Custodial wallet / SaaS in British Virgin Islands

Separate application for custody (US$10,000 fee); exchange activities need another.

Applicants must demonstrate robust software infrastructure, share capital adequacy, and client asset protection measures.

Ongoing compliance with AML/CFT laws, including Anti-Money Laundering Regulations, 2008, and related codes.

Virtual Assets Service Providers Act, 2022: https://www.bvifsc.vg (implied FSC source)

FSC Guidance on Regulation of Virtual Assets (2020): https://www.bvifsc.vg/library/guidance-regulation-virtual-assets-virgin-islands-bvi

VASP Registration/AML Guidance (2023): FSC publications

Custody providers – holding and managing digital assets

Other VASP services – storage and management of virtual assets

Virtual Assets Service Providers Act 2022: Enacted 2022, came into effect February 1, 2023

VASP Registration: Mandatory for VASP activities; submit in the FSC's approved form, specifying the category, with a business plan, details of directors/senior officers/compliance officer (meeting fit and proper criteria), AML/CTF/PF policies, and application fee.

No minimum capital specified in VASP Act; share capital based on operational expenses.

Applicants must provide audited financial projections and proof of sufficient capital to sustain operations.

Incorporate a BVI Business Company (BVIBC): Unique name, registered agent, registered office; minimum 1 director initially (at least 2 individual directors post-registration; FSC may require local director).

Fit and proper person requirements for senior officers and beneficial owners

Prior FSC approval of senior officer appointments

Annual financial reporting to the FSC

SIBA Licensing: Required if virtual asset activities involve defined investments (e.g., exchanges), unless excluded under SIBA Schedules 2 (Parts A/B/C).

Anti-money laundering and counter-terrorist financing (AML/CFT) obligations

Data protection and cyber security requirements

Anti-Money Laundering Regulations, 2020 (AML Regulations/AMLR) (amended 2022/2024): Core rules on customer due diligence, reporting, and controls.

Anti-Money Laundering and Terrorist Financing Code of Practice (AMLTFCoP/AMLTFCOP): Detailed AML/CFT/PF obligations for relevant businesses.

Adoption and Legislation: The Travel Rule integrates FATF Recommendations 15 and 16 into BVI law via Sections 19(4), Part VA, and Sections 41B through 41F of the AMLTFCoP, alongside the AMLR and Virtual Assets Service Providers Act, 2022 (VASP Act). Official guidance is in the BVI FSC's VASP Travel Rule Guidance (PDF: https://www.bvifsc.vg/sites/default/files/vasp_travel_guidance_f.pdf).

Threshold Amounts: USD 0—all virtual asset transactions, with no de minimis threshold.

Covered VASPs: Applies to all individuals and entities operating as VASPs in or from the BVI, including those registered under the VASP Act with the BVI Financial Services Commission (FSC). Entities offering virtual asset services must register.

Technical Implementation Requirements: VASPs must implement controls for Travel Rule compliance, including documented AML/CFT policies, procedures, continuous customer due diligence (CDD), transaction monitoring, and sanctions screening within 24 hours (e.g., freezing assets, reporting). They must demonstrate reasonable steps for compliance and align with FATF's risk-based approach, reporting to the FSC and Financial Investigation Agency (FIA).

Appointing an AML compliance officer (approved by the FSC) to oversee adherence and liaise with authorities, plus a Money Laundering Reporting Officer (MLRO) to handle internal reporting; notify FSC within 14 days if MLRO ceases office and apply for replacement approval within 21 days.

Submitting governance documents like AML/CFT manuals, cybersecurity policies, and business continuity plans during registration.

Retaining records (e.g., IP addresses, wallet details, transaction hashes) per the BVI Data Protection Act for AML/CFT/PF purposes.

Virgin Islands Sanctions Guidelines (2023): FIA PDF.

OFAC sanctions lack legal force in BVI but are practically required for VASPs with US exposure, including blocking virtual currencies linked to OFAC's Specially Designated Nationals (SDN) list, prohibiting unauthorized transactions, and reporting within 10 business days.

Breaches (e.g., contravening or circumventing sanctions) are criminal offenses: up to 6 months imprisonment or ~US$5,000 fine (summary conviction); up to 7 years imprisonment or unlimited fine (indictment).