Custodial wallet / SaaS in Tonga

Virtual Asset (VA): Defined broadly to mean a digital representation of value that can be digitally traded or transferred and used for payment or investment purposes. It does not include digital representations of fiat currencies, securities, or other financial assets that are already covered by other laws.

Virtual Asset Service Provider (VASP): Defined as any natural or legal person who, as a business, conducts one or more of the following activities for or on behalf of another natural or legal person:

Safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets (custody providers).

No specific "crypto license" is issued. Instead, if your business activity falls under the definition of a VASP (which exchanges, custody providers, and payment processors dealing with virtual assets invariably do), you will be treated as a "reporting entity" under the Money Laundering and Terrorist Financing Act 2020.

This means you are obligated to register with and be supervised by the relevant authorities (see "Registration vs. Licensing Regime" below) and comply with all AML/CFT requirements.

Registration Regime (AML/CFT focused): For VASPs, Tonga operates more of a registration and compliance oversight regime rather than a bespoke licensing regime. VASPs are categorized as "reporting entities" under the MLTFA 2020.

What this means: While you don't apply for a specific "Tonga Crypto License," you must register your business in Tonga, notify the relevant supervisory authority (likely the NRBT or FIU, depending on the specifics and which body is designated for VASP oversight under the Act's implementation), and demonstrate full compliance with AML/CFT obligations.

Traditional Licensing: If your VASP business also conducts activities that fall under traditional financial services (e.g., money remittance using fiat currency), then you would also need to seek appropriate licenses from the National Reserve Bank of Tonga for those specific activities.

Money Laundering and Terrorist Financing Act 2018 (as amended): This is the foundational law establishing the AML/CFT framework, defining offenses, setting out reporting obligations, and granting powers to authorities. It likely includes definitions that capture VASPs or their activities.

Evidence fact to.aml.customer-due-diligence-cdd-implementing not found (may have been renamed).

Ongoing Monitoring: Continuously monitoring the business relationship and transactions to ensure they are consistent with the VASP's knowledge of the customer, their business, and risk profile, including, where necessary, the source of funds.

Enhanced Due Diligence (EDD): Applying enhanced measures for higher-risk situations, such as:

No Monetary Threshold: STRs must be filed regardless of the amount of the transaction.

"Tipping Off" Prohibition: VASPs and their employees are prohibited from disclosing to the customer or a third party that an STR has been or will be filed.

Customer Due Diligence Records: All identification and verification data, beneficial ownership information, and supporting documents.

Transaction Records: Details of all transactions, including the amount, currency (both fiat and virtual assets), date, type of transaction, and the identity of the sender and receiver (including information required by the FATF "Travel Rule" for virtual asset transfers).

Business Relationship Records: Records pertaining to the business relationship and ongoing monitoring.

Internal Reports and STRs: Copies of all internal suspicious activity reports and STRs submitted to the TFIU.

Duration: Records must generally be kept for a period of at least five (5) years after the business relationship has ended or after the date of an occasional transaction.

FATF Standards: Tonga, as a member of the Asia/Pacific Group on Money Laundering (APG) (a FATF-style regional body), is expected to implement FATF Recommendations, including Recommendation 15 (New Technologies) and its interpretative note, which specifically addresses VASPs and the "Travel Rule" (requiring VASPs to obtain and transmit originator and beneficiary information for virtual asset transfers above a certain threshold).

Risk Assessment: Implementing a thorough institutional risk assessment to identify and mitigate ML/TF risks specific to their VASP operations is crucial.

Internal Controls: Developing and implementing robust internal controls, policies, procedures, and training programs for staff are essential for compliance.

Regulator Name: National Reserve Bank of Tonga (NRBT)

Entity Targeted: General Public / Unregulated Cryptocurrency Schemes and Platforms. Violation Type: Unregistered financial services, operating outside regulated financial system, potential for investment fraud, high volatility risks, lack of consumer protection, lack of Anti-Money Laundering (AML) / Counter-Financing of Terrorism (CFT) oversight. Penalty Amount: N/A (Public Warning).

December 2023: The NRBT reiterated warnings about crypto investments, noting their unregulated nature and high risks, following a trend of public advisories. This was part of their general consumer protection mandate.

June 2022: The NRBT issued a comprehensive warning about the risks of virtual assets, emphasizing that they are not legal tender in Tonga and are unregulated.

Tonga has not yet established a comprehensive regulatory framework specifically for virtual assets, which means that enforcement actions related to licensing or specific crypto laws are limited.

The NRBT's approach has been proactive in terms of consumer protection through public warnings, but there's no public record of significant penalties or enforcement actions against specific cryptocurrency businesses or individuals in Tonga within the requested timeframe.

Tonga is a member of the Asia/Pacific Group on Money Laundering (APG), indicating its commitment to AML/CFT standards. However, the implementation of these standards for virtual assets is an ongoing challenge for many small jurisdictions.