← Regulations / Taiwan / Operating Models / Custodial SaaS

Custodial wallet / SaaS in Taiwan

Hosted wallet provider that holds keys on behalf of end users, often white-labeled to businesses (custody as a service).

Conditional AI-Generated · Unreviewed

Custodial SaaS is conditionally permitted in Taiwan with a local entity, subject to AML obligations and medium licensing burden.

Verdict Details

Permitted
conditional
Local entity required
Yes
Licensing burden
Medium
Last updated
2026-07-13

AML Obligations

  • VASP AML Registration with the FSC (3–6 month process, 16+ VASPs approved since March 2024) — custodial wallet / SaaS providers are captured under Article 2, Paragraph 4 of the VASP AML Regulations as engaging in 'custody or administration of virtual assets or instruments enabling control over virtual assets'
  • Implement robust internal control systems for AML/CTF under the Regulations Governing Anti-Money Laundering and Countering Terrorism Financing for Virtual Asset Service Providers (effective July 1, 2021, issued by FSC)
  • Suspicious transaction reporting obligations to the FSC
  • Customer due diligence (CDD) and ongoing monitoring requirements
  • Travel Rule compliance per FSC guidance
  • Record-keeping and audit obligations under Article 11 of the VASP AML Regulations (including measures for safeguarding virtual assets)
  • The SaaS provider (custodian) bears primary AML responsibility as the registered VASP; the white-label client's AML obligations depend on whether the client itself qualifies as a VASP and must be contractually allocated

Key Restrictions

  • No dedicated digital asset custody license exists — custody services are regulated under the VASP AML framework, not a qualified-custodian regime
  • Customer asset segregation is required under FSC guidelines, but no explicit mandate for on-chain segregation to unique addresses per client
  • No current regulatory mandate for insurance, bonding, or cold storage for custodial wallets (expected in future VASP special law)
  • No legal definition of 'qualified custodian' for digital assets in current Taiwan regulations
  • The VASP Act (dedicated legislation) is under legislative review (expected 2025–2026) — obligations may materially change once enacted
  • Stablecoin framework under development

Key Risks

  • Regulatory ambiguity — no dedicated custody license or qualified-custodian definition means reliance on evolving FSC guidelines and a pending special law
  • Enforcement precedent — major fraud cases (ACE Exchange founder arrest, Pi Network pyramid schemes, Telegram investment scams) show aggressive prosecution of unregistered or fraudulent operators, creating reputational risk for the sector
  • Future legislative risk — the upcoming VASP special law (expected 2025–2026) may introduce capital requirements, insurance mandates, and stricter custody rules that existing operators must adapt to
  • No explicit insurance/bonding requirement today leaves custodial wallet providers exposed to operational risk and may be a gap relative to institutional client expectations
  • SaaS / white-label structure creates ambiguity about which party bears AML obligations — FSC guidance primarily targets the registered VASP, not the white-label client

Evidence

This verdict synthesizes the following facts. Each fact links to its primary source(s).

licensing 20% confidence

VASP: VASP Registration under FSC guidelines (3-6 months). Dedicated VASP law under legislative review. Approach influenced by Japan and Singapore models. MaiCoin and BitoPro are major local players.

licensing 20% confidence

CUSTODY: Customer asset segregation required under FSC guidelines

licensing 40% confidence

FSC — VASP guidelines and oversight — dedicated law under legislative review

licensing 20% confidence

Guiding Principles for Management of Virtual Asset Service Providers (2023) — VASP registration and conduct guidelines (being formalized into law, expected 2025-2026)

licensing 20% confidence

FSC Guidelines and Oversight: The FSC issues guidance (e.g., VASP Application Guidance, AML/CFT Notes, Travel Rule Guidance) and FAQs (latest published November 21, 2025) covering VASP definitions, registration, compliance obligations like AML/CFT systems, audits, and record-keeping, plus supervisory powers including enforcement and risk-based monitoring.

licensing 20% confidence

Registration and Status: Over 16 VASPs have been approved since March 2024, with the FSC committing to initial feedback within 6 weeks and decisions within 6 months, though actual timelines vary.

aml 60% confidence

Financial Supervisory Commission (FSC): The primary financial regulator in Taiwan responsible for overseeing financial institutions and has extended its oversight to VASPs regarding AML/CTF.

aml 60% confidence

Regulations Governing Anti-Money Laundering and Countering Terrorism Financing for Virtual Asset Service Providers (虛擬通貨平台及交易業務事業防制洗錢及打擊資恐辦法)

aml 60% confidence

Issued by the FSC, effective July 1, 2021.

aml 60% confidence

These regulations require VASPs to implement robust internal control systems for AML/CTF, report suspicious transactions, and conduct due diligence.

aml 60% confidence

Custodial License Requirements:

aml 60% confidence

Current State: There is no specific, dedicated "digital asset custody license" in Taiwan. However, engaging in "custody or administration of virtual assets or instruments enabling control over virtual assets" is defined as a Virtual Asset Service Provider (VASP) activity under Article 2, Paragraph 4 of the VASP AML Regulations.

aml 60% confidence

Therefore, any entity providing custody services is considered a VASP and must comply with the FSC's VASP AML Regulations, including registration with the FSC, establishing internal control systems, and adhering to AML/CTF obligations. This is a registration and compliance requirement rather than a comprehensive licensing regime for prudential supervision of custody specifically.

aml 60% confidence

Reference: VASP AML Regulations, Article 2, Paragraph 4.

aml 60% confidence

Segregation of Client Assets Rules:

aml 60% confidence

Current State: The VASP AML Regulations (Article 11) generally require VASPs to establish internal control and audit systems, including "measures for safeguarding virtual assets." While it does not explicitly mandate precise "on-chain segregation" to unique addresses per client or legal entity, it implicitly requires systems that ensure the safety and proper management of client assets. Best practices in the industry, even without explicit legal mandate, typically involve robust measures to distinguish client assets from proprietary assets.

aml 60% confidence

Reference: VASP AML Regulations, Article 2, Paragraph 4.

aml 60% confidence

Current State: There are no explicit regulatory mandates for VASPs to carry specific insurance or bonding for virtual asset custody in the current VASP AML Regulations. This is an area expected to be addressed in future comprehensive legislation.

aml 60% confidence

Many reputable VASPs may acquire insurance as part of their risk management, but it's not a regulatory requirement at present.

aml 60% confidence

Qualified Custodian Definitions:

aml 60% confidence

Current State: There is no specific, dedicated "digital asset custody license" in Taiwan. However, engaging in "custody or administration of virtual assets or instruments enabling control over virtual assets" is defined as a Virtual Asset Service Provider (VASP) activity under Article 2, Paragraph 4 of the VASP AML Regulations.

aml 60% confidence

Comprehensive VASP Special Law: The FSC has publicly announced its intention to establish a dedicated and comprehensive regulatory framework for virtual assets, moving beyond just AML/CTF.

aml 60% confidence

In September 2023, the FSC outlined its plans for a new "special law" for virtual assets, which will cover aspects such as:

aml 60% confidence

Capital requirements: For VASPs.

aml 60% confidence

Business rules: For token issuance and trading.

aml 60% confidence

Investor protection: Including segregation of client assets, insurance/compensation mechanisms.

aml 60% confidence

Custody rules: Likely to be more detailed and specific regarding security, operational resilience, and potentially the definition of qualified custodians.

aml 60% confidence

FSC News Release (September 2023 - Chinese): https://www.fsc.gov.tw/ch/home.jsp?id=96&aplistdnid=0&dfile=list&qnode=14810&args=AAABBBCAAAP_10&mode=&sname=&tsearch=&attrs= (Look for news releases around September 2023 regarding virtual asset supervision).

enforcement 85% confidence

Entity Targeted: David Pan (潘奕hofer), founder of ACE Exchange, and approximately 10 other individuals. Violation Type: Fraud, money laundering, operating an illegal pyramid scheme, organized crime. The group allegedly used fake tokens (NFTC, MOCT) to defraud investors out of hundreds of millions of New Taiwan Dollars. Penalty Amount: Assets worth over NT$200 million (approximately US$6.4 million) were frozen, including real estate, luxury cars, and cryptocurrency. The investigation is ongoing, and final penalties (imprisonment, further asset forfeiture) will be determined by the courts. Outcome: Key individuals, including the founder of a prominent Taiwanese exchange, were arrested. Assets were frozen, and legal proceedings are underway. This was a major blow to investor confidence and highlighted the risks within the unregulated parts of the crypto market.

enforcement 60% confidence

Entity Targeted: Numerous individuals and groups promoting "Pi Network" as a guaranteed high-return investment or operating multi-level marketing (MLM) schemes based on its unlisted cryptocurrency. Violation Type: Fraud, operating illegal pyramid schemes (violation of the Multi-level Marketing Supervision Act), misleading advertising. Penalty Amount: Varies per case, but includes arrests, asset seizures (though often smaller sums of cash, not directly crypto), and fines/imprisonment upon conviction. Specific aggregate amounts for all Pi Network-related crackdowns are hard to tally as they are localized efforts. Outcome: Numerous arrests across Taiwan, public warnings issued by authorities regarding the risks of Pi Network and similar speculative "investments," helping to protect potential victims.

enforcement 90% confidence

Entity Targeted: Individuals involved in online romance scams and investment fraud predominantly using Telegram, convincing victims to invest in fake cryptocurrency platforms. Violation Type: Fraud, money laundering. Penalty Amount: Arrests, freezing of bank accounts, and seizure of assets (e.g., millions of NTD in illicit gains). Specific fines and prison sentences are determined post-conviction. One operation in 2023 alone saw NT$110 million (US$3.5 million) in illicit gains seized. Outcome: Multiple arrests, significant amounts of illicit funds frozen or seized, raising public awareness about online investment scams.

enforcement 70% confidence

Outcome: Key individuals, including the founder of a prominent Taiwanese exchange, were arrested. Assets were frozen, and legal proceedings are underway. This was a major blow to investor confidence and highlighted the risks within the unregulated parts of the crypto market.

enforcement 70% confidence

Outcome: Numerous arrests across Taiwan, public warnings issued by authorities regarding the risks of Pi Network and similar speculative "investments," helping to protect potential victims.

enforcement 70% confidence

Outcome: Multiple arrests, significant amounts of illicit funds frozen or seized, raising public awareness about online investment scams.

Verdict Attribution

Source:
AI-Generated · Unreviewed
AI synthesized:
2026-07-13 (deepseek-chat)
Last updated:
2026-07-13
Confidence:
medium

This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.

Conditional — custodial wallet / SaaS providers are treated as VASPs under Taiwan's FSC AML framework and must register, implement AML/CTF systems, and segregate client assets, but no dedicated custody license or qualified-custodian regime exists yet; a comprehensive VASP special law (expected 2025–2026) will likely introduce capital, insurance, and stricter custody rules.

Questions this verdict aims to answer

  • What custody license / qualified-custodian status applies?
  • What segregation, insurance, and proof-of-reserves rules apply?
  • What AML obligations attach to the SaaS vs the white-label client?