Regulatory responsibility remains with the licensee
Outsourcing customer screening or blockchain analytics does not by itself discharge the licensee's responsibilities under the Virtual Assets Act, 2026 and the notified Services Regulations. The activity delegated and its materiality must be evaluated.
What must be assessed?
Regulations 37 to 43 address outsourcing classification, documented risk assessments, policy, registers, contracts, oversight, subcontracting and regulatory notifications. The operator should consider disruption of screening, unauthorised access, poor data quality, service-provider failures and access to information needed for supervision.
Contractual protections
The service agreement should explain functions, service levels, reporting, incident notification, audit or assurance, data handling, continuity and exit assistance as applicable. The outsourcing provider may undertake contractual duties, but the VASP needs its own accountable control owners.
The Travel Rule and customer records
Regulation 100 addresses Travel Rule obligations; the licensed firm must be able to show that originator and beneficiary information is handled as legally required. A vendor's assurance of technical compliance is not a substitute for checking the firm's actual transaction flows and customer files.
Evidence for a supervisory response
Retain board approvals, the provider's due-diligence file, documented risk assessment, current outsourcing agreement, testing records, exception reports and an escalation log. If a material outage occurs, assess reporting obligations promptly and preserve the incident chronology.
Practical conclusion
Outsourcing is a means of performing a regulated function, not transferring the underlying regulatory licence. A VASP should retain effective oversight and demonstrable control over the outsourced work.
For more detailed analysis, see PVARA Compliance and Digital Asset Investigations: AML, Travel Rule, Outsourcing and Records.