How Sanctuary operates within applicable regulatory frameworks
Cette traduction est fournie à titre informatif uniquement. En cas de divergence entre cette traduction et la version anglaise, la version anglaise prévaut. La version anglaise constitue le document juridiquement contraignant.
Sanctuary provides blockchain analytics software (AML Intelligence). We operate as a technology provider — we do not custody, transmit, or exchange digital assets on behalf of users and therefore do not qualify as a Money Services Business (MSB) or Virtual Asset Service Provider (VASP) under applicable regulations.
Our position is analogous to credit rating agencies: Moody's does not need a banking license to issue credit ratings. Similarly, Sanctuary does not need a VASP license to provide blockchain risk scores.
Legal basis: FATF Updated Guidance (2021) para. 55–58, MiCA Recital 22, CIMA VASP Guidance (2024).
Regulation (EU) 2023/1114 (Markets in Crypto-Assets) requires CASP authorization for providing crypto-asset services in the EU. The transitional period for existing providers ends July 1, 2026.
Sanctuary provides analytics software — not crypto-asset services as defined in MiCA Article 3(1)(16). Analytics and compliance tool providers are not classified as CASPs and do not require CASP authorization.
ESMA interprets reverse solicitation strictly: promotional campaigns, affiliate marketing, disclaimers, or pre-completed templates do not override the factual nature of client initiation.
The FATF Targeted Update (June 2025) reports that 29% of 138 assessed jurisdictions are largely compliant with Recommendation 15 (Virtual Assets/VASPs). Sanctuary aligns with FATF standards through:
Our Terms of Service are governed by English law (Laws of England and Wales) with dispute resolution via LCIA arbitration. This is standard for international B2B technology companies operating in a neutral jurisdiction.
Sanctuary implements privacy by design:
Sanctuary services are not available to users located in jurisdictions subject to comprehensive sanctions programs. Currently restricted:
EU and UK users: see Terms of Service §7 for reverse solicitation and registration provisions.
Our customers — compliance officers, exchanges, and merchants — use Sanctuary data as one input into their own compliance decisions. The final determination is always made by the qualified professional, not our software.
When presented with valid legal requests (court orders, subpoenas) from competent authorities, Sanctuary cooperates within applicable law. We notify affected users unless prohibited by the legal instrument. Due to the Blind Protocol, the data available for disclosure (from AML Intelligence) is limited to hashed identifiers, not raw wallet addresses.
Current security measures include:
SOC 2 Type II certification is on the roadmap as the platform scales. For vendor security assessments, we provide completed security questionnaires and architecture documentation upon request for Enterprise tier customers.
For compliance inquiries: [email protected]