Custodial wallet / SaaS in United States
Hosted wallet provider that holds keys on behalf of end users, often white-labeled to businesses (custody as a service).
Custodial SaaS is conditionally permitted in United States with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- FinCEN MSB registration (immediate, Form 107) under the Bank Secrecy Act — applies to the SaaS operator as the money transmitter
- State Money Transmitter Licenses (MTLs) required in 49 states + DC (18-36 months for full coverage, $2M-$10M+ in bonds/fees); Montana is sole exemption
- Travel Rule (FinCEN) compliance required for transactions above applicable thresholds
- OFAC sanctions screening required on all transactions
- If the custodian holds digital assets classified as securities (per Howey Test), SEC custody rules apply — including qualification as a qualified custodian, account segregation, quarterly reporting, and annual audits with proof-of-reserves
- New York BitLicense (23 NYCRR Part 200) required for NY customers — 12-24+ months, $2M+ capital
- California DFAL license required effective July 1, 2026, with $100k/day penalties for non-compliance
- IRS reporting obligations — virtual currency treated as property; 1099-B/1099-MISC reporting likely applies depending on user activity
- The SaaS operator (custodian) bears primary AML/BSA obligations as the money transmitter; white-label clients may be considered MSBs themselves if they engage in transmission activities, creating potential dual-reporting obligations
Key Restrictions
- A trust charter (state-level) or OCC national bank charter is typically required to serve as a qualified custodian for digital asset securities
- SEC custody rules apply if the custodian holds any digital assets that are classified as securities — requiring qualified custodian status, segregation of client assets, and annual audit with proof of reserves
- Cannot serve US customers without FinCEN MSB registration and state MTLs; NY requires a separate BitLicense
- The white-label (SaaS) model creates ambiguity about which entity bears the primary AML obligation — both the custodian and the client may need independent MSB/MTL coverage
- Operator must geofence out jurisdictions where it lacks licensing coverage (e.g., NY without BitLicense)
- Insurance/bonding requirements vary by state MTL — typically $100k-$2M surety bond per state plus net worth requirements
Key Risks
- Dual-regulatory risk: assets could be simultaneously classified as commodities (CFTC) and securities (SEC) — different custody and segregation rules apply to each
- SEC enforcement risk if the custodian holds tokens later deemed securities without proper qualified-custodian status
- State-by-state licensing fragmentation — achieving full 50-state coverage is expensive ($2M-$10M+ total) and time-consuming (18-36 months)
- SaaS/white-label structure creates regulatory ambiguity: the custodian may be deemed to share MSB liability with its clients, especially if the custodian facilitates transmission, not just storage
- New York BitLicense requirement is a major barrier — 12-24+ month application and $2M+ minimum capital
- California DFAL effective July 2026 adds another large-state licensing burden with $100k/day penalties
- IRS and state tax authority enforcement risk — NJ Division of Taxation uses automated tools to cross-check reported crypto income against 1099 forms
- OFAC sanctions compliance is high-risk — crypto transactions can involve sanctioned addresses; failure to screen is a DOJ enforcement trigger
- Increasing federal enforcement focus — DOJ has filed civil forfeiture for $225.3M in stolen digital funds (June 2025); SAFE Crypto Act (Dec 2025) and EO 14390 (March 2026) signal intensified anti-fraud efforts
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
SEC — Securities, token classification (Howey Test), broker-dealer/ATS registration
CFTC — Commodities (BTC/ETH classified as commodities), derivatives, anti-fraud in spot markets
FinCEN — AML/BSA, MSB registration, Travel Rule enforcement
OFAC — Sanctions compliance for virtual currency transactions
DOJ — Criminal enforcement — money laundering, fraud, sanctions evasion
Bank Secrecy Act (1970) — AML/CFT, MSB registration and reporting obligations
Securities Act of 1933 / Securities Exchange Act of 1934 (1933) — Securities registration, broker-dealer/exchange/ATS requirements
New York BitLicense (23 NYCRR Part 200) (2015) — NY-specific virtual currency business licensing
California DFAL (2025) — Digital Financial Assets Law — state crypto licensing
VASP: FinCEN MSB registration (immediate, Form 107) + state Money Transmitter Licenses in 49 states + DC (18-36 months for full coverage, $2M-$10M+ in bonds/fees). Montana is sole exemption.
CUSTODY: Trust charter (state-level) or OCC national bank charter; SEC custody rules apply if holding securities. OCC interpretive letters permit national banks to provide crypto custody.
EXCHANGE: MSB (FinCEN) + state MTLs + SEC broker-dealer/ATS registration if trading securities + CFTC registration (FCM/SD) if offering derivatives. NY BitLicense required for NY customers (12-24+ months, $2M+ capital).
Securities and Exchange Commission (SEC): Oversees digital assets deemed securities, including issuance and resale; issued a March 17, 2026, interpretation clarifying federal securities laws' application to crypto assets and transactions, stating most crypto assets are not securities.
Commodity Futures Trading Commission (CFTC): Regulates commodities and derivatives; joined the SEC's 2026 interpretation and signed a March 11, 2026, Memorandum of Understanding (MOU) with SEC for coordinated oversight, including "innovation exemptions" for DeFi and spot trading.
Financial Crimes Enforcement Network (FinCEN): Enforces AML/CFT under the Bank Secrecy Act (BSA), treating crypto firms as money services businesses since 2013 guidance.
State regulators: Examples include California's DFPI (Digital Financial Assets Law effective July 1, 2026, requiring licenses with $100k/day penalties); New Jersey Department of Banking and Insurance; New York's NYDFS (BitLicense regime); Connecticut (money transmitter laws).
Federal authorities filed a civil forfeiture complaint to reclaim $225.3 million in stolen digital funds in June 2025, according to the U.S. Department of Justice
On December 15, 2025, U.S. Senators Elissa Slotkin and Jerry Moran introduced the Strengthening Agency Frameworks for Enforcement of Cryptocurrency (SAFE Crypto) Act to establish an inter-governmental task force to combat digital fraud
On March 6, 2026, White House officials issued Executive Order 14390 targeting foreign scam centers and protecting local retail investors
The New Jersey Division of Taxation uses automated tools to identify mismatches between reported cryptocurrency income and federal 1099 forms
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a custodial wallet / SaaS operator may serve US residents, but only after obtaining FinCEN MSB registration, state MTLs in 49 states (plus a BitLicense for NY and DFAL license for CA), and, if holding digital assets deemed securities, must hold a trust or national bank charter as a qualified custodian with segregated accounts, annual audits, and proof-of-reserves.
Questions this verdict aims to answer
- What custody license / qualified-custodian status applies?
- What segregation, insurance, and proof-of-reserves rules apply?
- What AML obligations attach to the SaaS vs the white-label client?