← Regulations / Tuvalu / Operating Models / Custodial SaaS

Custodial wallet / SaaS in Tuvalu

Hosted wallet provider that holds keys on behalf of end users, often white-labeled to businesses (custody as a service).

Conditional AI-Generated · Unreviewed

Custodial SaaS is conditionally permitted in Tuvalu with a local entity, subject to AML obligations and low licensing burden.

Verdict Details

Permitted
conditional
Local entity required
Yes
Licensing burden
Low
Last updated
2026-07-13

AML Obligations

  • Customer Due Diligence (CDD): identify and verify customers and beneficial owners under the Money Laundering and Proceeds of Crime Act 2017.
  • Ongoing Monitoring: monitor customer transactions for suspicious activity.
  • Record Keeping: maintain records of customer identification and transactions.
  • Suspicious Transaction Reporting (STR): report suspicious activities to the Tuvalu Financial Intelligence Unit (FIU).
  • AML/CTF obligations apply to any entity dealing with virtual assets; the SaaS provider is the responsible entity as the regulated 'financial institution' (the white-label client may also have obligations if it touches fiat).
  • Oversight by the Tuvalu FIU under the Tuvalu Financial Intelligence Unit Act 2017 and the Money Laundering and Proceeds of Crime Act 2017.

Key Restrictions

  • No dedicated crypto/custody license exists — the legal status of custodial wallet services is ambiguous under existing law.
  • Any entity must first register as a company under the Companies Act 1991 (domestic) or International Companies Act 1993 (offshore).
  • If activities are later deemed by the TFSA to fall under financial services definitions, a general financial services license may become required — creating legal uncertainty.
  • A local physical presence, local directors, and a registered office are likely required for any regulated financial activity.
  • No specific segregation, insurance, or proof-of-reserves rules exist for custodial crypto assets.

Key Risks

  • Regulatory ambiguity: no clear legal classification for custodial wallet services creates risk of retroactive enforcement if TFSA reinterprets activity as regulated financial services.
  • Extremely limited regulatory capacity and enforcement infrastructure means operator guidance is scarce and compliance certainty is low.
  • No crypto-specific enforcement actions on record, but also no legal safe harbor — operator may be operating in a gray zone.
  • Lack of dedicated custodian rules means there is no framework for segregation, insurance, or proof-of-reserves, creating operational and client-protection exposure.
  • Small jurisdiction risk: any shift in FATF recommendations or political/regulatory attention could rapidly change the landscape.

Evidence

This verdict synthesizes the following facts. Each fact links to its primary source(s).

licensing 20% confidence

No specific cryptocurrency/VASP licenses currently exist. Unlike jurisdictions with mature crypto regulations (e.g., Malta, Singapore, Estonia), Tuvalu has not introduced bespoke licenses for these activities.

licensing 20% confidence

General Financial Services Licences (Potential for Interpretation): It is possible that certain activities, particularly those involving the conversion of virtual assets to fiat currency or managing third-party funds (even if denominated in virtual assets), could be interpreted by regulators as falling under existing general financial services laws, such as those governing money transmission, offshore banking, or investment services. However, this would require a specific legal interpretation by the Tuvalu Financial Services Authority (TFSA) or the Ministry of Finance, and there's no public guidance to suggest this is routinely applied to pure crypto businesses.

licensing 20% confidence

Company Registration: Any entity operating in Tuvalu, regardless of its specific activities, would first need to be registered as a company under the Companies Act 1991 or the International Companies Act 1993 (for offshore entities). This is a general business registration, not a financial services license.

licensing 20% confidence

For virtual assets, neither a specific registration nor a specific licensing regime exists.

licensing 20% confidence

Entities engaging in VASP activities would typically register as a general company. If their activities were later deemed by the TFSA to fall under existing financial services definitions, they might then be required to pursue a specific license under those general financial services acts (e.g., for money transmission, offshore banking, or investment advice). However, without clear definitions for virtual assets in these acts, this remains speculative.

licensing 20% confidence

Capital Requirements: For general financial services entities, capital requirements vary depending on the specific activity. If crypto activities were ever licensed, similar capital adequacy rules would likely apply, proportional to the scope and risk of operations.

licensing 20% confidence

AML/KYC Requirements: This is the most definite area of regulation. Tuvalu is a member of the Asia/Pacific Group on Money Laundering (APG) and has enacted legislation to combat money laundering and terrorist financing. Any entity operating in Tuvalu, including those dealing with virtual assets, would be subject to:

licensing 20% confidence

Customer Due Diligence (CDD): Identifying and verifying the identity of customers and beneficial owners.

licensing 20% confidence

Ongoing Monitoring: Monitoring customer transactions for suspicious activity.

licensing 20% confidence

Record Keeping: Maintaining records of customer identification and transactions.

licensing 20% confidence

Suspicious Transaction Reporting (STR): Reporting suspicious activities to the Tuvalu Financial Intelligence Unit (FIU).

licensing 20% confidence

Tuvalu's Money Laundering and Proceeds of Crime Act 2017 and the Tuvalu Financial Intelligence Unit Act 2017 would be the primary legal instruments.

licensing 20% confidence

Local Presence: For most regulated financial services, a local physical presence, local directors, and/or a registered office are typically required. This would likely be a requirement for any future dedicated crypto license.

licensing 20% confidence

Cybersecurity & Data Protection: While not unique to crypto, entities would need to comply with general data protection principles (if any specific legislation exists beyond general privacy expectations) and implement robust cybersecurity measures to protect customer assets and data.

licensing 20% confidence

No specific application process for crypto licenses exists.

licensing 20% confidence

General Company Registration: The process would involve applying to the Registrar of Companies (under the Ministry of Finance) to incorporate a company. This involves submitting articles of association, details of directors and shareholders, and paying registration fees.

licensing 20% confidence

If, in the future, a general financial services license were deemed necessary for crypto activities, the application would likely be made to the Tuvalu Financial Services Authority (TFSA), involving detailed business plans, financial projections, AML/CTF policies, and fit-and-proper checks for directors and significant shareholders.

licensing 20% confidence

Tuvalu Financial Services Authority (TFSA): The primary regulator for financial services.

licensing 20% confidence

Tuvalu Financial Services Authority Act 2010: Establishes the TFSA and its powers.

licensing 20% confidence

Tuvalu Financial Intelligence Unit (FIU): The body responsible for receiving and analyzing suspicious transaction reports.

licensing 20% confidence

Tuvalu Financial Intelligence Unit Act 2017: Governs the FIU's operations and mandates reporting obligations.

licensing 20% confidence

Anti-Money Laundering and Counter-Terrorist Financing (AML/CTF) Legislation:

licensing 20% confidence

Money Laundering and Proceeds of Crime Act 2017: The primary legislation for AML/CTF, which would apply to any entity engaged in financial activities, including those involving virtual assets. This act defines "financial institutions" and "designated non-financial businesses and professions" that have AML obligations. While virtual assets aren't specifically named for licensing purposes, their handling could bring an entity under the scope of these definitions for AML purposes, especially if it involves traditional financial flows.

enforcement 20% confidence

Limited Financial Sector & Regulatory Capacity: Tuvalu is a very small island nation with a nascent financial sector. Its regulatory infrastructure, especially concerning complex and emerging areas like cryptocurrency, is extremely limited compared to larger economies.

enforcement 20% confidence

Lack of Dedicated Crypto Legislation/Regulators: Tuvalu does not appear to have dedicated legislation or a specific regulatory body focused solely on cryptocurrency supervision or enforcement as seen in major financial jurisdictions.

enforcement 20% confidence

Focus on AML/CFT (if any): Any financial oversight would primarily fall under anti-money laundering and combating the financing of terrorism (AML/CFT) frameworks. The Tuvalu Financial Intelligence Unit (TFIU) would be the most relevant body for financial intelligence and potentially coordinating investigations into financial crimes, including those involving digital assets. However, their actions, especially concerning specific entities and penalties, are rarely publicized with the level of detail requested for a jurisdiction of this size.

enforcement 20% confidence

No Public Records: A thorough review of available public records, news reports, government publications, and international financial regulatory databases (like those from the FATF or regional bodies that might monitor Tuvalu) reveals no publicly reported cryptocurrency enforcement actions originating from Tuvalu in recent years. This suggests either:

enforcement 20% confidence

No significant enforcement actions have taken place.

Verdict Attribution

Source:
AI-Generated · Unreviewed
AI synthesized:
2026-07-13 (deepseek-chat)
Last updated:
2026-07-13
Confidence:
low

This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.

Conditional — custodial wallet / SaaS operations are legally ambiguous in Tuvalu; no specific crypto or custody license exists, but the operator must register as a company, comply with general AML/CTF obligations under the Money Laundering and Proceeds of Crime Act 2017, and faces the risk that activities may later be deemed regulated financial services requiring a general license from the TFSA.

Questions this verdict aims to answer

  • What custody license / qualified-custodian status applies?
  • What segregation, insurance, and proof-of-reserves rules apply?
  • What AML obligations attach to the SaaS vs the white-label client?