Custodial wallet / SaaS in Timor-Leste

There are no specific licensing requirements for cryptocurrency custodians or digital asset service providers in Timor-Leste.

Any entity operating within the financial sector might fall under the general oversight of the Banco Central de Timor-Leste (BCTL), but this would be for traditional financial activities, not specifically for digital asset custody.

No specific rules mandate the segregation of client digital assets from a custodian's proprietary assets.

No specific insurance or bonding requirements for cryptocurrency custodians are in place.

There are no mandates regarding the use of cold storage or specific security protocols for digital assets.

No official definition of a "qualified custodian" specifically for digital assets exists within Timor-Leste's regulatory framework.

There is no publicly announced or pending legislation specifically addressing cryptocurrency custody.

No specific licenses are currently required for crypto-specific activities.

Neither a specific registration nor a licensing regime exists for VASPs.

If a service provider's activities blur the lines with traditional financial services (e.g., holding fiat currency deposits, facilitating fiat-to-fiat transfers through crypto, or providing lending services in fiat backed by crypto), they might inadvertently fall under existing financial services laws and require a license as a financial institution, payment service provider, or money service business from the BCTL. However, for pure crypto-to-crypto activities or non-custodial wallets, there is no direct precedent or requirement.

Local Presence: No specific local presence requirements for VASPs given the lack of specific regulation. However, to operate any business in Timor-Leste, general company registration and business licensing laws would apply, which typically require a registered office and local representation.

AML/KYC (Anti-Money Laundering/Know Your Customer): This is the most critical area. While specific VASP regulations are absent, any business engaging in financial activities, including those involving virtual assets, is strongly advised to implement robust AML/KYC procedures. This includes:

The general AML/CFT laws of Timor-Leste (e.g., Law No. 2/2011) would be the guiding principles. Failure to comply with these general obligations could lead to criminal charges if illicit activities are facilitated.

Law No. 3/2011 on Prevention and Combat of Money Laundering and Financing of Terrorism (Lei N.º 3/2011 de Prevenção e Combate ao Branqueamento de Capitais e ao Financiamento do Terrorismo): This is the foundational law that establishes the framework for AML/CFT in Timor-Leste. It defines money laundering and terrorist financing offenses, sets out reporting obligations for financial institutions and designated non-financial businesses and professions (DNFBPs), and establishes the Financial Intelligence Unit (FIU).

Identification and Verification:

For individuals: Obtain and verify identity using reliable, independent source documents, data, or information (e.g., full legal name, date of birth, nationality, residential address, unique identification number from government-issued ID like passport or national ID card).

For legal entities (companies): Obtain and verify the company's name, legal form, proof of existence, powers that regulate and bind the legal person, names of relevant persons holding senior management positions, and identify and verify beneficial owners (those who ultimately own or control more than a certain percentage, typically 25% or 10%).

Obligation to Report: VASPs are obligated to report to the Unidade de Informação Financeira (UIF) any transaction, regardless of its value, where they have reasonable grounds to suspect that:

The funds are the proceeds of criminal activity (money laundering).

The funds are linked to terrorist financing.

"No Tipping-Off" Rule: VASPs, their directors, officers, and employees are prohibited from disclosing to the customer or any third party that an STR has been or will be submitted to the UIF.

Customer Identification Data: All records obtained through CDD procedures (e.g., copies of identification documents, verification data). These must be kept for at least five (5) years after the business relationship has ended.

Transaction Records: All records relating to transactions (e.g., amounts, currencies, dates, parties involved, account numbers, virtual asset wallet addresses/transaction IDs). These must be kept for at least five (5) years from the date of the transaction.

Ongoing Monitoring: Continuously monitor transactions and the business relationship to ensure they are consistent with the VASP's knowledge of the customer, their business, and risk profile. This includes scrutinizing transactions to ensure they are not suspicious.

Enhanced Due Diligence (EDD):

Issuing Warnings and Advisories: The BCTL has previously issued statements cautioning the public about the risks associated with cryptocurrencies, highlighting their volatile nature, lack of regulatory oversight, and potential for use in illicit activities. These are general advisories rather than enforcement actions against specific entities.

Prioritization: Enforcement efforts in smaller, developing economies often prioritize more traditional forms of financial crime due to limited resources and the nascent stage of crypto adoption.