A Brief Introduction to Taiwan's Virtual Asset Services Act

Taiwan’s new Virtual Asset Services Act creates a comprehensive framework for digital asset businesses. Under the law, any firm or platform providing regulated virtual asset services must obtain a government license to operate. Providers are classified by service type (for example, crypto-fiat exchange, crypto-to-crypto trading, transfers, custody, issuance, lending, etc.) and must hold a separate permit for each category. Operating without a valid license is a criminal offense punishable by imprisonment and substantial fines.

Licensing, Capital and Organizational Requirements

Licensing requires meeting strict legal and financial criteria. A VASP must generally be organized as a joint-stock company (股份有限公司), unless it is a licensed bank or a foreign firm approved to operate branches. The regulator will set minimum capital or operational-fund requirements for each service type. Before commencing business, each VASP must deposit an “operational guarantee” (a cash or equivalent bond) of a specified size in a designated bank. This deposit is protected and serves as a priority fund for customer claims: if a VASP fails, its creditors can claim this deposit first before any other assets. Firms must replenish the bond if any portion is drawn down.

Any change of operations, such as opening a new branch or service outlet, also requires prior approval. For example, a foreign crypto exchange or bank must set up a local legal entity and obtain a separate license. The law explicitly forbids unlicensed activity: anyone who operates virtual asset services without authorization (or issues stablecoins without a license) faces prison terms (up to 7 years) and heavy fines (in the tens of millions of Taiwan dollars).

Scope of Regulated Services

The Act defines a broad range of “virtual asset services” that require licensing. These include:

• Exchanges (Crypto-Fiat and Crypto-Crypto): Buying or trading virtual assets for New Taiwan dollars, foreign currencies (including RMB, HKD), or other virtual assets.

• Trading Platforms: Operating a centralized market or exchange platform for virtual assets.

• Transfers (Remittance): Transferring or remitting virtual assets on behalf of customers (for example, cross-border crypto payments).

• Custody and Wallet Services: Safekeeping or managing clients’ virtual assets, including their wallets or private keys.

• Issuance/Underwriting: Issuing new virtual assets (token offerings) and arranging their sale or distribution.

• Lending/Borrowing: Crypto lending or borrowing services (accepting virtual assets on loan and promising to return an equivalent or greater amount later).

• Other Approved Services: Any additional services that the FSC designates. Each category requires its own license.

Each category requires a separate permit. A single VASP may hold multiple licenses if it offers multiple services. Expanding into a new service area without approval is prohibited.

Internal Controls and Prudential Safeguards

VASPs must maintain strong governance, audit and risk-management systems. The law mandates documented internal control policies, compliance procedures and independent audits for every critical operation. Firms must also implement robust cybersecurity measures: secure IT infrastructure, data encryption, access controls, confidentiality rules and disaster-recovery plans. Any outsourcing of services must preserve equivalent controls.

On the financial side, VASPs may not over-leverage or overextend themselves. Regulators will impose caps on leverage and require certain liquidity ratios (for example, limiting current liabilities relative to current assets). The FSC can also set limits on total lending and on exposures to any single asset or counterparty, including affiliates. In practice, a VASP cannot operate with excessive debt or funding mismatches. All large transactions and loans must conform to these limits and are subject to regulatory review. VASPs must prepare audited financial statements regularly and report to the FSC. These measures ensure ongoing monitoring of solvency and liquidity.

Customer Asset Protection

Protecting client assets is a top priority. VASPs must keep all customer funds fully segregated from the firm’s own assets. In practice, client cryptocurrencies and tokens must be held in distinct wallets or accounts that are never mixed with the VASP’s assets. A VASP may not use, transfer or pledge client assets except to comply with a customer’s instructions or a legal order. Creditors of the VASP have no claim on segregated customer assets, which remain off-limits even if the VASP fails or is liquidated.

For any fiat currency held for clients (from crypto trades or related services), even stronger safeguards apply. All customer cash must be kept in a trust or escrow account at a bank, or otherwise fully guaranteed by a bank. This means any TWD or foreign currency held on behalf of clients is not considered the VASP’s property, but is held in custody for clients. Firms must reconcile and independently verify these balances regularly, and report on them. This arrangement ensures client withdrawals are honored immediately, shielding customers from the VASP’s financial troubles.

Stablecoin Regulation

The law treats fiat-pegged digital currencies with special caution. Any entity wishing to issue a stablecoin (a cryptocurrency pegged to one or more fiat currencies) must obtain an FSC license, which requires mandatory consultation with the Central Bank. Only licensed stablecoins may be listed, traded or serviced by VASPs. VASPs are explicitly forbidden from handling any stablecoin that lacks this approval.

Stablecoin issuers face strict reserve requirements. Each stablecoin must be backed 100% by reserved assets held in segregated accounts at domestic banks (and, for large issuances, with mandatory deposits at the Central Bank). These reserve assets must be audited regularly and kept entirely separate from the issuer’s own funds. Creditors of the issuer cannot claim these reserves, and the issuer may only use them to redeem or stabilize the coin. This full-reserve system ensures the stablecoin maintains its peg and protects users from any issuer default.

VASP Industry Association

Taiwan requires all licensed VASPs to join a government-recognized industry association. No provider may lawfully operate outside this trade group, and the association cannot arbitrarily refuse eligible members. The association is empowered to set industry self-regulatory rules and standards (its charter, codes of conduct, etc.), subject to FSC approval. If the regulator deems it necessary to protect investors or the public interest, it can order the association to change its rules or practices.

In turn, the association must enforce compliance among its members. It can discipline or even expel firms that violate its codes, following a formal review process. It is also tasked with coordinating industry best practices and providing ongoing training and education for VASPs and users. This model blends official oversight with peer-driven regulation, promoting discipline and knowledge-sharing in the crypto industry.

Transition and Compliance Deadlines

Existing VASPs (those already registered under Taiwan’s AML rules before the Act takes effect) face a tight timeline. They must submit a full VASP license application within six months after the law’s implementation. The FSC then has 15 months from the law’s start date to review and grant licenses. Any firm that fails to apply within six months, or fails to secure a license within 15 months, must cease its virtual asset business operations. This transition period allows AML-registered businesses to adjust while imposing a firm cutoff to eliminate unlicensed activity.

Enforcement and Penalties

The FSC has broad inspection and enforcement powers. It can conduct on-site audits of any VASP, demand books and digital records, and appoint examiners (auditors, lawyers, etc.) at the firm’s expense. If violations or fraud are suspected, regulators can seal or freeze relevant records, servers or crypto wallets, and request assistance from other authorities (for example, to block transactions or restrict travel for key individuals).

Key offenses and penalties include:

• Fraud and Manipulation: Making false, deceptive or misleading disclosures about a virtual asset’s issuance or trading, or manipulating prices/volumes, is strictly prohibited. Offenders face 3–10 years in prison and fines from NT$10 million up to NT$200 million, and must compensate any harmed investors.

• Unauthorized Operations: Operating an exchange, platform, transfer service, custody business or issuing a stablecoin without the required license is a crime. This carries up to 7 years imprisonment and fines up to NT$100 million. Both the responsible persons and the firm can be punished.

• Custody and Reporting Violations: Commingling or misusing customer assets (crypto or fiat), or failing to provide accurate audited financial statements, is severely punished. Responsible officers can be jailed (up to 5 years) and fined (up to NT$50 million), and the firm can be fined similarly.

• False Declarations: Submitting false statements or hiding information in license applications or official reports is illegal. Violators can be fined (around NT$2.4 million) or jailed (up to 3 years).

• Administrative Sanctions: In addition to criminal penalties, the FSC can issue warnings, order corrections, suspend a VASP’s business (for up to 6 months), or even revoke its license outright. The regulator can remove unfit managers, bar transfers of certain assets, or require a troubled VASP to transfer its customer accounts to another licensed firm.

Taken together, these provisions give Taiwan strong tools to investigate and punish wrongdoing. The Act aligns with global standards by combining preventive controls, industry self-regulation