Crypto ATM / kiosk operator in Papua New Guinea

Currently, neither a specific registration nor a licensing regime exists for VASPs.

Anticipated Future: Based on FATF recommendations, it is highly probable that PNG will eventually adopt a licensing regime for VASPs. The FATF standards recommend that VASPs be licensed or registered, and subject to effective systems for monitoring and ensuring compliance with AML/CTF requirements. Licensing typically implies a more rigorous pre-approval process and ongoing supervision than simple registration.

AML/KYC (Anti-Money Laundering / Know Your Customer): This is the most certain requirement. Future regulations will mandate VASPs to:

Identify and verify customers (KYC).

Conduct ongoing customer due diligence.

Monitor transactions for suspicious activity.

Report suspicious transactions to FASU.

Implement robust risk-based AML/CTF programs.

Adhere to the "travel rule" for VA transfers, requiring information sharing between VASPs.

Local Presence: For foreign entities, a local physical presence, a local board of directors, or a local registered company structure is often a requirement for financial licenses.

Consumer Protection: Rules around disclosures, clear terms of service, dispute resolution mechanisms, and safeguarding of client assets.

Bank of Papua New Guinea (BPNG): BPNG has previously issued warnings to the public regarding the risks associated with cryptocurrencies, including volatility, lack of consumer protection, and potential use for illicit activities. These warnings do not constitute a regulatory framework but indicate a cautious approach.

Anti-Money Laundering and Counter Terrorist Financing Act 2015 (AML/CTF Act 2015): This Act provides the legal basis for identifying, freezing, and confiscating assets related to money laundering and terrorist financing. It obligates financial institutions and designated non-financial businesses and professions (DNFBPs) to implement AML/CTF measures. While it pre-dates specific crypto regulation, its broad definitions and principles are applied to virtual asset activities where deemed appropriate by regulators.

Obligations for VASPs (or entities providing similar services):

Designated Person/Entity Screening: VASPs must screen their customers (both at onboarding and on an ongoing basis) against the UN Consolidated Sanctions List, which includes individuals and entities designated under various UN sanctions regimes (e.g., terrorism, proliferation, specific country regimes).

Asset Freezing: If a VASP identifies that it holds assets (including virtual assets) belonging to a designated person or entity, it must immediately freeze those assets and report the match to FASU.

Prohibition on Dealing: VASPs are prohibited from making funds or economic resources available to, or for the benefit of, designated persons or entities.

Suspicious Transaction Reporting (STR): Any transaction involving designated persons, or transactions suspected of being related to money laundering or terrorist financing, must be reported to FASU.

Extraterritorial Reach: OFAC and EU sanctions can have extraterritorial effects, particularly if transactions involve:

Correspondent Banking Relationships: PNG financial institutions (and potentially VASPs dealing with them) rely on correspondent banking relationships with US and European banks, which impose their own OFAC/EU compliance requirements.

Bank of Papua New Guinea - Public Notice on Digital Currencies, Virtual Assets and Cryptocurrencies (PDF)

PNG Central Bank: A cautious approach towards cryptocurrency - The PNG Bulletin (Refers to BPNG's ongoing stance in 2022)

Legal Basis: The AML/CTF Act 2015 mandates compliance with international obligations, including UN sanctions. FASU, under this Act, is responsible for disseminating UN sanctions lists to reporting entities and overseeing compliance.