Remote VASP serving residents in Oman
Foreign-incorporated entity that offers exchange, custody, or transfer services to residents of a jurisdiction without establishing a local entity or office.
Remote VASP is conditionally permitted in Oman with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- CDD/ID&V obligations under Royal Decree No. 30/2016 and Ministerial Decision No. 63/2016 (collect identifying information, verify using reliable independent documents)
- Beneficial ownership identification (natural persons owning 25%+ or otherwise controlling the customer)
- Ongoing transaction monitoring and record-keeping for consistency with customer profile
- PEP screening and Enhanced Due Diligence (EDD) for PEPs, including senior management approval
- Sanctions screening against national and international lists (UN, OFAC)
- EDD for higher-risk categories (non-face-to-face, complex structures, high-value transactions, cross-border correspondent virtual asset relationships, high-risk jurisdictions)
- Suspicious Transaction Report (STR) filing obligation to Oman Financial Intelligence Unit (OMAFIU) when funds are suspected to be proceeds of crime or related to terrorism financing
- No tipping-off prohibition regarding STR submissions
- Record-keeping: transaction records, CDD records, and communication records must be maintained
Key Restrictions
- Must be licensed by the Capital Market Authority (CMA) under the 2023 Virtual Assets Regulatory Framework — a foreign entity cannot serve Omani residents without a CMA license
- CBO has issued prohibitory warnings against crypto activities for financial institutions under its supervision, effectively barring traditional banking channels for crypto services
- No specific licensing regime for non-CMA-regulated entities — the CMA framework is the only pathway for VASPs
- Local entity incorporation is effectively required to obtain a CMA license and submit to its supervision
Key Risks
- CBO warnings create uncertainty about banking access — even licensed VASPs may struggle to access regulated banking relationships
- Enforcement risk is elevated for unlicensed remote operators: the CMA framework establishes a legal basis for enforcement actions against non-compliant VASPs
- Regulatory ambiguity remains because the CMA framework is recent (Nov 2023) and not yet tested through enforcement actions
- FATF Recommendation 15 compliance pressure means Oman is expected to actively pursue unlicensed VASPs serving residents
- No grandfathering or transitional provisions are publicly known for existing remote operators
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Capital Market Authority (CMA) Virtual Assets Regulatory Framework (2023): The CMA issued a comprehensive regulatory framework for virtual assets in July 2023. This framework aims to regulate the activities of VASPs, including issuance, listing, and trading of virtual assets, ensuring compliance with international AML/CFT standards. It covers licensing requirements, corporate governance, market conduct, and crucial for this discussion, AML/CFT obligations.
Central Bank of Oman (CBO): The CBO has previously issued warnings regarding the risks of virtual currencies. However, in parallel with the CMA, it has also been working on developing its own regulatory framework for digital assets, particularly concerning digital currencies and payments.
Royal Decree No. 30/2016 on Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT Law), amended by Royal Decree No. 112/2020: This is the foundational law for AML/CFT in Oman. While it predates explicit crypto regulations, its broad definitions of "funds," "financial institutions," and "financial activities" are intended to encompass new technologies and virtual assets once they fall under a regulated scope. VASPs, once licensed, will be designated as financial institutions or designated non-financial businesses and professions (DNFBPs) under this law.
Oman's Adherence to FATF Standards: Oman is a member of the Middle East and North Africa Financial Action Task Force (MENAFATF) and is committed to implementing the recommendations of the Financial Action Task Force (FATF). FATF Recommendation 15 specifically addresses new technologies, urging countries to regulate and supervise VASPs for AML/CFT purposes, including sanctions compliance.
Royal Decree No. 30/2016 (Law on Combating Money Laundering and Terrorism Financing): This is the foundational AML/CFT law in Oman, outlining the obligations for financial institutions and designated non-financial businesses and professions (DNFBPs).
Ministerial Decision No. 63/2016 (Implementing Regulations of the Law on Combating Money Laundering and Terrorism Financing): This decision provides detailed regulations and guidelines for implementing Royal Decree 30/2016.
Identification and Verification (ID&V) of Customers:
Beneficial Ownership Identification:
Politically Exposed Persons (PEPs):
Obligation to Report: If a VASP knows, suspects, or has reasonable grounds to suspect that funds are proceeds of a criminal activity or are related to terrorism financing, it must promptly file a Suspicious Transaction Report (STR) with the Oman Financial Intelligence Unit (OMAFIU).
No Tipping-Off: VASPs and their employees are prohibited from disclosing to the customer or any third party that an STR is being, or has been, submitted, or that an investigation is being conducted.
CBO Warnings against Crypto (Ongoing/Recurring)
CMA Issuance of Virtual Asset Regulatory Framework
Outcome: Establishes a comprehensive legal and regulatory environment for virtual assets in Oman, paving the way for licensed crypto activities and, importantly, future enforcement actions against non-compliant entities. This is a move towards legitimization under strict control.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a remote VASP serving Omani residents must obtain a CMA license under the 2023 Virtual Assets Regulatory Framework (requiring local presence), comply with full AML/CFT obligations under Royal Decree 30/2016, and navigate CBO banking restrictions; unlicensed remote service carries material enforcement risk.
Questions this verdict aims to answer
- May a non-resident provider serve residents from abroad?
- Does cross-border service trigger licensing, registration, or AML obligations?
- What enforcement risk exists for unlicensed remote operators?