Taiwan's Virtual Asset Service Act: What VASPs and Stablecoin Issuers Must Do Now
Taiwan passed its first dedicated crypto statute on June 30, 2026, and the rules that follow will be materially harder to meet than anything the island has required before. The Virtual Asset Service Act (虛擬資產服務法), cleared at the third reading in the Legislative Yuan, replaces a registration-only AML baseline with a full permission-and-licensing regime covering prudential requirements, custody, cybersecurity, market conduct, and now stablecoin issuance. The Act is not yet in force, but the scoping window is already open, and firms with a Taiwan nexus cannot afford to treat it as a future problem.
From AML Registration to Comprehensive Licensing
Until this Act, Taiwan regulated crypto businesses primarily through anti-money laundering law. Article 6 of the Money Laundering Control Act (洗錢防制法), in force since November 30, 2024, required any business providing virtual asset services to complete registration before operating, and required providers incorporated outside Taiwan to establish a local entity first. Operating without that registration carried up to two years' imprisonment or a fine of up to TWD 5 million (roughly USD 157,000) for individuals, with corporate offenders facing up to ten times that amount.
That regime produced a small compliant market. When the Financial Supervisory Commission (FSC) published its registered-firm list on September 22, 2025, it named nine businesses. Eight remain registered today.
What the Act Adds on Top of the AML Baseline
The Virtual Asset Service Act does not displace that AML foundation. It builds a prudential and conduct layer on top of it. The statute, running to seven chapters and 56 articles, now governs providers' financial and business operations, the fitness of responsible persons and key staff, internal control and audit systems, information security management, listing and delisting review, segregated custody of customer assets, outsourcing arrangements, civil liability to customers, and financial reporting obligations.
Two provisions deserve particular attention for firms mapping their scope exposure. First, lending is named as a discrete licensable category, which will capture businesses that have not previously thought of themselves as requiring a financial services permission. Second, the Act includes a residual category that gives the FSC authority to bring new service models within scope without returning to the legislature each time the market invents a new product type.
Seven VASP Categories and the Licensing Structure
Supervision moves from registration to permission-based licensing across seven defined VASP categories. Article 7 of the approved bill prohibits operating any virtual asset business without both FSC permission and a license. Article 11 requires providers to hold a minimum capital amount or allocated operating funds, and to deposit a guarantee with an FSC-designated financial institution. Critically, neither the capital threshold nor the guarantee amount is fixed in the statute itself — both will be set in the subordinate regulations the FSC is still drafting. The commercial cost of entry to Taiwan's licensed market is therefore still an open question.
Financial Institutions Entering the Market
Article 7, paragraph 4 allows a financial institution to, with FSC permission, concurrently operate virtual asset businesses and be treated as a provider under the Act. For crypto-native applicants, that creates a competitive dynamic that goes beyond simply obtaining a license: the question becomes who else will hold one alongside them, and with what balance sheet. Banks entering the space under this provision could change the competitive landscape materially.
Industry Association Membership as a Precondition
Article 29 bars a provider from operating unless it has joined the relevant industry association. That is not a soft expectation — it is a license precondition. Firms building their application timelines need to factor membership, and the governance standards that come with it, into their preparation.
Transition Timelines for Existing Registered Firms
Firms that completed AML registration before the Act's commencement date, and financial institutions already providing virtual asset services under existing FSC rules, receive a transition period. They have 12 months from the effective date to apply to the FSC for permission, and 21 months to obtain both permission and a license. The deadline can be extended once, by up to three months, where circumstances require it.
The Clock Has Not Started Yet
The Act is not yet in force. The Executive Yuan will set the commencement date separately, and the FSC has stated that the Act and all nine of its subordinate regulations will take effect together. FSC officials, speaking on the day of passage, indicated the earliest this would happen is the first quarter of 2027. Neither the 12-month application window nor the 21-month licensing deadline begins until that date is set.
That sounds like breathing room. In practice it is not. Most AML-registered firms will need to rebuild significant parts of their control environment to meet the new requirements around custody segregation, cybersecurity management, listing and delisting governance, and personnel fitness. None of those gaps can be closed on the day a licensing application is filed. The subordinate regulations, once published, will define exactly what is required — and firms that have not already begun internal gap assessments will find the 21-month window compresses quickly.
Enforcement Exposure Increases Sharply
The penalty structure under the Act represents a step change from the AML registration regime. Under the previous rules, unregistered operation carried a maximum of two years' imprisonment and a TWD 5 million fine for individuals, with corporates facing up to ten times that amount.
New Criminal Penalties Under Articles 47 to 54
Operating a virtual asset business or issuing a stablecoin without permission is separately criminalized under Articles 47 to 54 of the approved bill. The maximum penalty is seven years' imprisonment and a TWD 100 million fine. Fraud and manipulation of virtual asset prices carry three to ten years' imprisonment and fines ranging from TWD 10 million to TWD 200 million. These are not administrative sanctions — they are criminal provisions, and they apply to the individuals responsible for the business, not only to the corporate entity.
The FSC's decision to anchor the Act with criminal penalties of this severity signals a clear enforcement posture. A high-profile fraud caseload in the crypto sector has given these market-conduct provisions their political weight, and the regulator has publicly framed the Act as the industry's entry into governance under a dedicated financial statute.
Taiwan's Stablecoin Framework: Dual Consent and Full Reserves
The Act creates Taiwan's first legal framework specifically for stablecoin issuance, and the design reflects a deliberate policy position from both the FSC and the central bank.
The Dual-Consent Requirement
Issuing a stablecoin in Taiwan requires both the central bank's agreement and FSC permission. That dual-consent structure tells you how the two regulators view the instrument: as something that sits at the intersection of monetary policy and financial services supervision, not purely in one domain.
Reserve, Redemption, and Yield Restrictions
The reserve requirements are strict. Reserve assets must be held at a financial institution in Taiwan, kept fully independent of the issuer's own assets, and placed in trust. Issuers must submit to periodic inspection and make regular information disclosures. Issuance and redemption must occur at face value, and the issuer may not refuse a holder's redemption request.
Article 37 removes yield as a distribution strategy entirely. The issuer is prohibited from paying any form of interest or return on the stablecoin. For issuers whose business models currently depend on yield-bearing products, this is a structural constraint, not a compliance detail.
Article 38 addresses insolvency. Reserve assets are excluded from the issuer's bankruptcy estate, and holders receive priority of claim over them. The design intent is to make the holder's claim survive the issuer's failure — a consumer protection mechanism modeled on similar provisions in other jurisdictions developing stablecoin regimes.
Taken together, these provisions describe an instrument that resembles a narrow-purpose payment token with ring-fenced backing, rather than an investment product. Issuers planning to operate in Taiwan will need to assess whether their existing product structure is compatible with these requirements or requires fundamental redesign.
Two Things Already Moving Before the Act Takes Effect
While the Act awaits its commencement date, two developments are already in motion. First, draft Travel Rule amendments are out for public consultation, with the comment period running until September 14, 2026. Those amendments sit within the existing AML regulatory framework and will apply independently of when the Act commences. Firms should be engaging with that consultation now.
Second, the industry association has publicly committed to three priorities in response to passage: assisting the FSC in drafting subordinate regulations to enable a smooth transition; aligning members with international AML, safeguarding, and investor protection standards, including addressing unlicensed offshore platforms operating in the Taiwanese market; and strengthening public-private partnerships to block illicit fund flows. Firms that are not yet members of the association will need to factor that into their timeline planning, given Article 29's membership precondition.
Accounting and Compliance Implications for Firms
For accounting firms, CFOs, and compliance teams advising businesses with Taiwan operations, the Act opens a set of practical work streams that need to begin now, before the subordinate regulations are finalized.
B2B: What Firms and Auditors Need to Address
The new financial reporting obligations under the Act will require VASPs to produce accounts that satisfy FSC requirements, which are still being defined in the subordinate rules. Auditors engaged with Taiwanese VASP clients should begin scoping what "financial reporting" means in this context and whether existing audit methodologies for digital asset holdings, custody arrangements, and internal controls are adequate. The custody segregation requirement in particular will affect how customer assets appear on the balance sheet — and how they are treated in the event of a wind-down or insolvency.
For firms using Hong Kong virtual asset licensing as a regional benchmark, Taiwan's Act follows a broadly comparable licensing model but introduces the stablecoin dual-consent mechanism as a distinct feature. The reserve-in-trust requirement and the holder-priority insolvency provision will need separate accounting treatment from the issuer's own liabilities. Robust stablecoin auditing standards will be essential for any issuer seeking to meet the FSC's periodic inspection and disclosure requirements.
Capital adequacy assessments cannot be completed until the FSC publishes the subordinate rules setting the minimum capital and guarantee deposit amounts. But firms can begin internal assessments now: mapping the gap between current capitalization and what a prudentially regulated VASP is likely to need, and identifying what restructuring — of capital, legal entity, or both — may be required before an application is filed.
Personnel Fitness and Internal Controls
The Act's fitness requirements for responsible persons and key staff create a personnel risk that often goes underweighted in licensing preparation. Firms should begin identifying which roles will require FSC approval, reviewing the backgrounds of current holders of those positions, and building a remediation process for any gaps. Internal audit and control frameworks will also need to be documented to a standard that satisfies a financial regulator, not just an AML supervisor.
Frequently Asked Questions
When does the Virtual Asset Service Act actually take effect?
The Act was passed on June 30, 2026, but it is not yet in force. The Executive Yuan will set the commencement date separately, and the FSC has indicated the Act and its nine subordinate regulations will take effect together. The FSC's stated earliest estimate is the first quarter of 2027, though that date has not been confirmed officially.
Do existing AML-registered firms need to re-register or simply apply for a license?
Firms that completed AML registration before the commencement date do not restart from scratch, but they must apply for FSC permission within 12 months of the effective date and obtain both permission and a license within 21 months. The licensing deadline can be extended once by up to three months. Neither clock starts until the Executive Yuan sets the commencement date.
What makes Taiwan's stablecoin rules different from a standard payment token regime?
Two features stand out. First, issuance requires dual consent from both the central bank and the FSC, reflecting the instrument's perceived monetary-policy implications. Second, yield is prohibited outright under Article 37 — issuers cannot pay any form of interest or return on the stablecoin, which eliminates yield-bearing product structures that might otherwise be used to attract holders.
What are the new criminal penalties for operating without permission?
Under Articles 47 to 54 of the Act, operating a virtual asset business or issuing a stablecoin without FSC permission carries a maximum of seven years' imprisonment and a TWD 100 million fine. Fraud and price manipulation carry three to ten years and fines of TWD 10 million to TWD 200 million. These penalties apply to responsible individuals, not only to the corporate entity.
Can foreign firms operate in Taiwan under the new Act?
The pre-existing AML requirement for non-Taiwan entities to incorporate a local company or branch before operating has not been removed by the Act. The new licensing framework builds on top of that local entity requirement. Offshore platforms that serve Taiwanese users without a local presence and without a license remain in scope for enforcement, and the industry association has specifically identified unlicensed offshore platforms as a priority concern.
Source: TRM Labs