Crypto-funded debit card in Timor-Leste

No specific licenses are currently required for crypto-specific activities.

If a service provider's activities blur the lines with traditional financial services (e.g., holding fiat currency deposits, facilitating fiat-to-fiat transfers through crypto, or providing lending services in fiat backed by crypto), they might inadvertently fall under existing financial services laws and require a license as a financial institution, payment service provider, or money service business from the BCTL. However, for pure crypto-to-crypto activities or non-custodial wallets, there is no direct precedent or requirement.

Traditional financial institutions (banks, payment service providers, insurance companies, microfinance institutions) are licensed by the BCTL.

Capital Requirements: No specific capital requirements for VASPs as there are no specific licenses. If a business were to seek a traditional financial license (e.g., as a payment service provider), then the BCTL's requirements for that specific license would apply, which include significant capital.

Local Presence: No specific local presence requirements for VASPs given the lack of specific regulation. However, to operate any business in Timor-Leste, general company registration and business licensing laws would apply, which typically require a registered office and local representation.

Law on Payment Systems: Regulates payment service providers and systems.

Law No. 2/2011 on the Prevention and Combat of Money Laundering and Financing of Terrorism: This is Timor-Leste's primary AML/CFT law. While it likely does not explicitly mention "virtual assets" or "VASPs," its general provisions apply to entities engaged in financial activities and would be the basis for any enforcement action related to money laundering or terrorism financing through crypto. Finding the official, current version of this law online through a public government portal can be challenging for Timor-Leste. You may need to consult local legal resources.

Lei dos Serviços de Pagamento (Law No. 2/2021, of 23 August) – Law on Payment Services: This law governs payment services and electronic money institutions. It defines electronic money as "electronically (including magnetically) stored monetary value as represented by a claim on the issuer which is issued on receipt of funds for the purpose of making payment transactions."

Instrução do BCTL No. 001/2022 – Instituições de Moeda Eletrónica (Electronic Money Institutions): This instruction further details the licensing, operational, and prudential requirements for e-money institutions.

For E-money and Payment Service Providers: Any entity seeking to issue electronic money or provide payment services in Timor-Leste must be licensed by the Banco Central de Timor-Leste (BCTL). This process is detailed in:

Holding a significant portion of received funds in highly liquid, low-risk assets (e.g., central bank deposits, government bonds).

Segregation of client funds from operational funds.

Minimum capital requirements.

No specific classification for stablecoins.

Law No. 3/2011 on Prevention and Combat of Money Laundering and Financing of Terrorism (Lei N.º 3/2011 de Prevenção e Combate ao Branqueamento de Capitais e ao Financiamento do Terrorismo): This is the foundational law that establishes the framework for AML/CFT in Timor-Leste. It defines money laundering and terrorist financing offenses, sets out reporting obligations for financial institutions and designated non-financial businesses and professions (DNFBPs), and establishes the Financial Intelligence Unit (FIU).

Banco Central de Timor-Leste (BCTL - Central Bank of Timor-Leste):

Unidade de Informação Financeira (UIF) / Financial Intelligence Unit (FIU) of Timor-Leste:

Identification and Verification:

For legal entities (companies): Obtain and verify the company's name, legal form, proof of existence, powers that regulate and bind the legal person, names of relevant persons holding senior management positions, and identify and verify beneficial owners (those who ultimately own or control more than a certain percentage, typically 25% or 10%).

Ongoing Monitoring: Continuously monitor transactions and the business relationship to ensure they are consistent with the VASP's knowledge of the customer, their business, and risk profile. This includes scrutinizing transactions to ensure they are not suspicious.

Enhanced Due Diligence (EDD):

Obligation to Report: VASPs are obligated to report to the Unidade de Informação Financeira (UIF) any transaction, regardless of its value, where they have reasonable grounds to suspect that:

"No Tipping-Off" Rule: VASPs, their directors, officers, and employees are prohibited from disclosing to the customer or any third party that an STR has been or will be submitted to the UIF.

Customer Identification Data: All records obtained through CDD procedures (e.g., copies of identification documents, verification data). These must be kept for at least five (5) years after the business relationship has ended.

Transaction Records: All records relating to transactions (e.g., amounts, currencies, dates, parties involved, account numbers, virtual asset wallet addresses/transaction IDs). These must be kept for at least five (5) years from the date of the transaction.

Crypto-Related Services: However, services related to cryptocurrency, such as exchange fees charged by a local service provider, custodial services, or consulting services, could potentially be subject to the 2.5% Sales Tax if they are deemed a taxable service provided in Timor-Leste. This area remains ambiguous due to the lack of specific guidance.

Issuing Warnings and Advisories: The BCTL has previously issued statements cautioning the public about the risks associated with cryptocurrencies, highlighting their volatile nature, lack of regulatory oversight, and potential for use in illicit activities. These are general advisories rather than enforcement actions against specific entities.