Remote VASP serving residents in Papua New Guinea
Foreign-incorporated entity that offers exchange, custody, or transfer services to residents of a jurisdiction without establishing a local entity or office.
Remote VASP is conditionally permitted in Papua New Guinea without local incorporation, subject to AML obligations and medium licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- No
- Licensing burden
- Medium
- Last updated
- 2026-07-13
AML Obligations
- No explicit AML obligations currently — VASPs are not designated as 'reporting entities' under the AML/CTF Act 2015 (pg.travel-rule.none-explicitly-as-reporting-entities; pg.travel-rule.consequently-vasps-are-not-explicitly)
- Once the anticipated regulatory framework is adopted, VASPs will be required to: identify and verify customers (KYC) (pg.licensing.identify-and-verify-customers-kyc), conduct ongoing customer due diligence (pg.licensing.conduct-ongoing-customer-due-diligence), monitor transactions for suspicious activity (pg.licensing.monitor-transactions-for-suspicious-activity), report suspicious transactions to FASU (pg.licensing.report-suspicious-transactions-to-fasu), implement risk-based AML/CTF programs (pg.licensing.implement-robust-risk-based-amlctf-programs), and adhere to the FATF Travel Rule for VA transfers (pg.licensing.adhere-to-the-travel-rule)
- Designated person/entity screening against UN Consolidated Sanctions List required upon onboarding and ongoing basis (pg.aml.designated-personentity-screening-vasps-must)
- Asset freezing obligations if VA held for a designated person/entity, with immediate report to FASU (pg.aml.asset-freezing-if-a-vasp)
- Suspicious Transaction Reporting (STR) to FASU for any transactions involving designated persons or suspected ML/TF (pg.aml.suspicious-transaction-reporting-str-any)
- De facto OFAC/EU sanctions screening obligations if transactions involve US persons, US dollar clearing, US-origin technology, or EU persons/entities (pg.aml.extraterritorial-reach-ofac-and-eu; pg.aml.correspondent-banking-relationships-png-financial)
Key Restrictions
- No existing VASP licensing or registration regime — the regulatory framework is entirely anticipated, not yet in force (pg.licensing.currently-neither-a-specific-registration)
- Cryptocurrencies are not legal tender in PNG, per BPNG public warning (pg.enforcement.outcome-the-bpng-clarified-that)
- Cross-border service to PNG residents from abroad falls into a regulatory gap — no specific license exists to obtain, meaning the operator cannot become 'licensed' even if it wanted to (pg.licensing.cryptocurrency-exchanges-would-fall-into; pg.licensing.custody-providers-similarly-no-specific)
- Future licensing will likely require local presence, a local board, or a local registered company structure for foreign entities (pg.licensing.local-presence-for-foreign-entities)
- FATF standards strongly imply VASPs should be regulated, and the APG MER identified PNG's lack of VASP coverage as a significant deficiency — regulatory change is expected but timing is uncertain (pg.licensing.anticipated-future-based-on-fatf; pg.travel-rule.the-apg-mer-specifically-notes)
Key Risks
- Regulatory ambiguity risk: no current regime means the operator cannot become compliant, but BPNG public warnings create enforcement exposure for operating in the gap (pg.enforcement.statements-are-often-general-and; pg.enforcement.outcome-the-bpng-clarified-that)
- Reputational and de-risking risk: PNG financial institutions rely on US/EU correspondent banking, which may impose sanctions/AML compliance requirements on VASPs (pg.aml.correspondent-banking-relationships-png-financial; pg.aml.reputational-risk-failing-to-comply)
- Once a future licensing regime is enacted, unlicensed operators serving PNG residents may face retroactive enforcement, fines, or orders to cease (pg.travel-rule.once-vasps-are-brought-under)
- Consumer protection warnings from BPNG create PR exposure — public is warned that losses from crypto transactions are not protected by PNG law (pg.enforcement.outcome-the-bpng-clarified-that)
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Currently, neither a specific registration nor a licensing regime exists for VASPs.
Anticipated Future: Based on FATF recommendations, it is highly probable that PNG will eventually adopt a licensing regime for VASPs. The FATF standards recommend that VASPs be licensed or registered, and subject to effective systems for monitoring and ensuring compliance with AML/CTF requirements. Licensing typically implies a more rigorous pre-approval process and ongoing supervision than simple registration.
Local Presence: For foreign entities, a local physical presence, a local board of directors, or a local registered company structure is often a requirement for financial licenses.
Identify and verify customers (KYC).
Conduct ongoing customer due diligence.
Monitor transactions for suspicious activity.
Report suspicious transactions to FASU.
Implement robust risk-based AML/CTF programs.
Adhere to the "travel rule" for VA transfers, requiring information sharing between VASPs.
Cryptocurrency Exchanges: Would fall into this gap. If a business sought to offer traditional securities exchange services, it would require licenses under the Securities Commission of Papua New Guinea (if established for this purpose) or relevant financial market laws. However, crypto assets are not typically classified as securities under existing PNG law.
Custody Providers: Similarly, no specific license for crypto custody. Traditional trust or financial services licenses might be considered, but these are not designed for digital assets.
Designated Person/Entity Screening: VASPs must screen their customers (both at onboarding and on an ongoing basis) against the UN Consolidated Sanctions List, which includes individuals and entities designated under various UN sanctions regimes (e.g., terrorism, proliferation, specific country regimes).
Asset Freezing: If a VASP identifies that it holds assets (including virtual assets) belonging to a designated person or entity, it must immediately freeze those assets and report the match to FASU.
Suspicious Transaction Reporting (STR): Any transaction involving designated persons, or transactions suspected of being related to money laundering or terrorist financing, must be reported to FASU.
Extraterritorial Reach: OFAC and EU sanctions can have extraterritorial effects, particularly if transactions involve:
Correspondent Banking Relationships: PNG financial institutions (and potentially VASPs dealing with them) rely on correspondent banking relationships with US and European banks, which impose their own OFAC/EU compliance requirements.
Reputational Risk: Failing to comply with major international sanctions regimes like OFAC or EU can lead to severe reputational damage, de-risking by international partners, and exclusion from global financial systems.
None explicitly as reporting entities under the current AML/CTF Act 2015.
Consequently, VASPs are not explicitly designated as "reporting entities" or "financial institutions" under the current AML/CTF framework. This means they are generally not subject to AML/CTF obligations, including the Travel Rule.
The APG MER specifically notes that PNG needs to take steps to license or register VASPs and subject them to the full range of AML/CTF obligations.
Outcome: The BPNG clarified that cryptocurrencies are not legal tender in PNG. They highlighted risks such as volatility, lack of regulation, potential for scams, and use in illicit activities. The statement advised the public to exercise caution and warned that losses would not be protected by PNG laws. It also indicated the BPNG's intention to develop appropriate regulations for digital assets in the future. This warning has generally underpinned the BPNG's ongoing stance.
Statements are often general and not tied to a single "action" URL, but reflect ongoing policy. For example, the BPNG's Annual Reports or public addresses often touch upon these topics. The above 2021 notice remains the foundational document. News articles frequently refer back to this stance:
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — remote VASPs serving PNG residents currently operate in a regulatory vacuum (no VASP licensing regime exists), but face enforcement risk from BPNG public warnings and anticipated FATF-driven licensing; AML obligations are not yet legally in force for VASPs but are expected once the framework is adopted.
Questions this verdict aims to answer
- May a non-resident provider serve residents from abroad?
- Does cross-border service trigger licensing, registration, or AML obligations?
- What enforcement risk exists for unlicensed remote operators?