Prying
Mapping ASEAN's crypto scene: What's legal, what's safe, what's yours.
ASEAN has some of the highest internet and mobile penetration rates in the world, but that alone doesn't explain why crypto adoption looks so different from one country to the next. Remittances, government debt, even religious law shape policy as much as regulation does. Philippine stablecoins exist because $35 billion a year in remittances need a cheaper channel. Laos courted crypto miners to chase down a mounting debt. Brunei's Sharia-compliance question is still unresolved.
69%
Asia-Pacific's crypto growth rate to June 2025, the fastest of any region in the world.
103%
Indonesia's growth over the same period, nearly double Vietnam's, APAC's third-largest market.
With no shared regional rulebook, each government has taken its own approach, forcing users to navigate ten different regimes as a result. Licensed doesn't mean safe, as Thailand proved when its dominant exchange concealed a hack from its own regulator for five years. Legal doesn't mean stable either. Vietnam legalized trading the same year it froze 86 million bank accounts for reasons outside crypto. Even banning crypto doesn't mean it's unused. Myanmar has a deep USDT market even after outlawing crypto in 2020.
This piece maps what's actually legal, safe, and usable across all ten countries. The clearest pattern holds almost everywhere. Unlicensed, offshore platforms keep getting squeezed through fines, blocks, and extraterritorial reach. The licensed path isn't getting easier either with increasing capital requirements, license moratoriums, and licensing caps. Both sides of the gate are narrowing and this piece captures the ever-changing rules as they stand now.
Southeast Asia's crypto scene
Select a country above.
Singapore
Established #63 Crypto Adoption- Legal
- Licensed since 2020: Under the Payment Services Act, MAS-regulated. No DPT license means essentially no protection if a platform disappears with your funds.
- No marketing to Singapore customers: Foreign platforms without a Singapore entity can serve you without a license, but they can't legally advertise or solicit here, which is why many international exchanges just block Singapore IPs outright.
- Regulatory comfort now extends to public rails: DBS has tokenized structured notes directly on public Ethereum, not just an internal ledger, a bank moving onto the same rails you'd use, with the regulator's blessing.
- Safe
- The rulebook doesn't flip-flop: Six-plus years of phased tightening with zero reversals, the most predictable regime in the region; what you sign up under today is unlikely to change on you later.
- The bar screens for compliance capacity, not capital: Roughly 300 firms applied. Most were rejected or withdrew, usually over an AML/CFT program that didn't meet MAS's bar, or personnel who didn't clear background checks, not simply a shortage of money. The capital bar is real too: S$500,000 base capital plus a security deposit up to S$200,000. Only 37 firms made it through.
- MAS's enforcement is ongoing: It fined three DPT providers a combined S$4.8 million for AML failures, and revoked Bsquared Technology's license entirely in 2026, 16 months after licensing it, over false information given to the regulator, real consequences that land after firms have already cleared the bar.
- Yours
- No capital gains tax for casual holders: IRAS only treats your activity as taxable income if it looks like a business, frequent trading, clear profit-seeking. Staking and DeFi yield work the same way: IRAS taxes the gain when you eventually sell the reward tokens, not their value when you received them, sidestepping the question of when a continuous reward stream technically "happened." Whether that gain counts as taxable income comes down to the same test as trading: a habitual, systematic effort to profit from staking makes it a business; occasional staking without that pattern stays a tax-free capital gain.
- Cash-out is frictionless, with one precise caveat: PayNow/FAST transfers are instant and free, and StraitsX's "fee-free" claim holds specifically for FAST transfers; SWIFT and on-chain transfers carry real fees.
- Stablecoin rules are still catching up: MAS finalized a framework in 2023 requiring 100% reserve backing and Singapore incorporation. The actual legislation, though, was still being drafted as of a November 2025 update from MAS's own Managing Director, not yet before Parliament. That's already past the mid-2026 target the framework was originally aiming for.
- Your exchange history reaches IRAS from 2028, not sooner: Singapore has committed to CARF, the OECD's automatic crypto-tax-data-sharing standard, with first international exchanges due in 2028. Domestic collection starts 1 January 2027, but DPT-licensed platforms already gather this identity and transaction data today under MAS's existing KYC and Travel Rule requirements; CARF adds a channel for foreign tax authorities to receive it too, not a new category of data collected from you.
- Self-custody is untouched; licensed platforms aren't: MAS doesn't regulate what you do with your own wallet, only DPT-licensed services trigger KYC and Travel Rule reporting on transfers above the threshold. A VPN gets past a geo-block technically, but doesn't change your legal exposure if the platform itself isn't licensed to serve you.
History
Jan 2019 Payment Services Act passed Legal
Before this, digital-payment-token services in Singapore were essentially unregulated. The Act introduced the region’s first real licensing regime: capital and security-deposit minimums, mandatory AML/CFT programs, and MAS approval, where none of that had existed. Took effect 28 January 2020, the real start date for DPT licensing.
2020–2026 Six years of incremental tightening Safe
Roughly 300 firms applied for a license; most were rejected or withdrew, usually over an AML/CFT program that didn’t meet MAS’s bar or key personnel who didn’t clear background checks, not simply a lack of capital. Only 37 remained licensed by 2026, the highest bar in the region.
Jun 2025 Overseas-only loophole closed Legal
Singapore-incorporated firms used to serve only overseas customers while sidestepping Singapore’s own DPT licensing rules entirely, trading under a Singapore company registration, a physical business address, not a blockchain one, without being subject to Singapore oversight. Part 9 of the Financial Services and Markets Act came into force on 30 June 2025, requiring these firms to either get licensed or apply for an overseas-only exemption; MAS has said it will generally not grant that exemption, effectively forcing them to relocate or shut down.
2026 Stablecoin legislation drafted Yours
Builds on a 2023 framework requiring 100% reserve backing, Singapore incorporation, and monthly audits for issuers. The legislation was still being drafted as of a November 2025 MAS update, not yet before Parliament and already past the mid-2026 target it was aiming for.
Homegrown
Founded 2016
Retail crypto exchange and card app, one of the most recognized consumer brands in the industry.
140M Users Quantum Run
Founded 2018
World's second-largest crypto exchange by trading volume.
60M+ Users CoinLaw
Founded in Singapore, later relocated its base to Dubai in 2022.
Founded 2020
Yield-tokenization protocol that lets users trade future yield separately from the underlying asset.
$3.8B TVL DeFiLlama
DeFiLlama's #1 protocol in the yield category, as of January 2026.
Founded 2017
Layer-1 blockchain built around network sharding, one of the first projects to bring the concept to a live mainnet.
~$50M Market cap CoinMarketCap
Down sharply from a 2021 peak near $2B.
Founded 2017
Institutional trading firm and liquidity provider for digital assets.
~$4B Valuation TrueUp
Regulators & terms
- MAS Monetary Authority of Singapore
- Singapore's central bank and financial regulator; grants and revokes the DPT license crypto platforms need under the Payment Services Act.
- IRAS Inland Revenue Authority of Singapore
- Singapore's tax authority; decides whether your crypto activity is a tax-free capital gain or taxable business income.
- DPT Digital Payment Token
- MAS's regulatory category for cryptocurrencies under the Payment Services Act; a "DPT license" is what lets a platform legally serve Singapore.
- CARF Crypto-Asset Reporting Framework
- An OECD standard for automatically sharing crypto-exchange user data across tax authorities; Singapore's first exchanges are due in 2028.
Thailand
Established #17 Crypto Adoption- Legal
- Licensed since 2018, extraterritorial reach since 2025: A Royal Decree closed the loophole for foreign operators in April 2025, so offshore platforms serving Thai users now fall under SEC licensing too.
- Unlicensed platforms get blocked outright: Thailand blocked Bybit, OKX, 1000X, CoinEx, and XT.com nationwide from June 2025, users got one month's notice to withdraw funds first.
- Bitkub is the default on-ramp: Instant deposits from any major Thai bank, but "default" doesn't mean spotless.
- Regulatory comfort extends to the banks, on assets you'd recognize: Kasikornbank is licensed for digital-asset custody under SEC supervision, safekeeping real crypto that already lives on public chains, not a bank-issued token on a private ledger, and SCB holds a 51% stake in an actual exchange, real equity in a real trading venue, not a sealed-off pilot.
- Safe
- Licensed didn't stop Bitkub from hiding a hack: Caught in 2026 concealing a ฿1.7 billion ($50M) hack from its own regulator for five years. The SEC's criminal complaint is still under investigation as of August 2026, no verdict yet, but individual directors face up to ten years in prison if convicted.
- Bitkub isn't the only cautionary case: Zipmex had its exchange and broker licenses revoked entirely in 2024 over financial instability and inadequate management.
- Recourse exists, it's just slow: The SEC can investigate, revoke a license, and refer executives for criminal prosecution, as it did with Zipmex, ordering customer assets returned within 15 days of the 2024 revocation; but that came two years after the fund freeze that triggered it, and the Bitkub concealment ran five years before surfacing at all. Licensed doesn't mean fast.
- Yours
- A real, time-limited tax break, but it doesn't cover yield: Licensed-platform trades are exempt from capital gains tax through 2029, a deliberate incentive to stay onshore, but for individuals, staking and yield rewards are taxed as personal income tax in the year received, a separate taxable event the trading exemption doesn't touch; a business earning yield would be taxed under corporate rules instead, a different regime entirely. After the exemption's 2029 end date it needs renewal, and since it was set by ministerial regulation rather than parliament, it could lapse with less friction than a full law would.
- Unlicensed-platform users are the ones getting swept into the "mule account" crackdown: Banks and digital asset operators are both covered entities under the same 2025 Technology Crime Decree that authorized the exchange blocks, and the new anti-technology-crime taskforce it created can freeze deposit accounts with credible evidence of a link to a technology crime, so a bank account tied to an unlicensed platform is more likely to get flagged, even for someone who did nothing wrong themselves.
- Blocked platforms give you one month, not more: The June 2025 block of Bybit, OKX, and three others gave users a single month to withdraw funds before access cut off entirely, workable if you were watching the news, tight if you weren't.
- A baht stablecoin is coming, but as a locked sandbox, not a public rollout: Eight institutions, including Kasikornbank, Bank of Ayudhya, and Bitkub, are testing Bank of Thailand-supervised pilots restricted to interbank settlement. Issuance stays with regulated private entities, not the central bank itself, and BOT hasn't said whether the underlying ledger will be public or permissioned. A public hearing is expected by the end of 2026, with formal rules not arriving before early 2027.
- Your exchange history reaches the Revenue Department from 2028, not sooner: Thailand has committed to CARF, the OECD's automatic crypto-tax-data-sharing standard, with first international exchanges due in 2028. Domestic collection starts 1 January 2027, but licensed exchanges already gather this identity and transaction data today under the FATF-aligned KYC rules they operate under; CARF adds a channel for foreign tax authorities to receive it too, not a new category of data collected from you.
- Self-custody is untouched, but every on-ramp needs KYC: Thailand doesn't restrict what you do with your own wallet, only licensed exchanges must verify identity under FATF-aligned rules. A VPN doesn't change your legal status, and platforms increasingly geofence by residency and KYC data, not just IP address.
History
May 2018 Digital Asset Business Emergency Decree Legal
The region’s first dedicated crypto law established the SEC as regulator and split assets into cryptocurrency and digital tokens.
May 2021 Bitkub hacked, quietly Safe
A theft of digital assets worth roughly 1.7 billion baht ($47–50M). Not disclosed publicly or to the regulator at the time.
May 2024 Zipmex licenses revoked Safe
Thailand’s Finance Ministry stripped Zipmex of its digital asset exchange and broker licenses over financial instability and inadequate management, the SEC ordered it to halt operations and return client assets within 15 days.
Apr 2025 Foreign-operator loophole closed Legal
A Royal Decree extended SEC licensing to offshore platforms serving Thai users, not just Thailand-based ones, closing a gap that had let unlicensed foreign exchanges operate freely as long as they weren’t incorporated locally.
Jun 2025 Five foreign exchanges blocked Legal
Bybit, OKX, 1000X, CoinEx, and XT.com were blocked nationwide for operating without a license, users had one month’s notice to withdraw funds before access cut off entirely.
Jul 2026 Concealment exposed Safe
Thailand’s SEC filed a criminal complaint against Bitkub and former director Sakolkorn Sakavee, who has since publicly admitted to altering regulatory filings to hide the 2021 hack for five years. The case is still under investigation as of August 2026; if convicted, individuals face up to ten years in prison under Section 88(2) of the Digital Asset Business Decree.
Homegrown
Founded 2017
Cross-chain data oracle network, comparable to Chainlink.
~$30M Market cap CoinMarketCap
Regulators & terms
- SEC Securities and Exchange Commission (Thailand)
- Thailand's securities regulator; licenses exchanges under the 2018 Digital Asset Business Decree and extended its reach to offshore platforms in 2025.
- BOT Bank of Thailand
- Thailand's central bank; developing the country's baht-pegged stablecoin, expected 2026-2027.
- CARF Crypto-Asset Reporting Framework
- An OECD standard for automatically sharing crypto-exchange user data across tax authorities; Thailand's first exchanges are due in 2028.
Philippines
Established #9 Crypto Adoption- Legal
- Legal since 2017, two licensing paths: BSP VASP or SEC CASP, either way a real bar, ₱50 million paid-up capital for VASPs, a fit-and-proper test for directors, mandatory AML/KYC registration with the AMLC.
- The licensing freeze isn't temporary anymore: BSP's moratorium on new VASP licenses, in place since 2022, was expected to lift by September 2025; instead it was extended indefinitely, reviewed periodically rather than on a fixed timeline.
- Unlicensed platforms get cut off: The SEC named ten banned exchanges (OKX, Bybit, KuCoin, Kraken, MEXC, and others) in August 2025, and ISPs began blocking roughly 50 unlicensed platforms by December.
- Banks are moving onto public rails too: UnionBank and other Philippine banks are building PHPX, a peso-backed stablecoin running on Hedera, a public network, not an internal ledger.
- Safe
- The frozen door cuts both ways: No new licensed platform can enter to compete with Coins.ph or PDAX while the moratorium holds; it protects incumbents as much as it protects users.
- Not every licensed platform survives: Several VASPs have gone inactive or had licenses cancelled since 2025, including WIBS PHP's DO PAY platform and ETRANSS, a reminder that a license can be revoked or lapse, not a permanent guarantee.
- Yours
- Cash-out is fast, and pesos spend directly at retail: InstaPay or PESONet transfers land in minutes, or you can spend crypto directly at any of the roughly 700,000 merchants on the QR Ph network without a separate cash-out step first, backend liquidation happens automatically at checkout.
- The best-built path for getting paid abroad: PDAX's payroll partnership with Toku makes getting paid in stablecoins and cashing out locally the most developed anywhere in ASEAN.
- Remittances are where the stablecoin case is strongest, and BSP has approved it: Roughly 20 million OFWs send home an estimated $35-38 billion a year, one of the world's largest remittance corridors, and Coins.ph's BSP-approved peso stablecoin PHPC, issued on the public Polygon and Ronin networks rather than a private ledger, alongside bank pilots like BPI's with Meridian, are cutting typical transfer costs from around 6% toward roughly 1%.
- Ordinary income tax, no special rate: How much you owe depends on how often you trade and how the BIR classifies your activity, casual holder or registered business; there's no separate capital-gains regime crypto could fall into instead, unlike some of its neighbors. Staking or mining rewards are their own taxable event regardless of that classification, valued at fair market value the moment they're credited, separate from whatever you owe later when you actually sell; being classed as a business changes registration and reporting obligations, not whether the reward itself is taxed.
- Your exchange history will become visible to the BIR, but not until 2028: The Philippines has committed to CARF, the OECD's automatic crypto-tax-data-sharing standard, with first international exchanges due in 2028. Domestic collection starts 1 January 2027, but licensed VASPs and CASPs already gather this identity and transaction data today under BSP's existing anonymous-transaction ban; CARF adds a channel for foreign tax authorities to receive it too, not a new category of data collected from you. The data moves tax-authority to tax-authority under CARF's automatic-exchange rules, not to the public or to other regulators.
- Self-custody isn't directly regulated, but every legal on-ramp is: BSP prohibits anonymous transactions, so anyone using a licensed VASP or CASP must complete KYC. A VPN to reach a blocked exchange like Binance isn't illegal by itself, but acting as an agent or promoter for one can trigger criminal liability.
History
Feb 2017 BSP Circular 944 Legal
The region’s earliest framework. Required exchanges to register as a Remittance and Transfer Company: minimum capital, internal controls, AML Act compliance, and registration with the AMLC. Payouts above ₱500,000 had to go through checks or direct deposit, not cash.
Jan 2021 Upgraded to full VASP guidelines Legal
BSP Circular 1108 adopted the FATF Travel Rule: for transfers above ₱50,000 (about $893), VASPs must exchange the full identity of both sender and recipient, name, wallet address, ID number, and screen every party against terrorist-financing and sanctions lists.
Sep 2022 New licenses frozen Safe
A moratorium on new VASP licenses begins, extended indefinitely again in 2025. Existing platforms keep operating; nobody new gets in.
Feb 2025 Removed from FATF grey list Safe
The only country removed in that review round, credited for AML/CFT improvements.
Jul 2025 SEC CASP framework takes effect Legal
A second licensing track alongside BSP’s VASP regime, extending to any platform serving Filipino users regardless of where it’s based, with a ₱100 million paid-up capital requirement.
Aug 2025 Ten foreign exchanges banned Legal
SEC named OKX, Bybit, KuCoin, Kraken, MEXC, Bitget, Phemex, CoinEx, BitMart, and Poloniex; ISPs began blocking roughly 50 unlicensed platforms by December.
Homegrown
Founded 2020
Web3 gaming guild that pioneered play-to-earn scholarships, closely tied to Axie Infinity's early growth.
$20.6M Treasury The Crypto Times
Cut 35 jobs and shut down its web3 game publishing arm in July 2026.
Regulators & terms
- BSP Bangko Sentral ng Pilipinas
- The Philippines' central bank; runs the VASP licensing track, under an indefinite moratorium on new licenses since 2022.
- SEC Securities and Exchange Commission (Philippines)
- A second, capital-markets licensing track (CASP) alongside BSP's VASP regime; also orders ISPs to block unlicensed foreign exchanges.
- VASP Virtual Asset Service Provider
- BSP's license category for crypto exchanges and wallet providers operating in the Philippines.
- CASP Crypto-Asset Service Provider
- The SEC's parallel licensing track to BSP's VASP regime, extending to any platform serving Filipino users regardless of where it's based.
- BIR Bureau of Internal Revenue
- The Philippines' tax authority; will start receiving Filipino exchange-user data automatically once CARF reporting begins.
- AMLC Anti-Money Laundering Council
- The Philippines' AML regulator; VASP and CASP applicants must register with it as part of licensing.
- CARF Crypto-Asset Reporting Framework
- An OECD standard for automatically sharing crypto-exchange user data across tax authorities; the Philippines' first exchanges are due in 2028.
Malaysia
Established #42 Crypto Adoption- Legal
- Licensed since 2019, with a real capital bar: DAX operators need MYR 5 million in paid-up capital and Malaysia incorporation, plus SC-vetted directors, a genuine licensing bar, not a rubber stamp.
- Unlicensed platforms get cut off: Binance was ordered to disable Malaysian access in 2021 and remains unlicensed and blocked as of mid-2026; since April 2026, Google Ads requires proof of SC or BNM licensing before an exchange can even advertise to Malaysians.
- Regulatory comfort extends to the banks, but on private rails: Bank Negara Malaysia's (BNM) Digital Asset Innovation Hub has Standard Chartered and Capital A piloting a ringgit stablecoin, and Maybank and CIMB piloting tokenized deposits; Maybank's pilot explicitly runs on its own permissioned blockchain, unlike Singapore's DBS move onto public Ethereum, this stays on infrastructure the banks themselves control.
- Safe
- The direction never reverses: Six years of steady tightening, capped by a May 2026 overhaul that raises capital and custody requirements yet again, the most consistent trajectory in the region after Singapore's.
- No licensed operator has actually collapsed: Enforcement has landed on unlicensed platforms, four unregistered exchanges hit with administrative action, Binance still blocked, while the five registered DAX operators have no track record of the kind of implosion Thailand's Bitkub or the Philippines' WIBS PHP had.
- Approval doesn't guarantee a platform ever opens: Torum received conditional approval as Malaysia's sixth DAX in February 2024, never launched, and quietly disappeared from the SC's register two years later without explanation.
- The 2026 upgrade isn't instant: Existing operators have until 20 May 2028 to meet the new capital and custody bar, so being licensed today doesn't yet mean meeting the new rules.
- Yours
- The safety-cost tradeoff is unusually visible: Luno charges a real spread, roughly 2% on instant buy and sell, but is licensed and protected, while P2P via DuitNow skips that built-in spread entirely, leaving you with no regulator to appeal to if the other side of the trade doesn't pay up.
- No capital-gains regime, but no official threshold either: For individuals, LHDN can tax frequent, profit-seeking trading as business income up to 30%, with no published rule on where casual holding ends and "trading" begins. LHDN's digital-currency guidance treats staking rewards as likely taxable on their own, regardless of whether your broader trading pattern would otherwise count as casual holding; a registered business earning yield is taxed on it as ordinary business income either way, the casual/trading distinction doesn't apply to a company in the first place.
- A ringgit stablecoin is coming, but not a retail one yet: BNM's 2026 pilots are wholesale, bank-to-bank settlement and tokenized deposits, not something you can personally hold; BNM plans to clarify retail-facing rules by end of 2026.
- Your exchange history reaches LHDN from 2028, not sooner: Malaysia has committed to CARF, the OECD's automatic crypto-tax-data-sharing standard, with first international exchanges due in 2028. Domestic collection starts 1 January 2027, but SC-licensed DAX operators already gather this identity and transaction data today as part of their existing licensing conditions; CARF adds a channel for foreign tax authorities to receive it too, not a new category of data collected from you.
- Self-custody sits outside supervision, for now: A wallet that's purely non-custodial software isn't within SC's regulatory scope; only services that also offer fiat exchange or custody functions need a license. Using Binance over a VPN isn't itself illegal, but it's a gray area against an active regulatory restriction, and Binance is more likely to suspend the account than the law is to touch you.
History
Jan 2019 Tokens classified as securities Legal
The Capital Markets and Services (Prescription of Securities)(Digital Currency and Digital Token) Order brought digital currencies and tokens under securities law for the first time, the foundational order both DAX exchange licensing and the later IEO framework build on.
Jan 2019 DAX operators can register Legal
Revised Guidelines on Recognized Markets let the SC register Digital Asset Exchange operators for the first time. Luno Malaysia, SINEGY, and Tokenize Technology became the first three registered DAX operators that year.
Jan 2020 Guidelines on Digital Assets published Legal
A separate track from DAX exchange licensing: established the IEO regime for token fundraising, all token sales must run through an SC-registered IEO platform, no direct ICOs. Came into force in October 2020.
Jul 2021 Binance ordered offline Legal
The SC ordered Binance to disable Malaysian access within 14 days for operating an unregistered exchange, cease all marketing, and restrict Malaysians from its Telegram group. Binance remains unlicensed and blocked as of mid-2026.
Apr 2026 Google Ads locked to licensed platforms Legal
The SC partnered with Google to require proof of licensing, either SC or BNM, before a platform can run financial ads targeting Malaysians, cutting off a marketing channel unlicensed exchanges had relied on.
May 2026 DAX guideline overhaul Safe
Liberalized token-listing rules (exchanges can now list eligible tokens without case-by-case SC approval) but tightened financial, shareholding, and custody requirements for exchange operators. Existing operators have until 20 May 2028 to comply. The SC also took administrative action against four unregistered exchanges around the same time.
2026 BNM stablecoin and tokenized-deposit pilots Yours
Bank Negara onboarded three wholesale pilots under its Digital Asset Innovation Hub: a ringgit stablecoin settlement project led by Standard Chartered and Capital A, plus tokenized-deposit pilots from Maybank and CIMB. These are bank-to-bank projects, not a retail product; BNM plans to clarify rules for broader use by end of 2026.
Homegrown
Founded 2014
Independent crypto price-tracking and market-data aggregator, one of the most-used sites in the industry.
~20M Monthly visitors Similarweb
Founded 2021
Platform for creating and monetizing tokenized AI agents.
~$370M Market cap CoinMarketCap
Down from an all-time high near $4.6B in January 2025.
Regulators & terms
- SC Securities Commission Malaysia
- Licenses DAX operators and raised the capital and custody bar substantially in its May 2026 guideline overhaul.
- BNM Bank Negara Malaysia
- Malaysia's central bank; running the wholesale ringgit stablecoin and tokenized-deposit pilots banks are testing under its Digital Asset Innovation Hub.
- LHDN Lembaga Hasil Dalam Negeri
- Malaysia's Inland Revenue Board; can tax frequent crypto trading as business income up to 30%, with no published threshold for where "casual" ends.
- DAX Digital Asset Exchange
- Malaysia's license category for crypto exchanges; only five operators currently hold one.
- CARF Crypto-Asset Reporting Framework
- An OECD standard for automatically sharing crypto-exchange user data across tax authorities; Malaysia's first exchanges are due in 2028.
Indonesia
Established #7 Crypto Adoption- Legal
- Legal to hold and trade, but not legal tender: Only the rupiah counts for payment; Indodax, Tokocrypto, and Pintu are the licensed exchanges where most people actually buy and trade.
- Oversight moved from a commodities regulator to a financial one: OJK took over from Bappebti in January 2025, and Law 4/2026, effective June 2026, raised the minimum exchange license capital to IDR 500 billion (roughly $320M), timed to the same July 2026 deadline the EU set for MiCA compliance.
- Unlicensed platforms get shut down, not just warned: Kominfo blocks unlicensed platforms at the network level, and OJK's Satgas PASTI task force took down 228 unlicensed platforms between January and May 2026 alone.
- The central bank is building its own stablecoin in parallel, on a private ledger: Bank Indonesia's Project Garuda digital rupiah runs on a permissioned Hyperledger Besu network, wholesale-only for interbank settlement, not the public-chain move Singapore's DBS or Malaysia's ringgit pilots reference by comparison; it exists alongside, not instead of, OJK's private-sector licensing track for stablecoin issuers.
- Safe
- Being licensed didn't stop the country's largest exchange from getting hacked: Indodax lost $22M in September 2024; oversight then sat with Bappebti, not OJK, and Indodax kept operating afterward with no license action taken.
- Enforcement followed within a month of the July 1, 2026 compliance deadline: OJK gained full authority and bank-style powers over capital, custody, and governance in June 2026, and once the governance and risk-management deadline landed, by 31 July 2026 had handed out IDR 91.09 billion in penalties across 104 parties, revoked 2 licenses, and suspended 6 more.
- The new capital bar is steep enough to reshape the field: IDR 500 billion (~$320M) is a minimum many of today's exchanges likely can't clear without raising serious capital; expect smaller platforms to get squeezed out or merged away before the deadline lands.
- Yours
- Cashing out is genuinely smooth: Direct to major banks or e-wallets like GoPay and OVO.
- The tax mechanism changed in August 2025: VAT on crypto transactions dropped to zero, replaced by a single final income tax withheld at the point of sale: 0.21% if the exchange has been officially appointed as a tax collector by the government, or 1%, nearly five times higher, if it hasn't. Mining income is carved out explicitly for individuals, taxed under the general progressive personal income tax law rather than that flat rate; staking or lending yield isn't named in the regulation at all, so which of the two it falls under is unresolved. A business earning either would be taxed under Indonesia's separate corporate income tax rules regardless.
- A rupiah stablecoin path now exists, but its own infrastructure is opaque: OJK cleared its first private rupiah-stablecoin issuer through its regulatory sandbox in June 2026, though the issuer hasn't published which chain it settles on; Bank Indonesia's own digital rupiah, by contrast, is confirmed to run on a permissioned ledger, not a public one. Neither is yet a mainstream way to get paid.
- Your exchange history is already reaching the DJP: Indonesia has committed to CARF, the OECD's automatic crypto-tax-data-sharing standard, with first international exchanges to Indonesia's Directorate General of Taxes (DJP) due in 2027. Domestic collection by exchanges has been running since 1 January 2026, but OJK-licensed platforms already gather this identity and transaction data today under existing KYC and AML rules; CARF adds a channel for foreign tax authorities to receive it too, not a new category of data collected from you.
- Self-custody is legal, but licensed platforms only trade an approved whitelist: Personal cold-wallet use isn't restricted the way trading is; KYC and AML obligations fall on exchanges and businesses, not individual wallet holders. Trading a token outside OJK's approved list is a violation for the platform and potentially the trader, and using a VPN to reach one of Kominfo's blocked platforms isn't just an access workaround, it's routing around the exact rule the block exists to enforce.
History
Sep 2018 Crypto classified as a commodity Legal
Ministry of Trade Regulation No. 99/2018 first allowed crypto assets to be traded as futures commodities.
Feb 2019 Bappebti Regulation No. 5/2019 Legal
The detailed physical-market framework for crypto-asset futures trading: governance and consumer-protection rules, AML/CFT compliance, five-year transaction-record retention, servers required to sit inside Indonesia, and licensing for exchanges, traders, clearing institutions, and storage managers.
Sep 2024 Indodax hacked for $22M Safe
Indonesia’s largest exchange lost $22M to hackers and paused operations. Oversight at the time still sat with Bappebti, not OJK; Indodax kept operating afterward with no license action taken.
Jan 2025 Oversight moves to OJK Safe
The single biggest change in the country’s crypto history: regulatory authority transferred from the commodities regulator Bappebti to the financial regulator OJK, a shift from treating crypto as a commodity to treating it as a financial instrument.
Aug 2025 Tax mechanism overhauled Yours
MOF Regulation 50/2025 dropped VAT on crypto transactions to zero and replaced it with a single final income tax withheld at the point of sale: 0.21% through a licensed exchange, 1% through any platform without an appointed tax collector.
Jan-May 2026 228 unlicensed platforms shut down Legal
OJK’s Satgas PASTI task force took down 228 platforms trading digital financial assets without a license over five months, alongside Kominfo’s existing network-level blocks.
Jun 2026 First rupiah stablecoin issuer cleared Yours
OJK’s regulatory sandbox approved IDRP’s rupiah-stablecoin issuer model and a separate non-trading custody model, opening a registration path for future providers. Bank Indonesia is separately planning its own government-bond-backed digital rupiah.
Jun 2026 P2SK Law Amendment takes effect Legal
Law 4/2026 gave OJK bank-style prudential powers over capital, custody, and governance, and raised the minimum digital-asset exchange license capital to IDR 500 billion (roughly $320M), timed to the same July 2026 deadline the EU set for MiCA compliance.
Homegrown
Founded 2026
OJK-licensed exchange, clearing, and custody consortium built by eleven of Indonesia's largest crypto platforms.
$70M Funding raised PR Newswire
Reaches a combined 20 million users across its founding exchanges.
Regulators & terms
- OJK Otoritas Jasa Keuangan
- Indonesia's Financial Services Authority; took over crypto oversight from Bappebti in 2025 and gained bank-style prudential powers in 2026.
- Bappebti Badan Pengawas Perdagangan Berjangka Komoditi
- Indonesia's former crypto regulator, the commodities futures trading body; handed oversight to OJK in January 2025.
- Kominfo Ministry of Communication and Informatics
- Blocks unlicensed crypto platforms at the network level in Indonesia; renamed Komdigi (Ministry of Communication and Digital Affairs) in 2025.
- Satgas PASTI OJK's illegal-fintech task force
- Shut down 228 unlicensed crypto platforms in Indonesia between January and May 2026 alone.
- MiCA Markets in Crypto-Assets
- The EU's crypto regulatory framework; Indonesia's regulator has explicitly used its 2026 compliance deadline as a benchmark despite Indonesia not being in Europe.
- CARF Crypto-Asset Reporting Framework
- An OECD standard for automatically sharing crypto-exchange user data across tax authorities; Indonesia's first exchanges are due in 2027.
Vietnam
Recent #4 Crypto Adoption- Legal
- Legal only since January 2026, after nine years with no defined legal status: Resolution 05/2025/NQ-CP, issued September 2025, launched a five-year licensed pilot, and the underlying Law on Digital Technology Industry took effect 1 January 2026.
- The licensing bar is among the highest in the region: CASP applicants need VND 10 trillion (roughly $380M) in paid-in capital, at least 65% institutional ownership with over 35% from at least two financial institutions, and a 49% cap on foreign ownership.
- Big domestic banks are lining up to run exchanges, not just fintechs: Five applicants cleared initial screening, including affiliates of Techcombank, VPBank, and LPBank alongside VIX Securities and Sun Group; officials targeted Q3 2026 for the first licenses.
- Offshore platforms get fined out, not blocked outright: Decree 284/2026/NĐ-CP, effective September 2026, fines individual traders up to 50 million VND (about $1,900) for using unlicensed platforms like Binance, OKX, or Bybit.
- Safe
- The bigger risk is Vietnam's banking system, not crypto policy: The law recognizing crypto passed in mid-2025, and months before it even took effect, 86 million bank accounts, nearly half the country, were deactivated in an unrelated biometric-ID compliance drive.
- Funds weren't seized, but they were locked: The freeze targeted accounts without face or fingerprint verification under Circular 17/2024/TT-NHNN, aimed at fraud, not crypto policy, but it shows how exposed your ability to move money at all can be to something that has nothing to do with crypto.
- The licensed market doesn't actually exist yet: No exchange has launched under Resolution 05 as of this writing; the five applicants are still under review, so "licensed" is a status you can apply for, not yet a platform you can use.
- Yours
- Most people still trade P2P on Binance, because the licensed system isn't live yet: First domestic licenses were targeted for Q3 2026, and a maximum of five domestic platforms will be approved once the market goes live.
- Issuing new fiat-backed stablecoins is banned outright: Vietnamese-issued crypto assets must be backed by "real assets," excluding securities and fiat currency, so a domestic USDT- or USDC-style issuer can't be licensed here; foreign-issued cryptocurrencies like Bitcoin and Ethereum aren't subject to this backing rule at all. Whether trading existing foreign stablecoins stays open on licensed platforms is still unresolved.
- A flat 0.1% tax applies to every trade from July 2026, for individuals: modeled directly on Vietnam's existing stock-transaction tax, a levy on the transaction value, not a tax on the gain; a small exemption applies for casual holders under roughly $400 in annual gains. Vietnamese companies trading crypto instead pay 20% corporate income tax on profit; foreign companies routed through Vietnamese platforms pay the same 0.1% individual rate rather than the corporate one. Whether the exemption extends to staking or stablecoin yield hasn't been addressed by the draft rules; staking rewards themselves are taxed as income when received, separately from the trading tax.
- Self-custody isn't restricted, but every licensed platform verifies you: Owning a private wallet and trading P2P is how most people actually participate; CASPs must run KYC on any transaction worth roughly $1,000 or more, and using an unlicensed offshore platform, VPN or not, is what the new fines specifically target.
History
2017 Informal payment ban Legal
The State Bank of Vietnam prohibits using crypto as a means of payment (Document 5747/NHNN-PC), while leaving trading and ownership legally undefined for most of a decade.
Jun 2023 Added to FATF grey list Safe
Cited for AML/CFT deficiencies, including a lack of regulation for virtual assets and VASPs. A real driver behind the push toward formal legal recognition that followed.
Jun 2025 Law on Digital Technology Industry passed Legal
First formal legal recognition of crypto assets. Takes effect 1 January 2026, not immediately.
Sep 2025 Resolution 05/2025/NQ-CP issued Legal
Launched the CASP licensing regime and a five-year pilot programme. Applicants need VND 10 trillion (roughly $380M) in paid-in capital, at least 65% institutional ownership, and a 49% cap on foreign ownership, among the highest bars in the region.
Sep 2025 86 million bank accounts frozen Safe
A mass biometric-ID compliance purge, unrelated to crypto policy, deactivated nearly half the country’s bank accounts under Circular 17/2024/TT-NHNN. Funds weren’t seized, just locked until face or fingerprint verification. This happened before the new crypto law even took effect, not after.
Jan 2026 Law takes effect Legal
Crypto assets formally recognized under the Law on Digital Technology Industry. From 20 January 2026, the State Securities Commission began accepting license applications from Vietnamese enterprises, the first concrete step toward an actual licensed market rather than just a recognized one.
Jul 2026 Fines for unlicensed trading Legal
Decree 284/2026/NĐ-CP set fines up to 50 million VND (about $1,900) for individual traders using unlicensed platforms like Binance, OKX, or Bybit, and up to 200 million VND for unauthorized offerings or AML violations. Takes effect 1 September 2026.
2026 (Q3 target) First domestic licenses expected Safe
Five applicants, including affiliates of Techcombank, VPBank, and LPBank alongside VIX Securities and Sun Group, cleared initial screening. No exchange has launched under Resolution 05 as of this writing.
Homegrown
Founded 2018
Game studio behind Axie Infinity, the play-to-earn title that helped ignite the whole P2E boom.
~$3B Valuation Konvoy Ventures
Founded 2017
One of DeFi's original decentralized exchange protocols, still operating today as KyberSwap.
~$5.4B Aggregator volume (30d) DeFiLlama
Its own TVL has shrunk to about $1M, down from billions in DeFi's earlier years, but the protocol pivoted to aggregation and still routes billions in trades through other platforms' liquidity.
Founded 2017
Multi-chain wallet and DeFi super-app.
~$13M FDV CoinMarketCap
Down sharply from an initial fully diluted value near $75M.
Founded 2017
Layer-1 blockchain, still active today under a new name and token.
Active Status Binance Announcements
Rebranded from TomoChain to Viction in November 2023, same project, new name.
Regulators & terms
- CASP Crypto Asset Service Provider
- Vietnam's license category under Resolution 05/2025/NQ-CP, issued by the Ministry of Finance; requires roughly $380M in paid-in capital.
Cambodia
Recent #33 Crypto Adoption- Legal
- Licensed banks can hold stablecoins, not Bitcoin: Prakas B7-024-735, issued December 2024, splits assets into Group 1 (tokenized securities and fiat-backed stablecoins, which licensed banks can hold up to 5% of capital) and Group 2 (Bitcoin, Ethereum, and everything else unbacked), which banks are barred from holding on their own balance sheets at all.
- Only two firms are actually licensed, against a grey market far larger than that: As of this writing, under the Securities and Exchange Regulator's FinTech Regulatory Sandbox program, meaning most people actually using crypto in Cambodia today are doing it outside any licensed structure entirely.
- Unlicensed exchanges get blocked at the network level, but not completely: The Telecom Regulator shut down access to 16 exchange websites, including Binance, Coinbase, and OKX, in December 2024, though their mobile apps still work.
- Safe
- No licensed platform has faced a real stress test yet, unlike its neighbors: With only two operators actually licensed since December 2024, the framework hasn't been through anything like Thailand's Bitkub concealment or Indonesia's Indodax hack, not proof it's safer, just that there's been far less activity for anything to go wrong with.
- Digital money is already normal here, just tightly state-controlled: Bakong, the central bank's own payment system built on a private, permissioned ledger, handles 65% of the population daily and moved $104.8 billion in 2024 alone, 330% of GDP, but it's closed-loop: no connection to open blockchains, no Bitcoin, no crypto transfers.
- The governor has said the quiet part out loud: NBC Governor Chea Chanto said Cambodia "won't recognize private cryptocurrencies until Bakong is stable," meaning the state's own system, not crypto adoption, is the actual priority driving policy.
- Yours
- Bank accounts get flagged and frozen over Binance P2P trades: This is routine, not rare, with no guaranteed timeline for getting access back.
- Getting money in or out without a state-sanctioned channel is a real, active struggle: Not just a theoretical restriction, one of the harder places in the region to actually use crypto day to day.
- A 20% capital gains tax applies to crypto from January 2026, for individuals: the regime, delayed twice from an original September 2025 start, taxes the gain between sale price and cost basis; crypto isn't named in the law itself, it's swept in by treating it as an "intangible asset." VAT-registered businesses fall under Cambodia's ordinary income tax instead, a separate carve-out written into the same law. Either way, no rule addresses staking, mining, or lending yield separately, so that income would fall under whichever of the two regimes already applies, not a distinct income tax the way Vietnam's staking rewards are.
- Self-custody isn't addressed by the new rules at all: Licensing under Prakas B7-024-735 covers exchange and custodial-wallet services, not what you do with your own keys; the same customer due diligence NBC requires of licensed platforms is exactly what P2P trading, the real workaround here, lets you skip.
History
2020 Bakong launches Yours
The central bank’s own blockchain-based CBDC and instant-payment system, years before any crypto-specific law existed. Reached 65% of the population.
Dec 2024 Prakas B7-024-735 Prokor Legal
The country’s first dedicated crypto framework. Splits assets into Group 1 (tokenized securities and fiat-backed stablecoins, which licensed banks can hold up to 5% of capital) and Group 2 (Bitcoin, Ethereum, and everything else unbacked, walled off from the banking system entirely).
Dec 2024 16 exchange websites blocked Legal
The Telecom Regulator of Cambodia shut down access to 16 exchange websites, including Binance, Coinbase, and OKX, for operating without a Securities and Exchange Regulator license. Their mobile apps still work, a real gap in the block.
Jan 2026 20% capital gains tax applies to crypto Yours
Cambodia has no crypto-specific tax law; the General Department of Taxation classifies crypto as an "intangible asset" and taxes the gain between sale price and cost basis under the general CGT regime that took effect for non-real-estate assets this year.
Regulators & terms
- NBC National Bank of Cambodia
- Cambodia's central bank; issued Prakas B7-024-735, the framework splitting crypto into bank-approvable and banking-system-barred categories.
Laos
Thin #125 Crypto Adoption- Legal
- Technically legal, but through a deliberately narrow gate: Only two platforms, Lao Digital Asset Exchange and Bitqik, hold a Bank of the Lao PDR (BOL) trading license, each paying a $1 million one-off royalty fee to the Ministry of Finance and a $5 million deposit with the central bank; they also owe a 15% lump-sum tax on the trading fees they collect from buyers and sellers, a levy on the platform's own fee revenue rather than a separate charge added to what a trader pays; neither platform publishes its actual fee schedule, so how much of that reaches the end user isn't verifiable.
- Mining is licensed on a separate, cheaper track: Fifteen companies have been licensed to mine or trade crypto since a September 2021 green light, each paying a $500,000 fee and required to operate near hydropower plants.
- Still just two licensed exchanges, four years after the framework opened: That's a fraction of the licensed venues in neighboring countries, though whether that reflects demand, roughly 5% of Laotians use crypto at all, the lowest rate in the region, or is simply a function of the steep entry costs keeping competitors out isn't something officials have said.
- Safe
- The whole framework started as a fiscal gambit, and it mostly failed: Officials projected roughly $180 million in tax revenue from crypto operations for 2022 alone, meant to help pay down national debt; by 2023 the government admitted crypto operations hadn't eased the debt, and some licensed firms owed roughly $20 million in unpaid electricity bills.
- Officials cite industrial power priorities, not money laundering, for the 2026 mining shutdown: The Deputy Energy Minister has said directly that the electricity is being redirected to AI data centers, metals refining, and EV manufacturing, a different stated rationale than the AML or investor-protection reasoning used almost everywhere else in the region.
- This doesn't touch ordinary users directly, only the miners still connected: Miner electricity use has already fallen roughly 70% from its 2021-2022 peak of 500 MW to around 150 MW as the phase-out proceeds; nothing here changes the rules for people simply holding or trading crypto.
- Yours
- January 2025 foreign-currency controls made moving money in or out even harder: Decision 11/BOL requires foreign exchange to go through authorized banks or licensed FX markets only, narrowing informal off-ramps that existed before.
- No crypto-specific tax law exists: In its absence, gains are likely taxed as ordinary income on the difference between sale and acquisition cost, though this remains an interpretation of general tax principles, not a settled rule; nothing distinguishes staking or lending yield from a trading gain either, for an individual or a business, since neither has its own rule to begin with.
- Only around 5% of the population uses crypto at all: The lowest in the region, a real reflection of how closed off the market is, not just under-counting.
- Self-custody and VPN use aren't addressed by any rule here: The licensing framework covers exchanges and miners, nothing in it speaks to what you do with your own wallet or how you reach a platform; the real practical constraint is Decision 11/BOL's currency controls, not a crypto-specific rule.
History
Sep 2021 Six mining companies greenlit Legal
The government authorized an initial six companies to mine and trade crypto, part of a bid to turn Laos’s hydropower surplus into debt-relief revenue. The mining track grew to fifteen licensed companies, each paying a $500,000 fee and required to operate near hydropower plants.
Jan 2022 Two trading platforms licensed Legal
The Bank of the Lao PDR licensed Lao Digital Asset Exchange and Bitqik as the only crypto trading platforms, each paying a $1M one-off royalty fee to the Ministry of Finance, a $5M deposit with the central bank, and a 15% lump-sum tax on transaction fees. No further platforms have been licensed since.
Sep 2023 Government admits the debt gambit failed Safe
Officials had projected roughly $180 million in tax revenue from crypto operations for 2022 alone. Prime Minister Sonexay Siphandone acknowledged the national debt hadn’t been eased, and some licensed firms owed roughly $20 million in unpaid electricity bills.
Jan 2025 Foreign-currency controls tighten Yours
Decision No. 11/BOL requires all foreign exchange to go through authorized banks or licensed FX markets, narrowing informal off-ramps.
2026 (Q1) Crypto mining shutdown Safe
Electricity supply to crypto miners cut, redirected to AI data centers, metals refining, and EV manufacturing. Officials cite industrial power priorities, not AML or investor protection, a different stated rationale than most of the region's other rule changes.
Regulators & terms
- BOL Bank of the Lao PDR
- Laos's central bank and crypto regulator; licenses the only two trading platforms allowed to operate.
Myanmar
Thin #109 Crypto Adoption- Legal
- Banned since May 2020: Directive 9/2020 prohibits the sale, purchase, or exchange of digital currencies, including Bitcoin and USDT, with prison time, fines, or both; a May 2024 public notice reiterated the ban, warning of imprisonment and frozen accounts.
- Enforcement is real, not just on paper: Myanmar's central bank (CBM) has pursued legal action against illegal currency conversion and unauthorized USDT-based hundi transfers (Myanmar's informal, hawala-style money-transfer networks) under the Anti-Money Laundering Law and Financial Institutions Law, including account closures.
- Myanmar is one of only three countries on FATF's actual blacklist: FATF added Myanmar in October 2022 alongside Iran and North Korea, over money-laundering and terrorist-financing deficiencies first flagged in 2018 and never resolved, a far more serious designation than the grey list most of its neighbors have cycled through.
- Safe
- The ban hasn't stopped anything, it's just pushed everything underground: Telegram groups trade USDT for cash in public markets constantly.
- Myanmar hosts part of a genuinely dangerous scam economy that runs on USDT: Forced-labor compounds have trafficked workers into running fake crypto-investment scams against victims worldwide, paid out in USDT specifically because it moves peer-to-peer around bank AML checks, a real risk tied to the region, not just an abstract statistic.
- Both sides of the civil war are building their own digital money: The opposition National Unity Government (NUG) declared USDT legal tender in December 2021 to route around the junta's currency restrictions, while the junta separately formed a committee in May 2025 to build a fully traceable digital kyat, explicitly framed around monitoring transactions and preventing capital flight.
- Yours
- Officially, nothing: There's no legal path to cash out or get paid.
- Unofficially, an active informal USDT economy exists and is used daily, but it carries the legal risk the ban itself creates and zero institutional protection if something goes wrong.
- Whose money you're actually using depends on where you are: NUG-aligned areas treat USDT as the practical currency and the kyat as invalid; junta-controlled areas still officially recognize only the kyat.
- VPNs and self-custody are how almost everyone actually participates: Nearly every active trader uses a VPN to reach Binance or Kraken, and P2P deals arranged on Telegram or Facebook require no KYC at all, just a phone and a counterparty; enforcement reaches banking channels, not encrypted apps or in-person cash trades.
History
May 2020 Central Bank Directive 9/2020 Legal
One of the earliest blanket crypto bans anywhere in the world, prohibiting the sale, purchase, or exchange of Bitcoin, Ethereum, and USDT. Trading or exchanging them can mean imprisonment, fines, or both under the Anti-Money Laundering Law and Financial Institutions Law.
Dec 2021 NUG declares USDT legal tender Yours
The opposition National Unity Government’s Ministry of Planning, Finance, and Investment declared Tether legal tender for domestic transactions and the kyat invalid in areas it controls, an attempt to hedge against inflation and route around the junta’s currency restrictions.
Oct 2022 Added to FATF blacklist Legal
FATF cited unaddressed money-laundering and terrorist-financing deficiencies first flagged in 2018. Myanmar joined Iran and North Korea as one of only three countries on the actual blacklist, a far more serious designation than the grey list.
ongoing A parallel economy the ban never stopped Safe
Telegram groups trade USDT for cash in public markets around the clock. Part of this same underground rail is exploited by forced-labor scam compounds that pay out in USDT specifically because it moves peer-to-peer around bank AML checks, a real risk tied to the region.
May 2025 Junta begins building a state digital kyat Safe
Notification 16/2025 formed a Central Committee for the Issuance of Central Bank Digital Currency, tasked with building a fully traceable digital kyat explicitly framed around monitoring transactions and preventing capital flight, even as private crypto stays banned.
Regulators & terms
- CBM Central Bank of Myanmar
- Issued Directive 9/2020, the blanket ban on crypto trading; separately building a state digital kyat since 2025.
- NUG National Unity Government
- Myanmar's opposition shadow government; declared USDT legal tender in areas it controls, in defiance of the ruling junta.
- FATF Financial Action Task Force
- The global anti-money-laundering watchdog; its grey and black lists shape how hard countries tighten crypto AML rules.
Brunei
Thin #124 Crypto Adoption- Legal
- Unregulated, not illegal: No licensing regime, no consumer protection rules, and no dedicated law of any kind covering crypto; AMBD's original December 2017 statement called it "not legal tender," not a ban.
- The 2017 warning was specific, and it still stands: It flagged the anonymity of crypto platforms operating in unverifiable jurisdictions, the absence of any regulatory safeguards, and its susceptibility to illegal use, none of that assessment has been formally revised since.
- There's cautious movement, just no new law yet: BDCB is assessing Sharia-compliant digital-asset products and has joined regional dialogues on crypto AML/CFT and licensing, but none of it has translated into an actual framework as of this writing.
- Safe
- The only official statement on the subject is from December 2017: Warning the public that crypto isn't legal tender and isn't regulated, and it has never been formally updated, not even after the central bank itself was renamed in 2021.
- If you're in Brunei, you're relying entirely on whatever protections a foreign platform happens to offer: The country itself hasn't issued a real framework in nearly a decade.
- Brunei's own fintech push is happening around crypto, not through it: 2024 guidelines encouraged banks to adopt blockchain platforms for their own systems, but the country's wider fintech sector remains small, fewer than 20 companies as of 2026, concentrated in payments and remittances, none of it specifically crypto-related.
- Yours
- Whatever a foreign exchange's own on/off-ramp allows is what you get: There's no local banking rail built for this, and no domestic platform to fall back on.
- No tax guidance addresses crypto specifically: Not because it's exempted, just because the question has never been formally answered; that includes staking or lending yield, there's no separate rule for it any more than there is for a trading gain.
- Sharia-compliance status is genuinely unsettled: There's no official guidance from Brunei's religious authorities on whether crypto trading is permissible, leaving the country's Muslim majority to navigate that question on their own.
- Self-custody sits in the same regulatory vacuum as everything else: No mechanism exists for BDCB to oversee wallets you control yourself, and there's no requirement to use a local platform, because there isn't one. Most foreign exchanges serving Brunei still require standard KYC on their own terms, regulation or not.
History
Dec 2017 AMBD public statement Legal
The only formal position ever issued: cryptocurrency is not legal tender and is not regulated. Warns the public to be cautious.
Jun 2021 A broader mandate arrived, but not on crypto Safe
AMBD became the Brunei Darussalam Central Bank (BDCB) under a new Order granting broader powers over financial stability and fintech integration, a natural point to revisit the 2017 crypto statement. It wasn't: that position stayed exactly as written.
2024 New fintech regulations Safe
Guidelines encouraged banks to adopt blockchain platforms for their own systems, part of a wider fintech push, but the sector itself remains small, fewer than 20 companies as of 2026. None of it was crypto-specific.
2025 Sharia-compliant digital assets assessed Legal
BDCB began developing a VASP licensing framework aligned with FATF standards and assessing Sharia-compliant digital-asset products, the first sign of movement beyond the 2017 warning, though nothing has become an actual rule yet.
Regulators & terms
- AMBD Autoriti Monetari Brunei Darussalam
- Brunei's central bank under its former name; issued the country's only official crypto statement in December 2017.
- BDCB Brunei Darussalam Central Bank
- AMBD renamed in 2021; now assessing Sharia-compliant digital-asset products.
What can you actually do?
| Country | Hold it? | What it costs | Where to buy | Spend it? | Get paid in it? |
|---|---|---|---|---|---|
| Yes licensed since 2020 | No CGT unless it looks like a business; staking taxed on disposal, same test | MAS-licensed exchanges StraitsX for stablecoins | Limited but instant cash-out | Not built out no licensed payroll product exists yet | |
| Yes licensed since 2018 | 5-year break on licensed platforms; yield taxed as income, exemption excluded | Bitkub homegrown; other licensed exchanges too | No no merchant network yet | Not common baht stablecoin pilots are interbank only | |
| Yes licensed since 2017 | 0-35% ordinary income tax; yield taxed on receipt, same regime | Coins.ph, PDAX both homegrown exchanges | Yes ~700K merchants via QR Ph | Yes OFW remittances, PDAX payroll | |
| Yes licensed since 2019 | Up to 30% if classed as trading; staking likely taxable regardless | Luno or cheaper P2P via DuitNow | No no merchant network | Not common ringgit stablecoin pilots are wholesale only | |
| Yes not legal tender | 0.21% if exchange is an appointed tax collector; yield unaddressed | Indodax, Tokocrypto, Pintu all homegrown exchanges | No no merchant network | Not common rupiah stablecoin pilots aren't retail-facing yet | |
| Yes only since January 2026 | 0.1% per trade for individuals from July 2026; staking taxed separately | Binance P2P licensed exchanges not live yet | No new stablecoins can't be issued | Not built out licensed market not live yet | |
| Depends bank stablecoins yes, BTC/ETH walled off | 20% CGT from January 2026, no separate yield rule | Offshore P2P blocked at network level | Very limited Bakong dominates domestic payments instead | No real path Bakong, the state system, has no crypto connection | |
| Technically yes 2 licensed platforms only | Unclear no personal tax law; 15% levied on exchange fee revenue | 2 platforms $1M exchange license fee | Barely functions as a market | No real path currency controls route all FX through licensed banks | |
| No banned since 2020 | N/A illegal, no tax framework of any kind | Underground USDT-for-cash, Telegram | Informal only real legal risk | No legal path informal USDT arrangements exist, at real risk | |
| Not illegal but unregulated | None no local tax rules, yield included | Foreign exchanges no local rail | Depends on foreign platform | No local path no local banking rail, no domestic platform |
Off the licensed path
Crypto's permissionless and borderless design means users can hold their own keys or route around geographic blocks. Self-custody is usually left alone, with enforcement concentrated at the on/off-ramps instead. Getting around a block carries more risk, ranging from losing any potential recourse to criminal liability if promoting a banned platform.
| Country | Self-custody | Getting around a block |
|---|---|---|
| Untouched Only licensed platforms trigger KYC and Travel Rule reporting | No MAS protection if you do A VPN gets past the geo-block; it doesn't get you MAS oversight or recourse if the platform itself isn't licensed | |
| Untouched Every licensed on-ramp still needs KYC under FATF-aligned rules | No regulator behind you if you do A VPN gets past geofencing; it doesn't get you the KYC-backed protection a licensed exchange offers | |
| Not directly regulated But BSP requires KYC on every legal VASP or CASP on-ramp | Using one is legal; selling access isn't Acting as an agent or promoter for a banned platform can trigger criminal liability | |
| Outside supervision Unless the wallet also offers fiat exchange or custody | A gray area, not a crime Binance is more likely to suspend the account than the law is to act | |
| Legal Platforms enforce KYC and an OJK-approved token whitelist | Puts you in violation too, not just the platform Reaching a Kominfo-blocked exchange to trade a token outside OJK's whitelist is a violation for you, not only for the platform | |
| Not restricted CASPs must KYC any transaction worth roughly $1,000 or more | You can still be fined Unlicensed-platform use, VPN or not, risks a fine of up to roughly $1,900 | |
| Not addressed by the rules Licensing covers exchanges and custodial wallets, not your own keys | P2P skips ID checks entirely The real workaround here, P2P trading, requires none of the due diligence NBC mandates for licensed platforms | |
| Not addressed by any rule The licensing framework covers exchanges and miners only | Not addressed either The real constraint is currency controls, not a crypto-specific rule | |
| How most people actually participate No KYC exists in the underground market at all | Nearly universal, and mostly unenforced Almost every trader uses one; enforcement reaches banking channels, not encrypted apps | |
| Same regulatory vacuum as everything else No mechanism exists for BDCB to oversee wallets you control yourself | Moot here Brunei doesn't ban crypto, so there's no block to bypass in the first place |