← Regulations / Papua New Guinea / Operating Models / Remote VASP

Remote VASP serving residents in Papua New Guinea

Foreign-incorporated entity that offers exchange, custody, or transfer services to residents of a jurisdiction without establishing a local entity or office.

Conditional AI-Generated · Unreviewed

Remote VASP is conditionally permitted in Papua New Guinea without local incorporation, subject to AML obligations and medium licensing burden.

Verdict Details

Permitted
conditional
Local entity required
No
Licensing burden
Medium
Last updated
2026-07-13

AML Obligations

  • No explicit AML obligations currently — VASPs are not designated as 'reporting entities' under the AML/CTF Act 2015 (pg.travel-rule.none-explicitly-as-reporting-entities; pg.travel-rule.consequently-vasps-are-not-explicitly)
  • Once the anticipated regulatory framework is adopted, VASPs will be required to: identify and verify customers (KYC) (pg.licensing.identify-and-verify-customers-kyc), conduct ongoing customer due diligence (pg.licensing.conduct-ongoing-customer-due-diligence), monitor transactions for suspicious activity (pg.licensing.monitor-transactions-for-suspicious-activity), report suspicious transactions to FASU (pg.licensing.report-suspicious-transactions-to-fasu), implement risk-based AML/CTF programs (pg.licensing.implement-robust-risk-based-amlctf-programs), and adhere to the FATF Travel Rule for VA transfers (pg.licensing.adhere-to-the-travel-rule)
  • Designated person/entity screening against UN Consolidated Sanctions List required upon onboarding and ongoing basis (pg.aml.designated-personentity-screening-vasps-must)
  • Asset freezing obligations if VA held for a designated person/entity, with immediate report to FASU (pg.aml.asset-freezing-if-a-vasp)
  • Suspicious Transaction Reporting (STR) to FASU for any transactions involving designated persons or suspected ML/TF (pg.aml.suspicious-transaction-reporting-str-any)
  • De facto OFAC/EU sanctions screening obligations if transactions involve US persons, US dollar clearing, US-origin technology, or EU persons/entities (pg.aml.extraterritorial-reach-ofac-and-eu; pg.aml.correspondent-banking-relationships-png-financial)

Key Restrictions

  • No existing VASP licensing or registration regime — the regulatory framework is entirely anticipated, not yet in force (pg.licensing.currently-neither-a-specific-registration)
  • Cryptocurrencies are not legal tender in PNG, per BPNG public warning (pg.enforcement.outcome-the-bpng-clarified-that)
  • Cross-border service to PNG residents from abroad falls into a regulatory gap — no specific license exists to obtain, meaning the operator cannot become 'licensed' even if it wanted to (pg.licensing.cryptocurrency-exchanges-would-fall-into; pg.licensing.custody-providers-similarly-no-specific)
  • Future licensing will likely require local presence, a local board, or a local registered company structure for foreign entities (pg.licensing.local-presence-for-foreign-entities)
  • FATF standards strongly imply VASPs should be regulated, and the APG MER identified PNG's lack of VASP coverage as a significant deficiency — regulatory change is expected but timing is uncertain (pg.licensing.anticipated-future-based-on-fatf; pg.travel-rule.the-apg-mer-specifically-notes)

Key Risks

  • Regulatory ambiguity risk: no current regime means the operator cannot become compliant, but BPNG public warnings create enforcement exposure for operating in the gap (pg.enforcement.statements-are-often-general-and; pg.enforcement.outcome-the-bpng-clarified-that)
  • Reputational and de-risking risk: PNG financial institutions rely on US/EU correspondent banking, which may impose sanctions/AML compliance requirements on VASPs (pg.aml.correspondent-banking-relationships-png-financial; pg.aml.reputational-risk-failing-to-comply)
  • Once a future licensing regime is enacted, unlicensed operators serving PNG residents may face retroactive enforcement, fines, or orders to cease (pg.travel-rule.once-vasps-are-brought-under)
  • Consumer protection warnings from BPNG create PR exposure — public is warned that losses from crypto transactions are not protected by PNG law (pg.enforcement.outcome-the-bpng-clarified-that)

Evidence

This verdict synthesizes the following facts. Each fact links to its primary source(s).

licensing 60% confidence

Currently, neither a specific registration nor a licensing regime exists for VASPs.

licensing 60% confidence

Anticipated Future: Based on FATF recommendations, it is highly probable that PNG will eventually adopt a licensing regime for VASPs. The FATF standards recommend that VASPs be licensed or registered, and subject to effective systems for monitoring and ensuring compliance with AML/CTF requirements. Licensing typically implies a more rigorous pre-approval process and ongoing supervision than simple registration.

licensing 60% confidence

Local Presence: For foreign entities, a local physical presence, a local board of directors, or a local registered company structure is often a requirement for financial licenses.

licensing 60% confidence

Identify and verify customers (KYC).

licensing 60% confidence

Conduct ongoing customer due diligence.

licensing 60% confidence

Monitor transactions for suspicious activity.

licensing 60% confidence

Report suspicious transactions to FASU.

licensing 60% confidence

Implement robust risk-based AML/CTF programs.

licensing 60% confidence

Adhere to the "travel rule" for VA transfers, requiring information sharing between VASPs.

licensing 60% confidence

Cryptocurrency Exchanges: Would fall into this gap. If a business sought to offer traditional securities exchange services, it would require licenses under the Securities Commission of Papua New Guinea (if established for this purpose) or relevant financial market laws. However, crypto assets are not typically classified as securities under existing PNG law.

licensing 60% confidence

Custody Providers: Similarly, no specific license for crypto custody. Traditional trust or financial services licenses might be considered, but these are not designed for digital assets.

aml 60% confidence

Designated Person/Entity Screening: VASPs must screen their customers (both at onboarding and on an ongoing basis) against the UN Consolidated Sanctions List, which includes individuals and entities designated under various UN sanctions regimes (e.g., terrorism, proliferation, specific country regimes).

aml 60% confidence

Asset Freezing: If a VASP identifies that it holds assets (including virtual assets) belonging to a designated person or entity, it must immediately freeze those assets and report the match to FASU.

aml 60% confidence

Suspicious Transaction Reporting (STR): Any transaction involving designated persons, or transactions suspected of being related to money laundering or terrorist financing, must be reported to FASU.

aml 60% confidence

Extraterritorial Reach: OFAC and EU sanctions can have extraterritorial effects, particularly if transactions involve:

aml 60% confidence

Correspondent Banking Relationships: PNG financial institutions (and potentially VASPs dealing with them) rely on correspondent banking relationships with US and European banks, which impose their own OFAC/EU compliance requirements.

aml 60% confidence

Reputational Risk: Failing to comply with major international sanctions regimes like OFAC or EU can lead to severe reputational damage, de-risking by international partners, and exclusion from global financial systems.

travel-rule 40% confidence

None explicitly as reporting entities under the current AML/CTF Act 2015.

travel-rule 40% confidence

Consequently, VASPs are not explicitly designated as "reporting entities" or "financial institutions" under the current AML/CTF framework. This means they are generally not subject to AML/CTF obligations, including the Travel Rule.

travel-rule 40% confidence

The APG MER specifically notes that PNG needs to take steps to license or register VASPs and subject them to the full range of AML/CTF obligations.

enforcement 60% confidence

Outcome: The BPNG clarified that cryptocurrencies are not legal tender in PNG. They highlighted risks such as volatility, lack of regulation, potential for scams, and use in illicit activities. The statement advised the public to exercise caution and warned that losses would not be protected by PNG laws. It also indicated the BPNG's intention to develop appropriate regulations for digital assets in the future. This warning has generally underpinned the BPNG's ongoing stance.

enforcement 60% confidence

Statements are often general and not tied to a single "action" URL, but reflect ongoing policy. For example, the BPNG's Annual Reports or public addresses often touch upon these topics. The above 2021 notice remains the foundational document. News articles frequently refer back to this stance:

Verdict Attribution

Source:
AI-Generated · Unreviewed
AI synthesized:
2026-07-13 (deepseek-chat)
Last updated:
2026-07-13
Confidence:
medium

This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.

Conditional — remote VASPs serving PNG residents currently operate in a regulatory vacuum (no VASP licensing regime exists), but face enforcement risk from BPNG public warnings and anticipated FATF-driven licensing; AML obligations are not yet legally in force for VASPs but are expected once the framework is adopted.

Questions this verdict aims to answer

  • May a non-resident provider serve residents from abroad?
  • Does cross-border service trigger licensing, registration, or AML obligations?
  • What enforcement risk exists for unlicensed remote operators?