Taiwan -- Custody Regulations Regulatory Overview

Taiwan's regulatory approach to cryptocurrency and digital assets has primarily focused on Anti-Money Laundering (AML) and Counter-Terrorism Financing (CTF) measures for Virtual Asset Service Providers (VASPs). While a comprehensive regulatory framework specifically for digital asset custody, akin to traditional financial services, is still under development, the Financial Supervisory Commission (FSC) has been proactive in setting initial guidelines and is working towards a dedicated law.

Here's a breakdown of the current situation:

Key Regulatory Body

• Financial Supervisory Commission (FSC): The primary financial regulator in Taiwan responsible for overseeing financial institutions and has extended its oversight to VASPs regarding AML/CTF.

Current Regulatory Framework (Primarily AML-Focused)

The core regulation currently applicable to VASPs (including those providing custody services) is:

• Regulations Governing Anti-Money Laundering and Countering the Financing of Terrorism for Virtual Asset Service Providers (虛擬資產平台及交易業務事業防制洗錢及打擊資恐辦法)
  • Issued by the FSC, effective July 1, 2021.
  • URL (FSC Announcement): https://www.fsc.gov.tw/ch/home.jsp?id=96&aplistdnid=0&dfile=list&qnode=14810 (Official Chinese text. English translations are often unofficial but widely available via legal firms).
  • These regulations require VASPs to implement robust internal control systems for AML/CTF, report suspicious transactions, and conduct due diligence.

Specific Custody-Related Aspects

1. Custodial License Requirements:

   • Current State: There is no specific, dedicated "digital asset custody license" in Taiwan. However, engaging in "custody or administration of virtual assets or instruments enabling control over virtual assets" is defined as a Virtual Asset Service Provider (VASP) activity under Article 2, Paragraph 4 of the VASP AML Regulations.
   • Therefore, any entity providing custody services is considered a VASP and must comply with the FSC's VASP AML Regulations, including registration with the FSC, establishing internal control systems, and adhering to AML/CTF obligations. This is a registration and compliance requirement rather than a comprehensive licensing regime for prudential supervision of custody specifically.
   • Reference: VASP AML Regulations, Article 2, Paragraph 4.

2. Segregation of Client Assets Rules:

   • Current State: The VASP AML Regulations (Article 11) generally require VASPs to establish internal control and audit systems, including "measures for safeguarding virtual assets." While it does not explicitly mandate precise "on-chain segregation" to unique addresses per client or legal entity, it implicitly requires systems that ensure the safety and proper management of client assets. Best practices in the industry, even without explicit legal mandate, typically involve robust measures to distinguish client assets from proprietary assets.
   • Reference: VASP AML Regulations, Article 11.

3. Insurance/Bonding Requirements:

   • Current State: There are no explicit regulatory mandates for VASPs to carry specific insurance or bonding for virtual asset custody in the current VASP AML Regulations. This is an area expected to be addressed in future comprehensive legislation.
   • Many reputable VASPs may acquire insurance as part of their risk management, but it's not a regulatory requirement at present.

4. Cold Storage Mandates:

   • Current State: The VASP AML Regulations (Article 11) require VASPs to implement "appropriate security measures" for safeguarding virtual assets. While cold storage is widely recognized as a critical security measure for virtual assets, the regulations do not explicitly mandate its use or specify percentages of assets to be held in cold storage. The choice of specific security measures is left to the VASP's internal control framework, subject to FSC oversight for appropriateness.
   • Reference: VASP AML Regulations, Article 11.

5. Qualified Custodian Definitions:

   • Current State: There is no specific legal definition of a "qualified custodian" for digital assets in Taiwan's existing regulations, similar to definitions found in traditional securities law (e.g., in the U.S.). Any entity performing custody as a VASP must comply with the VASP AML Regulations. The forthcoming comprehensive legislation is expected to address and potentially define such roles more clearly.

Pending Custody Legislation / Future Developments

• Comprehensive VASP Special Law: The FSC has publicly announced its intention to establish a dedicated and comprehensive regulatory framework for virtual assets, moving beyond just AML/CTF.

  • In September 2023, the FSC outlined its plans for a new "special law" for virtual assets, which will cover aspects such as:
    • Capital requirements: For VASPs.
    • Business rules: For token issuance and trading.
    • Investor protection: Including segregation of client assets, insurance/compensation mechanisms.
    • Custody rules: Likely to be more detailed and specific regarding security, operational resilience, and potentially the definition of qualified custodians.
  • The FSC indicated that it plans to complete a draft of this special law in 2024. This new law is expected to significantly deepen the regulatory oversight of custody services, bringing them more in line with traditional financial custody requirements.

• FSC News Release (September 2023 - Chinese): https://www.fsc.gov.tw/ch/home.jsp?id=96&aplistdnid=0&dfile=list&qnode=14810&args=AAABBBCAAAP_10&mode=&sname=&tsearch=&attrs= (Look for news releases around September 2023 regarding virtual asset supervision).

In summary: Taiwan is transitioning from an AML-centric approach to a more comprehensive regulatory framework for digital assets, including custody. While specific prudential rules for custody (like explicit segregation mandates, insurance, or cold storage requirements) are not yet in force, they are expected to be a core part of the upcoming special law for virtual assets currently being drafted by the FSC. Entities currently providing custody services must operate as registered VASPs and adhere to existing AML/CTF regulations.

Disclaimer: This information is for general informational purposes only and does not constitute legal, financial, or professional advice. Regulations are subject to change, and specific situations may require expert consultation. Always refer to the official and most current regulatory texts and seek legal counsel for specific guidance.