Summary
- Selling software is not a Regulated Activity. The risk is that the product amounts to "Arranging Deals in Investments" (Financial Services Act 2025, Sch. 1, para. 16), "Operating a Multilateral Trading Facility" (para. 54), "Providing Custody" (para. 43) or "Managing Assets" (para. 56).
- Four exclusions carry most of the weight: arrangements that do not bring about the deal (para. 17), merely enabling parties to communicate (para. 18), order routing where orders do not interact (para. 55), and the supplier-of-services exclusion (para. 76).
- Para. 81 (provision of information on an incidental basis) is narrower than its title: it applies to insurance-related arrangements and to insurance intermediation, not to general market data.
- The General Prohibition (s. 16) only bites on activity carried on "by way of business" in GMC (Sch. 1, Part 1, para. 3). A vendor located in GMC is "in GMC" regardless of where its clients sit.
- Worked example: an institutional execution platform whose clients connect to venues with their own credentials, and which never holds assets, has a strong case for sitting outside the perimeter. Change those facts and the answer changes.
Why this question matters for software companies in GMC
The Gelephu Mindfulness City Authority lists "Finance and Digital Assets" among its eight priority industries, and the Gelephu Financial Services Office (GFSO) regulates financial services and virtual asset activities under one statute. That attracts not only exchanges and custodians but their vendors: execution management systems, smart order routers, pre-trade risk and compliance tooling, post-trade reconciliation and market-data feeds. If your software touches an order, a price or a wallet, are you carrying on a Regulated Activity? The answer lies in reading the activity definitions in Schedule 1 to the Financial Services Act 2025 against the exclusions in the same Schedule. "$" means United States dollars (Companies Act 2025, s. 4A).
The framework in three sentences
An activity is a Regulated Activity if Schedule 1 specifies it (s. 19). No person may carry on a Regulated Activity "by way of business in GMC" unless it is a Licensed Firm (a holder of a Financial Services Licence from GFSO) or an Exempt Firm (Schedule 3) (s. 16(1)). Each specified activity is subject to the exclusions attached to it, including the general exclusions in Chapter 18 (Sch. 1, para. 2(3)).
"By way of business" has three alternative limbs (Sch. 1, Part 1, para. 3): engaging in the activity in a manner which in itself constitutes carrying on a business, holding oneself out as willing and able to engage in it, or regularly soliciting others to engage in transactions constituting it. A software company that markets a product which does one of the specified things is holding itself out. The business test rarely saves a vendor; the exclusions do.
The five activities a software vendor must test against
Arranging Deals in Investments (para. 16)
This is the activity that catches most infrastructure. Para. 16(1) covers "making arrangements with a view to another person (whether as principal or agent) Buying or Selling a Specified Investment, Virtual Asset or Spot Commodity"; para. 16(2) covers arrangements with a view to a person "who participates in the arrangements" buying or selling. The words "with a view to" are wide, and an execution platform exists so that its users can buy and sell. The exclusions therefore decide the outcome:
- Para. 17, arrangements not causing a deal. Excluded are "arrangements which do not or would not bring about the transaction to which the arrangements relate". Software that helps a user decide, check or record, but leaves the transaction to be brought about by the user's own instruction to a venue, has a strong para. 17 argument. Software that itself submits the order and returns the fill is harder to fit within it.
- Para. 18, enabling parties to communicate. A person does not arrange "merely by providing means by which one party to a transaction (or potential transaction) is able to communicate with other such parties". A connectivity layer or messaging gateway between a client and a venue is the paradigm case.
- Para. 19, arrangements amounting to an MTF or OTF. These are excluded from para. 16 only because they are regulated under para. 54 instead. A vendor cannot escape by saying its matching engine is "just arranging".
- Para. 76, sale of goods and supply of services. Under para. 76(5), arrangements made by a "supplier" for a transaction entered into by a "Customer" in connection with the supply of services are excluded. A "supplier" is a person "whose main business is to Sell goods or supply services and not to carry on" the listed regulated activities (para. 76(1)); a "Customer" here is a person other than an individual. A software house licensing software to institutions is a supplier and its users are Customers. The exclusion does not extend to contracts of insurance or fund units (para. 76(10)), and it does not help a vendor whose main business is in substance arranging.
- Para. 75, profession or non-investment business. Excluded is activity carried on "in the course of carrying on any profession or business which does not otherwise consist of the carrying on of Regulated Activities" and which "may reasonably be regarded as a necessary part of other services", provided it is not remunerated separately (para. 75(2)). A flat software subscription satisfies the remuneration limb; a per-trade fee tied to executed volume invites the argument that the arranging is being paid for separately.
Operating a Multilateral Trading Facility (para. 54) and the order-routing exclusion (para. 55)
Para. 54(1)(a) covers "the operation of a Multilateral Trading Facility on which Financial Instruments, Virtual Assets or Spot Commodities are traded". An MTF brings together "multiple third-party Buying and Selling interests ... in accordance with non-discretionary rules, in a way that results in a contract". Para. 55(1)(a) then excludes a facility that "is merely an order routing system where Buying and Selling interests in, or orders for, Financial Instruments, Virtual Assets or Spot Commodities are merely transmitted but do not interact".
The test is whether orders interact. A smart order router that receives one client's order, splits it, and sends the children to external venues where they are matched against third parties is transmitting, not matching. A system that nets two clients' opposite orders internally before sending the residual out has made those orders interact and has crossed into para. 54 territory.
Providing Custody (para. 43)
Custody is "safeguarding of Financial Instruments, Virtual Assets or Spot Commodities belonging to another" and administering them for that purpose (para. 43(1)). A vendor that never holds client assets, keys or venue balances is outside para. 43, and para. 44 confirms that providing information as to the value of assets in custody does not constitute administration. Wallet software where the user alone holds the keys is not custody by the vendor; a vendor holding API keys with withdrawal permissions, or co-signing a multisig over client funds, should assume it is.
Managing Assets (para. 56)
Managing Assets is managing "on a discretionary basis assets belonging to another person". Algorithmic execution engines sit close to this line. If the client sets the strategy, parameters and limits and can intervene, the discretion is the client's. If the vendor's staff choose when and what to trade for the client's account, the vendor is managing. The client agreement should make the allocation of discretion explicit.
Advising on Investments (para. 28)
Advising covers advice "on the merits" of buying or selling a particular Specified Investment or Virtual Asset (para. 28(1)(a)). Pre-trade compliance tooling that flags a breach of a client's own limits, or a screen that shows prices and analytics, does not advise on merits. Signals framed as recommendations to buy a specific asset may.
Market-data and benchmark providers
Distributing prices, volumes and reference data is not in itself dealing, arranging or advising. The one specified activity aimed at data is para. 68: "Providing Information in Relation to a Specified Benchmark" and "Administering a Specified Benchmark". It does not capture every index a vendor publishes, and para. 69 excludes information that "consists solely of factual data obtained from a publicly available source" and information compiled by a subscription service for purposes other than determining a Specified Benchmark. A vendor asked to contribute to or calculate a designated benchmark should revisit the analysis then.
A note on para. 81, "Provision of information on an incidental basis". Its title suggests a general safe harbour for information services; its text does not. It excludes arranging, custody, managing and insurance intermediation only where the activity relates to a contract of insurance and consists of providing information to a policyholder in the course of a non-regulated business (para. 81(1)–(4)). A crypto data vendor should not rely on it.
Worked example: an institutional execution and compliance platform
The facts, anonymised and generic. A GMC company licenses a trading-technology platform to hedge funds, proprietary trading firms and exchanges: order and execution management, a smart order router, pre-trade risk and compliance checks against the client's own rulebook, and post-trade reconciliation. Clients connect to venues using their own accounts and API credentials. The platform never holds client assets or withdrawal-enabled keys, never nets orders between clients, never takes the other side of a trade, offers no recommendations, and is paid a fixed subscription plus implementation fees.
Applying the Schedule:
| Function | Activity in question | Result |
|---|---|---|
| Order and execution management | Para. 16 arranging | Para. 76(5): supplier of services to non-individual Customers; para. 75: necessary part of a software business, not separately remunerated |
| Smart order router | Para. 54 MTF / para. 16 | Para. 55: orders transmitted to external venues and do not interact within the platform |
| Venue connectivity via client credentials | Para. 16 | Para. 18: means by which the client communicates with the venue |
| Pre-trade compliance checks | Para. 28 advising | Not advice on merits; applies the client's own limits |
| Post-trade reconciliation and reporting | Para. 43 custody | No safeguarding; para. 44 confirms information about balances is not administration |
| Fixed subscription fee | Para. 3 business test and para. 75(2) | No separate remuneration for any arranging element |
On those facts the platform has a strong case that it carries on no Regulated Activity. Because the analysis rests on exclusions and construction, the company should record it in a perimeter memorandum and, since GFSO's published process starts with an initial meeting to present the business model, consider confirming the position with GFSO before launch.
The analysis changes when the facts change. A per-trade fee on executed notional puts para. 75(2) in issue. An internal crossing engine loses para. 55. Client API keys with withdrawal rights engage para. 43. A managed strategy run by the vendor's desk engages para. 56. "Buy" signals on named tokens engage para. 28. Each step turns a software company into a candidate for licensing.
Territorial scope and the non-GMC vendor
Section 16 prohibits Regulated Activities carried on "in GMC". A vendor operating in GMC is in GMC whatever the location of its clients. A vendor outside GMC serving GMC clients looks to the Non-GMC Person exclusions (paras. 71 and 79), which protect arranging and agreeing to arrange where the transaction is with or through a Licensed Firm or results from a "legitimate approach" not solicited by the vendor in any way (para. 79(7)). Marketing into GMC engages the Financial Promotion Restriction (s. 18), which reaches communications from outside GMC "capable of having an effect in GMC" (s. 18(3)).
Conduct rules that apply even to unregulated vendors
Section 19A prohibits conduct "in or from the GMC" in relation to a Virtual Asset, Specified Investment or Regulated Activity that is misleading, deceptive, fraudulent or dishonest, and Part 9 prohibits misleading statements (s. 102) and misleading impressions as to the market in or price of Financial Instruments or Accepted Virtual Assets (s. 103). A data vendor that publishes fabricated volumes, or an execution vendor whose marketing overstates venue coverage, is within reach of these sections whatever its licensing status. An unlicensed vendor must also not imply that it is regulated by GFSO; GEN Rulebook 4.4.1 prescribes the status disclosure that only a Licensed Firm may make.
Tax and corporate footnotes
A GMC software company pays 15% on chargeable income (Income Tax Act 2025, s. 43(1)(a)); individuals who are not Bhutanese citizens pay 0% on income derived on or before 31 December 2030 (s. 43(1)(ba)); computers attract a 100% allowance by election (s. 19A(2)). The company needs a director ordinarily resident in GMC (Companies Act 2025, s. 145(1)).
Practical checklist / Next steps
- Map the product: for each feature, who initiates, who transmits, who matches, who holds, who decides.
- Test each feature against paras. 16, 28, 43, 54 and 56, then apply paras. 17, 18, 44, 55, 75 and 76.
- Prefer a fixed subscription to execution-linked fees if you want para. 75(2).
- Keep venue credentials and keys with the client; never hold withdrawal rights; put the allocation of discretion in the client agreement.
- Record the analysis, present the model to GFSO at the initial meeting, and refresh the memorandum whenever a feature changes.
Frequently asked questions
Does a crypto trading-software company in GMC need a GFSO licence?
No licence is needed for supplying software as such. It needs one if a feature amounts to arranging (para. 16), operating a trading facility (para. 54), custody (para. 43), managing assets (para. 56) or advising (para. 28) by way of business, and no exclusion applies. Paras. 17, 18, 55, 75 and 76 are the exclusions to build around.
Is a smart order router an MTF?
No, where it "merely" transmits orders to external venues and those orders "do not interact" within the router (para. 55). It becomes an MTF if it matches or nets client orders against each other under non-discretionary rules.
Does providing market data require a licence?
Not unless the data is provided in relation to a designated Specified Benchmark (para. 68), and even then para. 69 excludes purely factual public data and subscription services compiled for other purposes. Do not rely on para. 81, which is confined to insurance-related information.
Key takeaways
- Software is not a Regulated Activity; the features it performs may be. Test each against paras. 16, 28, 43, 54 and 56.
- Paras. 17, 18, 55 and 76 are the vendor's exclusions. Para. 81 is not.
- Never hold keys or credentials with withdrawal rights, never match client orders internally, and keep discretion with the client.
- Fee design matters: execution-linked fees can defeat para. 75(2).
- Sections 19A and 102–103 apply to every vendor, licensed or not.
This article is general information about the law of the Gelephu Mindfulness City Special Administrative Region as at the date above. It is not legal advice and does not create a lawyer–client relationship.
You may contact Basnet Law at basnet@basnetgmc.com or office@basnetgmc.com for any legal queries related to GMC.
References
- Financial Services Act 2025, ss. 16, 18, 19, 19A, 102, 103; Schedule 1, Part 1, paras. 2(3), 3; Part 2, paras. 16, 17, 18, 19, 28, 43, 44, 54, 55, 56, 68, 69, 71, 75, 76, 79, 81; Schedule 3
- GEN Rulebook 2026, Rule 4.4.1
- Income Tax Act 2025, ss. 19A, 43(1)(a), 43(1)(ba)
- Companies Act 2025, ss. 4A, 145
