Liberia’s anti-money-laundering law includes virtual asset service providers within its framework. That does not justify promising a complete licensing procedure here or declaring a project compliant. This guide organizes the questions to document and the controls to prepare with the authorities and local professionals; it does not replace their review.
In brief
- Describe the flows and the powers actually exercised: receiving, converting, transferring, holding or merely displaying information.
- Due diligence obligations involve more than photographing an identity document during registration.
- No public launch should rely on a foreign license or a partnership whose local scope has not been verified.
Map the service before looking for a regulatory label
The guide to the status and criteria of crypto platforms helps separate the functions behind a brand. For a Liberian project, draw the path from the customer’s currency to its final destination. Each arrow should identify a responsible party, a contract and the power exercised over the funds, even when several steps appear in a single interface.
Ask one simple question: who can act without a new instruction from the customer? A company that holds a key, approves withdrawals or moves a reserve exercises control that must be examined. Calling the service “community-based” or “decentralized” does not automatically change that power. Legal descriptions should reflect how the technology works, not the other way around.
Next, identify the currencies and assets involved. Receiving LRD, converting it into USD and then delivering a stablecoin involves several relationships. The payment provider, any exchange and the token provider may operate under separate contracts. Authorization granted for one step must not be silently extended to the entire service chain.
List the target customers, their place of residence and how they will be solicited. A website accessible from several countries can raise questions beyond Liberia. Do not infer that the absence of a physical office means there are no obligations. Commercial targeting, the functions offered and each jurisdiction’s rules require a tailored review before expansion or an advertising campaign.
Finally, distinguish between a prototype and live operations. An internal test using no real funds can help verify software; it does not validate a business model. Set a clear threshold before accepting funds: required documents, confirmations expected and the people authorized to decide. A beta version should not turn users into involuntary financiers of a framework that remains uncertain.
Link the functions to the relevant rules and authorities
The AML/CFT law published by the Financial Intelligence Agency defines VASPs by the professional activities they carry out for others. It also provides for a risk-based approach and due diligence measures for covered entities. These provisions offer a concrete basis for analysis, but they do not confirm that your combination of services already has the necessary authorizations.
Prepare a note describing the functions involved, then ask how they should be classified. Exchanging currencies and tokens, providing custody and transfers, as well as an offering linked to the issuance of an asset, may raise different questions. An answer obtained for one function must not be presented to customers as approval for all of the company’s future products.
The GIABA evaluation published in 2023 identified historical shortcomings in the implementation of the VASP framework. Its review notably relied on a visit conducted in 2022. Use the document to formulate questions, not to derive the current licensing procedure or assume that nothing has changed since that period.
An actionable response should specify the holder, the function, the territory and the conditions. Keep the correspondence together with its full context. Encouragement to innovate is not a license, and participation in a conference is not regulatory approval. Public-facing documents should avoid suggesting these misleading equivalences.
Also ask how a partner can be verified. If a company offers to “cover” your activity through its status, examine the contract, the actual delegation and the restrictions. A marketing partnership does not necessarily transfer an authorization. No launch should depend solely on trust in a provider’s sales representative, however well-known the provider may be.
Design due diligence that is proportionate and workable
The KYC, data and recourse guide helps move beyond a purely documentary approach. In a real service, controls must connect identity, the beneficial owner, intended use and observed transactions. Collecting a document without verification or follow-up procedures creates the appearance of compliance while leaving the key risks unaddressed.
Section 15.3.2 of the law addresses due diligence at the start of a business relationship, while the following provisions cover monitoring and higher-risk situations. The organization must translate the applicable obligations into procedures, with guidance from a qualified adviser. Do not copy thresholds from another country or a partner’s rules without checking their relevance and local legal basis.
Document the risks specific to the model: third-party accounts, inconsistent supporting documents, rapid changes in beneficiaries, customers who are difficult to verify or transfers with no identifiable commercial rationale. A red flag does not automatically prove an offense. It should trigger a defined, proportionate and traceable review, rather than an improvised decision by an isolated agent dealing with an impatient customer.
Define responsibilities when an alert is raised. Who reviews the file, who can suspend a transaction and who decides what regulatory action follows? Confidentiality and reporting rules must be understood before the first incident. A support team that systematically promises immediate release may conflict with compliance work and create commitments that cannot be honored.
Protect the data collected as well. Restrict access, secure exchanges and set retention periods in line with the applicable rules. Do not use a shared messaging group as an identity archive. A security incident can affect people who have never bought crypto if their documents were simply submitted during registration or a support request.
Separate customer funds, treasury and technical controls
The wallet and security guide explains why custody requires more than a strong password. Determine who owns the keys, who approves movements and who can restore access. Internal rules must withstand an absence, a compromise or a dispute between partners without depending on a single indispensable person.
Build a daily reconciliation between customer obligations and the assets under control. A total displayed in a database does not prove that the reserve is available. As a purely educational example, customer balances totaling 8 000 units against 7 850 units actually available reveal a shortfall of 150, or 1,875%. It must be explained before the affected operations continue.
This example does not establish any regulatory ratio. It merely shows why an internal review must cover quantities and their availability, not only their converted value. Two assets bearing the word dollar are not automatically interchangeable. A reserve in USD, a claim on a partner and a stablecoin on a network carry different constraints.
Set operational limits suited to the service and approved by the appropriate managers. An internal cap may reduce exposure, but it does not replace a legal obligation. Document exceptions and their approval. If every major customer receives an informal workaround, the rule exists only on paper and incidents become harder to explain.
The continuity plan should cover outages, loss of connectivity, partner unavailability and key-related incidents. Define how customers will be informed without revealing secrets. Test backups in a safe environment. A service unable to explain what happens to funds during an interruption should not present its usual transfer speed as a permanent guarantee.
Frame the commercial offering and prepare for an orderly wind-down
The total crypto cost calculation should appear in the service’s quotes. State the currency, fees, expected net amount and contractual timelines. A “free” promotion should not conceal a conversion margin or a mandatory withdrawal. Customers must be able to compare the offer before providing their funds, not only after delivery.
For a journey involving a phone, the Mobile Money and crypto guide distinguishes the payment layers. Check the operator’s terms and the commercial agreement actually obtained. The technical ability to send funds to a number does not prove that your company may use it to collect payments for a public-facing financial service.
Plan complaints by stage and responsible party. Customers should know what evidence to provide and how to track their request. Avoid absolute recovery promises: a network error or a payment to a third party cannot always be reversed. An honest procedure explains the investigation methods and their limits without charging for a promise that cannot be verified.
The contract should also address a prolonged suspension or the end of the business. Identify restitution procedures, dependencies on partners and the people authorized to act. An orderly wind-down requires reliable data and available assets. It cannot be improvised once support stops responding and key holders shift responsibility among themselves.
Crypto regulation in Liberia should therefore be approached as a project of evidence and organization. Have the scope reviewed before launch, link the rules to the actual functions and document decisions. Until a decisive authorization or responsibility has been clarified, limit the project to preparation: a product that is technically ready is not thereby legally cleared for operation.
