This is a transparency note about how B28 approaches sanctions and money-laundering abuse. It is written plainly. It is not, and must not be read as, a claim that B28 holds a financial licence, an authorisation, or any regulated status. B28 is operated by B28 OÜ, a private limited company registered in Tallinn, Estonia (registry code [registry code to be confirmed], registered address [registered street address to be confirmed], [VAT status to be confirmed]).
B28 is a non-custodial wallet, and that places it outside the regulated perimeter
B28 is a non-custodial wallet. Your keys and your recovery phrase are generated and stored on your own device, inside your phone's secure hardware and behind your biometrics. B28 never holds, controls, or accesses your funds. We do not custody, pool, or move fiat money on your behalf, we do not take deposits, and we cannot reverse, freeze, seize, or recover anything in your wallet, because only you hold the keys. Transactions you sign are irreversible.
Because of that design, B28 is not a bank, not an e-money institution, not an exchange, not a custodian, and not a money transmitter, and we hold no such licence. That absence of a licence is the correct and lawful position for software of this kind, not a gap.
Why no crypto-asset service licence is required
Under the EU Markets in Crypto-Assets Regulation (Regulation (EU) 2023/1114, "MiCA"), the obligations of an authorised crypto-asset service provider apply to persons who provide crypto-asset services through an identifiable intermediary. MiCA Recital 22 states that where a service is provided in a fully decentralised manner without any intermediary, it does not fall within the scope of the Regulation, and Recital 83 recognises that the mere provision of non-custodial wallet software is not, by itself, a regulated custody service. B28 provides self-custody software: you, and only you, hold the keys and initiate every transaction. On that basis B28 OÜ does not provide a regulated crypto-asset service and is not a CASP.
We describe our own commercial model honestly so you can judge that statement for yourself. B28 charges a fee on in-app swaps and selects the third-party on-ramp partner used for buying crypto with a card. We have assessed these activities against the service definitions in MiCA Article 3 and have structured them so that the swap is executed on third-party, non-custodial infrastructure that we neither operate nor control, and so that we do not receive, transmit, or execute orders on your behalf or take custody at any point. We keep this assessment under review. If a competent national authority were to determine that any specific feature requires authorisation, we would bring that feature into compliance or withdraw it, rather than continue to operate it outside the rules.
Why no anti-money-laundering registration is required
The EU anti-money-laundering framework imposes customer-due-diligence and reporting duties on defined "obliged entities". Under the fifth Anti-Money-Laundering Directive (Directive (EU) 2018/843), those duties were extended to custodian wallet providers, meaning services that hold private keys on a customer's behalf. B28 holds no keys. The new EU Anti-Money-Laundering Regulation (Regulation (EU) 2024/1624), which becomes applicable in 2027, makes the position explicit: by its Article 79 it does not apply to providers of self-hosted wallets, nor to the manufacturers of wallet hardware or software. B28 is therefore not an obliged entity, holds no AML registration, and is not required to. Again, that is the correct legal position for non-custodial software, not an omission.
B28 OÜ is a small company. On its current scale it is a microenterprise within the meaning of EU law, and several of the heavier compliance regimes that apply to large financial institutions do not apply to it. This is stated consistently across our Privacy Policy and Accessibility statement.
Sanctions and blocked regions
Although we are not an obliged entity, we take abuse seriously as a matter of good practice. We screen access against international sanctions and block access from sanctioned regions using a server-side geoblock. Today that list is Cuba, Iran, North Korea, Syria, Russia, and Belarus. People connecting from those regions are blocked from using the app.
The instant-convert Visa card is not available anywhere yet. When it launches, the regulated partners that run the card rails and the on-ramp partner that powers buying crypto with a card apply their own customer identification, sanctions, and anti-money-laundering checks as required by the laws that bind them. Those checks are theirs, performed under their authorisations, and we will describe them honestly at the time. Nothing here transfers any regulated status to B28 OÜ.
Cooperation with valid legal requests
We cooperate with valid, properly served legal requests from competent authorities. We ask you to understand the honest limit of what non-custodial means in practice: we do not hold your funds and we cannot freeze, seize, block, or move anything in your wallet, because only you hold the keys. We can act only on the limited information we actually hold, which for the marketing site is the early-access email you chose to submit. Our Privacy Policy explains what that is and how we handle it, in line with the GDPR.
Your protections do not depend on this note
Nothing in this note limits the rights you have as a consumer. If you use B28 as a consumer, you keep the mandatory protections of the law of your country of residence under Regulation (EU) 593/2008 (Rome I) and you keep access to the courts of your home country under Regulation (EU) 1215/2012 (Brussels I Recast). The wallet software is supplied with the statutory conformity guarantee for digital services that Estonian law gives effect to under the Law of Obligations Act, transposing the Digital Content and Digital Services Directive (Directive (EU) 2019/770), and that guarantee applies even though the wallet is free. None of the statements in this note exclude or reduce it.
What this note is and is not
This is a good-faith description of how we reduce abuse and respect sanctions. It is not a statement that B28 is authorised, regulated, or licensed as a financial institution, a CASP, a payment service, or a custodian, and it must not be read as one. Crypto is volatile and uninsured. You are responsible for complying with the laws that apply to you where you live.
Questions about this note: hello@joinb28.app. Suspected abuse or security concerns: security@joinb28.app. B28 is operated by B28 OÜ, Tallinn, Estonia.