DeFi protocol frontend in Tonga

Virtual Asset (VA): Defined broadly to mean a digital representation of value that can be digitally traded or transferred and used for payment or investment purposes. It does not include digital representations of fiat currencies, securities, or other financial assets that are already covered by other laws.

Virtual Asset Service Provider (VASP): Defined as any natural or legal person who, as a business, conducts one or more of the following activities for or on behalf of another natural or legal person:

Exchange between virtual assets and fiat currencies.

Exchange between one or more forms of virtual assets.

Transfer of virtual assets.

Safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets (custody providers).

Participation in and provision of financial services related to an issuer's offer or sale of a virtual asset.

No specific "crypto license" is issued. Instead, if your business activity falls under the definition of a VASP (which exchanges, custody providers, and payment processors dealing with virtual assets invariably do), you will be treated as a "reporting entity" under the Money Laundering and Terrorist Financing Act 2020.

This means you are obligated to register with and be supervised by the relevant authorities (see "Registration vs. Licensing Regime" below) and comply with all AML/CFT requirements.

Payment Processors: If a payment processor primarily deals with fiat currency and facilitates remittances, they may also need a money services business license or similar authorization from the National Reserve Bank of Tonga (NRBT), irrespective of crypto involvement. If they solely process virtual assets, their primary obligation falls under the VASP AML/CFT framework.

Registration Regime (AML/CFT focused): For VASPs, Tonga operates more of a registration and compliance oversight regime rather than a bespoke licensing regime. VASPs are categorized as "reporting entities" under the MLTFA 2020.

What this means: While you don't apply for a specific "Tonga Crypto License," you must register your business in Tonga, notify the relevant supervisory authority (likely the NRBT or FIU, depending on the specifics and which body is designated for VASP oversight under the Act's implementation), and demonstrate full compliance with AML/CFT obligations.

Traditional Licensing: If your VASP business also conducts activities that fall under traditional financial services (e.g., money remittance using fiat currency), then you would also need to seek appropriate licenses from the National Reserve Bank of Tonga for those specific activities.

AML/KYC (Anti-Money Laundering / Know Your Customer):

Customer Due Diligence (CDD): Implementing robust procedures to identify and verify the identity of customers (individuals and corporate entities). This includes collecting names, addresses, dates of birth, national identification numbers, and beneficial ownership information for legal entities.

Money Laundering and Terrorist Financing Act 2018 (as amended): This is the foundational law establishing the AML/CFT framework, defining offenses, setting out reporting obligations, and granting powers to authorities. It likely includes definitions that capture VASPs or their activities.

Identification and Verification of Customer Identity:

For natural persons: Obtaining and verifying name, date of birth, residential address, and national identification number or passport details using reliable, independent source documents, data, or information.

For legal entities (e.g., companies): Obtaining and verifying the entity's name, legal form, proof of incorporation/existence, registered address, names of directors/partners, and proof of authority of persons acting on its behalf.

Identification and Verification of Beneficial Owners (UBOs): Taking reasonable measures to identify and verify the identity of the ultimate beneficial owners of the customer, especially for legal entities and trusts.

Understanding the Purpose and Intended Nature of the Business Relationship: Gathering information about the customer's intended activities and the purpose for which the VASP's services will be used.

Ongoing Monitoring: Continuously monitoring the business relationship and transactions to ensure they are consistent with the VASP's knowledge of the customer, their business, and risk profile, including, where necessary, the source of funds.

Enhanced Due Diligence (EDD): Applying enhanced measures for higher-risk situations, such as:

Transactions or relationships involving Politically Exposed Persons (PEPs).

Complex, unusually large transactions, or unusual patterns of transactions that have no apparent economic or lawful purpose.

Cross-border correspondent relationships (if applicable).

Customers from high-risk jurisdictions.

No Monetary Threshold: STRs must be filed regardless of the amount of the transaction.

"Tipping Off" Prohibition: VASPs and their employees are prohibited from disclosing to the customer or a third party that an STR has been or will be filed.

Customer Due Diligence Records: All identification and verification data, beneficial ownership information, and supporting documents.

Transaction Records: Details of all transactions, including the amount, currency (both fiat and virtual assets), date, type of transaction, and the identity of the sender and receiver (including information required by the FATF "Travel Rule" for virtual asset transfers).

Business Relationship Records: Records pertaining to the business relationship and ongoing monitoring.

Internal Reports and STRs: Copies of all internal suspicious activity reports and STRs submitted to the TFIU.

Duration: Records must generally be kept for a period of at least five (5) years after the business relationship has ended or after the date of an occasional transaction.

FATF Standards: Tonga, as a member of the Asia/Pacific Group on Money Laundering (APG) (a FATF-style regional body), is expected to implement FATF Recommendations, including Recommendation 15 (New Technologies) and its interpretative note, which specifically addresses VASPs and the "Travel Rule" (requiring VASPs to obtain and transmit originator and beneficiary information for virtual asset transfers above a certain threshold).

Risk Assessment: Implementing a thorough institutional risk assessment to identify and mitigate ML/TF risks specific to their VASP operations is crucial.

Internal Controls: Developing and implementing robust internal controls, policies, procedures, and training programs for staff are essential for compliance.

December 2023: The NRBT reiterated warnings about crypto investments, noting their unregulated nature and high risks, following a trend of public advisories. This was part of their general consumer protection mandate.

June 2022: The NRBT issued a comprehensive warning about the risks of virtual assets, emphasizing that they are not legal tender in Tonga and are unregulated.

February 2021: A warning was issued regarding crypto scams and the inherent risks of dealing with unregulated entities.

Tonga has not yet established a comprehensive regulatory framework specifically for virtual assets, which means that enforcement actions related to licensing or specific crypto laws are limited.

The NRBT's approach has been proactive in terms of consumer protection through public warnings, but there's no public record of significant penalties or enforcement actions against specific cryptocurrency businesses or individuals in Tonga within the requested timeframe.

Tonga is a member of the Asia/Pacific Group on Money Laundering (APG), indicating its commitment to AML/CFT standards. However, the implementation of these standards for virtual assets is an ongoing challenge for many small jurisdictions.