DeFi protocol frontend in Timor-Leste

Lack of Specific Regulation is Not the Same as Legality or Full Freedom: While there are no crypto-specific licenses, any entity operating within Timor-Leste would still be subject to general business laws, tax laws, and potentially, if their activities could be interpreted as traditional financial services, existing financial sector legislation overseen by the Banco Central de Timor-Leste (BCTL).

AML/CFT Obligations: Even without specific VASP regulation, Timor-Leste, as a member of the international community, is subject to the recommendations of the Financial Action Task Force (FATF). Its existing Anti-Money Laundering (AML) and Counter-Financing of Terrorism (CFT) laws (such as Law No. 2/2011 on the Prevention and Combat of Money Laundering and Financing of Terrorism, and any subsequent updates) would apply to financial institutions and designated non-financial businesses and professions (DNFBPs). The BCTL and other relevant authorities would expect any entity involved in financial transactions, even those involving virtual assets, to have robust AML/KYC controls in place to prevent illicit activities.

No specific licenses are currently required for crypto-specific activities.

If a service provider's activities blur the lines with traditional financial services (e.g., holding fiat currency deposits, facilitating fiat-to-fiat transfers through crypto, or providing lending services in fiat backed by crypto), they might inadvertently fall under existing financial services laws and require a license as a financial institution, payment service provider, or money service business from the BCTL. However, for pure crypto-to-crypto activities or non-custodial wallets, there is no direct precedent or requirement.

Neither a specific registration nor a licensing regime exists for VASPs.

AML/KYC (Anti-Money Laundering/Know Your Customer): This is the most critical area. While specific VASP regulations are absent, any business engaging in financial activities, including those involving virtual assets, is strongly advised to implement robust AML/KYC procedures. This includes:

Customer due diligence (identifying and verifying customers).

Monitoring transactions for suspicious activity.

Reporting suspicious transactions to the national Financial Intelligence Unit (FIU), likely housed within the Ministry of Finance or Central Bank.

The general AML/CFT laws of Timor-Leste (e.g., Law No. 2/2011) would be the guiding principles. Failure to comply with these general obligations could lead to criminal charges if illicit activities are facilitated.

Local Presence: No specific local presence requirements for VASPs given the lack of specific regulation. However, to operate any business in Timor-Leste, general company registration and business licensing laws would apply, which typically require a registered office and local representation.

Law No. 3/2011 on Prevention and Combat of Money Laundering and Financing of Terrorism (Lei N.º 3/2011 de Prevenção e Combate ao Branqueamento de Capitais e ao Financiamento do Terrorismo): This is the foundational law that establishes the framework for AML/CFT in Timor-Leste. It defines money laundering and terrorist financing offenses, sets out reporting obligations for financial institutions and designated non-financial businesses and professions (DNFBPs), and establishes the Financial Intelligence Unit (FIU).

Obligation to Report: VASPs are obligated to report to the Unidade de Informação Financeira (UIF) any transaction, regardless of its value, where they have reasonable grounds to suspect that:

"No Tipping-Off" Rule: VASPs, their directors, officers, and employees are prohibited from disclosing to the customer or any third party that an STR has been or will be submitted to the UIF.

Customer Identification Data: All records obtained through CDD procedures (e.g., copies of identification documents, verification data). These must be kept for at least five (5) years after the business relationship has ended.

Transaction Records: All records relating to transactions (e.g., amounts, currencies, dates, parties involved, account numbers, virtual asset wallet addresses/transaction IDs). These must be kept for at least five (5) years from the date of the transaction.

Ongoing Monitoring: Continuously monitor transactions and the business relationship to ensure they are consistent with the VASP's knowledge of the customer, their business, and risk profile. This includes scrutinizing transactions to ensure they are not suspicious.

Enhanced Due Diligence (EDD):

Issuing Warnings and Advisories: The BCTL has previously issued statements cautioning the public about the risks associated with cryptocurrencies, highlighting their volatile nature, lack of regulatory oversight, and potential for use in illicit activities. These are general advisories rather than enforcement actions against specific entities.

Prioritization: Enforcement efforts in smaller, developing economies often prioritize more traditional forms of financial crime due to limited resources and the nascent stage of crypto adoption.