Custodial wallet / SaaS in Tuvalu
Hosted wallet provider that holds keys on behalf of end users, often white-labeled to businesses (custody as a service).
Custodial SaaS is conditionally permitted in Tuvalu with a local entity, subject to AML obligations and low licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- Low
- Last updated
- 2026-07-13
AML Obligations
- Customer Due Diligence (CDD): identify and verify customers and beneficial owners under the Money Laundering and Proceeds of Crime Act 2017.
- Ongoing Monitoring: monitor customer transactions for suspicious activity.
- Record Keeping: maintain records of customer identification and transactions.
- Suspicious Transaction Reporting (STR): report suspicious activities to the Tuvalu Financial Intelligence Unit (FIU).
- AML/CTF obligations apply to any entity dealing with virtual assets; the SaaS provider is the responsible entity as the regulated 'financial institution' (the white-label client may also have obligations if it touches fiat).
- Oversight by the Tuvalu FIU under the Tuvalu Financial Intelligence Unit Act 2017 and the Money Laundering and Proceeds of Crime Act 2017.
Key Restrictions
- No dedicated crypto/custody license exists — the legal status of custodial wallet services is ambiguous under existing law.
- Any entity must first register as a company under the Companies Act 1991 (domestic) or International Companies Act 1993 (offshore).
- If activities are later deemed by the TFSA to fall under financial services definitions, a general financial services license may become required — creating legal uncertainty.
- A local physical presence, local directors, and a registered office are likely required for any regulated financial activity.
- No specific segregation, insurance, or proof-of-reserves rules exist for custodial crypto assets.
Key Risks
- Regulatory ambiguity: no clear legal classification for custodial wallet services creates risk of retroactive enforcement if TFSA reinterprets activity as regulated financial services.
- Extremely limited regulatory capacity and enforcement infrastructure means operator guidance is scarce and compliance certainty is low.
- No crypto-specific enforcement actions on record, but also no legal safe harbor — operator may be operating in a gray zone.
- Lack of dedicated custodian rules means there is no framework for segregation, insurance, or proof-of-reserves, creating operational and client-protection exposure.
- Small jurisdiction risk: any shift in FATF recommendations or political/regulatory attention could rapidly change the landscape.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
No specific cryptocurrency/VASP licenses currently exist. Unlike jurisdictions with mature crypto regulations (e.g., Malta, Singapore, Estonia), Tuvalu has not introduced bespoke licenses for these activities.
General Financial Services Licences (Potential for Interpretation): It is possible that certain activities, particularly those involving the conversion of virtual assets to fiat currency or managing third-party funds (even if denominated in virtual assets), could be interpreted by regulators as falling under existing general financial services laws, such as those governing money transmission, offshore banking, or investment services. However, this would require a specific legal interpretation by the Tuvalu Financial Services Authority (TFSA) or the Ministry of Finance, and there's no public guidance to suggest this is routinely applied to pure crypto businesses.
Company Registration: Any entity operating in Tuvalu, regardless of its specific activities, would first need to be registered as a company under the Companies Act 1991 or the International Companies Act 1993 (for offshore entities). This is a general business registration, not a financial services license.
For virtual assets, neither a specific registration nor a specific licensing regime exists.
Entities engaging in VASP activities would typically register as a general company. If their activities were later deemed by the TFSA to fall under existing financial services definitions, they might then be required to pursue a specific license under those general financial services acts (e.g., for money transmission, offshore banking, or investment advice). However, without clear definitions for virtual assets in these acts, this remains speculative.
Capital Requirements: For general financial services entities, capital requirements vary depending on the specific activity. If crypto activities were ever licensed, similar capital adequacy rules would likely apply, proportional to the scope and risk of operations.
AML/KYC Requirements: This is the most definite area of regulation. Tuvalu is a member of the Asia/Pacific Group on Money Laundering (APG) and has enacted legislation to combat money laundering and terrorist financing. Any entity operating in Tuvalu, including those dealing with virtual assets, would be subject to:
Customer Due Diligence (CDD): Identifying and verifying the identity of customers and beneficial owners.
Ongoing Monitoring: Monitoring customer transactions for suspicious activity.
Record Keeping: Maintaining records of customer identification and transactions.
Suspicious Transaction Reporting (STR): Reporting suspicious activities to the Tuvalu Financial Intelligence Unit (FIU).
Tuvalu's Money Laundering and Proceeds of Crime Act 2017 and the Tuvalu Financial Intelligence Unit Act 2017 would be the primary legal instruments.
Local Presence: For most regulated financial services, a local physical presence, local directors, and/or a registered office are typically required. This would likely be a requirement for any future dedicated crypto license.
Cybersecurity & Data Protection: While not unique to crypto, entities would need to comply with general data protection principles (if any specific legislation exists beyond general privacy expectations) and implement robust cybersecurity measures to protect customer assets and data.
No specific application process for crypto licenses exists.
General Company Registration: The process would involve applying to the Registrar of Companies (under the Ministry of Finance) to incorporate a company. This involves submitting articles of association, details of directors and shareholders, and paying registration fees.
If, in the future, a general financial services license were deemed necessary for crypto activities, the application would likely be made to the Tuvalu Financial Services Authority (TFSA), involving detailed business plans, financial projections, AML/CTF policies, and fit-and-proper checks for directors and significant shareholders.
Tuvalu Financial Services Authority (TFSA): The primary regulator for financial services.
Tuvalu Financial Services Authority Act 2010: Establishes the TFSA and its powers.
Tuvalu Financial Intelligence Unit (FIU): The body responsible for receiving and analyzing suspicious transaction reports.
Tuvalu Financial Intelligence Unit Act 2017: Governs the FIU's operations and mandates reporting obligations.
Anti-Money Laundering and Counter-Terrorist Financing (AML/CTF) Legislation:
Money Laundering and Proceeds of Crime Act 2017: The primary legislation for AML/CTF, which would apply to any entity engaged in financial activities, including those involving virtual assets. This act defines "financial institutions" and "designated non-financial businesses and professions" that have AML obligations. While virtual assets aren't specifically named for licensing purposes, their handling could bring an entity under the scope of these definitions for AML purposes, especially if it involves traditional financial flows.
Limited Financial Sector & Regulatory Capacity: Tuvalu is a very small island nation with a nascent financial sector. Its regulatory infrastructure, especially concerning complex and emerging areas like cryptocurrency, is extremely limited compared to larger economies.
Lack of Dedicated Crypto Legislation/Regulators: Tuvalu does not appear to have dedicated legislation or a specific regulatory body focused solely on cryptocurrency supervision or enforcement as seen in major financial jurisdictions.
Focus on AML/CFT (if any): Any financial oversight would primarily fall under anti-money laundering and combating the financing of terrorism (AML/CFT) frameworks. The Tuvalu Financial Intelligence Unit (TFIU) would be the most relevant body for financial intelligence and potentially coordinating investigations into financial crimes, including those involving digital assets. However, their actions, especially concerning specific entities and penalties, are rarely publicized with the level of detail requested for a jurisdiction of this size.
No Public Records: A thorough review of available public records, news reports, government publications, and international financial regulatory databases (like those from the FATF or regional bodies that might monitor Tuvalu) reveals no publicly reported cryptocurrency enforcement actions originating from Tuvalu in recent years. This suggests either:
No significant enforcement actions have taken place.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- low
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — custodial wallet / SaaS operations are legally ambiguous in Tuvalu; no specific crypto or custody license exists, but the operator must register as a company, comply with general AML/CTF obligations under the Money Laundering and Proceeds of Crime Act 2017, and faces the risk that activities may later be deemed regulated financial services requiring a general license from the TFSA.
Questions this verdict aims to answer
- What custody license / qualified-custodian status applies?
- What segregation, insurance, and proof-of-reserves rules apply?
- What AML obligations attach to the SaaS vs the white-label client?