On-shore VASP in Timor-Leste

Lack of Specific Regulation is Not the Same as Legality or Full Freedom: While there are no crypto-specific licenses, any entity operating within Timor-Leste would still be subject to general business laws, tax laws, and potentially, if their activities could be interpreted as traditional financial services, existing financial sector legislation overseen by the Banco Central de Timor-Leste (BCTL).

AML/CFT Obligations: Even without specific VASP regulation, Timor-Leste, as a member of the international community, is subject to the recommendations of the Financial Action Task Force (FATF). Its existing Anti-Money Laundering (AML) and Counter-Financing of Terrorism (CFT) laws (such as Law No. 2/2011 on the Prevention and Combat of Money Laundering and Financing of Terrorism, and any subsequent updates) would apply to financial institutions and designated non-financial businesses and professions (DNFBPs). The BCTL and other relevant authorities would expect any entity involved in financial transactions, even those involving virtual assets, to have robust AML/KYC controls in place to prevent illicit activities.

No specific licenses are currently required for crypto-specific activities.

If a service provider's activities blur the lines with traditional financial services (e.g., holding fiat currency deposits, facilitating fiat-to-fiat transfers through crypto, or providing lending services in fiat backed by crypto), they might inadvertently fall under existing financial services laws and require a license as a financial institution, payment service provider, or money service business from the BCTL. However, for pure crypto-to-crypto activities or non-custodial wallets, there is no direct precedent or requirement.

Neither a specific registration nor a licensing regime exists for VASPs.

Capital Requirements: No specific capital requirements for VASPs as there are no specific licenses. If a business were to seek a traditional financial license (e.g., as a payment service provider), then the BCTL's requirements for that specific license would apply, which include significant capital.

Customer due diligence (identifying and verifying customers).

Monitoring transactions for suspicious activity.

Reporting suspicious transactions to the national Financial Intelligence Unit (FIU), likely housed within the Ministry of Finance or Central Bank.

Local Presence: No specific local presence requirements for VASPs given the lack of specific regulation. However, to operate any business in Timor-Leste, general company registration and business licensing laws would apply, which typically require a registered office and local representation.

The general AML/CFT laws of Timor-Leste (e.g., Law No. 2/2011) would be the guiding principles. Failure to comply with these general obligations could lead to criminal charges if illicit activities are facilitated.

Law No. 2/2011 on the Prevention and Combat of Money Laundering and Financing of Terrorism: This is Timor-Leste's primary AML/CFT law. While it likely does not explicitly mention "virtual assets" or "VASPs," its general provisions apply to entities engaged in financial activities and would be the basis for any enforcement action related to money laundering or terrorism financing through crypto. Finding the official, current version of this law online through a public government portal can be challenging for Timor-Leste. You may need to consult local legal resources.

Law No. 3/2011 on Prevention and Combat of Money Laundering and Financing of Terrorism (Lei N.º 3/2011 de Prevenção e Combate ao Branqueamento de Capitais e ao Financiamento do Terrorismo): This is the foundational law that establishes the framework for AML/CFT in Timor-Leste. It defines money laundering and terrorist financing offenses, sets out reporting obligations for financial institutions and designated non-financial businesses and professions (DNFBPs), and establishes the Financial Intelligence Unit (FIU).

Banco Central de Timor-Leste (BCTL - Central Bank of Timor-Leste):

The BCTL is responsible for the overall supervision of financial institutions in Timor-Leste, including ensuring their compliance with AML/CFT requirements.

Unidade de Informação Financeira (UIF) / Financial Intelligence Unit (FIU) of Timor-Leste:

Identification and Verification:

For individuals: Obtain and verify identity using reliable, independent source documents, data, or information (e.g., full legal name, date of birth, nationality, residential address, unique identification number from government-issued ID like passport or national ID card).

For legal entities (companies): Obtain and verify the company's name, legal form, proof of existence, powers that regulate and bind the legal person, names of relevant persons holding senior management positions, and identify and verify beneficial owners (those who ultimately own or control more than a certain percentage, typically 25% or 10%).

Ongoing Monitoring: Continuously monitor transactions and the business relationship to ensure they are consistent with the VASP's knowledge of the customer, their business, and risk profile. This includes scrutinizing transactions to ensure they are not suspicious.

Enhanced Due Diligence (EDD):

Politically Exposed Persons (PEPs)

Customers from high-risk geographic locations (as identified by FATF or national lists)

Complex, unusually large transactions, or unusual patterns of transactions that have no apparent economic or lawful purpose.

Business relationships and transactions with no face-to-face contact.

Simplified Due Diligence (SDD):

Obligation to Report: VASPs are obligated to report to the Unidade de Informação Financeira (UIF) any transaction, regardless of its value, where they have reasonable grounds to suspect that:

The funds are the proceeds of criminal activity (money laundering).

The funds are linked to terrorist financing.

"No Tipping-Off" Rule: VASPs, their directors, officers, and employees are prohibited from disclosing to the customer or any third party that an STR has been or will be submitted to the UIF.

Customer Identification Data: All records obtained through CDD procedures (e.g., copies of identification documents, verification data). These must be kept for at least five (5) years after the business relationship has ended.

Transaction Records: All records relating to transactions (e.g., amounts, currencies, dates, parties involved, account numbers, virtual asset wallet addresses/transaction IDs). These must be kept for at least five (5) years from the date of the transaction.

Segregation of Client Assets Rules:

No specific rules mandate the segregation of client digital assets from a custodian's proprietary assets.

No specific insurance or bonding requirements for cryptocurrency custodians are in place.

Cold Storage Mandates:

Crypto-Related Services: However, services related to cryptocurrency, such as exchange fees charged by a local service provider, custodial services, or consulting services, could potentially be subject to the 2.5% Sales Tax if they are deemed a taxable service provided in Timor-Leste. This area remains ambiguous due to the lack of specific guidance.

Issuing Warnings and Advisories: The BCTL has previously issued statements cautioning the public about the risks associated with cryptocurrencies, highlighting their volatile nature, lack of regulatory oversight, and potential for use in illicit activities. These are general advisories rather than enforcement actions against specific entities.

Prioritization: Enforcement efforts in smaller, developing economies often prioritize more traditional forms of financial crime due to limited resources and the nascent stage of crypto adoption.