Custodial wallet / SaaS in Taiwan
Hosted wallet provider that holds keys on behalf of end users, often white-labeled to businesses (custody as a service).
Custodial SaaS is conditionally permitted in Taiwan with a local entity, subject to AML obligations and medium licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- Medium
- Last updated
- 2026-07-13
AML Obligations
- VASP AML Registration with the FSC (3–6 month process, 16+ VASPs approved since March 2024) — custodial wallet / SaaS providers are captured under Article 2, Paragraph 4 of the VASP AML Regulations as engaging in 'custody or administration of virtual assets or instruments enabling control over virtual assets'
- Implement robust internal control systems for AML/CTF under the Regulations Governing Anti-Money Laundering and Countering Terrorism Financing for Virtual Asset Service Providers (effective July 1, 2021, issued by FSC)
- Suspicious transaction reporting obligations to the FSC
- Customer due diligence (CDD) and ongoing monitoring requirements
- Travel Rule compliance per FSC guidance
- Record-keeping and audit obligations under Article 11 of the VASP AML Regulations (including measures for safeguarding virtual assets)
- The SaaS provider (custodian) bears primary AML responsibility as the registered VASP; the white-label client's AML obligations depend on whether the client itself qualifies as a VASP and must be contractually allocated
Key Restrictions
- No dedicated digital asset custody license exists — custody services are regulated under the VASP AML framework, not a qualified-custodian regime
- Customer asset segregation is required under FSC guidelines, but no explicit mandate for on-chain segregation to unique addresses per client
- No current regulatory mandate for insurance, bonding, or cold storage for custodial wallets (expected in future VASP special law)
- No legal definition of 'qualified custodian' for digital assets in current Taiwan regulations
- The VASP Act (dedicated legislation) is under legislative review (expected 2025–2026) — obligations may materially change once enacted
- Stablecoin framework under development
Key Risks
- Regulatory ambiguity — no dedicated custody license or qualified-custodian definition means reliance on evolving FSC guidelines and a pending special law
- Enforcement precedent — major fraud cases (ACE Exchange founder arrest, Pi Network pyramid schemes, Telegram investment scams) show aggressive prosecution of unregistered or fraudulent operators, creating reputational risk for the sector
- Future legislative risk — the upcoming VASP special law (expected 2025–2026) may introduce capital requirements, insurance mandates, and stricter custody rules that existing operators must adapt to
- No explicit insurance/bonding requirement today leaves custodial wallet providers exposed to operational risk and may be a gap relative to institutional client expectations
- SaaS / white-label structure creates ambiguity about which party bears AML obligations — FSC guidance primarily targets the registered VASP, not the white-label client
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
VASP: VASP Registration under FSC guidelines (3-6 months). Dedicated VASP law under legislative review. Approach influenced by Japan and Singapore models. MaiCoin and BitoPro are major local players.
CUSTODY: Customer asset segregation required under FSC guidelines
FSC — VASP guidelines and oversight — dedicated law under legislative review
Guiding Principles for Management of Virtual Asset Service Providers (2023) — VASP registration and conduct guidelines (being formalized into law, expected 2025-2026)
FSC Guidelines and Oversight: The FSC issues guidance (e.g., VASP Application Guidance, AML/CFT Notes, Travel Rule Guidance) and FAQs (latest published November 21, 2025) covering VASP definitions, registration, compliance obligations like AML/CFT systems, audits, and record-keeping, plus supervisory powers including enforcement and risk-based monitoring.
Registration and Status: Over 16 VASPs have been approved since March 2024, with the FSC committing to initial feedback within 6 weeks and decisions within 6 months, though actual timelines vary.
Financial Supervisory Commission (FSC): The primary financial regulator in Taiwan responsible for overseeing financial institutions and has extended its oversight to VASPs regarding AML/CTF.
Regulations Governing Anti-Money Laundering and Countering Terrorism Financing for Virtual Asset Service Providers (虛擬通貨平台及交易業務事業防制洗錢及打擊資恐辦法)
Issued by the FSC, effective July 1, 2021.
These regulations require VASPs to implement robust internal control systems for AML/CTF, report suspicious transactions, and conduct due diligence.
Custodial License Requirements:
Current State: There is no specific, dedicated "digital asset custody license" in Taiwan. However, engaging in "custody or administration of virtual assets or instruments enabling control over virtual assets" is defined as a Virtual Asset Service Provider (VASP) activity under Article 2, Paragraph 4 of the VASP AML Regulations.
Therefore, any entity providing custody services is considered a VASP and must comply with the FSC's VASP AML Regulations, including registration with the FSC, establishing internal control systems, and adhering to AML/CTF obligations. This is a registration and compliance requirement rather than a comprehensive licensing regime for prudential supervision of custody specifically.
Reference: VASP AML Regulations, Article 2, Paragraph 4.
Segregation of Client Assets Rules:
Current State: The VASP AML Regulations (Article 11) generally require VASPs to establish internal control and audit systems, including "measures for safeguarding virtual assets." While it does not explicitly mandate precise "on-chain segregation" to unique addresses per client or legal entity, it implicitly requires systems that ensure the safety and proper management of client assets. Best practices in the industry, even without explicit legal mandate, typically involve robust measures to distinguish client assets from proprietary assets.
Reference: VASP AML Regulations, Article 2, Paragraph 4.
Current State: There are no explicit regulatory mandates for VASPs to carry specific insurance or bonding for virtual asset custody in the current VASP AML Regulations. This is an area expected to be addressed in future comprehensive legislation.
Many reputable VASPs may acquire insurance as part of their risk management, but it's not a regulatory requirement at present.
Qualified Custodian Definitions:
Current State: There is no specific, dedicated "digital asset custody license" in Taiwan. However, engaging in "custody or administration of virtual assets or instruments enabling control over virtual assets" is defined as a Virtual Asset Service Provider (VASP) activity under Article 2, Paragraph 4 of the VASP AML Regulations.
Comprehensive VASP Special Law: The FSC has publicly announced its intention to establish a dedicated and comprehensive regulatory framework for virtual assets, moving beyond just AML/CTF.
In September 2023, the FSC outlined its plans for a new "special law" for virtual assets, which will cover aspects such as:
Capital requirements: For VASPs.
Business rules: For token issuance and trading.
Investor protection: Including segregation of client assets, insurance/compensation mechanisms.
Custody rules: Likely to be more detailed and specific regarding security, operational resilience, and potentially the definition of qualified custodians.
FSC News Release (September 2023 - Chinese): https://www.fsc.gov.tw/ch/home.jsp?id=96&aplistdnid=0&dfile=list&qnode=14810&args=AAABBBCAAAP_10&mode=&sname=&tsearch=&attrs= (Look for news releases around September 2023 regarding virtual asset supervision).
Entity Targeted: David Pan (潘奕hofer), founder of ACE Exchange, and approximately 10 other individuals. Violation Type: Fraud, money laundering, operating an illegal pyramid scheme, organized crime. The group allegedly used fake tokens (NFTC, MOCT) to defraud investors out of hundreds of millions of New Taiwan Dollars. Penalty Amount: Assets worth over NT$200 million (approximately US$6.4 million) were frozen, including real estate, luxury cars, and cryptocurrency. The investigation is ongoing, and final penalties (imprisonment, further asset forfeiture) will be determined by the courts. Outcome: Key individuals, including the founder of a prominent Taiwanese exchange, were arrested. Assets were frozen, and legal proceedings are underway. This was a major blow to investor confidence and highlighted the risks within the unregulated parts of the crypto market.
Entity Targeted: Numerous individuals and groups promoting "Pi Network" as a guaranteed high-return investment or operating multi-level marketing (MLM) schemes based on its unlisted cryptocurrency. Violation Type: Fraud, operating illegal pyramid schemes (violation of the Multi-level Marketing Supervision Act), misleading advertising. Penalty Amount: Varies per case, but includes arrests, asset seizures (though often smaller sums of cash, not directly crypto), and fines/imprisonment upon conviction. Specific aggregate amounts for all Pi Network-related crackdowns are hard to tally as they are localized efforts. Outcome: Numerous arrests across Taiwan, public warnings issued by authorities regarding the risks of Pi Network and similar speculative "investments," helping to protect potential victims.
Entity Targeted: Individuals involved in online romance scams and investment fraud predominantly using Telegram, convincing victims to invest in fake cryptocurrency platforms. Violation Type: Fraud, money laundering. Penalty Amount: Arrests, freezing of bank accounts, and seizure of assets (e.g., millions of NTD in illicit gains). Specific fines and prison sentences are determined post-conviction. One operation in 2023 alone saw NT$110 million (US$3.5 million) in illicit gains seized. Outcome: Multiple arrests, significant amounts of illicit funds frozen or seized, raising public awareness about online investment scams.
Outcome: Key individuals, including the founder of a prominent Taiwanese exchange, were arrested. Assets were frozen, and legal proceedings are underway. This was a major blow to investor confidence and highlighted the risks within the unregulated parts of the crypto market.
Outcome: Numerous arrests across Taiwan, public warnings issued by authorities regarding the risks of Pi Network and similar speculative "investments," helping to protect potential victims.
Outcome: Multiple arrests, significant amounts of illicit funds frozen or seized, raising public awareness about online investment scams.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — custodial wallet / SaaS providers are treated as VASPs under Taiwan's FSC AML framework and must register, implement AML/CTF systems, and segregate client assets, but no dedicated custody license or qualified-custodian regime exists yet; a comprehensive VASP special law (expected 2025–2026) will likely introduce capital, insurance, and stricter custody rules.
Questions this verdict aims to answer
- What custody license / qualified-custodian status applies?
- What segregation, insurance, and proof-of-reserves rules apply?
- What AML obligations attach to the SaaS vs the white-label client?