Self-custodial wallet / non-custodial software in Tonga

Virtual Asset (VA): Defined broadly to mean a digital representation of value that can be digitally traded or transferred and used for payment or investment purposes. It does not include digital representations of fiat currencies, securities, or other financial assets that are already covered by other laws.

Virtual Asset Service Provider (VASP): Defined as any natural or legal person who, as a business, conducts one or more of the following activities for or on behalf of another natural or legal person:

Safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets (custody providers).

No specific "crypto license" is issued. Instead, if your business activity falls under the definition of a VASP (which exchanges, custody providers, and payment processors dealing with virtual assets invariably do), you will be treated as a "reporting entity" under the Money Laundering and Terrorist Financing Act 2020.

Registration Regime (AML/CFT focused): For VASPs, Tonga operates more of a registration and compliance oversight regime rather than a bespoke licensing regime. VASPs are categorized as "reporting entities" under the MLTFA 2020.

AML/KYC (Anti-Money Laundering / Know Your Customer):

Money Laundering and Terrorist Financing Act 2018 (as amended): This is the foundational law establishing the AML/CFT framework, defining offenses, setting out reporting obligations, and granting powers to authorities. It likely includes definitions that capture VASPs or their activities.

Identification and Verification of Customer Identity:

For natural persons: Obtaining and verifying name, date of birth, residential address, and national identification number or passport details using reliable, independent source documents, data, or information.

For legal entities (e.g., companies): Obtaining and verifying the entity's name, legal form, proof of incorporation/existence, registered address, names of directors/partners, and proof of authority of persons acting on its behalf.

Identification and Verification of Beneficial Owners (UBOs): Taking reasonable measures to identify and verify the identity of the ultimate beneficial owners of the customer, especially for legal entities and trusts.

Understanding the Purpose and Intended Nature of the Business Relationship: Gathering information about the customer's intended activities and the purpose for which the VASP's services will be used.

Ongoing Monitoring: Continuously monitoring the business relationship and transactions to ensure they are consistent with the VASP's knowledge of the customer, their business, and risk profile, including, where necessary, the source of funds.

Enhanced Due Diligence (EDD): Applying enhanced measures for higher-risk situations, such as:

No Monetary Threshold: STRs must be filed regardless of the amount of the transaction.

"Tipping Off" Prohibition: VASPs and their employees are prohibited from disclosing to the customer or a third party that an STR has been or will be filed.

Customer Due Diligence Records: All identification and verification data, beneficial ownership information, and supporting documents.

Transaction Records: Details of all transactions, including the amount, currency (both fiat and virtual assets), date, type of transaction, and the identity of the sender and receiver (including information required by the FATF "Travel Rule" for virtual asset transfers).

Business Relationship Records: Records pertaining to the business relationship and ongoing monitoring.

Internal Reports and STRs: Copies of all internal suspicious activity reports and STRs submitted to the TFIU.

Duration: Records must generally be kept for a period of at least five (5) years after the business relationship has ended or after the date of an occasional transaction.

FATF Standards: Tonga, as a member of the Asia/Pacific Group on Money Laundering (APG) (a FATF-style regional body), is expected to implement FATF Recommendations, including Recommendation 15 (New Technologies) and its interpretative note, which specifically addresses VASPs and the "Travel Rule" (requiring VASPs to obtain and transmit originator and beneficiary information for virtual asset transfers above a certain threshold).

Risk Assessment: Implementing a thorough institutional risk assessment to identify and mitigate ML/TF risks specific to their VASP operations is crucial.

Internal Controls: Developing and implementing robust internal controls, policies, procedures, and training programs for staff are essential for compliance.

Entity Targeted: General Public / Unregulated Cryptocurrency Schemes and Platforms. Violation Type: Unregistered financial services, operating outside regulated financial system, potential for investment fraud, high volatility risks, lack of consumer protection, lack of Anti-Money Laundering (AML) / Counter-Financing of Terrorism (CFT) oversight. Penalty Amount: N/A (Public Warning).

December 2023: The NRBT reiterated warnings about crypto investments, noting their unregulated nature and high risks, following a trend of public advisories. This was part of their general consumer protection mandate.

June 2022: The NRBT issued a comprehensive warning about the risks of virtual assets, emphasizing that they are not legal tender in Tonga and are unregulated.

Tonga has not yet established a comprehensive regulatory framework specifically for virtual assets, which means that enforcement actions related to licensing or specific crypto laws are limited.

Tonga is a member of the Asia/Pacific Group on Money Laundering (APG), indicating its commitment to AML/CFT standards. However, the implementation of these standards for virtual assets is an ongoing challenge for many small jurisdictions.