctions regimes (e.g., related to terrorism, proliferation, specific countries like North Korea, Iran, etc.).

VASPs must freeze assets of sanctioned individuals/entities and report such findings to the FIU.

OFAC Sanctions Compliance:

Practical Necessity: Any VASP transacting in USD, dealing with US persons or entities, or having any nexus to the US financial system (e.g., through correspondent banking relationships, cloud providers, software vendors) must comply with OFAC sanctions to avoid secondary sanctions or blocking by US financial institutions.

EU Sanctions Compliance:

Screen against the following lists at a minimum:

UN Security Council Consolidated List: This list includes individuals and entities subject to asset freezes, travel bans, and arms embargoes imposed by the UN.

OFAC Specially Designated Nationals and Blocked Persons (SDN) List: This is the primary list for US sanctions. VASPs should also be aware of other OFAC lists (e.g., Sectoral Sanctions Identifications List, Foreign Sanctions Evaders List).

EU Consolidated List of persons, groups and entities subject to EU financial sanctions:

Limited Public Enforcement Record: The Marshall Islands is a smaller jurisdiction. While it has laws related to financial activities and anti-money laundering (AML) / combating the financing of terrorism (CFT), and has even explored innovative digital asset legislation (like the controversial Digital Assets Act of 2018 to create a sovereign digital currency, the SOV, which has largely stalled due to international pressure), its financial regulatory bodies do not have a robust public record of enforcement actions, particularly for complex and high-profile cryptocurrency cases, in the same way major financial hubs (like the US, UK, or EU) do.

Role as a Corporate Registry: Many cryptocurrency companies choose to incorporate in the Marshall Islands due to its flexible corporate registry (the Marshall Islands Trust Company Complex, or RMI-TCC). However, their primary operations and therefore primary regulatory oversight and enforcement actions often come from the jurisdictions where they primarily conduct business or where their customers are located, rather than from the RMI itself. For example, a company registered in RMI might face enforcement from the U.S. SEC or DOJ for activities impacting U.S. persons.

Office of the Banking Commissioner (OBC): Responsible for regulating financial institutions.

Financial Intelligence Unit (FIU): Deals with AML/CFT matters and suspicious transaction reports. They would investigate financial crimes, but their enforcement actions are typically less public than those of a securities regulator.