Taiwan 2026 VASP Licence: How Fintechs, Exchanges & Crypto Platforms Obtain Approval and Comply with Stablecoin, AML & Custody Rules

Last reviewed: July 8, 2026

Taiwan’s Legislative Yuan passed the Virtual Asset Service Act on 30 June 2026, replacing the previous self-regulatory AML-registration model with a comprehensive licensing regime administered by the Financial Supervisory Commission (FSC). For any platform, exchange, or fintech operating in the virtual-asset space, obtaining a VASP license in Taiwan is now a statutory prerequisite, not a voluntary best-practice exercise. Existing AML-registered VASPs must submit a licence application within twelve months and secure full approval within twenty-one months, creating one of Asia-Pacific’s tightest compliance windows.

This guide walks founders, compliance officers, and in-house counsel through the entire VASP licensing process, from determining whether the Act applies, to preparing the application dossier, navigating stablecoin dual-approval requirements, and building the AML, KYC, and custody infrastructure that the FSC expects to see on day one.

Executive Summary and Quick-Action Checklist

The Virtual Asset Service Act fundamentally reshapes fintech compliance in Taiwan. Every profit-seeking entity that exchanges, transfers, custodies, or otherwise deals in virtual assets for customers must hold an FSC-issued licence. Platforms already registered with the Securities and Futures Bureau (SFB) under the prior AML framework retain their operational status during the transitional period, but only if they file a licence application within twelve months of the Act’s effective date and complete the full approval process within twenty-one months (with one possible three-month extension).

Industry observers expect the FSC to prioritise review of applicants whose existing AML programmes and governance structures most closely mirror the new statutory requirements. Platforms that delay their gap analysis risk missing the transitional window and being forced to suspend services.

10-Point Quick-Action Checklist, VASP Licence Taiwan (July 2026)

1. Confirm whether your activities fall within the Act’s VASP definition (exchange, custody, transfer, brokerage, wallet services).
2. Determine your entity category: domestic VASP, overseas VASP, or stablecoin issuer.
3. Conduct an internal gap analysis against FSC licensing requirements.
4. Appoint or upgrade your Chief AML/CFT Compliance Officer.
5. Prepare or update your AML/CFT programme, including risk assessment, CDD policies, and SAR procedures.
6. Secure or formalise a bank partnership (New Taiwan Dollar deposit custody and client-fund segregation).
7. Compile all corporate, governance, IT-security, and financial documents for the application dossier.
8. Engage legal counsel for a pre-application review and, where appropriate, an FSC pre-submission meeting.
9. Submit the VASP licence application to the FSC within twelve months of the Act’s effective date.
10. Monitor FSC supplementary guidelines and be prepared to respond to information requests during review.

Legislative Background: The Virtual Asset Service Act, What Changed

Before June 2026, Taiwan’s virtual-asset sector operated under a patchwork of administrative guidance. The primary touchpoint was the SFB’s AML/CFT registration requirement, which mandated that VASPs register and implement anti-money-laundering controls but did not impose comprehensive licensing, capital-adequacy, or custody obligations. The FSC had signalled since late 2024 that standalone legislation was under development, and the Executive Yuan submitted the draft Virtual Asset Service Act to the Legislative Yuan in early 2026.

The Act’s passage on 30 June 2026 represents the single most significant regulatory shift for crypto-licensed businesses in Taiwan’s history. Its objectives include investor protection, market integrity, systemic-risk mitigation (particularly for stablecoins), and alignment with global standards set by the Financial Action Task Force (FATF).

Who Needs a VASP Licence in Taiwan, Scope and Entity Types

The Act defines a “virtual asset service provider” broadly. Any profit-seeking enterprise incorporated or operating in Taiwan that provides one or more of the following services to the public is captured:

• Exchange services. Facilitating the conversion between virtual assets and fiat currencies, or between different virtual assets.
• Transfer services. Conducting transfers of virtual assets on behalf of customers.
• Custodial and safekeeping services. Holding, storing, or managing virtual assets or instruments enabling control over virtual assets.
• Brokerage and dealing. Acting as an intermediary or market-maker in virtual-asset transactions.
• Wallet and related financial services. Providing hosted wallet infrastructure or ancillary services connected to virtual-asset issuance, offering, or sale.

Domestic VASP vs Overseas VASP vs Stablecoin Issuer

The Act draws meaningful distinctions between entity types. Understanding which category applies is the first step in the VASP licence application process.

Edge Cases: DeFi Protocols, Non-Custodial Wallets, and NFTs

The Act’s broad language creates grey areas for truly decentralised protocols that have no identifiable operator, for non-custodial (self-hosted) wallet software, and for certain NFT platforms. Where a discernible profit-seeking entity controls the user interface, manages private keys, or exercises discretion over transactions, the FSC is likely to treat the operator as a VASP regardless of how the project’s documentation characterises its architecture. Early indications suggest that the FSC will issue supplementary guidance addressing these boundary questions, and platforms in uncertain territory should consider a pre-application meeting with the regulator before the deadline.

VASP Licensing Process, Step-by-Step Application and Required Documents

The VASP licensing process under the Virtual Asset Service Act is the most document-intensive compliance exercise a Taiwan crypto business will face. The FSC evaluates applicants across corporate governance, financial soundness, AML/CFT readiness, information-security capability, custody infrastructure, and consumer-protection measures. The following step-by-step framework synthesises the statutory requirements and the practical expectations that industry observers anticipate based on the FSC’s approach to comparable licensing regimes (e.g., electronic-payment institutions).

Step 1, Confirm VASP Category and Service Scope

Map every service line against the Act’s definitions. Platforms offering multiple services (e.g., exchange plus custody) should identify each licensable activity, as the FSC may impose activity-specific conditions.

Step 2, Compile the Application Dossier

The table below summarises the core documents and their purpose.

Step 3, Pre-Application Engagement with the FSC

Although not formally mandated, a pre-application meeting with the FSC’s designated VASP review team is strongly advisable. Early indications suggest the FSC welcomes preliminary consultations, particularly for novel service models, overseas VASP branching structures, or stablecoin issuance proposals. This meeting allows the applicant to surface potential objections and tailor the dossier before formal submission.

Step 4, Submit and Respond to Information Requests

File the complete application with the FSC within the twelve-month transitional window (for existing registrants) or before commencing operations (for new entrants). The FSC may issue supplementary information requests. Timely, comprehensive responses accelerate review; incomplete or evasive answers are a common cause of delay.

Step 5, Licence Issuance or Conditional Approval

Upon satisfactory review, the FSC issues the VASP licence. Conditions may be attached, for example, activity restrictions, enhanced reporting, or capital top-up requirements. The entire process must conclude within twenty-one months of the Act’s effective date for existing registrants. One three-month extension may be granted where the applicant demonstrates good-faith compliance efforts but faces delays outside its control.

Common Reasons for Rejection or Delay

• Incomplete AML programme. Missing risk-assessment methodology, undefined SAR thresholds, or absence of a designated AML officer.
• Inadequate custody arrangements. Failure to demonstrate proper segregation between platform and client assets.
• No bank partner. Inability to provide a confirmed banking relationship for fiat-currency handling and client-fund segregation.
• Governance gaps. Directors or senior managers with undisclosed criminal records or regulatory sanctions.
• Unresponsive applicants. Delayed or evasive replies to FSC supplementary queries.

Stablecoin Regulation in Taiwan, Dual Approval, Issuer Tests, and Bank Partnerships

The Virtual Asset Service Act treats stablecoins as a distinct risk category warranting heightened oversight. Any entity proposing to issue a virtual asset designed to maintain a stable value relative to a fiat currency, basket of currencies, or other reference asset must navigate a dual-approval pathway involving both the FSC and the Central Bank of the Republic of China (Taiwan).

The rationale is straightforward: stablecoins that achieve wide adoption can function as de-facto payment instruments, implicating monetary-policy transmission, deposit-taking rules, and systemic-risk considerations that fall within the central bank’s mandate.

Key Approval Tests for Stablecoin Issuers

• Reserve adequacy. Reserves must fully back outstanding stablecoin liabilities. The likely practical effect will be that permitted reserve assets are restricted to high-quality, liquid instruments, government securities, central-bank deposits, or cash equivalents held with authorised domestic banks.
• Redemption guarantee. Holders must be able to redeem stablecoins at par value within a defined timeframe. The Act mandates clear disclosure of redemption procedures and any applicable fees.
• Bank partnership. Reserve assets must be custodied with a regulated domestic bank under a trust or segregated-account arrangement. The bank serves as an independent check on asset sufficiency.
• Consumer protection. Issuers must maintain complaint-handling mechanisms, transparent disclosures, and cooling-off rights where applicable.
• Systemic-risk assessment. The central bank evaluates whether the stablecoin’s design, scale, or interconnections pose risks to monetary stability or the payments infrastructure.

Foreign Stablecoins

Platforms listing or facilitating trading in foreign-issued stablecoins (such as USDT or USDC) face separate compliance considerations. The Act empowers the FSC to restrict, condition, or prohibit the listing of specific stablecoins that do not meet Taiwan’s reserve, redemption, or disclosure standards. Industry observers expect the FSC to publish a whitelist or approval framework for widely traded foreign stablecoins, though the timeline for this guidance remains unclear.

Practical Structuring, Trust Arrangements and Segregated Accounts

For domestic issuers, the most robust structure is a statutory trust arrangement with a licensed trust bank. Under this model, reserve assets are held in a ring-fenced trust account, legally separated from the issuer’s operating assets and immune from the issuer’s creditors in insolvency. Where a full trust arrangement is not feasible, a segregated escrow account with a domestic commercial bank may be acceptable, provided contractual protections mirror the functional equivalence of trust segregation.

AML/CFT, KYC, and Sanctions Screening for VASPs

The Act codifies Taiwan’s AML obligations for VASPs, aligning domestic requirements with FATF Recommendation 15 and the FATF’s Updated Guidance on Virtual Assets and VASPs. Every licensed VASP must implement and maintain a comprehensive AML/CFT programme. The programme’s key elements are outlined below.

Minimum AML Programme Requirements

• Risk assessment. A documented, institution-wide money-laundering and terrorist-financing risk assessment, updated at least annually.
• Customer due diligence (CDD). Tiered CDD, simplified for low-risk customers, standard at onboarding, and enhanced for higher-risk profiles (PEPs, high-value transactions, non-face-to-face relationships).
• Ongoing transaction monitoring. Automated systems to flag unusual transaction patterns, large-value transfers, and rapid movement of assets across wallets or platforms.
• Suspicious activity reports (SARs). Procedures for timely filing of SARs with the Anti-Money Laundering Division of the Investigation Bureau, Ministry of Justice.
• Sanctions screening. Real-time screening of customers and counterparties against domestic and international sanctions lists, including those maintained by the United Nations, the US Office of Foreign Assets Control (OFAC), and Taiwan’s own designated lists.
• PEP screening. Identification and enhanced scrutiny of politically exposed persons and their associates.
• Record-keeping. Retention of CDD records, transaction records, and SAR documentation for a minimum of five years after the business relationship ends.
• AML compliance officer. Appointment of a senior officer with board-level reporting authority and adequate resources to oversee the programme.
• Staff training. Regular, documented AML/CFT training for all employees with customer-facing or compliance roles.

Outsourcing Compliance Functions

VASPs may outsource certain AML functions (e.g., transaction-monitoring technology, sanctions-screening databases) to third-party providers. However, the VASP retains full regulatory responsibility. The FSC expects documented due diligence on service providers, contractual access to records, and the ability to terminate the arrangement if the provider’s performance is inadequate.

Custody Rules in Taiwan, Safekeeping Models and Technology Expectations

Client-asset custody sits at the heart of the FSC’s supervisory concerns. The Virtual Asset Service Act requires VASPs to segregate client virtual assets from proprietary holdings and to maintain custodial arrangements that protect clients in the event of platform insolvency, cyberattack, or operational failure. The custody rules in Taiwan under the Act are among the region’s most prescriptive.

Accepted Custody Models

• Third-party institutional custody. Engaging a regulated, independent custodian to hold client assets in segregated wallets. This model provides the strongest legal separation and is the likely preferred model for the FSC.
• Self-custody with segregation. The VASP holds client assets directly but in wallets that are technically and legally segregated from operational wallets. Cold-storage requirements (offline key management) typically apply to the majority of client assets.
• Multi-signature (multi-sig) arrangements. Transaction authorisation requires multiple independent key-holders, reducing single-point-of-failure risk. Multi-sig may supplement either of the above models.

What the FSC Expects, Custody Checklist

• Documented custody policy specifying the proportion of assets held in cold storage versus hot wallets.
• Independent audit or proof-of-reserves attestation at regular intervals.
• Insurance coverage or reserve fund to compensate clients for losses arising from security breaches.
• Disaster-recovery and business-continuity plans for custody infrastructure.
• Contractual agreements with third-party custodians specifying liability allocation, audit rights, termination triggers, and data-access provisions.
• Key-management procedures, including key-generation ceremonies, secure storage of seed phrases, and succession protocols for lost or compromised keys.

Commercial and Transactional Considerations for Fintechs and Exchanges

Beyond the licensing formalities, several commercial realities shape fintech compliance in Taiwan for virtual-asset businesses.

Banking Access

Securing a bank partnership remains one of the most challenging aspects of operating a VASP in Taiwan. Domestic banks have historically been cautious about onboarding crypto clients. The Act’s licensing framework is expected to improve bank willingness, a licensed VASP presents a materially lower compliance risk than an unregulated platform, but applicants should begin bank discussions early and in parallel with their licence preparation.

Cross-Border Flows and Token Listing

VASPs facilitating cross-border virtual-asset transfers must comply with Taiwan’s foreign-exchange regulations and the Act’s specific requirements for virtual-asset transfers, which may include the “travel rule” (originator and beneficiary information accompanying transfers). Token listing decisions carry regulatory implications: the FSC may scrutinise listed tokens for securities-law characteristics, and stablecoins are subject to the dual-approval regime discussed above.

Corporate Governance and Capital Adequacy

The Act empowers the FSC to set minimum capital and liquidity requirements through subordinate regulations. Industry observers expect these to reflect the scale and risk profile of each VASP category, potentially differentiating between exchange operators (higher capital) and pure wallet or transfer services (lower capital). Boards should include independent directors and ensure that compliance, risk, and audit functions are staffed and resourced independently of commercial operations.

M&A and Investor Due-Diligence Considerations

For venture-capital firms and acquirers evaluating Taiwan VASP targets, the licence status, pending application quality, and transitional-deadline exposure are now material due-diligence items. A target that has not filed within twelve months, or whose application is substantively deficient, may face an operational shutdown that erases deal value. Investors should request copies of the application dossier, FSC correspondence, and compliance-programme documentation as part of standard due diligence.

Penalties, Supervisory Powers, and Enforcement Risk Management

The Virtual Asset Service Act grants the FSC a graduated enforcement toolkit:

• Administrative fines. Imposed for breaches of licensing, AML, custody, or disclosure obligations. Fine ranges are calibrated to the severity and duration of the breach.
• Licence revocation or suspension. The FSC may revoke or suspend a licence where the VASP has engaged in serious or persistent non-compliance, poses a systemic risk, or has obtained the licence through misrepresentation.
• Orders to cease operations. An unlicensed VASP may be ordered to immediately cease all regulated activities and may face injunctive action.
• Criminal exposure. Operating without a licence, or knowingly facilitating money laundering through a VASP, may give rise to criminal liability under the Act and Taiwan’s Money Laundering Control Act.
• Remedial pathways. The FSC may issue rectification notices before escalating to fines or revocation. Prompt, good-faith remediation, documented and communicated proactively, materially reduces enforcement risk.

Practical Next Steps, Timelines, and Checklist

For founders, compliance officers, and in-house counsel, the following five-step action plan translates the Act’s requirements into an operational workstream:

1. Gap assessment (immediate). Compare current operations, governance, and AML programme against the Act’s requirements and identify deficiencies.
2. Bank-partner engagement (within 30 days). Initiate or formalise banking relationships for client-fund segregation and fiat-currency handling.
3. Application dossier preparation (months 1–6). Compile all required documents, engage external auditors, and conduct penetration testing.
4. VASP licence application submission (within 12 months). File with the FSC; respond promptly to information requests.
5. Ongoing compliance maintenance. Update AML risk assessments annually, monitor FSC supplementary guidelines, and schedule periodic legal reviews.

Platforms that begin immediately are best positioned to secure their VASP license in Taiwan within the statutory window, and to demonstrate to the FSC the operational maturity that expedites approval. Those exploring the broader crypto-licensing landscape may find additional context in our guide to launching a crypto exchange.

Sources

1. Financial Supervisory Commission (FSC), Virtual Asset Service Act
2. Taiwan Laws and Regulations Database, Ministry of Justice
3. Central Bank of the Republic of China (Taiwan)
4. Securities and Futures Bureau (SFB), AML Registration and VASP Rules
5. FATF, Updated Guidance on Virtual Assets and VASPs
6. Legislative Yuan, Bill Records