Crypto ATM / kiosk operator in Andorra

Exchange between digital assets and fiat currencies: This covers cryptocurrency exchanges that allow users to buy and sell crypto with traditional money (EUR, USD, etc.).

Custody and administration of digital assets on behalf of third parties: This covers services where an entity holds or controls private keys for virtual assets on behalf of clients.

Transfer of digital assets is subject to active regulatory development and finalization, with basis transfer rules still being refined and not yet settled like traditional securities.

There is no specific EUR 125,000 threshold for custody and administration services for virtual assets under Andorra’s Law 24/2022; licensing is based on compliance requirements rather than a fixed monetary amount.

Higher amounts may be required depending on the volume and complexity of operations, or if combined with other licensed activities.

In addition to initial capital, VASPs must maintain sufficient regulatory capital to cover operational risks and ensure continuous solvency.

AML/KYC (Anti-Money Laundering / Know Your Customer):

Andorra is committed to international AML/CFT standards, including those set by the Financial Action Task Force (FATF). VASPs are subject to strict AML/KYC obligations, which align with Law 14/2017, of 22 June, on preventing money laundering and terrorist financing.

Customer Due Diligence (CDD): Implementing appropriate risk-based procedures for identifying and verifying the identity of clients (individuals and legal entities).

Ongoing Monitoring: Continuous monitoring of business relationships and transactions to detect unusual or suspicious activities.

Suspicious Activity Reporting (SAR): Reporting suspicious transactions to the Unitat d'Inteligència Financera d'Andorra (UIFAND).

Record Keeping: Maintaining records of client identification, transactions, and due diligence for a specified period.

Designation of an AML Officer: Appointing a qualified AML officer responsible for overseeing compliance.

A significant local presence is typically required. This often includes:

Physical office: Establishing an operational base in Andorra.

Risk Assessment: Conducting a comprehensive risk assessment of their business, clients, products, and geographies.

Law 14/2017 of 22 June on the prevention and fight against money laundering and the financing of terrorism: This is Andorra's principal AML/CFT law, establishing the general obligations for all obliged entities. It has been subsequently amended to incorporate international recommendations.

Law 9/2023 of 23 March on digital assets: This specific law regulates virtual assets and their service providers, bringing VASPs under the scope of Law 14/2017 and defining the specific licensing and operational requirements for these entities. This law formally identifies VASPs as obliged entities for AML/CFT purposes.

Exchange between virtual assets and fiat currencies.

Exchange between one or more forms of virtual assets.

Transfer of virtual assets.

Custody and/or administration of virtual assets or instruments enabling control over virtual assets.

Identification and Verification:

Natural persons in Andorra must have their identity verified using reliable, independent source documents, data, or information (e.g., official ID cards, passports), and Andorra now permits digital and remote identity verification methods such as document scanning and biometric liveness checks under its UIFAND-compliant AML framework.

Beneficial Ownership (BO):

Identify and take reasonable measures to verify the identity of the beneficial owner(s) of legal entities. This includes understanding the ownership and control structure. The threshold for beneficial ownership is typically 25% or more of the shares or voting rights, or control through other means.

Purpose and Intended Nature of the Business Relationship:

Conduct ongoing due diligence on the business relationship, including scrutinizing transactions undertaken throughout the course of that relationship to ensure that the transactions are consistent with the obliged entity’s knowledge of the customer, their business, and risk profile.

VASPs must apply a risk-based approach to CDD. This means the intensity of CDD measures should be proportionate to the assessed ML/TF risks.