Self-custodial wallet / non-custodial software in San Marino
Publisher of software where users hold their own private keys. The publisher never holds, controls, or has access to user funds.
Self-custodial wallet is conditionally permitted in San Marino with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- ODLTs (Operators in Distributed Ledger Technologies) are classified as 'financial intermediaries' under Decree 120/2019 and must comply with full AML/CFT obligations, even if the software publisher never holds user funds.
- Customer Due Diligence (CDD) — must identify and verify natural persons (name, DOB, address, nationality, official ID) and legal persons/arrangements (legal name, form, address, proof of existence, authorized signatories).
- Beneficial Ownership — identify and verify beneficial owners (natural persons holding >25% shares/voting rights or exercising control).
- Risk-Based Approach (RBA) — assess ML/TF risks based on customer type, services, virtual asset types, geography, and delivery channels; apply CDD proportionate to risk.
- Enhanced Due Diligence (EDD) — required for PEPs, cross-border correspondent relationships, complex/unusual/large transactions, high-risk jurisdictions, and transactions involving new or anonymity-favoring technologies.
- Ongoing monitoring — continuous monitoring of business relationships and transactions; keep CDD data up to date.
- Suspicious Transaction Reporting (STR) — must report to the Financial Intelligence Agency (AIF).
- Appoint an AML Officer and a Board-level AML Compliance Officer.
- Implement comprehensive internal controls, policies, and procedures for AML/CFT.
- Report to and be supervised by the Banca Centrale della Repubblica di San Marino (BCSM) — the primary financial regulator responsible for licensing and oversight of VASPs.
Key Restrictions
- Must incorporate as a joint-stock company (S.p.A.) or limited liability company (S.r.l.) established in San Marino.
- Registered office and effective management must be in San Marino.
- Must obtain authorization (registration) as an ODLT/VASP from the BCSM before offering services — software publishing that relates to DLT/VAs likely requires this authorization even without custody.
- Minimum share capital: €150,000 if no direct services to the public, no client funds, and low risk profile; €300,000 if providing direct services. BCSM may require higher amounts.
- Capital must be fully paid up.
- Even though users hold their own private keys (non-custodial), the publisher may still be classified as an ODLT under San Marino's broad definition of 'providing services related to virtual assets' — this introduces substantial compliance overhead.
Key Risks
- Regulatory ambiguity — the law defines ODLT/VASP activity broadly ('providing other services related to virtual assets'), which could sweep in non-custodial software publishers, creating classification uncertainty.
- No licensed DLT service providers existed as of the July 2022 MONEYVAL report, meaning the practical application of the ODLT regime to non-custodial software is untested.
- Discretionary enforcement — as a small jurisdiction with limited public enforcement history, the BCSM's interpretation of the law toward non-custodial publishers is unclear.
- High setup costs — mandatory local incorporation (S.p.A. or S.r.l.) and €150,000–€300,000+ minimum capital creates a high barrier for a software publisher with no custody risk.
- Full AML/CFT obligations (CDD, EDD, STR) apply even though the publisher has no access to user funds — this creates a mismatch between compliance burden and actual risk.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Law No. 171 of December 17, 2019, "Regulations for Distributed Ledger Technologies and Blockchain for Business" (Legge 171/2019): This law defines DLT, virtual assets, and establishes the framework for Operators in Distributed Ledger Technologies (ODLTs).
BCRA Circular No. 64 of 15 September 2020, "Disciplining the activities of Operators in Distributed Ledger Technologies": This circular provides detailed implementation rules for Law 171/2019, specifying the requirements for obtaining authorization (registration) as an ODLT.
BCRA Circular No. 67 of 11 May 2021, "Amendments and additions to Circular No. 64 of 15 September 2020": This circular introduced updates and clarifications to the initial implementing regulations.
Decree No. 120 of 21 August 2019, "Provisions against money laundering and terrorist financing": This AML/CFT law is applicable to ODLTs and virtual asset service providers (VASPs).
Providing other services related to virtual assets.
Legal Form & Establishment:
Must be a joint-stock company (Società per Azioni - S.p.A.) or a limited liability company (Società a responsabilità limitata - S.r.l.) established in San Marino.
Must have its registered office and effective management in San Marino.
Minimum Share Capital:
€150,000 for ODLTs that do not provide direct services to the public, do not hold client funds/virtual assets, and whose activity carries a low risk profile as assessed by the BCRA.
€300,000 for ODLTs providing services directly to the public (including VASPs like exchanges and custody providers) and holding client funds or virtual assets.
The BCRA may require a higher capital amount based on the complexity, scale, and risk profile of the proposed activities.
Capital must be fully paid up.
ODLTs are considered "financial intermediaries" under San Marino's AML/CFT legislation (Decree 120/2019) and are subject to all related obligations.
Implementing robust Customer Due Diligence (CDD) procedures for all clients (identifying and verifying identity, beneficial ownership).
Conducting risk assessments for business relationships and transactions.
Implementing comprehensive internal controls, policies, and procedures for AML/CFT.
Appointing an AML Officer and a Board-level AML Compliance Officer.
Establishing a Suspicious Transaction Reporting (STR) mechanism and reporting to the Financial Intelligence Agency (AIF).
Legge n. 200 del 19 dicembre 2023 – "Disposizioni per la prevenzione e il contrasto del riciclaggio e del finanziamento del terrorismo, nonché modifiche e integrazioni a leggi in materia di vigilanza prudenziale e di gestione delle crisi degli enti creditizi e finanziari."
Regolamento della Banca Centrale della Repubblica di San Marino n. 2023-01 – "Regolamento in materia di prestatori di servizi relativi ad attività virtuali (VASP)."
Natural Persons: Obtain and verify identity using reliable, independent source documents, data, or information (e.g., name, date of birth, place of birth, address, nationality, official identification number/document type).
Legal Persons/Arrangements: Obtain and verify legal name, legal form, address, proof of existence, powers that regulate and bind the legal person/arrangement, and names of individuals authorized to act on its behalf.
Identify the beneficial owner(s) (natural person(s) who ultimately own or control the customer and/or the natural person on whose behalf a transaction is being conducted).
For legal persons, this typically involves identifying natural persons holding more than 25% of shares or voting rights, or exercising control through other means.
Purpose and Intended Nature of Business Relationship: Obtain information on the purpose and intended nature of the business relationship or occasional transaction.
Risk-Based Approach (RBA): VASPs must implement a risk-based approach to AML/CFT, meaning they should:
Enhanced Due Diligence (EDD): Apply EDD in higher-risk situations, including but not limited to:
Conduct ongoing monitoring of the business relationship and transactions undertaken throughout the course of that relationship.
No Licensed DLT Service Providers (as of last major assessment): A key finding from the MONEYVAL (Council of Europe anti-money laundering body) "Fifth Round Mutual Evaluation Report on San Marino" published in July 2022 stated:
Focus on Regulatory Framework Development: San Marino has been more focused on building its regulatory framework. The BCSM is the primary regulator and issues circulars and regulations. Their focus in recent years has been on establishing robust AML/CFT measures for new technologies.
Discretionary Enforcement/Lack of High-Profile Cases: In smaller jurisdictions, enforcement actions, if they occur, might not always be widely publicized, especially if they are against smaller, unlicensed operations or result in administrative warnings rather than significant public penalties. It's also possible that San Marino hasn't experienced high-profile crypto-related financial crimes or major non-compliance incidents warranting significant public enforcement.
Banca Centrale della Repubblica di San Marino (BCSM) Official Website:
MONEYVAL Report (July 2022):
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- low
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a non-custodial wallet publisher may be classified as an ODLT/VASP under San Marino's broad "services related to virtual assets" definition, requiring full BCSM authorization, local incorporation (S.p.A./S.r.l.), €150,000+ minimum capital, and comprehensive AML/CFT obligations (CDD, EDD, STR, AML officer), despite never holding user funds; however, the practical application of the regime to non-custodial software is untested and regulatory ambiguity is high, with no licensed DLT service providers as of mid-2022.
Questions this verdict aims to answer
- Does software publishing trigger VASP / MSB classification?
- Do AML obligations attach when no custody exists?
- What disclosure or consumer-protection rules apply?