Vanuatu -- Custody Regulations Regulatory Overview

Vanuatu has recently introduced specific legislation governing virtual assets and virtual asset service providers (VASPs), which includes provisions relevant to digital asset custody. The primary piece of legislation is the Virtual Asset Providers Act No. 27 of 2023, which came into effect on 1 January 2024. This Act works in conjunction with the existing Financial Dealers Licensing Act [CAP 70] and the Anti-Money Laundering and Counter-Terrorism Financing Act No. 13 of 2014 (as amended).

The Vanuatu Financial Services Commission (VFSC) is the primary regulator responsible for licensing and oversight.

Here’s a breakdown of the custody regulations based on the Virtual Asset Providers Act No. 27 of 2023:

Overall Regulatory Framework

• Virtual Asset Providers Act No. 27 of 2023 (VAPA 2023): This is the cornerstone legislation for virtual assets, including custody services. It defines "virtual assets," "virtual asset service providers" (VASPs), and sets out licensing and operational requirements.
  • Vanuatu Financial Services Commission - Virtual Asset Providers Act No. 27 of 2023 (PDF link on VFSC website)
• Financial Dealers Licensing Act [CAP 70]: While the VAPA 2023 is specific, the general principles and licensing framework of financial dealing can be considered complementary.
  • Vanuatu Law Online - Financial Dealers Licensing Act [CAP 70] (PDF link on Vanuatu Law Online)
• Anti-Money Laundering and Counter-Terrorism Financing Act No. 13 of 2014 (AML/CTF Act): VASPs are designated as reporting entities under this Act, making AML/CTF compliance mandatory for all licensed virtual asset service providers, including custodians.
  • Vanuatu Financial Services Commission - Anti-Money Laundering and Counter-Terrorism Financing Act No. 13 of 2014 (PDF link on VFSC website)

1. Custodial License Requirements

The VAPA 2023 mandates that any person who provides virtual asset services in or from Vanuatu must be licensed by the VFSC. Providing "custody or administration of virtual assets or instruments enabling control over virtual assets" is explicitly defined as a virtual asset service (Section 2, VAPA 2023).

• Application Requirements (Section 12, VAPA 2023): An applicant for a VASP license must submit to the VFSC:
  • A completed application form.
  • Details of the applicant’s proposed business activities.
  • A business plan.
  • Proof of the applicant's financial soundness and adequate capital (Section 18).
  • Proposed internal controls, risk management systems, and cybersecurity framework (Section 19).
  • Policies and procedures for compliance with the AML/CTF Act (Section 17).
  • Details of directors, officers, and significant shareholders, including "fit and proper person" assessments.
  • Any other information required by the VFSC.
• Capital Requirements (Section 18, VAPA 2023): A VASP must at all times maintain a minimum unimpaired paid-up capital as prescribed by the Minister through regulation. This regulation is yet to be fully detailed.
• Fit and Proper Persons (Section 14, VAPA 2023): Directors and senior management must meet "fit and proper" criteria established by the VFSC, demonstrating competence, integrity, and financial soundness.

2. Segregation of Client Assets Rules

The VAPA 2023 explicitly addresses the segregation of client assets, which is a critical aspect of custody.

• Client Assets (Sections 20, 21, 22, VAPA 2023):
  • A VASP must hold a client’s virtual assets separate from its own assets and the assets of other clients (Section 20(1)).
  • Virtual assets held by a VASP on behalf of a client are not to be used to satisfy any liability of the VASP or form part of its assets (Section 20(2)).
  • A VASP is prohibited from using, dealing with, or otherwise disposing of a client's virtual assets without the client's explicit consent, except as authorized by law or a court order (Section 21).
  • A VASP must maintain adequate records that clearly identify the ownership of each client's virtual assets (Section 22).

3. Insurance/Bonding Requirements

The VAPA 2023 does not explicitly mandate specific insurance or bonding requirements for licensed VASPs performing custody. However, these aspects would typically fall under the broader requirements for:

• Risk Management and Internal Controls (Section 19, VAPA 2023): A licensed VASP must implement robust risk management systems and internal controls designed to ensure the security, integrity, and operational resilience of its services, which could implicitly encourage or require consideration of insurance.
• Financial Soundness and Capital Requirements (Section 18, VAPA 2023): The requirement for adequate capital is intended to provide a buffer against operational risks, though it's not a direct substitute for insurance.

Future subsidiary regulations or VFSC guidelines might introduce specific insurance requirements.

4. Cold Storage Mandates

The VAPA 2023 does not explicitly mandate the use of "cold storage" (offline storage of private keys) for virtual assets. However, it implicitly covers this through general security requirements:

• Risk Management and Internal Controls (Section 19, VAPA 2023): A licensed VASP must implement "effective cybersecurity measures" and "robust risk management systems and internal controls" to ensure the security and integrity of virtual assets. Best practices in digital asset security dictate the use of cold storage for a significant portion of client assets, and any VASP's risk management framework would be expected to include such measures.

The VFSC would likely assess the adequacy of a VASP's storage solutions (hot, warm, cold wallets) as part of its licensing and ongoing supervision based on the VASP's proposed internal controls and cybersecurity framework.

5. Qualified Custodian Definitions

The VAPA 2023 defines a "virtual asset service provider" (VASP) as a person or entity that, among other services, "provides custody or administration of virtual assets or instruments enabling control over virtual assets" (Section 2).

Therefore, under Vanuatu law, a licensed Virtual Asset Service Provider (VASP) that offers custody services, and complies with all the requirements of the VAPA 2023, effectively acts as the "qualified custodian" for digital assets. There isn't a separate, more restrictive definition beyond being a duly licensed VASP performing custody.

6. Pending Custody Legislation

The Virtual Asset Providers Act No. 27 of 2023 is the most recent and significant piece of legislation directly addressing virtual asset custody, having come into effect in January 2024. As such, it is the primary framework.

While the core Act is in place, it does allow for further specification through "regulations" by the Minister responsible for financial services (Section 34, VAPA 2023). These subsidiary regulations or VFSC guidelines might provide more granular details on:

• Specific capital thresholds.
• Detailed cybersecurity requirements, potentially touching on cold/hot storage ratios.
• Reporting formats and frequency.
• More explicit requirements for insurance or bonding.

However, as of now, there are no public announcements of further major Acts specifically pending regarding virtual asset custody beyond the VAPA 2023 itself.

Disclaimer: This information is provided for general informational purposes only and does not constitute legal advice. The regulatory landscape for digital assets is complex and constantly evolving. It is crucial to consult with a legal professional specializing in Vanuatu financial services law for specific advice regarding cryptocurrency custody regulations and licensing in Vanuatu.