Skip to content

Taiwan's 2026 Virtual Asset Service Act

The Virtual Asset Service Act passed its third reading in the Legislative Yuan on 30 June 2026, having been approved by the Executive Yuan that April. It marks Taiwan's shift in crypto-asset regulation from registration under anti-money-laundering law to licensing under a dedicated financial statute. Commencement follows promulgation and the date the Executive Yuan designates, so the obligations below are not all running yet. What it reaches goes beyond centralized exchanges to stablecoin issuers, organizations that accept cryptocurrency donations, and, at the margins, ordinary users holding assets in self-custody.

This page covers the Act's structure, the provisions that matter, the penalty design, and the effect on different kinds of reader, and tracks what remains before it fully takes effect. It is not legal advice. For the operative requirements, sentences, and scope, the authority is the text as passed on third reading and the secondary legislation the competent authority issues.

Why an international reader might care

Taiwan is running this reform in the open, on a visible legislative timeline, in a jurisdiction where crypto adoption is high and the regulator is explicit about following the international direction of travel. For anyone comparing regimes across the Asia-Pacific, the useful contrast is with Singapore's Payment Services Act licensing regime (in force since January 2020, tightened in 2024 and again with the digital token service provider regime from June 2025), Hong Kong's two-pillar arrangement where the Securities and Futures Commission licenses virtual asset trading platforms and the Monetary Authority licenses fiat-referenced stablecoin issuance under the Stablecoins Ordinance from August 2025, and Mainland China's comprehensive ban on crypto business activity and mining, which stops short of criminalizing personal holding. Taiwan is arriving at licensing later than Singapore and Hong Kong, which means its provisions can and do draw on experience already visible in those regimes.

From registration to licensing

The current regime brings virtual asset service providers under the Money Laundering Control Act as a matter of declaration and registration, focused on customer due diligence (KYC) and suspicious transaction reporting. The Act moves to the licensing model familiar from other financial statutes: a provider must obtain the competent authority's licence before operating, and detailed requirements attach to corporate form, capital, custody of customer assets, and permitted business types. The regulatory density rises substantially.

For users, the number of compliant providers falls, while each of them has passed prior review and remains under continuing supervision. Providers operating without a licence fall within the Act's criminal provisions.

Find the part that applies to you

  • You use a wallet and occasionally send or receive crypto: go straight to "What this means for individual users". Most situations are not directly affected.
  • You run an exchange, issue a stablecoin, or take crypto donations for an organization: read "What this means for organizations" and "Listed companies holding crypto".
  • You follow global regulatory trends without a stake in this one: skip the detail and read "International comparison".

Structure of the Act (56 articles)

Per the Executive Yuan's published explanatory statement, the Act runs to 56 articles:

  • General provisions (Articles 1 to 5): legislative purpose, competent authority, definitions, the innovation sandbox, international cooperation
  • Virtual asset service providers (Articles 6 to 28): business types, licensing, dedicated and concurrent operation, corporate form and capital
  • Trade associations (Articles 29 to 33)
  • Stablecoins (Articles 34 to 41): issuance, reserves backing the peg to fiat currency, transaction consent mechanisms
  • Administration and supervision (Articles 42 to 46): prohibition of fraud and manipulation, inspection, and exit
  • Penalties (Articles 47 to 54)
  • Transitional provisions and commencement (Articles 55 and 56)

The competent authority is the Financial Supervisory Commission (FSC). Providers already registered under the Money Laundering Control Act convert to licences under this Act during the transition period.

Defining "virtual asset", and where NFTs sit

The Act spends considerable space on the definition, and on whether non-fungible tokens (NFTs) fall inside the regime. The explanatory statement says that whether a given instrument is a virtual asset under this Act comes back to the statutory definition and to the competent authority's determination in the individual case. What the press calls a thing does not settle whether the Act applies. For NFT creators, issuance platforms, and secondary-market operators, that boundary decides whether the business needs a licence.

Why the stablecoin chapter draws attention

Articles 34 to 41 handle three things:

  • Issuance requires a licence, with requirements on the issuer and the terms of issuance
  • Reserves backing the peg to fiat currency, connecting to financial order and the central bank's role
  • Transactions and consent mechanisms, including user protection

This part touches technical design and accounting practice, and will still need secondary legislation and interpretive rulings after passage. In policy terms it brings an on-chain payment instrument inside the financial regulatory perimeter, so that a stablecoin performing a monetary function in practice carries the corresponding settlement and reserve guarantees.

Penalties, and what the sentences actually say

Two provisions carry the criminal weight. Article numbering below follows the Executive Yuan version. The version passed on third reading may renumber these or alter their content, so check the promulgated text before citing an article number:

  • Article 47: violating Article 42(1) or 42(4), covering fraud and manipulation in virtual assets, carries imprisonment of not less than 3 years and not more than 10 years, and may carry a fine of not less than NT$10 million and not more than NT$200 million. The legislative reasoning draws the analogy to the Securities and Exchange Act and the Futures Trading Act, and to the need for deterrence where civil and administrative measures fall short
  • Article 48: violating Article 7(1), 7(3), or 34(1), covering operating without a licence or issuing a stablecoin without one, carries imprisonment of up to 7 years and may carry a fine of up to NT$100 million, with joint liability for the legal person

Other provisions cover custody of customer assets and false statements in applications, at lower sentences or as administrative penalties. Where a headline emphasizes the maximum sentence, it is usually taking the ceilings from these two articles. Reading the elements of the offence tells you which conduct the legislature set out to deter, and checking the promulgated text tells you what survived.

The transition

Providers registered under the current anti-money-laundering regime, and financial institutions already conducting the relevant business, convert to licences under this Act during a transition period after commencement. The exact length and conditions follow the text as passed and the competent authority's announcements. Three dates are worth keeping apart when reading coverage: the third reading, the presidential promulgation, and the commencement date. They are normally different.

What this means for individual users

The Act aims at providers offering services to the public, receiving customer assets, or conducting transactions, and at stablecoin issuers. An individual using a self-custody wallet and moving their own assets on-chain does not necessarily fall within "operating a virtual asset service business". The question to hold onto is whether what you are doing amounts to a business requiring prior authorization:

  • Occasional personal transfers on-chain: generally not a business
  • Holding assets for others, or managing them for a fee over time: potentially within "offering services to the public", with the boundary depending on the specific facts and the authority's determination
  • Issuing a stablecoin or stablecoin-like asset personally: expressly within scope

This page does not determine individual cases. If your activity sits between personal use and offering a service, consider professional advice before a large movement or public promotion.

What this means for organizations

  • Centralized exchanges: compliance burden rises from registration to prior review under licensing, with requirements on corporate form, capital, and custody of customer assets. The barrier to entry goes up
  • Stablecoin issuers: newly and explicitly regulated under the dedicated chapter
  • Non-profits accepting cryptocurrency donations: the Act's focus is not the act of receiving donations, but an organization that holds donors' assets on their behalf, provides conversion, or offers other services may fall within the provider definition. Map your actual operational flow against the provisions and confirm with an accountant and counsel

Listed companies holding crypto: the exchange's accounting and internal control guidance (May 2026)

On 29 May 2026, the Taiwan Stock Exchange and the Taipei Exchange jointly commissioned the Accounting Research and Development Foundation to produce two sets of guidance for listed companies: guidance on accounting for stablecoin transactions, and guidance on internal controls for holding cryptocurrency. Where the sections above concern the issuance side that the FSC and the central bank regulate, these two address the corporate side: how a listed company records crypto assets once it holds them, and how risk control is implemented.

The accounting guidance requires a company holding stablecoins to determine the accounting classification against the law as it stands and the issuer's most recently published user terms, and works through four cases drawn from common USDC and USDT transaction patterns. Classification turns on contractual rights. Depending on whether the stablecoin in question is under a legislated regime, the test is whether the holder has a contractual right to receive cash or another financial asset, which then places the stablecoin as a financial asset, an intangible asset, or inventory. Held for sale or trading, it is inventory.

The internal control guidance requires controls across four areas: holding and management, wallet creation and custody, acquisition and disposal and conversion and transfer, and payment and receipt transactions. The control points include a cryptocurrency management unit supervised by the board, at least one specialist in the cryptocurrency field and one dedicated information security specialist, and a three-tier approval structure (responsible manager, general manager, chairperson), with transaction limits and loss ceilings. Wallets and private keys use multi-signature, the initiator and the approver cannot be the same person, and private keys, seed phrases, and passwords are held in separate layers. Hot wallet market value cannot exceed 15% of total holdings, and going over requires transfer to cold storage or third-party custody within 5 business days. Where third-party custody is used, the institution must be licensed in its own jurisdiction and provide a SOC 1 Type 2 or ISAE 3402 Type 2 report (third-party audit evidence of internal control effectiveness), reassessed for compliance at least annually. Both sets of guidance connect to the existing Regulations Governing the Acquisition and Disposal of Assets by Public Companies and to material information procedures, so acquisitions or disposals over the threshold still require announcement and filing.

For an anonymity community, the more consistent and transparent the corporate holding side becomes, the clearer the difference between the two paths: the compliant route is auditable, disclosed, and approved by several people, while self-custody on-chain is a different trade-off between privacy and bearing your own risk.

Cross-border sanctions and the over-compliance side effect

The Act brings exchanges, stablecoin issuers, and custodians under licensing, on top of the existing FATF Travel Rule (the international anti-money-laundering rule requiring identifying information on both sides of a transfer to accompany it) and the US Treasury's OFAC sanctions lists, which financial institutions face heavy penalties for breaching. Over-compliance is the effect that appears in practice without appearing in the text.

Over-compliance is itself lawful. Facing ambiguous rules, a provider minimizing its own risk to zero will set reporting thresholds tighter than the law requires, widen what counts as suspicious, and block whole categories of users from higher-risk jurisdictions. For Taiwanese providers, the recurring patterns are:

  • Small cross-border donations destined for Myanmar, Syria, Iran, or Afghanistan automatically triggering enhanced due diligence, or being refused outright
  • Individual accounts with a long history of Tor use or self-custody being classified as high-risk, raising the cost of appealing
  • Taiwanese donors supporting Hong Kong media, Ukrainian grassroots organizations, or Uyghur human rights projects being questioned about the purpose of a domestic transfer, or having an overseas channel closed without warning

The mechanism matches the decade and more of financial censorship cases documented by Rainey Reitman, former EFF Activism Director and Chief Program Officer, in Transaction Denied. What is particular about Taiwan's position is that it holds both ends: affected donors, and providers carrying the added compliance load. The cases are in When financial companies act as censors, and the operational guidance for advocacy organizations is in Anonymous donation channels for advocacy organizations.

International comparison: the US "Crypto Week" bills of 2025

Taiwan's move from AML registration to licensing under a financial statute overlaps in problem definition with the US market structure legislation of the same period. On 17 July 2025 the House of Representatives passed three crypto bills in three days, which the industry and press called Crypto Week.

  • GENIUS Act (S.1582, stablecoins): passed the House 308-122, signed by President Trump on 18 July 2025 (Pub. L. 119-27). The effective date is set separately in the text, at 18 months after enactment or 120 days after federal agencies publish final implementing rules, whichever is earlier. It requires 100% reserves in fiat or short-term Treasuries, monthly public reserve disclosure, federal or state licensing of issuers, anti-money-laundering obligations under the Bank Secrecy Act, and prohibits paying interest or yield to holders. This is the counterpart to the Taiwanese Act's stablecoin chapter (Articles 34 to 41)
  • CLARITY Act (H.R.3633, market structure): passed the House 294-134 on 17 July 2025, and a revised version cleared the Senate Banking Committee 15-9 on a bipartisan vote on 14 May 2026, awaiting a full Senate vote. It divides the long-overlapping SEC and CFTC jurisdiction over crypto assets, giving the CFTC exclusive authority over digital commodity spot markets while the SEC keeps investment contract assets, and establishes registration for exchanges, brokers, and dealers. The problem it solves, the bifurcated SEC and CFTC jurisdiction, has no Taiwanese counterpart. At the level of establishing a registration or licensing regime for providers, it compares to Articles 6 to 28 of the Taiwanese Act
  • Anti-CBDC Surveillance State Act (H.R.1919): passed the House 219-210 on 17 July 2025 (Roll Call 201), with S.1124 pending in the Senate. It bars the Federal Reserve from issuing a central bank digital currency directly or through intermediaries. There is no Taiwanese counterpart, and it reflects US legislators positioning public digital currency as a surveillance instrument
Dimension US GENIUS Act Taiwan's Act, stablecoin chapter
Reserves 100% fiat or short-term Treasuries, monthly public disclosure Reserves backing the peg to fiat (ratio and disclosure frequency to be set in secondary legislation)
Who may issue Subsidiaries of insured depository institutions, federally approved non-bank issuers, state-approved issuers (under US$1 billion) Providers licensed by the competent authority
Paying interest Expressly prohibited Not expressly addressed, pending secondary legislation
AML obligations Bank Secrecy Act applies directly Carried over from the Money Laundering Control Act
Supervisor Federal or state financial regulators Financial Supervisory Commission

The comparison is for readers with cross-border operations or an interest in on-chain assets, showing how two jurisdictions handle the same set of problems. The stablecoin chapter maps most directly onto the GENIUS Act. The CLARITY Act maps onto the provider licensing framework. The Anti-CBDC bill runs in the opposite direction to Taiwan's digital New Taiwan dollar discussion.

The community tracks these three because global stablecoin and market structure regimes shape each other. Circle, which issues USDC, is a US company, USDT has US exposure, and most stablecoins Taiwanese users actually touch are directly constrained by the GENIUS Act. Further reading is in The cryptocurrency privacy spectrum.

Progress in the Legislative Yuan

From cabinet approval to third reading

The Finance Committee completed its article-by-article review on 3 June 2026 and reported the bill to the full chamber, which passed it on third reading on 30 June 2026. Versions and developments during review, with attribution and figures following the Legislative Yuan's own bill records:

  • Several competing versions: besides the Executive Yuan version drafted by the FSC, there were versions from the Taiwan People's Party caucus and from DPP and KMT legislators (including Lin Chu-yin, Lin Ssu-ming, and Ko Ju-chun), with more than ten proposals consolidated for joint review by the Finance Committee. Cross-party agreement that a dedicated statute was needed came earlier than agreement on the specific provisions
  • FSC chairperson's report (7 May 2026): Peng Chin-lung reported to the Finance Committee on the development of financial technology, listing stablecoin reserves and the prohibition on paying interest as the two main directions, echoing the GENIUS Act's design of the same period. The same session covered virtual asset custody pilots, real-world asset tokenization, AI supervision, and financial large language models, with stablecoins one item among them
  • Six categories of business: the Executive Yuan version set out virtual asset exchange, platform operation, transfer, custody, underwriting, and lending as the permitted activities for licensed providers
  • Transition period: the Executive Yuan version allowed 9 months to apply and 18 months to obtain the licence, with some legislators' versions arguing for a shorter deadline. The industry association asked for a longer transition and for explicit provisions on what happens to those who fail review. The operative figures follow the text as passed

Three dates stay worth keeping apart: the third reading on 30 June 2026, the presidential promulgation that follows, and the commencement date the Executive Yuan designates separately. The Act is not fully in effect until the last of them.

The public hearing on the pre-announced version (June 2025)

Before the Executive Yuan approved the draft on 2 April 2026, the FSC pre-announced a 50-article version for public comment on 25 March 2025. The Finance Committee of the 11th Legislative Yuan held its fifth public hearing on that version on 12 June 2025.

Hsieh Feng-ying, Director General of the central bank's Department of Banking, suggested at the hearing that stablecoins be regulated along the lines of the Act Governing Electronic Payment Institutions, with an explicit reserve deposit obligation on issuers. That is a significant marker of the central bank's position. Press accounts list the FSC, the central bank, and the Ministry of Justice among the participating agencies, alongside industry bodies including the Taiwan Virtual Asset Anti-Money Laundering Association and the Taiwan Virtual Asset Service Provider Association. Who actually registered to speak, and what the written submissions said, follows the Legislative Yuan's published speaker list and record.

The pre-announced version (50 articles, penalties at Articles 41 to 48) and the approved version (56 articles, penalties at Articles 47 to 54) differ by six in article numbering, while the elements, sentences, and fines for fraud and manipulation and for unlicensed operation or stablecoin issuance are the same.

When reading coverage, keep industry associations, government agencies, and human rights or consumer NGOs apart. A trade association is not civil society in the broader sense.

Why an anonymity community tracks financial regulation

We advocate for Tor, Tails, and OONI, and we pay attention to how payments and identity expose people. The regulatory density of a VASP regime directly shapes the choice structure between a compliant exchange and self-custody on-chain. Setting out where the legislation stands gives the community shared ground for discussing privacy, fraud prevention, and compliance together rather than past each other. Further reading: the anonymous payments research track and the cryptocurrency privacy spectrum.

Sources

The Chinese-language version of this page is at 台灣 VASP 法 2026.

If you have first-hand hearing records, or track amendments after third reading, the channels on the Community services page reach us and we will update this page.