Monflo’s Chhay Lin Lim: an anarchist with a MiCA licence

I asked a man whose crypto firm is licensed by the Dutch regulator what he makes of a state that says it surveils you to protect you. He answered in two words, then said them again. Chhay Lin Lim founded Monflo, an Apeldoorn company whose IBAN account turns the euros you send it into a euro stablecoin. He calls himself a hardcore crypto anarchist. He also sat in front of the AFM last year, made his case, and received a MiCA licence in December. Both things are true at once, and this interview is about how.

The full conversation runs sixteen minutes.

Two words for the surveillance state

I had put the same question to Aaron Day and to Casey Ford earlier in the day. In every surveillance state the line is the same: I need to watch you to keep you safe. Lim did not pause.

I think it’s nonsense. I really think it’s nonsense. I don’t need protection from the state as much as they say that they give me protection. I think in a lot of ways they’re actually hurting me

Chhay Lin Lim, Founder, Monflo

He is not saying that as an activist with nothing to lose. Monflo is a licensed crypto-asset service provider supervised by the AFM, with De Nederlandsche Bank looking at its prudential side, and the hurt he means is the cost of getting there.

if I’m trying to run a business, a crypto business in the Netherlands, you need to go through so many hurdles just to open a business, just to be able to operate a business. You’re not protecting me. You’re not even protecting the people who want to use Monflo

Chhay Lin Lim

The hurdles are real and they are dated. MiCA authorisation ate most of 2025 for the Dutch firms that applied; Monflo’s arrived on 4 December, and by the start of this month the trackers that mirror ESMA’s register counted roughly 330 authorised providers across the whole EEA. The next hurdle has a date too. Article 79 of the EU’s anti-money-laundering regulation bans accounts in anonymity coins at crypto service providers from 10 July 2027. Recital 160 of the same regulation puts providers of hardware and software wallets that have no access to or control over the assets outside that prohibition. A licensed account provider that holds the keys sits inside it, which is exactly what Lim built. When he says the state is not protecting the people who want to use Monflo, the people he means are the ones that rule is about to reach.

An anarchist with a licence

The obvious question is how a man who describes himself on camera as “a hardcore cypherpunk, hardcore crypto anarchist” ends up filing for a licence. His answer is that the licence is the tactic, and the politics have not moved.

But I also understand that you need to operate in a way that’s legally if you want to be able to grow. So our strategy is we’re never doing anything illegally, but the main strategy, the main goal, is to provide full privacy for everyone

Chhay Lin Lim

He went further in the next breath, and I am paraphrasing here because the recording is unclear on two words: he wants the state either gone or as minimal as it can be made. That is his politics and I present it as his. What the licence actually covers is narrower than the ambition. ESMA’s interim register lists Monflo B.V. for three of the ten MiCA services: custody and administration, execution of orders, and transfer services, with passporting into Belgium, Germany and Luxembourg. Yield products are listed on the company’s own site as coming soon. So the thing that exists today, in the company’s own description, is an IBAN account that converts incoming euros into a euro stablecoin and sends euros back to an ordinary bank account on the way out, a swap function that routes through a third-party aggregator, and a card. His view of what the licence means is generous: “the fact that they give you the license already says that they trust you,” he told me.

Trust is not the word I would use. A licence is permission with conditions attached and a supervisor who can take it back, and he knows it, because a minute earlier he had told me that regulators are “very neutral” in the room. The more accurate reading is that the AFM found the file complete. That is still an achievement for a self-described anarchist, and the story of how he got there is the best part of the interview.

What Monflo’s Chhay Lin Lim told the AFM

Before the licence, the AFM invited him to explain what Monflo was doing. This is his account of the meeting and I have not been able to check it against the regulator’s, so read it as one side. His opening line is the part I would have paid to see land.

I started my presentation by saying, you know what, we are here to protect the consumer. I believe that the best way to protect the consumer is to have an infrastructure that’s fully transparent what’s happening to the money. And that is why we chose blockchain technology.

Chhay Lin Lim

Think about what that does in a licensing meeting. A public chain is the most auditable ledger a supervisor will ever be offered; every euro that becomes a stablecoin leaves a trail that does not depend on the company’s own books. The privacy half is the harder sell, and he did not hide it.

people should have the right to privacy and only the transactions they want to show should be shown. If the regulator suspects they do something wrong, the regulator can come to us and then the user has the responsibility to show whatever the regulator asks them to show.

Chhay Lin Lim

So what I did is stop seeing us as always the adversary of the regulators, instead of finding common ground. In the end, we all want to protect the consumer. And I really believe the regulators are here to protect the consumer, even though I disagree with a lot of things they do, of course.

Chhay Lin Lim

That “of course” is the moment he stopped selling. A founder pitching a privacy product to a privacy conference has every incentive to play the rebel. He chose to say, on camera, that the people who licensed him are doing their job, and then to say he disagrees with a lot of it anyway. Both halves are checkable against his behaviour: he applied, he complied, and he still turned up at an event whose Wi-Fi password, as I found out when I connected, calls fiat a scam.

An account that never sees your passport

Here is the concrete mechanism, and it is the part of the interview I would send to anyone who thinks a licensed firm cannot do data minimisation.

We want to know as little as possible of the user that is legally allowed. So we have policies in place. To give one very clear example is we don’t want to have you opening a bank account with us by submitting your ID documents to us. We don’t want that at all.

Chhay Lin Lim

The tool he uses for that is iDIN, the service the Dutch banks set up so that a company can confirm who you are through your own bank’s login. It lets Monflo rely on the identity check your bank did when you opened your account there. One thing to know about that dependency: iDIN’s own site says the service has been acquired by the Belgian identity app itsme, which plans to replace it over time, so the plumbing behind this promise is changing hands.

we can send a message to your bank, if you already bank somewhere, and then in the message, we ask the bank, is this really the person who is saying that he is? And then your bank can send us a message with the information that you are actually the person

Chhay Lin Lim

we are able to know that the person is who he is, that who says that he is, without obtaining the ID documents of that person. So, again, a very clear example of data minimalization.

Chhay Lin Lim

Be precise about what that buys you, because it still involves an identity check. Your name and date of birth still travel from your bank to Monflo, and your bank did the passport work years ago. What Monflo avoids is holding a copy of the document itself, which is the thing that leaks when a crypto firm gets breached. Whether a bank-to-bank confirmation satisfies every step of customer due diligence for a crypto provider is a question for Monflo’s compliance file and for the AFM, which supervises exactly that, and I have not seen the file. As a design choice it is the opposite of the industry habit of asking for a selfie with your passport and keeping both forever.

A product nobody buys until it is too late

The second design choice he raised with the regulator is where the money sits.

“One of the ways in which we also protect the consumer is by offering every person his own separate wallet,” he said. “They don’t need to trust us. So don’t trust, but verify.”

A separate wallet per customer means a balance you can check on the chain rather than on a statement, and Monflo’s site names Fireblocks as the infrastructure behind it. It is a company claim about a company design, so treat it as such, and note that it stops short of self-custody: the firm holds the keys, which is what a custody licence is for. Then I asked what he wanted people to take home from his talk, and he gave the most honest description of the privacy business I heard all week.

Privacy is most relevant in a doomsday scenario, right? When there’s full surveillance where you’re not allowed to do anything you want to. But, and this makes it very difficult to sell privacy. But we should not despair. We have weapons at hand. The weapons we have at hand is the community. We have each other.

Chhay Lin Lim

That is a founder admitting that his product’s strongest use case is one his customers hope never arrives. It is also why every privacy company at this event talks about community before it talks about features, and he reached for the same history the rest of them reach for.

It is also very powerful to try and build parallel societies, parallel systems. As long as we have each other’s back, I think we have a good chance to win. We need to be inspired by the crypto anarchists, by the cypherpunks who were able to win the first crypto war in the early 1990s. If they could win, why can we not win?

Chhay Lin Lim

One date check. The fight he means began in the early 1990s, with the Clipper chip proposal of 1993 and the criminal investigation into the author of PGP, and it was won later in the decade: the United States loosened its encryption export rules in 1996 and largely gave them up by 2000. The cypherpunks did win, and they needed most of a decade to do it, which is the more useful lesson for anyone fighting the 2027 version.

Compliant privacy, two years out

I asked which product he most wanted to add. He did not name a token or a yield feature.

On the short term, it’s compliant privacy. I think it’s doable, indeed. I expect that within the next two years that we can fully implement it. But it’s not the end goal.

Chhay Lin Lim

He did not define the term, and I did not get a second pass at it. What I can say is what the calendar does to it. Two years from this week is September 2028. The ban on anonymous crypto accounts at licensed providers takes effect on 10 July 2027, well inside that window, so whatever compliant privacy turns out to mean at Monflo, it has to be a version that a supervised provider can run after that date: selective disclosure of the kind he described to the AFM, most likely, rather than anonymity. The end goal in his words is “privacy by default”. The interesting product will be the one that gets as close to that as a licence allows, and he is one of very few founders in the Netherlands positioned to find out where that line is.

Frequently asked questions

Is Monflo licensed under MiCA?

It is: ESMA’s interim register, fed by the AFM, lists Monflo B.V. as authorised since 4 December 2025 for custody and administration, execution of orders and transfer services, passported to Belgium, Germany and Luxembourg. De Nederlandsche Bank handles prudential supervision.

Does Monflo verify your identity?

It does, according to Lim, through iDIN: Monflo asks your own bank to confirm you are who you say you are, so it never collects a copy of your ID document. It is data minimisation rather than an absence of checks.

What did Chhay Lin Lim say about surveillance?

Asked about the claim that the state surveils people to protect them, he called it nonsense, said the hurdles for a crypto business in the Netherlands hurt him more than they protect anyone, and argued that more choice protects consumers better than more supervision.

What is “compliant privacy” and when is it coming?

He did not define it beyond the phrase and a two-year estimate. The EU ban on anonymous crypto accounts at licensed providers starts on 10 July 2027, so any version Monflo ships will have to work within that rule, which points to selective disclosure rather than anonymity.

Read next

• Casey Ford of Nym on why your free VPN behaves like malware, the interview Lim mentions when he talks about the surveillance state.
• Aaron Day of the Daylight Freedom Foundation, the other conversation I put the same question to.
• Our preview of Common S3nse 2026, for the 2027 rule that frames every interview at this event.
• The Common S3nse speaker line-up, if you want to know who else was on stage.
• Monflo’s company page, for the licence footer, the partners and the products in the company’s own words.
• ESMA’s MiCA page and interim register, where the authorisation date and the three licensed services can be checked.
• The AFM’s register of crypto-asset service providers, the Dutch regulator’s own list.
• His interview with B2B Cambodia, in which he tells the story of founding Monflo during his mother’s illness and the inflation of 2022.

Recorded at Common S3nse 2026, De Hallen Studio’s, Amsterdam, on 4 September 2026, during Cypherpunk Week. Quotes are verbatim from the recording with filler removed. Cryptofocus is a media partner of Common S3nse. Nothing here is financial advice.