Law Articles
2026-10-16
ICO
Taiwan’s Virtual Asset Service Act: Observations on the Transition Period Before the Licensing Regime Takes Effect
【Zhong Yin Law Firm Partner Charlotte Wu】
charlotte.wu@zhongyinlawyer.com.tw
charlotte.wu@zhongyinlawyer.com.tw
Taiwan’s Virtual Asset Service Act (the “Act”) was promulgated on July 22, 2026, with its effective date to be set separately by the Executive Yuan. According to the Financial Supervisory Commission (the “FSC”), the Act could take effect as early as the first quarter of 2027. At that point, virtual asset service providers (“VASPs”) will move from the existing anti-money laundering (“AML”) registration regime to a licensing regime that requires prior regulatory approval.
The period between promulgation and effectiveness, and then through existing operators’ conversion to licensed status, is not only a critical window for compliance preparation. It is also an opportunity to reassess business models, capital structures and market positioning. For operators that intend to remain in the market, bring in strategic investors or enter Taiwan through acquisition, the ability to identify risks early and choose the right approach, even while the regulatory detail is still taking shape, will directly affect their operating and transaction strategies.
We continue to follow legislative and regulatory developments in the virtual asset sector. Below, we offer observations and recommendations on the changes to the regulatory framework, supervisory practice, preparations during the transition period, and legal considerations in M&A transactions.
Ⅰ. Legislative Timeline and Regulatory Framework: From Registration to Licensing
The Legislative Yuan passed the Act on third reading on June 30, 2026, and the President promulgated it on July 22, 2026. The Act comprises 56 articles. Under Article 2, the competent authority is the FSC; under Article 56, the effective date is to be set by the Executive Yuan.
A number of details that bear directly on operators’ actual operating conditions remain to be clarified in the implementing regulations. According to the FSC’s public statements, nine sets of implementing regulations are being drafted, covering the establishment of service providers; personnel management; financial and business management; internal controls; outsourcing; account management and the monitoring of suspicious or unusual transactions; trade association management; financial reporting; and the licensing and regulation of stablecoins. Current plans call for the Act and the implementing regulations to take effect together. The formal effective date and the specific requirements remain subject to later announcements by the authorities.
The most significant change introduced by the Act is that VASPs, which are currently subject to registration under the AML framework, will be required to obtain prior approval from the competent authority before they may operate. This is more than a change in application procedure. It will affect operators’ organizational form, capital allocation, personnel qualifications, internal controls and ongoing supervisory obligations.
The key provisions bearing directly on operations and market positioning are summarized below:
For operators that have already completed AML registration, the transitional arrangement in Article 55 is of particular importance. Under that article, VASPs that completed AML registration before the Act takes effect, and financial institutions that were already providing virtual asset services as permitted by the competent authority, must apply to the competent authority for a license within 12 months after the Act takes effect, and must be licensed and issued their license certificates within 21 months after the effective date. Where necessary, the deadline for obtaining the license may be extended once, by up to three months. An operator that fails to apply by the deadline, or fails to obtain a license by the deadline, may not continue to conduct virtual asset business.
The key dates are summarized below:
Based on the FSC’s current public statements on the earliest possible timetable, if the Act takes effect in the first quarter of 2027, the application deadline for existing operators could fall in the first quarter of 2028, and the deadline for obtaining a license could fall between the fourth quarter of 2028 and the first quarter of 2029. Actual dates must be calculated from the formal effective date, and remain subject to the authorities’ announcements and the rules applicable in each case.
Operators should therefore focus not only on when the Act takes effect, but also, as early as possible, on whether they meet the conditions for the transitional provision, the categories of business for which they expect to apply, and the gaps between their current operating structure and future licensing requirements. These determinations will directly shape preparation timelines and resource allocation.
II. A Shift in Supervisory Focus: From Formal Registration to Scrutiny of Actual Operations
Until the Act takes effect, operators remain subject to the AML and other requirements currently in force. The existing registration regime is not concerned solely with registration documents. The applicable rules already extend to operational matters such as information systems and security, the safekeeping of customers’ fiat currency, advertising and solicitation, and AML compliance, and VASPs have also been brought within the financial anti-fraud framework.
The Act builds a more comprehensive set of supervisory tools. Under Article 43, the competent authority may require operators to produce financial and business information, and may send personnel, or engage professionals, to inspect their business, books and records, electronic records, systems and wallets. Under Article 44, depending on the seriousness of a violation, the competent authority may impose corresponding measures, including warnings, removal of responsible persons, suspension of business, and revocation or cancellation of licenses. Article 53 further provides that where a legal entity is subject to penalty for violating administrative obligations, the intent or negligence of its responsible persons, business personnel or other employees may, as provided by law, be deemed the intent or negligence of the entity.
In our experience, supervision of the virtual asset industry has been moving gradually beyond formal registration and document review toward operators’ actual operating methods and internal management mechanisms. At least three trends in this development merit attention.
First, consistency between documentation and actual operations will matter more. The explanations an operator gives the competent authority, its internal policies, and the way those policies are actually implemented should correspond to one another. Where what has been filed diverges from actual operations, regulatory concerns may follow even if the documentation is formally complete.
Second, past operating history may influence licensing assessments. An operator’s past operating practices, the implementation of its internal controls, and its record of dealings with, or inspections by, the competent authority should all be taken into account in its internal review. Operators should not treat a license application as a stand-alone process detached from their prior operations.
Third, the transition period is not a regulatory gap. The fact that the Act has not yet taken effect does not mean that existing obligations are relaxed. Operators must continue to conduct business in accordance with the rules currently applicable, and should use the transition period to adjust, at an early stage, any business arrangements that may be inconsistent with the new regime.
For in-house legal and compliance personnel, compliance work should go beyond “assembling the documents.” It should build management mechanisms capable of explaining, tracing and verifying actual operations. This includes confirming that internal rules are actually implemented, that key decisions are documented, and that actual business processes conform to what has been filed externally.
Which items an individual operator should address first will depend on its business model, scope of registration, method of safeguarding customer assets and existing internal controls.
III. Strategies for the Transition Period: Managing the Timeline to Drive Compliance and Business Positioning
The transition period should not be a passive wait for implementing regulations to be issued. It should be a preparation period in which operators proactively complete internal inventories, adjust their operating structures and evaluate future paths.
We recommend that operators work in parallel across business, organization, capital, internal controls and transaction strategy, and organize their work in the following three phases.
Phase One: Before the Act Takes Effect — Complete the Business Inventory and Transition Assessment
First, operators should take stock of the services they provide, confirm how those services map to the seven categories of licensed business under the Act, and check whether the scope of their existing registration covers their actual operations.
Second, operators should conduct a gap analysis covering corporate organization, capital structure, responsible persons and beneficial owners, customer asset management, information security, internal controls and outsourcing arrangements, distinguishing items that can be improved immediately from those that can be determined only after the implementing regulations are published.
At the same time, operators should assess their future strategy: whether to rely mainly on applying for a license on their own, or whether it may be necessary to bring in strategic investors, restructure shareholdings, scale back certain businesses, or even consolidate resources through mergers or acquisitions. These options involve different funding needs, execution timelines and regulatory risks, and should be evaluated early.
Phase Two: From Effectiveness to the Application Deadline — Complete System Adjustments and the License Application
After the Act and the implementing regulations take effect, operators should complete the necessary adjustments to their organization, capital and internal control systems in line with the finalized application requirements and procedures and file their applications within the statutory deadline.
Because operators may still need to supplement documentation, adjust workflows or reallocate resources once the implementing regulations are published, the 12-month application period should not be treated as the starting point of actual preparation. A better approach is to complete in advance, before effectiveness, whatever can be dealt with ahead of time, and to address promptly, once the implementing regulations are published, any requirements that remain to be confirmed.
Phase Three: From Filing to Licensing — Support the Review and Maintain Compliance
Filing an application does not mean a license has been obtained. Operators should continue to cooperate with the competent authority’s review and its requests for supplementation and remediation and ensure that actual operations during the application period continue to comply with applicable law.
Because Article 55 requires existing operators to obtain a license within 21 months after the Act takes effect, with a single extension of up to three months available only where necessary, operators’ project management should not treat “completing the application” as the only milestone. It should target obtaining the license within the statutory deadline, leaving time for review, supplementation and any necessary adjustments.
Beyond compliance preparation, some operators may also use this period to reassess their market positioning and resource allocation. For operators with limited capital, internal controls that still need to be strengthened, or a wish to improve their competitiveness through consolidation, bringing in strategic investors, restructuring shareholdings, consolidating businesses or pursuing acquisitions may all be options worth evaluating.
It is important to note, however, that acquiring the equity of, or taking over the business of, an existing operator does not automatically mean that the acquirer can inherit its regulatory status, nor does it exempt the acquirer from the licensing requirements under the new regime. Different transaction structures may trigger different filing, prior approval or licensing procedures, which depend on the specific transaction and the rules the competent authority applies.
Accordingly, an acquisition strategy should not be evaluated only as the application deadline approaches. It should be built into overall planning early in the transition period and pursued in parallel with compliance preparation.
IV. M&A, Changes in Ownership and Beneficial Ownership Review: Aligning Transaction Structure with Regulatory Requirements
As the licensing regime approaches, some operators may seek to bring in investors, consolidate businesses or sell equity in response to capital, organizational and ongoing compliance costs. Conversely, operators wishing to enter the Taiwan market may seek to shorten their market-entry timeline by acquiring an existing VASP.
Whether acquiring an existing registered operator is of real benefit, however, cannot be judged solely by whether it has completed AML registration. One must also examine the scope of its registration, its compliance history, the regulatory requirements for changes in equity and control, and the feasibility of its obtaining a license in the future.
(A) Existing Registration Status Is Not a Freely Transferable License
Under the current registration regime, Article 9 of the Regulations Governing Anti-Money Laundering Registration of Businesses or Persons Providing Virtual Asset Services provides that changes of responsible persons, partners or beneficial owners, and the transfer or assignment of all or a major part of the business or assets, require prior application and approval.
After the Act takes effect, the license will in turn be tied to the operator’s approved scope of business, its financial condition and the suitability of its responsible persons, among other matters. Accordingly, even where a transaction takes the form of an equity acquisition, a business transfer or another form of consolidation, any assumption that the target’s existing registration or licensing status will automatically carry over, simply because the transaction documents so provide, should be treated with caution.
At the outset of a transaction, the parties should first clarify the target’s current regulatory status, the changes in control and business scope expected after the transaction, and the applications, approvals or other procedures those changes may involve, and only then determine the transaction structure and closing timetable.
(B) Changes in Ownership and Beneficial Ownership Review Should Be Assessed Before the Transaction
For transactions involving a change in responsible persons, major shareholders or ultimate beneficial owners (“UBOs”), particular attention should be paid to the resulting change in actual control and to whether the incoming responsible persons, shareholders or beneficial owners meet the applicable qualification requirements.
For buyers, it is not enough to confirm that the target has completed registration. Buyers should also examine whether the ownership structure is clear, whether the ultimate controllers can be identified, and whether the post-closing organization and governance arrangements satisfy current and anticipated regulatory requirements.
For sellers, equity, control and related filing information should be put in order early, and the procedures and timing the transaction may involve should be clarified, to reduce the risk that regulatory requirements cannot be completed in time and disrupt closing.
(C) Valuation and Due Diligence Should Focus on Whether the Target Can Operate on a Sustainable Basis
The acquisition price of a VASP should not be judged solely by customer numbers, trading volume or brand recognition. The value of existing registration status must also be weighed against the likelihood of obtaining a license in the future, the completeness of the compliance framework, and the capital and remedial costs required after closing.
We therefore recommend that buyers’ due diligence cover at least the following:
- Registration status and scope of business. Confirm whether the target has completed AML registration, whether the scope of its registration is consistent with its actual operations, how its current business maps to the Act’s seven categories of licensed business, and whether the conditions for the Article 55 transitional provision are met.
- Compliance and regulatory history. Review historical AML and internal audit results and the record of inspections by, and dealings with, the competent authority, and confirm whether any unremediated matters or potential violations exist.
- Customer assets and outsourcing arrangements. Confirm the segregation of customer assets from the target’s own assets, wallet management and access permissions, and the scope, allocation of responsibility and risk controls of outsourced functions.
- Advertising and solicitation. Review historical advertising, customer solicitation, cross-border customer referrals and public statements, to determine whether there are matters that could give rise to regulatory or civil liability.
- Ownership structure and actual control. Confirm the ultimate beneficial owners who are natural persons and the equity and control arrangements, and assess whether post-closing changes will trigger filings, prior approval or other regulatory procedures.
- License readiness and post-closing investment. Assess the remaining gaps between the target and licensing in terms of systems, capital and personnel qualifications, and estimate the time and cost required after closing to comply with the new regime.
The results of this diligence should in turn be reflected in the valuation and the transaction documents. Beyond the reasonableness of the price, the parties should make appropriate provision for necessary regulatory approvals, cooperation with the license application, information disclosure, liability for historical violations, price adjustment and termination mechanisms.
For a buyer, the question is not simply whether to acquire a registered company, but whether, at reasonable cost and manageable risk, it can obtain an operating entity with a sustainable business and a realistic prospect of meeting the requirements of the new regime.
V. Conclusion: Turning the Transition Period into a Compliance and Transaction Advantage
The Act has been promulgated, but its formal effective date and implementing regulations remain to be determined. What can be expected is that, once licensing takes effect, the competent authority will require more than a complete application package. It will also expect an operator’s organization, capital, internal controls and actual operations to comply with the applicable rules.
For existing operators, the immediate priorities are to complete the business and compliance inventory, confirm the direction of the future license application, and schedule the necessary organizational adjustments and the build-out of internal systems in step with the progress of the implementing regulations. The compliance documentation and operating procedures already built under the current registration regime can serve as a foundation for later preparation, but each must be reviewed item by item against the Act and its implementing regulations. Operators should not assume that existing systems will satisfy all licensing conditions.
For operators intending to enter the Taiwan market through investment or acquisition, licensing feasibility, changes in equity and control, beneficial ownership review and post-closing compliance costs should all be factored into the pre-transaction evaluation. Clarifying these issues early helps in choosing an appropriate transaction structure, valuing the target reasonably, and reducing the risk of discovering only after closing that a license cannot be obtained, or operations sustained, as expected.
We continue to follow virtual asset regulations, regulatory developments and the progress of the implementing regulations, and we advise operators on compliance preparation, organizational adjustments, equity transactions and M&A planning. Because each operator’s registration status, ownership structure and business model differ, specific solutions must be assessed case by case. If your company is planning a license application, considering strategic investors or evaluating an acquisition, we welcome the opportunity to discuss suitable legal and transaction arrangements with you.
Disclaimer
This article is provided for general informational purposes only and does not constitute legal advice on any particular matter. The implementing regulations under the Act and its formal effective date remain subject to change, and any application should be based on the most recently promulgated laws and regulations and the competent authority’s announcements. The practical observations in this article are based on the firm’s experience and do not represent the formal views of the competent authority. Any specific matter should be assessed individually on its facts, transaction structure and applicable law.
If you require legal advice regarding trust structures, or need to review the legal terms of trust contracts provided by financial institutions or trust companies, please feel free to contact:
Attorney Wu Jiehua
charlotte.wu@zhongyinlawyer.com.tw
tel +886 2 2377 1858 ext 8888