Crypto License in Labuan
Why Labuan is Asia's Premier Crypto Licensing Hub
The global digital asset landscape is rapidly maturing, demanding robust regulatory compliance and geographical flexibility. For international cryptocurrency businesses, securing a legitimate and tax-efficient operating base is paramount. The Labuan International Business and Financial Centre (Labuan IBFC), a midshore jurisdiction under the Federation of Malaysia, has firmly established itself as a leading choice.
Since the Labuan Financial Services Authority (Labuan FSA) began regulating digital asset activities, it has provided a clear, white-listed framework for international ventures. This guide outlines the strategic advantages, detailed requirements, and procedural steps for obtaining a Labuan crypto license in 2025, enabling global Virtual Asset Service Providers (VASPs) and FinTech companies to access the burgeoning Asian market. The convergence of strict Anti-Money Laundering (AML) standards and a favorable tax environment positions the Labuan jurisdiction as a highly competitive option for crypto exchange licensing.
Strategic Advantages of the Labuan IBFC Framework: Beyond the Tax Rate
Choosing Labuan is a strategic business decision driven by favorable regulatory and fiscal environments that are difficult to match in other jurisdictions.
The Attractive Tax Regime
Labuan’s tax structure is perhaps its most significant draw for crypto exchanges and digital asset companies:
Low Corporate Tax: Licensed entities engaged in qualifying trading activities benefit from a preferential 3% corporate tax rate on audited net profits. Alternatively, a fixed fee of MYR 20,000 (approx. USD 5,000) can be chosen. This stands in sharp contrast to Malaysia’s standard 24% rate. Crucially, the Labuan Business Activity Tax Act 1990 (LBATA) defines “trading activity” broadly to encompass digital financial services, making the preferential rate applicable to most licensed crypto operations. This tax efficiency is a major draw for companies managing large trading volumes and seeking to maximize retained earnings.
Indirect Tax Exemption: There is no withholding tax on dividends, interest, or royalties paid to non-residents, and no indirect taxes such as Sales and Service Tax (SST), capital gains tax, or stamp duty. This simplified structure reduces administrative overhead significantly and ensures clear profit margins.
Extensive Double Tax Treaty (DTA) Network: Labuan leverages Malaysia’s network of over 70 DTAs, providing clarity and minimizing tax exposure for global operations. This DTA access is critical for international money transfer businesses and funds operating within the digital asset space, allowing them to structure cross-border operations effectively and avoid double taxation on income flows.
Robust, Whitelisted Regulatory Oversight
Labuan FSA is the single regulator, adhering strictly to global standards, including those set by the Financial Action Task Force (FATF) and the Organisation for Economic Co-operation and Development (OECD). This “whitelisted” status enhances the company’s credibility and facilitates relationships with international banks and financial partners. For international VASPs, this compliance posture is non-negotiable, ensuring that the Labuan jurisdiction is respected by correspondent banks and foreign regulators worldwide. The proactive approach of the LFSA in adopting FATF travel rule protocols further cements its status as a responsible global financial center committed to fighting illicit finance.
Operational Flexibility and Global Reach: Tapping into Islamic Finance
Labuan facilitates 100% foreign ownership of companies and offers no foreign exchange controls for international business. A 2-year multi-entry work visa is also granted to approved staff, ensuring ease of operations. The jurisdiction actively encourages FinTech innovation, including Shariah-compliant digital finance through its Islamic Digital Asset Centre (IDAC).
The IDAC initiative is a key differentiator for Labuan, allowing digital asset businesses to tap into the rapidly growing market for Shariah-compliant digital tokens and investment products, utilizing the specialized Labuan Islamic Financial Services and Securities Act. This dual system (conventional and Islamic finance) means that a Labuan-licensed crypto exchange can offer:
Shariah-Compliant Offerings: The issuance of ethical, Shariah-compliant digital assets, ensuring all underlying activities (trading, custody, token issuance) adhere to strict Islamic financial principles.
Targeting New Markets: Accessing investors and institutions in the Middle East and Southeast Asia whose mandates require adherence to Islamic finance principles.
Regulatory Clarity for Tokens: Clear guidelines exist for the tokenisation of various real-world assets into Shariah-compliant digital securities, opening avenues for security token offerings (STOs) within a regulated environment.
The lack of mandatory local partnership requirements streamlines the setup process for global entities, giving foreign investors full operational control.
The Licensing Pathways: Money Broking vs. Exchange License and Beyond
For digital asset businesses, the Labuan FSA provides several license types. The most common and relevant for operating a crypto exchange or brokerage service fall primarily under the Digital Financial Services (DFS) framework. Understanding the nuances of these licenses is key to determining the appropriate regulatory umbrella for your specific digital asset business model.
The Labuan Money Broking License for Crypto: The VASP Standard
This is the most frequent and versatile pathway used by companies that wish to facilitate the trading of digital assets by bringing together counterparties (often functioning as an OTC desk or a traditional exchange platform). It is the regulatory umbrella most commonly associated with a Labuan VASP license.
While often used interchangeably with the Money Broking License in practice for standard spot trading, a dedicated “Exchange” license may be required for specific activities related to the listing and trading of digital securities or financial instruments beyond standard cryptocurrencies. The LFSA differentiates the licensing based on the underlying assets and the complexity of the market operation. For any platform listing security tokens or operating a market akin to a traditional stock exchange, the requirements become more akin to those of a capital market intermediary. Applicants should conduct a pre-application consultation to confirm the correct license category for their specific digital asset business model, especially if the volume of business is projected to be exceptionally high, as this can trigger a higher capital requirement, potentially up to MYR 1,500,000.
Other Relevant Licenses
Depending on the business scope, a company may require additional licenses:
Labuan Credit Token License: Relevant for businesses planning to issue proprietary blockchain-based tokens to facilitate the purchase of goods/services within their ecosystem. This often applies to utility token issuers and allows for the creation of a blockchain ecosystem within the Labuan IBFC.
Labuan Fund Management License: Required if the entity is managing pools of capital focused on investing in digital assets for third parties. This involves stringent investor protection protocols and specific guidelines under the Labuan Financial Services and Securities Act (LFSSA).
Labuan Digital Banking License: The most stringent license, allowing for full banking services via digital channels, requiring substantially higher capital (often upwards of MYR 10 million) and more complex core banking system compliance.
The LFSA emphasizes a risk-based approach, meaning that the capital requirement and compliance complexity can increase based on the proposed activities, expected transaction volumes, and the technical security systems implemented.
Core Regulatory and Substance Requirements: Demonstrating Commitment
To ensure genuine presence and compliance, the Labuan FSA enforces strict “substance” requirements as per the Labuan Business Activity Tax (Requirements for Labuan Business Activity) Regulations 2021 (LBATA). These rules are explicitly designed to prevent the creation of shell companies and ensure the tax benefit is tied to real economic activity on the island. This is a crucial element for maintaining the Labuan jurisdiction’s international reputation.
Corporate Establishment and Physical Presence (CIGA)
Legal Entity: The applicant must be a company incorporated or registered under the Labuan Companies Act 1990. The incorporation process must be done through a licensed Labuan Trust Company.
Physical Office in Labuan: This is a non-negotiable requirement. The office must be operational, adequately equipped, and clearly identifiable. The address serves as the company’s legal domicile, ensuring a real presence.
Local Staff and CIGA: A minimum of two full-time employees in Labuan must be hired. These employees must possess the necessary qualifications and be physically present to carry out the Core Income-Generating Activities (CIGA). For a Labuan VASP or crypto exchange, CIGA activities specifically include:
Key decision-making concerning the operation of the digital exchange platform.
Supervision and execution of compliance functions (AML/CFT).
Ongoing monitoring of security systems and client assets.
Risk management and financial accounting specific to the digital assets business.
Annual Operating Expenditure: The company must incur a minimum annual operating expenditure of RM100,000 in Labuan. This mandatory expenditure proves genuine economic commitment to the jurisdiction and covers salaries, office costs, and professional fees (e.g., trust company and audit fees), thus satisfying the LBATA substance rules.
Fit and Proper Criteria: Integrity of Key Personnel
The Labuan FSA rigorously assesses the reliability and qualifications of key personnel under the “fit and proper” test. This is a comprehensive background check on all directors, senior management, and major shareholders (holding 10% or more):
Professional Background: Key individuals must demonstrate relevant professional qualifications and proven experience in financial services, IT security, or compliance.
Integrity and Solvency: Checks cover any history of bankruptcy, criminal convictions, previous regulatory breaches in any jurisdiction, or adverse media.
Organizational Chart: A clear and detailed organizational chart must be submitted, showing clear lines of responsibility, especially concerning AML/CFT reporting. The LFSA often requires personal interviews with the Principal Officer and the MLRO to assess their understanding of the Labuan regulatory framework and their ability to execute the compliance program.
Capital and Financial Requirements
Minimum Capital: The required RM 500,000 must be fully paid up and maintained at all times. The LFSA monitors the source of funds to ensure they are legitimate, requiring detailed proof of fund origin from shareholders.
Working Capital: The business plan must demonstrate sufficient working capital beyond the minimum paid-up capital to sustain operations for at least 12 months, covering the mandatory operating expenditure and any required security reserves.
Annual Audit: Appointing an approved external auditor in Labuan is mandatory. The audit report must confirm that the company is adhering to the substance requirements and that financial reporting is accurate and in compliance with the LFSA’s guidelines on digital asset accounting. This annual audit is a key part of maintaining the license and proving genuine operation under the LBATA substance rules.
Request more information
Critical Compliance Pillars: Mastering AML/KYC & Technical Resilience
Compliance is the foundation of the Labuan license, demonstrating a commitment to international financial integrity standards. The application process places heavy emphasis on the quality and robustness of the operational manuals, which must reflect a world-class commitment to preventing financial crime.
Anti-Money Laundering (AML) and Know Your Customer (KYC): The RBA and Red Flags
Labuan’s AML standards are aligned with the highest global benchmarks, mandated by the Anti-Money Laundering, Anti-Terrorism Financing, and Proceeds of Unlawful Activities Act 2001 (AMLA). Licensees must submit a detailed AML/CFT Compliance Manual that addresses:
Risk-Based Approach (RBA): The manual must clearly outline the methodology for classifying customers (low, medium, high risk) based on objective criteria such as jurisdiction, expected transaction volume, complexity of the ownership structure, and product usage (e.g., higher risk for privacy coins, if permitted, or complex token trading). This RBA dictates the level of Customer Due Diligence (CDD) applied.
Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD): Procedures must mandate verification of the identity of clients and their Beneficial Owners (BOs). EDD is strictly mandatory for high-risk customers, Politically Exposed Persons (PEPs), and those dealing with specific high-risk jurisdictions identified by the FATF.
Ongoing Transaction Monitoring: The system must be capable of generating Suspicious Transaction Reports (STRs) based on red flags and typologies relevant to digital assets. The LFSA specifically requires awareness of the following Digital Asset Red Flags:
Rapid Fund Transfers: Large volumes of crypto transferred immediately after deposit, with no corresponding trading activity or economic rationale.
Layering through Mixers/Tumblers: Transactions showing links to known privacy-enhancing services or mixers.
Structuring: Multiple small, non-reportable fiat or crypto transactions designed to circumvent internal thresholds.
Sanctioned Entities: Wallet addresses or IP locations linked to sanctioned entities or high-risk geographic areas.
P2P Activity: Excessive or irregular peer-to-peer (P2P) transfers for exchange platforms that typically service centralized trading.
Travel Rule Implementation: Licensees must have a technical solution in place to comply with the FATF Travel Rule, requiring the collection and transmittal of originator and beneficiary information for all crypto transfers above the de minimis threshold for VASP-to-VASP transfers. This technological integration is a critical operational hurdle for all new Labuan VASPs.
Cybersecurity and Client Asset Protection: Advanced Custody Requirements
The LFSA emphasizes technological resilience and client protection, often requiring an independent third-party audit of the IT infrastructure prior to licensing.
Client Asset Segregation and Custody: This is paramount. Client assets (both fiat and digital) must be held in segregated accounts, distinct from the company’s operational funds. For digital assets, the requirements include:
Cold Storage Policy: A majority of client digital assets must be stored offline (cold storage) to minimize exposure to online attacks. The specific percentage is subject to LFSA risk review.
Multi-Signature Authorization Protocols: Access to cold storage and large hot wallet transfers must require multi-signature approval involving multiple key personnel, ideally residing in separate geographical locations.
Key Management System (KMS): A detailed, audited policy on the generation, storage, recovery, and destruction of cryptographic keys must be submitted.
Security Audits: External, independent IT security audits must be provided with the application (usually a penetration test and vulnerability assessment) and conducted periodically thereafter.
Business Continuity and Disaster Recovery (BCDR): A documented BCDR plan is essential, detailing how the company will maintain service and protect client data in the event of a system failure, cyber-attack, or natural disaster. The 14-day incident reporting rule to the LFSA ensures rapid regulatory oversight in crisis situations.
The Licensing Process: A Step-by-Step Roadmap and the Role of the Trust Company
Obtaining a Labuan crypto exchange license involves a structured process, typically facilitated through a licensed Labuan Trust Company which acts as the official intermediary with the LFSA. The full process can take between 3 to 6 months, provided all documentation is meticulously prepared.
The Labuan Trust Company (LTC) is mandatory and serves as the initial point of contact and corporate administrator. Their role is multi-faceted:
Corporate Secretarial Services: Incorporating the Labuan International Company and maintaining its statutory records.
Compliance Guidance: Advising on the precise LFSA regulations, helping tailor the business plan and compliance manuals to meet the fit and proper criteria.
Application Filing: Officially submitting the comprehensive application package to the LFSA on behalf of the applicant.
Substance Facilitation: Assisting in sourcing the physical office and facilitating the hiring of the necessary local staff to fulfill CIGA requirements.
The step-by-step roadmap involves:
Phase 1: Pre-Application & Structuring (4-6 weeks): Defining the scope (e.g., Money Broking VASP), engaging the LTC, and drafting the core legal documents (Business Plan, AML/CFT Manual, IT Security Plan).
Phase 2: Incorporation & Submission (2-4 weeks): Incorporation of the entity, collection of certified KYC documents for all key personnel, depositing the minimum RM 500,000 paid-up capital, and formal submission of the application package along with payment of the annual license fee.
Phase 3: Regulatory Review and Due Diligence (8-12 weeks): The LFSA conducts its rigorous review, often requesting clarifications, supplementary documents, or legal opinions. This is the period when the fit and proper interviews are conducted, and the applicant must demonstrate that the physical office and local staff are in place.
Phase 4: License Issuance and Commencement: Upon satisfaction of all conditions, the license is granted, allowing the VASP to commence international digital asset activities.
Labuan vs. SC Malaysia RMO: Understanding the Jurisdiction Split
It is vital for applicants to understand the dual regulatory system within Malaysia. The distinction between the Labuan IBFC (midshore, international) and the Securities Commission Malaysia (SC) (domestic, onshore) is often the source of confusion, but it is absolute.
The Future of Digital Assets in Labuan: Diversification and Growth
Labuan is actively positioning itself to facilitate the next wave of digital finance. Beyond basic exchange services, the framework supports the tokenisation of various asset classes:
Digital Banking License: Allowing for the provision of banking services via digital channels, requiring substantially higher capital (often upwards of MYR 10 million) and more complex core banking system compliance.
Tokenisation (STO/ICO) License: Licensing for the issuance of digital assets and security tokens backed by real-world assets (e.g., real estate, commodities, equities). This area is seeing rapid growth, utilizing the Labuan securities law framework.
Digital Asset Custody Services: Specific requirements for firms specializing in the secure storage and safekeeping of client digital assets, often requiring a standalone authorization or a specific endorsement on the main VASP license. These custody requirements are the most stringent technical hurdles, demanding:
Advanced Cryptographic Protocols: Use of hardware security modules (HSMs) and institutional-grade wallet infrastructure.
Specific Insurance Policies: Comprehensive insurance coverage for digital assets held in custody against theft, hacking, and employee collusion.
Regular Proof-of-Reserves Audits: Independent audits to prove that client digital assets are held and match liabilities in segregated accounts.
The jurisdiction’s progressive and pragmatic approach, combined with the low tax and strong compliance mandates, ensures that the Labuan crypto license remains one of the most sought-after regulatory approvals for serious global FinTech players looking to anchor their Asian operations in a legally compliant and economically efficient environment. Navigating the substance requirements and strict AML protocols is the key to success in this white-listed, forward-thinking midshore hub.
Anchoring Your Global Crypto VASP Operation in Labuan
The decision to obtain a Labuan crypto license in 2025 is a strategic long-term move for any international VASP seeking a regulated base in Asia. The framework successfully balances regulatory adherence—meeting global standards for AML/CFT and the FATF Travel Rule—with powerful fiscal incentives, namely the 3% corporate tax rate.
Success in the application process hinges entirely on meticulous preparation of the core documents: a robust business plan, a comprehensive RBA-driven AML/CFT manual, and verifiable proof of economic substance on the island, including the hiring of the two mandatory full-time employees to execute the CIGA. By leveraging the expertise of a licensed Labuan Trust Company and committing fully to the LFSA’s compliance pillars, global cryptocurrency exchanges can secure their foothold in a prestigious, whitelisted jurisdiction, setting the stage for sustainable growth in the world’s most dynamic digital asset market.
FAQ
The minimum paid-up capital required for the Labuan Money Broking License (the license commonly used by VASPs) is RM 500,000 (approximately USD 110,000). This sum must be fully paid, deposited into a bank account in Labuan or Malaysia, and remain unimpaired throughout the operation. It's important to note that the Labuan FSA may require a higher capital amount if the applicant's projected transaction volumes or the complexity of the services (such as derivatives trading) present a higher systemic risk. The capital serves as a stability reserve, not operational funding.
Licensed digital financial service providers in Labuan benefit from a preferential 3% corporate tax rate on audited net profits derived from qualifying trading activities. As an alternative, the entity may elect to pay a fixed annual tax fee of RM 20,000. This low rate applies because Labuan is classified as a midshore jurisdiction, provided the company meets the strict Substance Requirements under the LBATA (Labuan Business Activity Tax Act 1990). No withholding tax, capital gains tax, or indirect taxes (like Sales and Service Tax) apply to international business income.
The licensing process, from filing the application with the Labuan FSA to final approval, generally takes between 3 to 6 months. This timeframe is heavily influenced by the quality of initial submissions. Delays often occur due to deficiencies in the AML/CFT Compliance Manual, slow execution of the required background checks (the "fit and proper" test) for directors and shareholders, or failure to quickly establish the physical office and local staffing requirements. A pre-application consultation with the LFSA is highly recommended to clarify expectations.
To maintain the license and benefit from the low tax regime, the entity must demonstrate genuine economic substance in Labuan. This includes three non-negotiable requirements:
Maintaining an operational physical office in Labuan.
Employing a minimum of two full-time employees locally. These staff must be qualified and dedicated to performing the Core Income-Generating Activities (CIGA), such as platform decision-making and compliance oversight.
Incurring a minimum annual operating expenditure of RM 100,000 in Labuan. Failure to meet these annually audited requirements can lead to loss of the preferential 3% tax rate.
Yes. All Labuan-licensed VASPs are subject to international Anti-Money Laundering (AML) standards, as guided by the Financial Action Task Force (FATF). The Travel Rule mandates that VASPs collect and transmit specific originator and beneficiary information for all crypto transfers above a designated threshold. Compliance requires integrating technological solutions for transaction monitoring and information sharing between different VASP entities.
No. The Labuan license is explicitly granted for international business activities. License holders are strictly prohibited from actively marketing services to or accepting clients who are Malaysian residents (including individuals and entities). All transactions must be conducted in foreign currencies. Serving the domestic Malaysian market requires a separate and much more stringent license from the Securities Commission Malaysia (SC), with different tax implications.
Yes. By law, the entire application process, the incorporation of the Labuan International Company, and the initial submission of documents to the Labuan FSA must be facilitated and managed by a licensed Labuan Trust Company (LTC). The LTC acts as the legal and corporate services intermediary, ensuring all filings and corporate maintenance adhere to the Labuan Companies Act 1990 and LFSA regulations.
The application must include a comprehensive set of operational and compliance manuals. The two most critical documents are:
AML/CFT Compliance Manual: Detailing the Risk-Based Approach (RBA), Customer Due Diligence (CDD), Enhanced Due Diligence (EDD) procedures, and the process for submitting Suspicious Transaction Reports (STRs) to the authorities.
IT Governance and Cybersecurity Policy: Outlining infrastructure security, client asset segregation protocols (cold vs. hot storage), multi-signature key management, and a robust Business Continuity and Disaster Recovery (BCDR) plan, including the 14-day mandatory incident reporting rule to the LFSA.
The core Money Broking VASP license covers the custody of client assets that are directly related to the exchange services (i.e., holding assets on behalf of trading clients). However, if the company plans to offer specialized, standalone Digital Asset Custody Services as a primary business, the LFSA may require a specific endorsement or a separate license. This triggers heightened requirements concerning external security audits, cold storage protocols, and mandatory insurance coverage for digital assets under custody.