Custodial wallet / SaaS in Ukraine

Mandate: The Law "On Virtual Assets" mandates that any entity providing virtual asset services, including custody services, must obtain a permit (дозвіл). This permit functions similarly to a license.

Definition of VASP: Article 1 of the Law defines a "Virtual Asset Service Provider" (VASP) as a legal entity that, as part of its business activities, performs one or more of the following services for or on behalf of another natural or legal person:

Safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets. (This directly covers custody).

Issuing Authority: The NSSMC is generally responsible for issuing these permits. For virtual assets secured by monetary values, the NBU would be the responsible authority.

Specific Conditions: While the Law mandates permits, the specific conditions and procedures for obtaining these permits (e.g., capital requirements, personnel qualifications, technical requirements) are to be established by normative legal acts of the NSSMC and NBU. These specific acts are still largely in development or pending full implementation.

Separate Accounting: Article 12, Part 2, Point 2 requires VASPs to maintain separate accounting records for their own virtual assets and those of their clients. This is a foundational step towards ensuring client assets are not commingled with the VASP's proprietary assets.

The Law "On Virtual Assets" (Article 16, Part 2, Point 2) requires VASPs to ensure the reliable and safe storage of virtual assets and/or instruments enabling control over them. While the law doesn't explicitly use the term "segregation" in the same way traditional finance does for client funds (e.g., separate bank accounts), the underlying principle of protecting client assets is implied through:

The Law "On Virtual Assets" (Article 16, Part 2, Point 2) requires VASPs to ensure the reliable and safe storage of virtual assets and/or instruments enabling control over them. While the law doesn't explicitly use the term "segregation" in the same way traditional finance does for client funds (e.g., separate bank accounts), the underlying principle of protecting client assets is implied through:

However, it is a common regulatory practice in other jurisdictions for financial service providers, especially custodians, to have sufficient capital, insurance, or bonding to cover potential losses due to cyber-attacks, operational failures, or fraud.

AML/CFT Compliance: Obtaining a permit is intrinsically linked to strict adherence to the AML/CFT Law, including KYC procedures, transaction monitoring, and reporting suspicious activities.

While the VA Law is in force, its full implementation, particularly the practical licensing mechanism, depends on the adoption of secondary legislation (resolutions, procedures, and detailed requirements) by the NBU and MinDigital.

As of late 2023/early 2024, this secondary legislation has not yet been fully adopted, meaning the actual process for obtaining a license is largely suspended or not fully operational. The focus of the government has been on wartime priorities.

Custody Providers: Will require a VASP license covering "custody and/or administration services."

Currently, the exact, officially finalized capital requirements are pending the adoption of secondary legislation.

For other VASP activities (e.g., custody, transfer): Potentially around UAH 5 million (approx. $125,000 - $150,000).

These are indicative figures from drafts and should be verified once official regulations are published.

This is a cornerstone of the VA Law and is largely aligned with international standards (FATF recommendations).

VASPs will be subject to the Law of Ukraine "On Preventing and Countering Legalization (Laundering) of Criminal Proceeds, Terrorist Financing and Financing the Proliferation of Weapons of Mass Destruction."

Law of Ukraine No. 361-IX "On Preventing and Counteracting Legalization (Laundering) of Criminal Proceeds, Terrorist Financing and Financing the Proliferation of Weapons of Mass Destruction" (dated December 6, 2019, with subsequent amendments).

This is the foundational AML/CFT law in Ukraine, bringing the country's framework closer to FATF recommendations and the EU's 4th and 5th AML Directives. It designates "virtual asset service providers" as "reporting entities" (subjects of primary financial monitoring).

Identification and Verification:

For Individuals: Obtain and verify the customer's identity, including full name, date of birth, place of birth, address, identification number (where applicable), and details of the identity document (series, number, date of issue, issuing authority). Verification must be based on reliable, independent source documents, data, or information.

For Legal Entities: Obtain and verify the legal entity's name, registration number, legal form, legal address, contact details, and identify the management structure.

Beneficial Owner (UBO) Identification: Identify and take reasonable measures to verify the identity of the beneficial owner(s) of the customer. This is crucial for both individuals (e.g., if acting on behalf of another) and legal entities.

Understanding the Business Relationship:

Conduct ongoing monitoring of the business relationship and transactions undertaken throughout the course of that relationship to ensure consistency with the VASP's knowledge of the customer, their business, and risk profile. This includes monitoring the source of funds and the destination of virtual assets.

Enhanced Due Diligence (EDD):

Transactions above specific thresholds (e.g., equivalent of UAH 400,000 for certain types of operations, though suspicion requires reporting even below this).

Simplified Due Diligence (SDD):

State Financial Monitoring Service of Ukraine (SFMS - Держфінмоніторинг): Responsible for AML/CFT oversight and financial intelligence.

National Securities and Stock Market Commission (NSSMC - НКЦПФР): The primary regulator for virtual assets, especially those secured by currency, valuables, or property rights, and for most VASP activities.

National Bank of Ukraine (NBU - НБУ): Regulates virtual assets secured by monetary values.