# Taiwan

> Taiwan (Financial Supervisory Commission): The travel rule that has never come into force. Region: Asia-Pacific. Regime still forming: No settled rule on confidentiality yet; the framework is in draft or newly in force.

Part of the Soda Labs Privacy Hub regulation map, which reads the instruments
themselves rather than summarising the summaries: https://www.sodalabs.xyz/privacy-hub/regulation

## Key facts

- Entry type: Jurisdiction
- Region: Asia-Pacific
- Subject: The travel rule that has never come into force
- Authority: Financial Supervisory Commission
- Stance on on-chain confidentiality: Regime still forming. No settled rule on confidentiality yet; the framework is in draft or newly in force.
- Tags: VASP Act 2026, travel rule deferred, no coin blacklist, commonly misreported
- Canonical page: https://www.sodalabs.xyz/privacy-hub/regulation/jur-taiwan

## What it actually says

Two things commonly reported about Taiwan are wrong. The VASP Act is not pending; it passed its third reading on 30 June 2026, though commencement still has to be designated and licensing runs on a 21-month tail after that. And the travel rule, often described as operative with an NT$30,000 threshold, has never been in force at all. The provision has carried a deferred effective date since 2021, and the regulator confirmed in writing in August 2026 that it has still not been implemented, setting out a phased plan starting with domestic transfers in October 2026. There is no named privacy-coin prohibition. For now Taiwan is the outlier: a registration regime in force, and the transfer-identity machinery still switched off.

## The instruments that matter

- **VASP Act passed third reading 30 June 2026, promulgated 22 July 2026**: 56 articles defining seven service categories and requiring central bank consent plus FSC permission for stablecoin issuance; commencement is delegated to the Executive Yuan and has not been set, after which firms have 12 months to apply and 21 to be licensed
- **Travel rule not implemented**: the FSC confirmed in writing on 4 August 2026 that the mechanism has to date not been implemented, five years after the provision was made
- **Phased plan announced**: domestic VASP-to-VASP from October 2026, cross-border from end-2027, applying to transfers of any value with NT$30,000 as an enhanced-data trigger
- **Mandatory registration from 30 November 2024**: under the Money Laundering Control Act; nine firms had registered as at 22 September 2025
- **No functioning data protection authority**: Constitutional Court judgment 111-憲判-13 of 12 August 2022 gave three years to build an independent supervisory mechanism; that deadline lapsed unmet in August 2025
- **PDPA Article 1-1 has never commenced**: it designates a Personal Data Protection Commission as competent authority, but the Executive Yuan has not set a commencement date and the body remains a preparatory office

## Sources

- [Financial Supervisory Commission](https://www.fsc.gov.tw/ch/home.jsp?id=96&parentpath=0,2)
- [Money Laundering Control Act](https://law.moj.gov.tw/ENG/LawClass/LawAll.aspx?pcode=G0380131)

## Related entries

- [Thailand](https://www.sodalabs.xyz/privacy-hub/regulation/jur-thailand): Closed by whitelist, not by prohibition
- [Australia](https://www.sodalabs.xyz/privacy-hub/regulation/jur-australia): Travel rule without a threshold, no coin ban
- [Hong Kong SAR](https://www.sodalabs.xyz/privacy-hub/regulation/jur-hong-kong): Retail exclusion by liquidity gate, not by anonymity rule
- [India](https://www.sodalabs.xyz/privacy-hub/regulation/jur-india): No crypto statute, regulated through AML and tax
- [Japan](https://www.sodalabs.xyz/privacy-hub/regulation/jur-japan): Untraceability barred by self-regulation, now moving into ordinance
- [Singapore](https://www.sodalabs.xyz/privacy-hub/regulation/jur-singapore): Regulates anonymity by risk assessment, not prohibition