A Bitcoiner who has spent real time reading exchange terms of service, custodian license disclosures, or a broker's regulatory filings develops one specific, useful instinct: the ability to tell a regulator with an actual paper trail from one that was invented last year for a press release. Citizenship-by-investment marketing rarely rewards that instinct. Most programs name their regulator once, in a footnote, and move straight to the passport photo. Vanuatu's file does not need that treatment, because the institution behind it is not new and was not built to order. The Vanuatu Financial Services Commission has supervised the country's offshore and international financial sector since 1993, a generation before the Development Support Programme existed as a citizenship route at all. That sequencing is the whole argument in miniature: the DSP was built on top of an already-functioning supervisory apparatus, not stood up alongside one invented to match it. What follows is that apparatus on its own terms: what it licenses, how it connects to a citizenship file, what it has weathered, and the honest limits of what its record actually proves.
A regulator, not a program
The Vanuatu Financial Services Commission was created by the Vanuatu Financial Services Commission Act No. 35 of 1993, brought into force in December of that year. It did not appear in a vacuum. Company registration and financial-sector oversight in the territory trace back further, to a Registrar of Companies and Official Receivership Department that operated under the British administration of the Anglo-French Condominium from 1971, the point most serious histories of the jurisdiction's offshore sector treat as its genuine institutional origin. The 1993 Act consolidated that older function into a single statutory commission, and it did so in the same year Parliament passed the International Companies Act, now cited as Cap. 222, the law that made the Vanuatu International Business Company tax-exempt. cbi.vu's Journal has already covered the IBC itself, and how it actually fits a Bitcoiner's structure, in an earlier piece on banking a Vanuatu passport; this piece is not that piece and will not repeat it. What matters here is narrower: the VFSC and the tax-exempt IBC framework share a birth year, 1993, because they are two halves of one legislative package, a regulator and the structure it was built to supervise, arriving together rather than a structure arriving first and a regulator catching up to it years later.
Four decades, counted honestly
A title that commits to a round number, four decades, should not get to cheat the arithmetic a body paragraph would be held to. No single year makes "four decades" fall out cleanly, and this piece would rather say so than force it. The sector's deepest roots, the 1971 Registrar of Companies and Official Receivership Department, are 55 years old by 2026, over five decades, not four. The VFSC itself, and the modern tax-exempt IBC framework it supervises, turns 33 this year, since 1993, just over three decades, also not four. The anchor that actually lands close to the round number is Vanuatu's independence in 1980, 46 years by 2026, over four decades since the country became a sovereign state and began setting its own financial-sector policy rather than administering someone else's. That is the honest reading this piece uses: an offshore finance tradition with roots reaching back over five decades to 1971, formalized into the regulator and framework Vanuatu runs today just over three decades ago in 1993, the whole arc unfolding across the more than four decades since the country itself became sovereign in 1980. Three numbers, three different questions, and none of them should be flattened into the others for the sake of a cleaner headline.
What the VFSC actually licenses
A regulator's credibility rests on what it actually does, not on what it is called, so it is worth walking through the VFSC's own published legislation plainly rather than gesturing at it vaguely. The Commission administers the International Companies Act, Cap. 222, the tax-exempt IBC framework; the domestic Companies Act No. 25 of 2012; the Business Names Act, Cap. 211; the Partnership Act, Cap. 92; the Mutual Funds Act No. 38 of 2005 and the Unit Trusts Act No. 36 of 2005; the Foundation Act No. 38 of 2009; the Offshore Limited Partnerships Act No. 39 of 2009; two more specialized company-vehicle statutes, the Protected Cells Companies Act No. 37 of 2005 and the Incorporated Cell Companies Act No. 25 of 2009; the Company and Trust Services Providers Act No. 8 of 2010, which licenses the professional firms administering these structures; the Financial Dealers Licensing Act, Cap. 70, covering foreign-exchange and CFD brokers; and, cutting across all of it, the Anti-Money Laundering and Counter-Terrorism Financing Act No. 13 of 2014. One distinction is worth making with precision, because CBI commentary sometimes blurs it: the four retail banks operating in Vanuatu today answer to the Reserve Bank of Vanuatu, not the VFSC. The VFSC's own banking-related statutes, the Financial Institutions Act No. 2 of 1999 and the International Banking Act No. 4 of 2002, license a separate category, offshore and international banking licenses, not the everyday retail accounts a resident actually uses. Two regulators, two different banking questions, and conflating them is the kind of error a due-diligence officer notices immediately.
A second distinction belongs alongside it. The Vanuatu Financial Intelligence Unit, the body that runs the source-of-funds screening on a DSP application, is not the VFSC either. It is a separate institution with a narrower, cross-cutting anti-money-laundering mandate, feeding intelligence to law enforcement and regulators rather than licensing companies itself. A citizenship file therefore sits under two distinct pieces of Vanuatu's financial-sector architecture, one that screens the applicant and one that supervises the corporate and financial infrastructure the applicant may go on to use, and neither should be described as though it were the other.
An active file, not a rubber stamp
None of that licensing list would mean much if the VFSC only issued licenses once and never revisited them. It does revisit them. In 2025, the Commission enacted the Virtual Asset Service Providers Act No. 3 of 2025 and published a dedicated Risk Assessment for Virtual Assets, giving Vanuatu an actual statutory licensing regime for crypto-asset businesses rather than a policy vacuum, a detail directly relevant to a Bitcoin-focused reader weighing whether the jurisdiction takes the asset class seriously or simply tolerates it. In 2026, the VFSC achieved Associate Membership of the International Organization of Securities Commissions, IOSCO, after a multi-year application process, recognition from a body of securities regulators rather than a credential handed out on request. On the enforcement side, the record through 2025 and into 2026 shows the VFSC actively revoking Financial Dealers Licenses from multiple foreign-exchange and CFD brokers and issuing public warnings against operators presenting themselves as licensed when they were not, the ordinary, unglamorous work of a regulator that checks its own registry rather than trusting it to stay accurate on its own. It also tightened beneficial-ownership disclosure requirements for international companies in 2025.
Who currently holds the Commissioner's office is a fact this piece treats with the same caution cbi.vu applies to any fast-turnover personnel detail elsewhere on the site: rather than print a name pulled from press coverage and risk it going stale before a reader checks it, this piece describes the office itself, a Commissioner and board structure set out in the founding Act, and leaves the current officeholder to the VFSC's own public notices, the correct source for it, not a Journal post. None of the activity above is dramatic, and none of it should be sold as dramatic. It is what an active regulator's paper trail actually looks like: routine, dated, and independently verifiable, the opposite of a name invented for a slide.
The record is not spotless
A regulator with three decades of paper trail is not the same claim as a regulator with a spotless one, and this piece does not make the second claim. Vanuatu's financial sector has been examined unfavorably by international bodies more than once, and the honest version names the episodes rather than skipping past them. Around 2000, two separate reviews landed in the same window, run by two different bodies, with two different outcomes worth keeping apart. The Financial Action Task Force reviewed Vanuatu in 2000 under its Non-Cooperative Countries and Territories initiative; the review was not complete at the June 2000 plenary, and by the October 2000 plenary Vanuatu had not been named among the jurisdictions FATF actually listed as non-cooperative, a group of fifteen that included the Bahamas, the Cayman Islands, and Panama. Separately, the OECD named Vanuatu in June 2000 as one of 35 jurisdictions meeting its tax-haven criteria under the Harmful Tax Practices initiative; Vanuatu initially declined to commit to that initiative and was escalated in April 2002 to the OECD's list of uncooperative tax havens, before making the commitment the OECD required and being removed from that list by 2003.
A later, unrelated episode is a different story again: a 2015 referral and a formal FATF grey-listing in February 2016, resolved when FATF delisted Vanuatu in June 2018, a matter already covered on this site rather than repeated here. The European Union, separately again, currently keeps Vanuatu on its own high-risk third-country anti-money-laundering list, most recently reconfirmed in December 2025. That current dispute has its own shape and its own arguments, and this piece leaves it for its own telling elsewhere in the Journal rather than folding it into a different regulator's decades-old history.
A citizenship program can be invented for a press release. A regulator with three decades of dated, checkable licensing and enforcement history cannot be, and that difference is the entire argument.
Why continuity outranks a program's own marketing
Put the pieces next to each other and the case is not that Vanuatu's regulator is flawless. It is narrower and more useful than flawless: it is old, it is specific about what it licenses, it has been examined by outside bodies more than once, and it keeps producing a dated record a due-diligence officer can actually check against primary sources rather than a program's own website. That is a different kind of institution than a citizenship scheme invented for a press release and supervised by whatever ministry happens to answer the phone that year. A DSP file does not ask the VFSC to build compliance capacity from scratch to accommodate it. It inherits three decades of licensing infrastructure, anti-money-laundering statute, and enforcement habit that already existed before the first DSP application was ever filed, sitting underneath the VFIU's own applicant-level screening rather than replacing it. A reader who wants to see how that supervisory floor compares across jurisdictions, rather than take this piece's word for it, has a natural next stop in 21cbi.io's Bitcoin Passport Index at bpi.21cbi.io, a ranking of jurisdictions on Bitcoin-relevant regulatory, tax, and mobility criteria. This piece will not print a number here; the index is the place to actually see one.
None of this is a claim that Vanuatu's file is risk-free, or that the VFSC's record settles every question a bank's compliance desk will ask about a specific applicant. It settles a narrower, prior question: whether the supervisory layer underneath the passport is real, dated, and independently checkable, or whether it is a name attached to a program for the sale. On that narrower question, the record is public, and a reader does not have to take cbi.vu's word for it. For the personal-banking side of what happens after the file closes, the vatu, the four banks, the IBC's own limits, see this Journal's earlier piece on banking a Vanuatu passport. For the advisory conversation itself, 21cbi.io is where the statutes and the supervisory record above turn into a specific file.
Sources & Authorities- Vanuatu Financial Services Commission Act No. 35 of 1993
- Established the VFSC, brought into force in December 1993.
- International Companies Act, Cap. 222 (1993)
- Same-year legislation creating the tax-exempt Vanuatu International Business Company framework the VFSC supervises.
- 1971 Registrar of Companies and Official Receivership Department
- The pre-VFSC institutional root of Vanuatu's offshore sector, under the British administration of the Anglo-French Condominium.
- FATF (2000) and OECD Harmful Tax Practices initiative (2000–2003)
- The honest historical scrutiny record: FATF reviewed but did not list Vanuatu as non-cooperative in 2000; the OECD named Vanuatu a tax haven the same year, escalated it in 2002, then removed it in 2003 after Vanuatu committed to the initiative. Distinct from the later 2015–2016 FATF grey-listing, delisted June 2018, and from the EU's current high-risk list, reconfirmed December 2025.
- Virtual Asset Service Providers Act No. 3 of 2025
- The VFSC's statutory licensing regime for crypto-asset businesses, with an accompanying Risk Assessment for Virtual Assets published in 2025.
- VFSC legislation register (vfsc.vu)
- The Commission's own published list of the statutes it administers, the basis for the licensing scope described above.
Adam Juchniewicz, CEO, 21 CBI
Port Vila · July 2026