Custodial wallet / SaaS in United States
Hosted wallet provider that holds keys on behalf of end users, often white-labeled to businesses (custody as a service).
Custodial SaaS is conditionally permitted in United States with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- FinCEN MSB registration (immediate, Form 107) under the Bank Secrecy Act — applies to the SaaS operator as the money transmitter
- State Money Transmitter Licenses (MTLs) required in 49 states + DC (18-36 months for full coverage, $2M-$10M+ in bonds/fees); Montana is sole exemption
- Travel Rule (FinCEN) compliance required for transactions above applicable thresholds
- OFAC sanctions screening required on all transactions
- If the custodian holds digital assets classified as securities (per Howey Test), SEC custody rules apply — including qualification as a qualified custodian, account segregation, quarterly reporting, and annual audits with proof-of-reserves
- New York BitLicense (23 NYCRR Part 200) required for NY customers — 12-24+ months, $2M+ capital
- California DFAL license required effective July 1, 2026, with $100k/day penalties for non-compliance
- IRS reporting obligations — virtual currency treated as property; 1099-B/1099-MISC reporting likely applies depending on user activity
- The SaaS operator (custodian) bears primary AML/BSA obligations as the money transmitter; white-label clients may be considered MSBs themselves if they engage in transmission activities, creating potential dual-reporting obligations
Key Restrictions
- A trust charter (state-level) or OCC national bank charter is typically required to serve as a qualified custodian for digital asset securities
- SEC custody rules apply if the custodian holds any digital assets that are classified as securities — requiring qualified custodian status, segregation of client assets, and annual audit with proof of reserves
- Cannot serve US customers without FinCEN MSB registration and state MTLs; NY requires a separate BitLicense
- The white-label (SaaS) model creates ambiguity about which entity bears the primary AML obligation — both the custodian and the client may need independent MSB/MTL coverage
- Operator must geofence out jurisdictions where it lacks licensing coverage (e.g., NY without BitLicense)
- Insurance/bonding requirements vary by state MTL — typically $100k-$2M surety bond per state plus net worth requirements
Key Risks
- Dual-regulatory risk: assets could be simultaneously classified as commodities (CFTC) and securities (SEC) — different custody and segregation rules apply to each
- SEC enforcement risk if the custodian holds tokens later deemed securities without proper qualified-custodian status
- State-by-state licensing fragmentation — achieving full 50-state coverage is expensive ($2M-$10M+ total) and time-consuming (18-36 months)
- SaaS/white-label structure creates regulatory ambiguity: the custodian may be deemed to share MSB liability with its clients, especially if the custodian facilitates transmission, not just storage
- New York BitLicense requirement is a major barrier — 12-24+ month application and $2M+ minimum capital
- California DFAL effective July 2026 adds another large-state licensing burden with $100k/day penalties
- IRS and state tax authority enforcement risk — NJ Division of Taxation uses automated tools to cross-check reported crypto income against 1099 forms
- OFAC sanctions compliance is high-risk — crypto transactions can involve sanctioned addresses; failure to screen is a DOJ enforcement trigger
- Increasing federal enforcement focus — DOJ has filed civil forfeiture for $225.3M in stolen digital funds (June 2025); SAFE Crypto Act (Dec 2025) and EO 14390 (March 2026) signal intensified anti-fraud efforts
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
SEC — regulates crypto assets that are securities and transactions in them, including broker-dealer and exchange registration under the Exchange Act. Its 17 March 2026 interpretation (Rel. 33-11412, 91 FR 13714) sets a token taxonomy of digital commodities, digital collectibles, digital tools, stablecoins and digital securities, and applies the Howey test to determine when a non-security crypto asset is subject to an investment contract.
CFTC — administers the Commodity Exchange Act for crypto assets that are commodities (the 17 March 2026 SEC interpretation, joined by the CFTC, lists Bitcoin and Ether as digital commodities), regulates crypto derivatives, holds anti-fraud and anti-manipulation authority over commodity spot markets (7 U.S.C. 9), and since 4 December 2025 has permitted listed spot crypto trading on CFTC-registered exchanges.
FinCEN — Treasury bureau (31 U.S.C. 310) that administers the Bank Secrecy Act: MSB registration on Form 107 within 180 days of establishment and every two years (31 CFR 1022.380), and the funds-transfer recordkeeping and travel rule for transmittals of $3,000 or more (31 CFR 1010.410(e)-(f)).
OCC — charters and supervises national banks and federal savings associations, which may provide crypto-asset custody, certain stablecoin activities and node participation without prior supervisory non-objection (Interpretive Letter 1183, 7 March 2025); conditionally approved five national trust bank charters for digital-asset firms on 12 December 2025; and is the primary federal payment stablecoin regulator for Federal qualified issuers under the GENIUS Act.
IRS — administers federal tax on digital assets, which are treated as property, not currency; brokers report digital-asset sales on Form 1099-DA beginning with transactions on or after 1 January 2025.
OFAC — administers U.S. economic sanctions, which apply to virtual currency transactions; on 15 October 2021 it published 'Sanctions Compliance Guidance for the Virtual Currency Industry'.
DOJ — prosecutes federal crimes involving crypto assets, including money laundering (18 U.S.C. 1956) and operating an unlicensed money transmitting business (18 U.S.C. 1960), as well as fraud and sanctions-evasion offences.
Bank Secrecy Act (Public Law 91-508, 1970; codified at 31 U.S.C. 5311 et seq.) is the federal AML/CFT statute. It requires reports and records useful in criminal, tax and regulatory investigations and requires money transmitting businesses to register with Treasury (31 U.S.C. 5330), implemented by FinCEN Form 107 within 180 days of establishment and renewal every two years (31 CFR 1022.380).
Securities Act of 1933 section 5 (15 U.S.C. 77e) prohibits offers and sales of securities without an effective registration statement or an exemption, and Securities Exchange Act of 1934 section 15 (15 U.S.C. 78o) requires brokers and dealers to register with the SEC. Their application to crypto assets is set out in the SEC interpretation of 17 March 2026 (Rel. 33-11412, 91 FR 13714), which the CFTC joined.
New York BitLicense (23 NYCRR Part 200) (2015) — NY-specific virtual currency business licensing
California DFAL (2025) — Digital Financial Assets Law — state crypto licensing
VASP: FinCEN MSB registration (immediate, Form 107) + state Money Transmitter Licenses in 49 states + DC (18-36 months for full coverage, $2M-$10M+ in bonds/fees). Montana is sole exemption.
Custody: federally, national banks and federal savings associations may custody crypto assets (OCC Interpretive Letter 1183, 7 March 2025) and the OCC conditionally approved five national trust bank charters for digital-asset custodians on 12 December 2025; broker-dealers holding crypto asset securities are subject to Rule 15c3-3 possession requirements (SEC staff statement, 17 December 2025); and on 6 October 2026 the SEC proposed crypto custody rules for registered advisers and funds (91 FR 63870). State trust charters are available separately under state law.
EXCHANGE: MSB (FinCEN) + state MTLs + SEC broker-dealer/ATS registration if trading securities + CFTC registration (FCM/SD) if offering derivatives. NY BitLicense required for NY customers (12-24+ months, $2M+ capital).
Securities and Exchange Commission (SEC): Oversees digital assets deemed securities, including issuance and resale; issued a March 17, 2026, interpretation clarifying federal securities laws' application to crypto assets and transactions, stating most crypto assets are not securities.
Commodity Futures Trading Commission (CFTC): regulates commodities and derivatives under the Commodity Exchange Act; signed a Memorandum of Understanding with the SEC on 11 March 2026 to coordinate oversight and support lawful innovation (SEC PR 2026-26), and joined the SEC’s 17 March 2026 interpretation on crypto assets (Rel. 33-11412, 91 FR 13714), which the CFTC administers the CEA consistently with.
Financial Crimes Enforcement Network (FinCEN): administers the Bank Secrecy Act AML/CFT regime. Under FIN-2013-G001 (18 March 2013) an administrator or exchanger of convertible virtual currency is a money transmitter and therefore a money services business; FIN-2019-G001 (9 May 2019) consolidates that guidance and applies it to further CVC business models. Each MSB must register with FinCEN on Form 107 within 180 days of establishment and renew every two years (31 CFR 1022.380).
State regulators: Examples include California's DFPI (Digital Financial Assets Law effective July 1, 2026, requiring licenses with $100k/day penalties); New Jersey Department of Banking and Insurance; New York's NYDFS (BitLicense regime); Connecticut (money transmitter laws).
On 18 June 2025 the U.S. Department of Justice filed a civil forfeiture complaint in the U.S. District Court for the District of Columbia against more than $225.3 million in cryptocurrency that it alleges was laundered through a blockchain-based network dispersing proceeds of cryptocurrency investment-fraud ("confidence scam") schemes.
The SAFE Crypto Act (Strengthening Agency Frameworks for Enforcement of Cryptocurrency Act, S. 3428, 119th Congress), which would establish a Task Force for Recognizing and Averting Cryptocurrency Scams, was introduced on 10 December 2025 by Sen. Jerry Moran with Sen. Elissa Slotkin as original cosponsor and referred to the Senate Banking Committee; it has not advanced beyond committee referral as of 14 October 2026.
Executive Order 14390, "Combating Cybercrime, Fraud, and Predatory Schemes Against American Citizens", signed by the President on 6 March 2026 and published at 91 FR 12051 (11 March 2026), directs State, Treasury, War, Justice and Homeland Security to review their frameworks within 60 days and, within 120 days, submit an action plan identifying the transnational criminal organizations responsible for scam centers and cybercrime.
The New Jersey Division of Taxation uses automated tools to identify mismatches between reported cryptocurrency income and federal 1099 forms
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a custodial wallet / SaaS operator may serve US residents, but only after obtaining FinCEN MSB registration, state MTLs in 49 states (plus a BitLicense for NY and DFAL license for CA), and, if holding digital assets deemed securities, must hold a trust or national bank charter as a qualified custodian with segregated accounts, annual audits, and proof-of-reserves.
Questions this verdict aims to answer
- What custody license / qualified-custodian status applies?
- What segregation, insurance, and proof-of-reserves rules apply?
- What AML obligations attach to the SaaS vs the white-label client?