Custodial wallet / SaaS in Turks and Caicos

Requirement for Licensing: Any entity providing "custody or administration of virtual assets or instruments enabling control over virtual assets on behalf of another natural or legal person" (as per the definition of a VASP in Section 3 of the VASP Act 2022) is required to be licensed by the TCI FSC.

Application Process: Applicants must submit a comprehensive application to the FSC, which includes:

Detailed business plan.

Information on the applicant's corporate structure, ownership, and management.

Proof of financial soundness and capital adequacy.

Robust anti-money laundering (AML) and combating the financing of terrorism (CFT) policies and procedures.

Risk management framework.

IT and cybersecurity policies.

Segregation of client assets policies.

Disaster recovery plan.

Fit and Proper Test: All directors, senior officers, and significant shareholders are subject to "fit and proper" assessment by the FSC.

Local Presence: A licensed VASP must have a physical presence or designated contact in TCI.

Virtual Asset Service Providers Act 2022, Section 6 (Requirement to be Licensed).

Holding in Trust & Separate Accounts: A licensed VASP must:

Maintain separate client accounts for each client.

Protection from Insolvency: Client virtual assets held by a VASP cannot be considered assets of the VASP in the event of its insolvency or winding-up, protecting clients from creditors.

Specifically: "A licensed VASP shall — (a) hold virtual assets or instruments enabling control over virtual assets in trust for and on behalf of its client; (b) maintain separate client accounts for its clients."

Professional Indemnity Insurance: Licensed VASPs are required to maintain adequate professional indemnity insurance or other comparable guarantee. The specific amount or nature of this "comparable guarantee" would be subject to FSC approval based on the VASP's business model and risk profile.

Cold Storage for Significant Proportion: The regulations explicitly require the use of cold storage for a "significant proportion" of client virtual assets. This indicates a clear preference for offline storage for enhanced security against cyber threats.

Safekeeping or administration of virtual assets or instruments enabling control over virtual assets. (This specifically covers custody providers).

General Virtual Asset Business License: A minimum paid-up capital of TCI$500,000.

Restricted Virtual Asset Business License: A minimum paid-up capital of TCI$250,000. (This license may be granted for a more limited scope of activities or under specific conditions).

Customer Due Diligence (CDD): Implementing comprehensive policies and procedures for identifying and verifying customers' identities, including beneficial owners.

Enhanced Due Diligence (EDD): For higher-risk customers, politically exposed persons (PEPs), and complex transactions.

Record Keeping: Maintaining records of customer identification data and transaction details for at least five years.

Transaction Monitoring: Implementing systems to monitor transactions for suspicious activity.

Suspicious Transaction Reports (STRs): Reporting suspicious activities to the Financial Intelligence Agency (FIA) without tipping off the customer.

Risk Assessments: Conducting regular, comprehensive risk assessments of their business, customers, products, and geographies.

Compliance Officer: Appointing a qualified Money Laundering Reporting Officer (MLRO) and Deputy MLRO, responsible for AML/CFT compliance and reporting.

Training: Providing ongoing AML/CFT training to all relevant staff.

Registered Office: A VASP must maintain a registered office in the Turks and Caicos Islands.

Resident Agent: A VASP must appoint a resident agent in the Turks and Caicos Islands.

Directors and Senior Management: The FSC requires directors and senior management to be "fit and proper" individuals, demonstrating competence, integrity, and sound financial standing. At least one director must typically be a resident of TCI, or there must be significant local operational oversight.

Key Personnel: The MLRO, Deputy MLRO, and compliance officer positions are critical and subject to FSC approval.

When CDD is Required:

When establishing a business relationship.

When conducting occasional transactions above a specified threshold (e.g., USD 1,000 for wire transfers, or as otherwise prescribed by regulation).

Beneficial Ownership: Identification and verification of natural persons who ultimately own or control the customer (typically 10% or 25% ownership threshold, but VASPs must identify anyone who exerts ultimate control).