Taiwan’s Virtual Asset Service Act : What Institutional Players Must Prepare For
By Andrew Chang, Compliance Officer, Liminal
Three years after legislator Chiang Yung-chang first introduced Taiwan’s dedicated virtual asset bill in 2023, the Virtual Asset Service Act (VASA) was passed by the Legislative Yuan on June 30, 2026, and promulgated by President Lai Ching-te. Taiwan’s crypto regulation has crossed a threshold it will not step back from.
For institutions and B2B operators in the digital asset space, this law signifies a stronger regulation requirement that gives Taiwan a more regulated digital asset market. It formally replaces Taiwan’s AML registration system with a licensing regime modeled on traditional financial institution oversight, bringing VASPs under a level of regulatory scrutiny they have not faced before. Though the statue may appear strict, it actually gives VASPs legitimacy to conduct business in the Taiwanese market.
What Is the Taiwan Virtual Asset Service Act (VASA)?
The Virtual Asset Service Act is Taiwan’s first dedicated legislative framework governing the digital asset industry. Until its passage, crypto businesses in Taiwan operated under an anti-money laundering registration system, a relatively light-touch requirement compared to the full licensing frameworks that Singapore, Hong Kong, Japan, and the EU have each built over the past several years.
Under VASA, every Virtual Asset Service Provider operating in Taiwan must now obtain an explicit operating license from the Financial Supervisory Commission (FSC) before starting or continuing to do business in the country. AML registration alone is no longer sufficient.
The Act governs two broad areas for VASPs: institutional management, covering capital requirements, governance, and operational standards; and conduct management, covering prohibitions on insider trading, fraud, market manipulation, and money laundering, aligned largely with international standards.
Who Does VASA Apply To? The Seven VASP Categories
Article 6 of the Act defines VASPs across seven categories: Virtual Asset Exchanger,, Virtual Asset Trading Platform, Virtual Asset Transferor, Virtual Asset Custodian, Virtual Asset Underwriter, Virtual Asset Lender, and Other Virtual Asset Service Provider, a catch-all category for other types.
In practice, most of the deliberations during the reviewing process in the finance service committee in the Legislative Yuan centred on trading platforms, which make up the large majority of operators currently holding AML registration in Taiwan. This has shaped how several provisions were written, and it has also left some gaps that will need to be resolved through subsequent FSC regulations, particularly for custodian service providers and other non-trading categories.
For B2B infrastructure providers, Custodian would be the most directly relevant category. Liminal Taiwan is currently the first foreign company to apply for custodian registration in Taiwan, a position that reflects both the market opportunity and the regulatory complexity that institutions entering this space need to navigate carefully.
Key VASA Requirements: What Institutions Must Build or Verify
Mandatory FSC Licensing
All VASPs must obtain an FSC operating license. Existing operators registered for AML compliance have a 12-month window to submit a license application and up to 24 months in total to obtain full FSC approval.
This transition window looks reasonable on paper. In practice, institutions that need to build governance frameworks, strengthen their financial position, implement more detailed and even more complicated oversight rules, prepare cybersecurity documentation, and work through a licensing process for the first time will find that 24months moves quickly.
Capital Requirements and Financial Conditions
Article 11 of the Act requires VASPs to maintain a minimum paid-in capital or designated operating funds at all times, not simply at the point of application. Trading Platforms are expected to require capital or operating funds of at least NT$100 million, with the requirements for other VASP categories remain to be clarified by the FSC.
The capital requirement being an ongoing floor, not a one-time threshold, creates real cash-flow considerations for VASPs. Article 13 simultaneously caps the debt a VASP may take on through, for example, bond issuance. Institutions planning to enter or expand in Taiwan need to model their financial structure against both requirements before committing to market entry.
Asset Segregation and Customer Protection
VASPs must keep client funds separate from company operating assets at all times. Articles 14 through 23 establish general requirements applicable to all VASPs, including internal audit and control systems, outsourcing regulations, and customer protection frameworks, consistent in substance with practices required in other jurisdictions.
For institutions relying on third-party custody or wallet infrastructure providers, asset segregation is no longer simply a best practice. The VASP’s custodian is directly implicated in compliance. Due diligence on infrastructure vendors becomes a regulatory obligation, and the question of whether a custody partner’s architecture can demonstrably support segregation at the account or wallet level will be an FSC licensing consideration.
Cybersecurity Standards
Platforms will need to demonstrate cybersecurity controls that meet FSC expectations. For institutions operating at scale across multiple chains and wallet types, this means security certifications and controls need to be documented, auditable, and maintained on an ongoing basis, not simply declared at the point of licensing.
Internal Governance and Risk Management
Institutions need documented governance frameworks, defined risk appetite, and clear lines of accountability. For many crypto-native businesses that have grown rapidly outside the governance structures of regulated financial institutions, building this retroactively is among the most time-consuming parts of the licensing process. A lengthy back-and-forth between applicants and regulators is expected. The process could be a grind..
Association Membership
Chapter 3 of the Act establishes a VASP association and requires every VASP to join before commencing operations. Taiwan’s financial supervisory model operates on two tiers: self-regulation through associations and direct FSC supervision. The association will establish self-regulatory rules covering matters either (a) of detail that are not put in the statute, or (b) rulebooks or executive actions that the statute authorizes the administration to draft or conduct. In such cases, the regulators would then ask the Association for opinions from the industry. This is an important part of the compliance environment that institutions entering Taiwan should factor into their operational planning.
Stablecoin Issuers Face a Distinct and Higher Regulatory Burden
Chapter 4 of the Act (Articles 34 through 41) treats stablecoin issuers as a special kind of VASP subject to requirements that go beyond those imposed on other VASPs.
Stablecoin businesses require dual approval from both the FSC and Taiwan’s Central Bank (the CBC) before operating. Article 36 requires stablecoin issuers to establish and maintain full reserve assets held at a financial institution within Taiwan. The practical reading of this provision is that both domestic and offshore stablecoin issuers may need to establish a local presence, incorporate a company, and apply for a license in accordance with the Act. A materially higher barrier to entry than simply meeting FSC requirements alone.
The 100% reserve mandate is a hard requirement. Every unit of stablecoin in circulation must be backed by an equivalent reserve asset held in a verifiable and segregated structure within Taiwan’s financial system. For institutions building stablecoin payment infrastructure, cross-border settlement rails, or institutional treasury products in the market, this has direct implications for how custody arrangements are structured and what reserve verification capabilities the underlying infrastructure must support.
Taiwan’s Central Bank has publicly described itself as playing a secondary role to the FSC, but it is often the case that when the central bank makes a request within its supervisory authority, the FSC typically requires operators to comply. In several closed-door meetings, officials from the Central Bank admitted that whenever they make regulatory suggestions, it is expected that those suggestions are followed by the financial institutions. Institutions should treat the dual approval requirement as a genuine dual review process, not a formality.
The Penalty Regime: Why This Becomes a Board-Level Conversation
Unauthorised operation of a crypto platform or stablecoin service carries a prison sentence of up to seven years and fines of up to NT$100 million (approximately USD 3.14 million) Market fraud or price manipulation offences carry three to ten years in prison and fines ranging from NT$10million to NT$200 million.
From a compliance standpoint, the statutory penalties indicates that legislators treats VASPs as one kind of financial institution. VASPs is, in the eyes of Taiwanese Law, as much FinTech companies as traditional financial institutions. . Penalty structures at this level reflects that Taiwan intends to enforce the regime with the same, if not more, seriousness applied to regulated financial services. When non-compliance can result in criminal liability for individuals, not only fines for the entity, compliance investment becomes a board-level conversation rather than a regional team’s operational concern.
For B2B operators, the penalty regime also raises the stakes on counterparty due diligence. Working with a platform that operates outside the FSC licensing framework, even as a service provider or liquidity partner, carries reputational and potentially legal exposure. Whether counterparties and partners are licensed in Taiwan will need to become part of standard onboarding and ongoing monitoring processes.
What the Transition Window Actually Requires: A Practical Checklist
The 21-month window from enactment to full FSC approval is the planning horizon institutions need to work backward from now. The practical steps are:
Gap assessment against FSC licensing requirements. Begin this as soon as the Executive Yuan publishes the effective date and the FSC publishes the rulebooks or further detailed regulations that VASA authorizes the FSC to set up.
Custody and wallet infrastructure audit. Review your current setup against asset segregation requirements. If you rely on a third-party custody provider, assess their certifications and controls now. ISO 27001, ISO 27701, and SOC 2 Type 2 (or even SOC 1 Type 2) are the baseline certifications an FSC-facing institution should be able to point to in their custody partner.
Governance documentation. Build or formalise risk management policies, internal controls frameworks, and defined accountability structures before the license application process begins. Regulators reviewing applications will examine this material closely.
Financial structure review. Model capital requirements and debt-ratio constraints against your current and projected financial position. The ongoing capital floor and debt cap operate simultaneously and may require restructuring for some operators.
Counterparty due diligence. Identify any business relationships in Taiwan with operators who may not be seeking or able to obtain a license. Address this proactively rather than under regulatory scrutiny.
Trade association preparation. Membership in Taiwan’s VASP trade association is a prerequisite to commencing operations. Engaging with the association’s formation and self-regulatory framework development early positions institutions to shape the rules that will govern the industry.
Taiwan’s VASA in the Context of Asia’s Regulatory Convergence
Taiwan’s Virtual Asset Service Act comes later than some people in Taiwan had hoped. Singapore (MAS), Hong Kong (SFC/HKMA), Japan (FSA), and now Taiwan have each moved from minimal registration frameworks to full licensing regimes with meaningful operational requirements and enforceable penalties. VASA is a bill that tries to combine the best practices in each jurisdiction, and set up a standard that allows Taiwan’s VASPs to compete in the international crypto market. Taiwan has great market potential, and VASA aims at building a regulatory environment that fosters VASPs that can bring the Taiwanese market to this borderless playing field. .
For B2B operators with multi-market APAC operations, this convergence has a practical implication: compliance infrastructure built to satisfy one regulator increasingly satisfies the requirements of others. Certified custody arrangements, segregated asset management, cybersecurity frameworks, and documented governance that meets MAS or SFC standards form a credible foundation for FSC licensing in Taiwan.
For Taiwan specifically, the passage of VASA also opens the market to participation from traditional financial institutions. Major banks and financial holding companies are already studying how to develop virtual asset-related businesses following the Act’s passage, sinceVASA provides a legal framework within which regulated institutions can operate. For those institutions, the infrastructure question is their starting point. The custody arrangements, wallet infrastructure, and compliance architecture they select will be subject to the same FSC scrutiny as the license itself.
Liminal Taiwan, currently the first foreign company to have applied for custodian registration in Taiwan, is positioned to support institutions navigating this process, providing wallet infrastructure that meets the FSC’s regulatory requirements and is already built to the certifications that institutional counterparties and regulators expect.
The institutions that will be well-positioned in Taiwan’s next regulatory phase are those that treat the transition window as a genuine compliance build, not a filing exercise. The infrastructure, governance, and counterparty decisions made now will determine the options available when the clock runs out.
Reference: Taiwan’s sweeping crypto law raises the bar with licensing, reserve mandates, and tough penalties — CoinDesk, July 1, 2026
Andrew Chang is Compliance Officer at Liminal Custody, an institutional digital asset custody and wallet infrastructure platform serving banks, exchanges, and regulated financial institutions across APAC and MENA. Liminal holds ISO 27001, ISO 27701, and SOC 2 Type 2 certifications and is the first foreign company to apply for custodian registration in Taiwan. To know more:
