Seychelles

The Fourth Schedule of the VASP Act inserts ss. 45B-45G into the AML/CFT Act. Originating providers must collect and keep originator and beneficiary information for each transfer (s. 45B), beneficiary providers must collect, record and verify it (s. 45C), and intermediaries must identify transfers missing information (s. 45E) while every provider monitors for it (s. 45F). Item 5 of the Third Schedule to the AML/CFT Act requires VASPs to report transfers of SCR 50,000 or more.

Section 18(1)(i) requires directors to notify the FSA in writing within 12 hours of becoming aware that a cyber-security event has occurred, with a written report within five working days (s. 18(2)). Section 22(1) requires appropriate and effective cyber security measures as prescribed, and the Cyber Security Requirements Regulations (reg. 7) add a 24-hour notice of attempts and a 5-working-day report on successful events. Section 21(1)(d) requires an annual cyber security report in January.

Section 5(1) prohibits carrying on, or purporting to carry on, the business of virtual asset services without a licence from the FSA. Section 42 required existing providers to apply by 31 December 2024; the FSA has since published warnings and enforcement statements on unlicensed operators.