Custodial wallet / SaaS in Mongolia

Partial but Evolving: Mongolia has moved from an unregulated state to establishing a foundational legal framework for virtual assets, specifically targeting Virtual Asset Service Providers (VASPs). The focus is heavily on AML/CFT compliance, risk management, and consumer protection through licensing. It's considered "partial" as it primarily regulates the service providers rather than attempting to regulate every facet of virtual assets or underlying technologies comprehensively at this stage.

Financial Regulatory Commission (FRC) of Mongolia:

Law on Regulation of Virtual Asset Service Providers (VASPs)

Date: Enacted on December 17, 2021 (effective from January 1, 2022).

Purpose: This law establishes the legal framework for the regulation of virtual assets and VASPs in Mongolia. Key provisions include:

Definition of VASP Activities: Outlines the services requiring a license, such as exchange between virtual assets and fiat currencies, exchange between one or more forms of virtual assets, transfer of virtual assets, safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets, and participation in and provision of financial services related to an issuer’s offer and/or sale of a virtual asset.

Licensing Requirements: Mandates that all entities providing VASP services must obtain a license from the FRC.

AML/CFT Compliance: Imposes strict AML/CFT obligations on licensed VASPs, including Know Your Customer (KYC) procedures, transaction monitoring, record-keeping, and suspicious transaction reporting to the FIU.

Risk Management: Requires VASPs to implement robust risk management systems, cybersecurity measures, and capital adequacy requirements.

Permitted but Regulated: Crypto trading and the operation of cryptocurrency exchanges are legal in Mongolia, provided they are conducted by entities that have obtained a license from the Financial Regulatory Commission (FRC).

Licensing is Mandatory: Any entity wishing to operate as a Virtual Asset Service Provider (VASP) – including crypto exchanges, custodial services, or providers facilitating virtual asset transfers – must go through a rigorous licensing process with the FRC.

Strict AML/CFT Compliance: Licensed exchanges and VASPs are subject to strict AML/CFT requirements, including:

Law on Combating Money Laundering and Terrorism Financing (LMLCFT): This is the main AML/CFT law in Mongolia, originally adopted in 2013 and subsequently amended (e.g., in 2018 and 2021) to incorporate FATF recommendations, including those related to virtual assets. It establishes the legal framework for identifying, freezing, and confiscating assets obtained from criminal activities, as well as preventing the financing of terrorism.

Financial Regulatory Commission (FRC) Resolutions and Regulations: The FRC is the primary regulator for non-banking financial services, including VASPs. They issue specific regulations, resolutions, and licensing requirements that detail how the LMLCFT applies to virtual asset businesses.

Identification and Verification (ID&V):

For Individuals: Obtain and verify the client's full name, date of birth, place of birth, nationality, permanent address, and unique identification number (e.g., national ID card number, passport number). Verification must be done using reliable, independent source documents, data, or information.

For Legal Entities: Obtain and verify the entity's legal name, legal form, registration number, address of registered office, and names of directors/partners. Understand the entity's ownership and control structure.

Beneficial Ownership (BO): Identify and verify the identity of the natural persons who ultimately own or control the customer, as well as the natural persons on whose behalf a transaction is being conducted. For legal entities, this typically involves identifying individuals owning 25% or more of the shares or voting rights, or otherwise exercising control.

Purpose and Nature of the Business Relationship: Understand the purpose and intended nature of the business relationship or transaction. This helps assess the risk profile of the customer.

Ongoing Monitoring: Continuously monitor the business relationship and transactions undertaken by the customer to ensure they are consistent with the VASP's knowledge of the customer, their business, and risk profile. This includes:

Scrutinizing transactions for unusual or suspicious patterns.

Keeping customer due diligence data up-to-date.

Risk-Based Approach: Implement policies and procedures to identify, assess, and understand the money laundering and terrorism financing (ML/TF) risks posed by customers, products, services, transactions, and delivery channels.

Enhanced Due Diligence (EDD): Apply EDD measures for higher-risk customers (e.g., politically exposed persons - PEPs, customers from high-risk jurisdictions, complex structures) and transactions. This may involve obtaining additional information on the customer, sources of funds/wealth, and the reasons for the intended transactions.

Screening: Screen customers against national and international sanctions lists (e.g., UN Security Council sanctions) and internal watchlists.

Reporting Threshold: Report any transaction (regardless of amount) or attempted transaction that the VASP knows, suspects, or has reasonable grounds to suspect is related to money laundering or terrorism financing.

Reporting Body: All STRs must be submitted to the Financial Information Unit (FIU) of Mongolia.

Timing: Reports must be filed promptly, without undue delay, typically within a few working days of forming a suspicion.

No Tipping-Off: VASPs and their employees are prohibited from disclosing to the customer or any third party that a report has been or will be made (i.e., "tipping-off").

CDD Records: All documents and data obtained through the CDD process (e.g., copies of identification documents, beneficial ownership information).

Transaction Records: Records of all virtual asset transactions, including amounts, types of virtual assets, sender and receiver addresses, timestamps, and any relevant metadata.

Analysis Records: Records of any internal inquiries, risk assessments, and the rationale behind decisions regarding customer risk categorization or suspicious activity.

STRs and Communications: Copies of all submitted STRs and any related communications with the FIU or other authorities.

Legal Basis: The implementation of UNSC resolutions is typically embedded in a country's national Anti-Money Laundering/Combating the Financing of Terrorism (AML/CFT) laws.

Legal Basis: Penalties would be outlined in the Law on Combating Money Laundering and Terrorism Financing and the Mongolian Criminal Code.