Mongolia’s Law on Virtual Asset Service Provider is the national statute governing virtual asset service providers, or VASPs, that are registered in Mongolia. Adopted by the State Great Khural on Dec. 17, 2021, and treated by official FRC and FIU materials as in force from Feb. 24, 2022, the law creates a registration and supervision framework administered by the Financial Regulatory Commission.
The law sits within Mongolia’s broader financial-sector and AML/CFT framework. Its stated purpose is to regulate the registration of legal entities providing virtual asset services, supervise their operations, and define related rights and obligations. As of July 22, 2026, Legalinfo lists the Mongolian text as valid, and the current text should be treated as the controlling source over unofficial English translations.
Scope of the Mongolia VASP Law
The law applies to virtual asset services provided in Mongolia, and from Mongolia to foreign countries, by companies registered in Mongolia. It does not purport to resolve private contractual disputes between a VASP and its customers. The definition of “virtual asset” covers an intangible digital representation of value that can be transferred or traded and used for payment or investment purposes, while excluding digital forms of official currency, securities, and electronic money licensed by the Bank of Mongolia.
Article 6 identifies five covered service categories: exchange between virtual assets and official currency; exchange among virtual assets; transfer of virtual assets; safekeeping and management of virtual assets or related instruments; and services connected with public offerings or sales of virtual assets. The law also prohibits public offering or sale of virtual assets without routing the activity through a company registered for the Article 6.1.5 service category.
Registration, governance, and AML/CFT controls
Companies seeking to provide covered virtual asset services must apply to the Financial Regulatory Commission for registration. The Commission is empowered to review whether an applicant meets statutory requirements, determine registration and governance standards, set capital and equity requirements, conduct remote and on-site supervision, require information, impose restrictions, suspend operations, and deregister providers that fail to meet legal or regulatory conditions.
The applicant requirements are broad. They include reliable and secure technology infrastructure, clear information about the applicant and related persons, a four-year business plan, operational structure, professional staff, internal-control and data-retention systems, AML/CFT and proliferation-financing controls, product and technology risk assessments, lawful sources of capital, tax registration, and qualified management. Unregistered persons are barred from providing covered virtual asset services, and registered VASPs are restricted to the activities listed in Article 6.1.
Customer disclosures, custody, and records
The law includes customer-facing obligations without converting registration into a state guarantee. VASPs must protect customer interests, communicate fairly and clearly, disclose specified risks before contracting, maintain continuous access to customer money and virtual assets for covered services, and separate customer money and virtual-asset accounts from the provider’s own accounts. Contracts must address issues such as wind-down planning, deregistration scenarios, lack of government or central-bank backing, absence of deposit-insurance protection, irreversible or erroneous transactions, volatility, fraud, cyber risks, technology outages, and the possibility that a provider’s assets may be insufficient to cover customer losses.
Registered VASPs must preserve paper and electronic records created in the course of business for at least 10 years. The law also applies confidentiality rules to the Commission, its personnel, and VASPs, subject to exceptions for official duties, criminal or violation proceedings, terrorism-financing and proliferation-financing inquiries, court orders, final court decisions, international treaty obligations, and other legal grounds.
Status and implementation timeline
Official Mongolian and regulator materials indicate that the law was adopted on Dec. 17, 2021, published in the State Information compendium on Feb. 14, 2022, and came into force on Feb. 24, 2022. FIU-Mongolia materials also state that implementation work included eight draft regulations and amendments approved in April and May 2022 to support registration, operation, and risk-based supervision of VASPs. Article 17 created a transitional period: the FRC could not register any company as a VASP for the first four months after entry into force, and persons already providing virtual asset services before the effective date had to register within three months after that four-month period, subject to meeting statutory requirements.