Operating a virtual asset business in the British Virgin Islands without a properly constituted AML/CFT program (anti-money laundering and countering the financing of terrorism framework) is one of the fastest routes to enforcement action the jurisdiction offers. The BVI's Virtual Asset Service Providers Act 2022 places VASPs (virtual asset service providers) under mandatory registration with the BVI Financial Services Commission and imposes AML obligations that align with the FATF Recommendations – including the Travel Rule (the obligation to pass originator and beneficiary identifying data with each qualifying transfer). For an inbound operator, understanding the compliance architecture before committing to the BVI structure is not optional; it is the difference between a functioning banking relationship and a frozen account.
This page sets out the BVI's AML and Travel Rule regime for digital-asset businesses: the statutory basis, the compliance program elements the FSC expects, the cross-border interaction with banking and tax, the common structural mistakes, and the decision point that determines whether the BVI is the right compliance domicile for your specific operating profile.
The AML Statutory Basis for BVI VASPs
The BVI's AML obligations for virtual asset businesses sit at the intersection of three instruments. The VASP Act 2022 requires registration of any entity carrying on virtual asset services from within or out of the BVI. The Anti-Money Laundering and Terrorist Financing Code of Practice (the AML Code) governs the substantive program requirements – customer due diligence, risk assessment, record-keeping, suspicious activity reporting and internal controls. The BVI Financial Services Commission (the FSC) is the competent authority for both VASP registration and AML supervision.
The statutory design tracks the FATF Recommendations closely. The BVI adopted FATF Recommendation 15 – which extends AML/CFT obligations to virtual asset activities – through the VASP Act framework. That alignment matters commercially: correspondent banks and institutional counterparties use FATF compliance posture as a proxy for counterparty risk. A BVI VASP that cannot demonstrate FATF-compliant controls will struggle to maintain banking rails, regardless of its registration status.
The FSC has signaled an expectation that BVI VASPs treat their AML program as a live operational document – updated as the risk environment changes – not a filing artifact produced at registration and left static. In our practice, operators who treat compliance as a box-ticking exercise at inception routinely face the steepest friction during renewal and examination cycles.
What Does the Travel Rule Require From a BVI VASP?
The Travel Rule requires a BVI-registered VASP to collect, verify and transmit specified originator and beneficiary information alongside each qualifying virtual asset transfer. The obligation applies on both the sending and receiving side: a VASP originator must transmit the data; a VASP beneficiary must receive, screen and retain it.
The required data elements follow the FATF standard: originator name, account number or wallet identifier, physical address or national identity number or date and place of birth, and – for the beneficiary – name and account or wallet identifier. The de-minimis threshold at which the full Travel Rule data obligation activates varies under BVI implementation, and operators should confirm the current threshold directly against the operative AML Code provisions rather than relying on informal guidance. For transfers below any applicable threshold, a reduced data set is still expected under the AML Code's general record-keeping requirements.
The cross-border dimension is acute. A BVI VASP transacting with a counterpart VASP in a jurisdiction that has implemented the Travel Rule differently – the EU under MiCA, Singapore under the MAS Payment Services Act, or the United Kingdom under the FCA's MLR regime – faces a data-matching problem. The originator message format used by one platform may not be readable by the receiving system. In our cross-border practice, we regularly advise operators on choosing a Travel Rule messaging protocol that achieves interoperability with counterparties in the jurisdictions where they actually route volume, rather than a protocol optimized only for BVI-to-BVI transactions, which represent a fraction of real-world flow.
For a scoped review of your Travel Rule implementation and protocol selection, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity structure, the counterparty jurisdictions, the volume profile – change the analysis materially.
The Compliance Program Elements the FSC Expects
A compliant BVI VASP AML program requires a set of interconnected controls, each of which the FSC may examine independently during a supervisory review.
Customer due diligence (CDD) is the foundation. The AML Code requires a risk-based approach: standard CDD for lower-risk customers, enhanced due diligence for higher-risk relationships including PEPs (politically exposed persons) and customers from jurisdictions identified as high-risk by the FATF. Beneficial ownership verification is mandatory. For corporate clients, the VASP must look through to the natural persons who ultimately own or control the entity.
Transaction monitoring is a distinct program element. A BVI VASP must operate a system – automated or, for smaller operators, documented manual processes – capable of identifying transactions that are inconsistent with the customer's established risk profile or that exhibit typologies associated with money laundering or sanctions evasion. On-chain monitoring using blockchain analytics tools has become a baseline expectation. Regulators across the leading hubs increasingly expect VASPs to screen wallet addresses against sanctions lists and to assess exposure to high-risk clusters, not merely to screen the customer at onboarding.
Suspicious activity reporting to the BVI Financial Intelligence Agency is mandatory when a VASP knows or has reasonable grounds to suspect that a transaction involves the proceeds of criminal conduct. The reporting obligation is not discretionary and applies even where the transaction has not been completed.
A Money Laundering Reporting Officer (MLRO) must be appointed. The MLRO is the nominated individual responsible for receiving and evaluating internal suspicious activity reports, filing external disclosures, and acting as the primary point of contact with the FSC on AML matters. The MLRO must be fit and proper as assessed by the FSC. For a BVI VASP with a remote team, the MLRO's jurisdictional location and accessibility to the FSC is a practical consideration that operators frequently underestimate.
How Does the BVI AML Regime Compare for an Inbound Operator?
For an operator already managing compliance programs in the EU, Singapore or the UAE, the BVI regime is structurally recognizable. It is FATF-aligned, activity-based, and risk-weighted. The substantive difference lies in the supervisory intensity and the resourcing expectations at different size thresholds.
A BVI structure is most attractive to operators who want an established common-law offshore register, a known counterparty risk profile for institutional relationships, and a VASP Act registration that provides regulatory legitimacy without the full CASP authorisation burden imposed under MiCA or the activity-specific licence stack required by VARA in Dubai. The BVI is not a light-touch substitute for a front-book licence in a retail-facing jurisdiction. It is a structural domicile for a holding entity, a fund administrator or a technology provider that does not face consumers directly.
For operators who do serve retail users, the BVI registration alone does not satisfy the licensing expectation of the user's home jurisdiction. A European retail exchange must hold a CASP authorisation (crypto-asset service provider licence) under MiCA regardless of where its parent entity is registered. A business serving UAE residents needs to engage with VARA. The BVI layer handles group-level AML obligations and common-law protections; it does not substitute for front-book licensing. We have seen operators discover this distinction at the banking stage, when a correspondent bank asks for the MiCA or VARA licence and the only answer is a BVI VASP registration – at which point the account opening stalls.
A Cross-Border AML Gap – A Recent Matter
In a recent engagement, a payments company had registered a BVI VASP entity and believed its group-level KYC and transaction-monitoring systems – designed primarily for its Singapore MAS-licensed subsidiary – satisfied the BVI AML Code requirements. During an FSC supervisory inquiry, it became apparent that the BVI entity was processing transfers that did not pass Travel Rule data to receiving VASPs, because the originating system was configured to treat the BVI entity as an internal wallet rather than a VASP counterparty. We restructured the data flow, documented the VASP-to-VASP relationship correctly, and produced a revised AML policy that mapped the BVI obligations separately from the Singapore regime. The FSC inquiry was resolved without formal action. The outcome illustrates a structural point: multi-jurisdictional AML programs routinely have jurisdiction-specific gaps that surface only under examination.
How Does the BVI AML Posture Interact With Banking and Tax?
Banking access for BVI VASPs is the most immediate commercial consequence of AML program quality. Correspondent banks operating in major financial centres – New York, London, Singapore – apply a tiered risk assessment to offshore VASP entities. A BVI VASP that presents a well-documented AML program, an MLRO with a verifiable track record, a clean transaction-monitoring architecture and evidence of Travel Rule compliance is materially better positioned to open and maintain accounts than one that presents only a registration certificate.
In our practice, operators consistently underestimate the due diligence burden imposed by banking counterparties. A correspondent bank's financial crime compliance team will request the AML policy, the risk assessment, the MLRO CV, the customer onboarding procedures and evidence of ongoing monitoring. An incomplete or template-based program triggers enhanced due diligence or outright refusal. The registration is the minimum; the bank's acceptance of the relationship depends on everything built above it.
The tax dimension is structurally separate. The BVI does not impose corporate income tax on profits arising outside the territory. A BVI VASP holding entity can therefore operate as part of a group structure where trading income arises in an operating subsidiary in a tax-treaty jurisdiction, and the BVI entity holds intellectual property or acts as a fund administrator. However, the substance expectations embedded in the BVI's VASP Act – a genuine MLRO, real internal controls, records available to the FSC – mean that the BVI entity cannot be a pure letterbox. Substance and tax efficiency are achievable together, but they require deliberate structural design, not assumption.
If your AML program or banking structure needs a second read before the next supervisory cycle, write to info@oboluslaw.com. If a prior application stalled or an account was closed, a structural review can identify the gap and the route forward.
Common Mistakes and the Decision Point for BVI Structure
The most common structural mistake is treating the BVI VASP registration as a finished compliance posture rather than as the regulated container within which a compliance program must operate. Registration and program adequacy are distinct. Registration is a threshold event. Program adequacy is an ongoing obligation that the FSC can assess at any time.
A second frequent error is failing to account for the jurisdictions where end users or counterparties are located. The BVI VASP Act's jurisdictional scope – services provided from or within the BVI – does not insulate the operator from the regulatory expectations of the counterparty's jurisdiction. An operator routing transfers to EU-resident VASPs will encounter MiCA's Travel Rule implementation on the receiving side. Ignoring the counterparty's regulatory environment produces operational failures at the point of transfer, not at the point of registration.
A third error, specific to the cross-border operator, is deploying a generic AML policy template that has not been calibrated to the BVI AML Code's specific requirements. The FSC is familiar with template-based programs. A policy that references the wrong statutory instrument, omits the BVI Financial Intelligence Agency as the reporting authority, or fails to address virtual-asset-specific risk typologies will not survive examination.
The decision point for a BVI structure turns on three questions: Is the entity a holding company, a fund administrator or a technology provider rather than a retail-facing operator? Does the operator have the capacity to build and sustain a genuine AML program with a qualified MLRO? And does the group structure place the consumer-facing activity in a separately licensed entity in the relevant distribution jurisdiction? If all three answers are yes, the BVI is a well-tested, common-law offshore register with a clear compliance path. If any answer is uncertain, the analysis requires more depth before commitment.
A common assumption is that offshore registration reduces compliance obligations. Under the BVI VASP Act and the AML Code, the opposite is true: registration activates full AML obligations, and the FSC's supervisory posture has become progressively more active. The BVI's value is its legal architecture and common-law protections, not a lower compliance standard.
Related at OBOLUS
- AML and Travel Rule compliance for digital-asset businesses – Full-spectrum AML program design, policy drafting and Travel Rule implementation across jurisdictions.
- AML/CFT policy drafting in Kazakhstan AIFC – How the AFSA's AML requirements compare and what an AIFC-domiciled VASP must produce.
- Cross-chain bridge legal risk in Gibraltar – Technology-layer compliance risks and the regulatory read for bridge operators in a comparable offshore hub.
FAQ
What does the Travel Rule require from a VASP?
The Travel Rule requires a VASP to collect, verify and transmit identifying information about the originator and beneficiary of each qualifying virtual asset transfer – including name, wallet or account identifier, and address or identity number. The obligation applies on both the sending and receiving side. In the BVI, these requirements flow from the AML Code and the VASP Act 2022, which adopt the FATF standard. The specific data threshold at which full Travel Rule obligations activate should be confirmed against current BVI provisions.
Who must act as MLRO for a crypto firm?
A BVI VASP must appoint a designated Money Laundering Reporting Officer who meets the FSC's fit-and-proper standard. The MLRO receives internal suspicious-activity reports, evaluates them, files external disclosures with the BVI Financial Intelligence Agency where required, and acts as the primary regulatory contact on AML matters. The role requires genuine operational involvement. An MLRO who is a nominee without real authority over the compliance function will not satisfy the FSC's expectation, and this is an area of increasing scrutiny in supervisory reviews.
How do regulators audit crypto AML programs?
The BVI FSC may conduct on-site or off-site supervisory reviews of a registered VASP's AML program. In practice, this involves requesting the AML policy, risk assessment, customer due diligence files, transaction-monitoring records and suspicious-activity report logs. Regulators across the leading hubs increasingly assess whether on-chain analytics are integrated into the monitoring process and whether Travel Rule data flows are documented and operational. A static policy with no evidence of live application is a common trigger for enhanced scrutiny or a follow-up examination.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance obligations that sit around them. Digital assets are the entirety of our practice. We map the licence, AML and banking stack across operating, custody and payment layers before you commit – so that the structure you build survives its first supervisory examination. To discuss your situation, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Victor Olsen, Regulatory & Compliance Analyst – specialising in AML program design, Travel Rule implementation and VASP registration strategy across offshore and onshore digital-asset jurisdictions.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.