Custodial wallet / SaaS in Malawi
Hosted wallet provider that holds keys on behalf of end users, often white-labeled to businesses (custody as a service).
Custodial SaaS is conditionally permitted in Malawi with a local entity, subject to AML obligations and medium licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- Medium
- Last updated
- 2026-07-13
AML Obligations
- Any entity operating as a VASP (including custodial wallet/SaaS providers) must comply with Malawi's general AML/CFT laws, namely the Proceeds of Serious Crime and Money Laundering Act, 2006 (as amended).
- AML/CFT registration with the Financial Intelligence Authority (FIA) Malawi is expected, though not under a specific VASP license regime.
- Customer due diligence (CDD/KYC) obligations arise under the general AML framework — applicable to any entity handling funds or virtual assets.
- Suspicious transaction reporting (STRs) to the FIA Malawi is required where there are suspicions of money laundering or terrorist financing.
- Malawi, through ESAAMLG, is subject to FATF Recommendation 15 on Virtual Assets and VASPs, pushing toward registration/licensing for AML purposes.
- No specific crypto-AML threshold is defined; general AML obligations apply to all relevant activities.
Key Restrictions
- Virtual assets are not recognized as legal tender in Malawi.
- No specific VASP or custody license exists — the regulatory framework is limited to general AML/CFT obligations and company registration.
- The Virtual Assets Service Providers (VASP) Bill was passed by the National Assembly in late 2023 but is not yet fully implemented/operationalized.
- Any company generating revenue in Malawi must be registered as a local entity or branch of a foreign company under Malawi's company laws.
- No specific segregation, insurance, cold-storage, or proof-of-reserves rules exist for digital asset custodians.
Key Risks
- Regulatory ambiguity: no dedicated VASP licensing regime means the legal status of custodial wallet/SaaS operations is a grey area.
- Enforcement risk: the RBM has consistently warned against crypto and may take action if it deems activities to be unregulated financial services.
- Transition risk: the VASP Bill, once operationalized, could impose new licensing, capital, and custody requirements — operators may need to restructure.
- Reputational risk: public advisories from the RBM discourage crypto use, creating negative PR exposure.
- No consumer protection or asset segregation rules mean custodial liability and user loss risk are unmediated by regulation.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Absence of Dedicated VASP Legislation:
There is currently no specific law or regulation in Malawi that defines "virtual assets" or "virtual asset service providers" (VASPs) for the purpose of licensing or registration.
This means there are no specific licenses for crypto exchanges, custody providers, or crypto-focused payment processors.
Custody Providers: Similar to exchanges, there are no specific licenses for providing crypto custody services.
Non-Recognition: Virtual assets are not recognized as legal tender or regulated financial instruments.
No Licensing/Supervision: There is no regulatory body licensing or supervising virtual asset service providers (VASPs) or crypto exchanges.
AML/KYC (Anti-Money Laundering/Know Your Customer):
While there are no crypto-specific AML/KYC regulations, Malawi has a robust general AML/CFT framework. The Financial Intelligence Unit (FIU) Malawi is the primary authority for AML/CFT.
Key Law: The Proceeds of Serious Crime and Money Laundering Act, 2006 (as amended). This act establishes the general framework for combating money laundering and terrorist financing.
Financial Intelligence Unit (FIU) Malawi Official Website: http://fiu.mw/ (Here you can find their reports, advisories, and the relevant legislation.)
Local Presence: N/A for crypto-specific licensing. However, any company operating and generating revenue in Malawi is generally required to be registered as a local entity or a branch of a foreign company under Malawi's company laws.
Custodial License Requirements:
There is no specific "custodial license" for digital assets in Malawi.
Any entity operating as a Virtual Asset Service Provider (VASP), which would include services like exchange, transfer, and safekeeping/administration of virtual assets (i.e., custody), would fall under the purview of Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT) laws.
The Financial Intelligence Authority (FIA) Malawi is the primary body responsible for AML/CFT supervision. While they may require registration and compliance with AML/CFT obligations for VASPs, this is not a specific "custody license" but rather an AML/CFT registration. The RBM has not indicated it issues licenses for crypto businesses.
FATF Recommendations: Malawi, through ESAAMLG, is subject to FATF recommendations, including Recommendation 15 on Virtual Assets and VASPs. This recommendation pushes for countries to license or register VASPs for AML/CFT purposes.
Segregation of Client Assets Rules:
There are no specific regulations in Malawi mandating the segregation of client digital assets from the custodian's proprietary assets.
There are no specific insurance or bonding requirements for digital asset custodians in Malawi.
Cold Storage Mandates:
There are no specific mandates for cold storage of digital assets by custodians. Operational security best practices would still dictate its use, but it's not a regulatory requirement.
Qualified Custodian Definitions:
There is no specific legal or regulatory definition of a "qualified custodian" for digital assets in Malawi.
Emerging Regulatory Framework: Malawi has been working towards establishing a regulatory framework for virtual assets. In late 2023, the National Assembly passed the Virtual Assets Service Providers (VASP) Bill. This bill aims to regulate virtual assets and virtual asset service providers, bringing them under the supervision of the Financial Intelligence Authority (FIA) and potentially the Reserve Bank of Malawi in the future.
"Malawi Passes Virtual Assets Service Providers Bill to Regulate Crypto Market" (November 2023) - This indicates future potential for enforcement, but actual enforcement actions under this new law would typically follow its full implementation and operationalization.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — custodial wallet / SaaS operations exist in a legal grey area with no dedicated VASP licensing regime, but must comply with general AML/CFT obligations under the Proceeds of Serious Crime and Money Laundering Act (FIA Malawi supervision), register as a local company, and monitor the pending VASP Bill (passed late 2023, not yet fully operational).
Questions this verdict aims to answer
- What custody license / qualified-custodian status applies?
- What segregation, insurance, and proof-of-reserves rules apply?
- What AML obligations attach to the SaaS vs the white-label client?