Albania

**Entity Targeted:** Faruk Fatih Özer, founder and CEO of the Turkish cryptocurrency exchange Thodex.

**Violation Type:** International fraud, money laundering (related to the collapse of the Thodex exchange, which defrauded hundreds of thousands of users of an estimated $2 billion). The Albanian action related to his illegal entry and residence, and the execution of the international arrest warrant.

**Penalty Amount (Albania):** No specific "penalty amount" was imposed by Albanian authorities on Özer directly for the crypto fraud. The outcome in Albania was his arrest and successful extradition.

**Outcome:** Faruk Fatih Özer was arrested in Vlora, Albania, following an international manhunt. After a period of legal appeals, he was extradited to Turkey, where he faced trial. In Turkey, he was subsequently sentenced to 11,196 years in prison in September 2023 for aggravated fraud, leading a criminal organization, and money laundering.

Law No. 97/2020, dated October 22, 2020, “On Virtual Assets” (Ligji Nr. 97/2020 “Për Asetet Virtuale”), in force since February 1, 2021. This is the definitive primary law for licensing of virtual asset service providers in Albania. The earlier draft Law No. 110/2020 was replaced.

Further details are provided by decisions of the Financial Supervisory Authority (AMF), such as Decision No. 27/2021, as amended by subsequent decisions (e.g., Decision No. 110/2021). The current consolidated version should be consulted for the most up-to-date licensing requirements and procedures.

**Supervising Authority:** The **Financial Supervisory Authority (AMF - Autoriteti i Mbikëqyrjes Financiare)** is the primary regulator responsible for licensing, supervision, and enforcement in the virtual asset sector.

**Issuance of virtual assets:** This includes Initial Virtual Asset Offerings (IVOs).

**Operating a trading platform for virtual assets (Exchanges):** This covers all types of virtual asset exchanges, including fiat-to-crypto, crypto-to-crypto, and peer-to-peer platforms facilitated by an operator.

**Custodian services for virtual assets:** This involves safekeeping, administration, or management of virtual assets or instruments enabling control over virtual assets (e.g., private keys).

**Transfer of virtual assets:** This includes services facilitating the movement of virtual assets between addresses or wallets, which covers aspects of **payment processing** using virtual assets.

**Providing financial services related to virtual asset offerings or sales.**

**Providing services related to portfolio management, investment advice, or other financial advisory services concerning virtual assets.**

The capital requirements vary depending on the type and scope of services offered. Implementing acts (like AMF Decision No. 27/2021) specify these amounts in Albanian Lek (ALL).

For example, for virtual asset trading platforms and custodian services, significant capital is required (e.g., 30,000,000 ALL - approximately €250,000, as per AMF Decision No. 27/2021).

For advisory services or issuance, the capital requirement might be lower (e.g., 15,000,000 ALL - approximately €125,000).

These are minimums, and the AMF may require higher capital based on the business plan and risk assessment.

Strict adherence to Albanian anti-money laundering and combating the financing of terrorism (AML/CTF) laws (primarily Law No. 9/2020 "On some additions and changes to Law No. 9/2020 on preventing money laundering and financing of terrorism").

Implementation of robust Know Your Customer (KYC) procedures for all clients.

Reporting suspicious transactions to the General Directorate for the Prevention of Money Laundering (GDPML).

Applicants must be legally established in Albania as a joint-stock company or limited liability company.

A physical office or registered address in Albania is required.

At least one local director or management representative may be required.

**Management and Shareholders (Fit & Proper Test):**

Directors, senior management, and significant shareholders must meet "fit and proper" criteria. This involves assessments of their professional qualifications, experience, financial soundness, integrity, and lack of criminal record.

Transparent ownership structure is mandatory only for foreign entities registered to do business in Alabama under the narrowed federal CTA; domestic companies are exempt.

Robust IT systems, cybersecurity measures, and data protection protocols (in line with GDPR principles).

Comprehensive business plan, outlining services, target markets, risk management framework, internal control systems, and contingency plans.

Segregation of client funds/assets from operational funds.

Proof of technical and human resources adequate for the proposed activities.

Risk Management Framework: A structured, organization‑wide process for identifying, assessing, responding to, authorizing, and continuously monitoring security and privacy risks to information systems and organizational operations, emphasizing integration into the system life cycle and enabling automation and ongoing risk management rather than relying solely on static, document‑based policies and procedures.

**Fees:** Application and annual supervision fees are applicable, determined by the AMF.

**Pre-Application Contact (Optional but Recommended):** Initial discussions with the AMF to clarify requirements and the scope of the proposed activities.

**Preparation of Documentation:** Compilation of a comprehensive application package, including:

Company registration records and related information in Alabama are available through the Alabama Secretary of State’s online Business Entity Records system, which now supports multiple modern search options (e.g., by entity name, ID, officer, or agent) rather than a single, limited lookup method.

AML/KYC policies and procedures are undergoing fundamental reform and evolution, building on but superseding prior frameworks per FinCEN's April 2026 proposed rule and related updates

For Singapore licensing, firms must assess directors and key personnel against MAS fit-and-proper criteria and maintain supporting documentation such as resumes/CVs, background checks, and formal fit-and-proper declarations/certifications; resumes alone are not sufficient.

Alabama still maintains corporate and securities frameworks that involve shareholder and ownership information, but the prior Alabama‑specific rule that directly referenced stockholder information supplements (Ala. Admin. Code 482‑1‑041) has been repealed, so any generic reference to “shareholder information and declarations” as a current Alabama licensing requirement is outdated unless tied to a specific, currently effective statute, rule, or filing obligation.

Internal operational manuals and risk management framework.

Submission of Application: Formal submission of the complete application package to the AMF.

**Ongoing Compliance:** Licensed entities are subject to continuous supervision, reporting obligations, and potential audits by the AMF.

Laws of the Albanian Parliament should now be searched primarily via the dedicated e‑legislation portal linked from the Parliament’s website, rather than by navigating the older ‘Aktet Ligjore/Legislation’ directory structure on www.parlament.al, although the main parliament site remains the entry point.

Ligjet.org is an older, non‑official site that may contain some Albanian legislation, but it is not reliable or complete for current laws such as Law no. 110/2020; the primary up‑to‑date official source is the Qendra e Botimeve Zyrtare (qbz.gov.al).

Accessing the definitive Albanian text is important for legal accuracy, but professional translations are not always strictly required for general research because authoritative English translations and machine-assisted translations may be available.

**Financial Supervisory Authority (AMF - Autoriteti i Mbikëqyrjes Financiare):**

This is the regulator. Their website publishes decisions, regulations, and guidance.

While not specific to virtual assets, this is the overarching AML/CTF law that VASPs must comply with.

No results found for "Ligji 9/2020" on the Albanian Parliament website (parlament.al); check Qendra e Botimeve Zyrtare (qbz.gov.al) for official gazette

The General Directorate for the Prevention of Money Laundering (GDPML) functions as Albania's Financial Intelligence Unit (FIU) responsible for receiving suspicious transaction reports and AML/CFT policy implementation at the national level.

**Virtual Currency:** Defined primarily as a digital representation of value that is not issued or guaranteed by a central bank or public authority, is not necessarily attached to a legally established currency, and does not possess the legal status of currency or money, but is accepted by natural or legal persons as a means of exchange and can be transferred, stored, and traded electronically. (Similar to Bitcoin, Ethereum primarily as payment/exchange).

Virtual tokens are cryptographically secured digital representations of rights or value on distributed ledger technology platforms, encompassing utility tokens, security tokens, and platform-specific tokens—a broader categorization that has evolved beyond the narrow AL licensing definition to align with international regulatory frameworks using terms like 'digital assets' or 'virtual assets.'

Investment Virtual Tokens: These are the security tokens. They grant rights and obligations analogous to traditional financial instruments (e.g., shares, bonds, derivatives).

**Utility Virtual Tokens:** Provide access to a good or service.

**Hybrid Virtual Tokens:** Combine features of both investment and utility tokens.

Represent **ownership rights** in an entity (e.g., a share in a company).

Represent **debt claims** against an entity (e.g., a bond or debenture).

In Alabama LLCs and partnerships, a typical profits interest does not grant a broad right to all future profits or revenues of the enterprise; instead, it entitles the holder only to a share of the entity’s future appreciation or future profits above the grant-date value, excluding existing value and often focusing on future capital events and/or future operating profits rather than general revenue sharing.

Confer **voting rights** or other corporate governance rights.

Are **transferable** and give rise to an expectation of **profit** from the efforts of others, similar to traditional investment contracts.

Derive their value from, or represent rights related to, **traditional financial instruments** (e.g., a tokenized derivative, a token representing ownership of physical gold but traded like a security).

Are **offered to the public as an investment opportunity** with the expectation of a return.

**Compliance with Securities Law (Law No. 9879/2008):**

For public offerings of crypto-asset tokens that are treated as securities or otherwise subject to securities offering rules in the relevant jurisdiction, an issuer may be required to publish a detailed prospectus or equivalent disclosure document approved by the competent authority; however, this is not a blanket rule for all investment virtual tokens, and under EU MiCAR many tokens instead require a crypto-asset white paper rather than an AMF-approved prospectus.

**Market Abuse Rules:** Prevention of insider trading and market manipulation.

Entities providing virtual asset services in the UAE (including Dubai) must be licensed by either the Securities and Commodities Authority (SCA) under the 2022 Virtual Assets Law or by the Dubai Virtual Assets Regulatory Authority (VARA), depending on the jurisdiction; the AMF and Law No. 66/2020 are no longer the correct references for current licensing requirements.

Robust internal governance and risk management systems.

**Exemptions:** Standard exemptions from prospectus requirements under Law No. 9879/2008 may apply (e.g., small offerings below a certain threshold, private placements to qualified investors, offerings solely to existing shareholders in certain circumstances). However, these exemptions would be interpreted in the context of virtual assets by the AMF.

**Licensed Platforms:** Trading of Investment Virtual Tokens must occur on platforms licensed by the AMF. These platforms are considered "DLT-based trading facilities" and are subject to rules akin to traditional regulated markets or multilateral trading facilities (MTFs).

**Investor Protection:** Platforms must implement measures to ensure fair and orderly trading, transparency (pre- and post-trade transparency rules), investor protection, and market integrity.

**AML/CTF:** All transactions on these platforms are subject to AML/CTF obligations, including customer due diligence (KYC), transaction monitoring, and suspicious activity reporting.

**Supervision:** The AMF has supervisory powers over these platforms, including the ability to conduct inspections, request information, and impose sanctions.

**Licensing and Registration:** Ensuring that virtual asset service providers (VASPs) obtain the necessary licenses to operate, particularly those dealing with virtual currencies and utility tokens. There have been public announcements by the AMF warning against unlicensed entities operating in the crypto space.

**AML/CTF Compliance:** Significant emphasis is placed on compliance with anti-money laundering and counter-terrorist financing rules across all types of virtual asset services.

**Investor Protection Warnings:** The AMF frequently issues public warnings to investors about the risks associated with virtual assets, particularly those offered by unlicensed entities or those lacking transparency.

**Law No. 66/2020 "On Financial Markets Based on Distributed Ledger Technology":**

English-language legal texts are now directly accessible via the official Albanian gazette (QBZ - qbz.gov.al), which provides both Albanian and English versions of laws and regulations, supplemented by the e-Albania portal for digitally stamped official documents.

**Law No. 9879/2008 "On Securities" (as amended):**

*Search Term for Official Albanian:* "Ligji 9879/2008 Për letrat me vlerë"

*This is fundamental for defining what constitutes a "security."*

**Law No. 110/2019 "On Preventing Money Laundering and Terrorism Financing":**

*Search Term for Official Albanian:* "Ligji 110/2019 Për parandalimin e pastrimit të parave dhe financimit të terrorizmit"

*Crucial for all virtual asset service providers.*

**AMF Regulatory Guidance:** The AMF website (amf.gov.al) is the primary source for regulatory updates, decisions, and guidance related to financial markets, including virtual assets. While specific, detailed guidance on token classification akin to the U.S. SEC's "Framework for 'Investment Contract' Analysis of Digital Assets" might not be published in the same form, the AMF issues various regulatory acts and instructions.

**Albanian Financial Supervisory Authority (AFSA - Autoritetit të Mbikëqyrjes Financiare):** This is the primary regulatory and supervisory body for virtual assets and VASPs in Albania. AFSA is responsible for licensing, supervision, and enforcing compliance with the Law on Virtual Assets.

**Website:** AFSA Official Website (Often primarily in Albanian, but English sections are available)

**Bank of Albania (Banka e Shqipërisë):** While AFSA supervises the virtual asset market, the Bank of Albania plays a role in monitoring financial stability, payment systems, and potentially the issuance of stablecoins or central bank digital currencies (CBDCs) in the future. It has historically issued warnings about the risks associated with cryptocurrencies.

**Website:** Bank of Albania Official Website

**Law No. 97/2020 "On Virtual Assets" (Ligji Nr. 97/2020 "Për Asetet Virtuale")**

**Date of Adoption:** October 22, 2020

**Date of Entry into Force:** February 1, 2021

The term 'virtual assets' lacks a single, stable legal definition in 2026; its meaning is fragmented across jurisdictions (e.g., SEC federal securities reclassification, IRS digital asset guidance, Pakistan's SBP law) and may no longer align with Alabama's prior state-level definition.

**Licensing of VASPs:** Establishes a mandatory licensing regime for entities wishing to offer virtual asset services (e.g., exchanges, custodians, issuers, transfer services).

**Market Supervision:** Grants AFSA powers to supervise the virtual asset market, including regulating issuance, trading, and post-trading activities.

**Consumer Protection:** Aims to protect investors and consumers from market manipulation, fraud, and illicit activities.

**AML/CFT Compliance:** Requires all licensed VASPs to implement robust AML/CFT measures in line with Financial Action Task Force (FATF) recommendations, including customer due diligence, suspicious transaction reporting, and record-keeping.

**Administrative Measures:** Outlines administrative measures and penalties for non-compliance.

The Law No. 97/2020 explicitly permits the operation of virtual asset exchanges and the trading of cryptocurrencies, but only by entities that have been duly licensed by AFSA.

**Practical Implementation Challenge - Lack of Licensed Entities:** Despite the law being in force since February 2021, AFSA has been extremely cautious, and **as of late 2023/early 2024, there are still no publicly known virtual asset service providers (VASPs) that have successfully obtained a license to operate in Albania.**

This means that while the legal framework exists to allow licensed exchanges and trading, **in practice, there are no legally operating domestic exchanges in Albania.** Any crypto trading or services offered within Albania by an entity without an AFSA license would be operating outside the legal framework.

AFSA's stance has been to thoroughly evaluate the nascent market, often citing the need for robust operational, technological, and AML/CFT infrastructure from applicants, or the market not being sufficiently mature.

**Risk for Consumers:** The lack of licensed operators means that Albanian citizens engaging in crypto trading do so primarily through foreign-based, unregulated platforms (from an Albanian perspective). This exposes them to significant risks as they lack the protection and recourse that would be provided by a domestically regulated market. The Bank of Albania has consistently issued warnings about the risks of virtual assets due to their volatility and lack of regulation at the user's access point.

Exchange between virtual assets and fiat currencies.

Exchange between one or more forms of virtual assets.

Safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets.

Participation in and provision of financial services related to an issuer's offer and/or sale of a virtual asset.

Alabama law requires individuals to physically produce identification when asked by police, not merely verbal self-identification, as affirmed by the Alabama Supreme Court in March 2026

**Natural Persons:** Identifying and verifying the identity of the customer and any beneficial owner using reliable, independent source documents, data, or information (e.g., identity cards, passports, official residence documents).

**Legal Entities:** Identifying and verifying the identity of the customer, including its name, legal form, address, proof of incorporation, and powers that regulate and bind the legal person. This also extends to identifying and verifying the identity of the natural persons who hold senior management positions and the beneficial owners.

**Beneficial Ownership:** Identifying the beneficial owner(s) of the customer and taking reasonable measures to verify their identity, including understanding the ownership and control structure of the customer.

**Purpose and Nature of the Business Relationship:** Obtaining information on the purpose and intended nature of the business relationship.

**Ongoing Monitoring:** Conducting ongoing monitoring of the business relationship, including scrutiny of transactions undertaken throughout the course of that relationship to ensure that the transactions are consistent with the VASP's knowledge of the customer, their business, and risk profile.

**Risk-Based Approach:** Applying CDD measures on a risk-sensitive basis. This means applying simplified CDD (SDD) measures where the risks are lower and enhanced CDD (EDD) measures where the risks are higher (e.g., transactions involving politically exposed persons (PEPs), high-value transactions, or relationships with customers from high-risk jurisdictions).

**Reporting Obligation:** If a VASP knows, suspects, or has reasonable grounds to suspect that funds are the proceeds of criminal activity, or are related to terrorism financing, it must promptly (without delay) report this to the General Directorate for the Prevention of Money Laundering (GDPML).

**No Threshold:** There is no minimum monetary threshold for reporting suspicious transactions; any amount can be suspicious.

**Protection for Reporters:** The law provides protection against civil or criminal liability for VASPs and their employees who report suspicions in good faith.

**"Tipping Off":** VASPs and their employees are prohibited from "tipping off" the customer or third parties about the fact that a suspicious transaction report has been made or that an investigation is underway.

**Period:** Records relating to CDD, business relationships, and transactions must be kept for at least **five years** after the end of the business relationship or after the date of an occasional transaction.

**Types of Records:** This includes copies of identification documents, account files, business correspondence, and records of transactions (including the amounts, currencies, and dates).

**Accessibility:** Records must be maintained in a way that allows for easy retrieval by competent authorities when requested.

**Internal Policies and Procedures:** Establish and maintain internal policies, controls, and procedures for AML/CFT compliance, proportionate to their nature and size.

**AML Officer:** Appoint a designated AML/CFT compliance officer at management level.

**Staff Training:** Implement ongoing training programs for relevant staff members to ensure they are aware of their AML/CFT obligations, the risks faced by the VASP, and how to identify and report suspicious activities.

**Risk Assessment:** Conduct institutional risk assessments to identify, assess, and understand the money laundering and terrorism financing risks to which they are exposed.

**General Directorate for the Prevention of Money Laundering (GDPML):** http://www.gdpml.gov.al/ (Often lists relevant legislation and guidance, though primarily in Albanian).

**Law No. 90/2020 "On Financial Markets Based on Distributed Ledger Technology" (DLT Law):**

This is Albania's primary legislation for regulating virtual assets and VASPs.

**Article 5(c)** explicitly states that VASPs are subject to the Law on Anti-Money Laundering and Counter-Terrorism Financing, thus bringing them squarely under the scope of sanctions compliance.

**Reference:** Law No. 90/2020 (Albanian Official Gazette, available via Albanian Parliament or Ministry of Finance, often referenced in legal summaries). An English summary can often be found through legal firms operating in Albania.

*General reference to Albanian legal portal:* Qendra e Publikimeve Zyrtare (QBZ) - Official Publishing Centre (search for "Ligj Nr. 90/2020").

This is the cornerstone of Albania's AML/CFT regime, applying to all "obliged entities," which now include VASPs by virtue of the DLT Law.

Key obligations for EU anti-money laundering compliance are now defined primarily by the new directly applicable EU Anti‑Money Laundering Regulation (AMLR) and related acts, which (from July 2027) will impose harmonised, detailed requirements on obliged entities – including comprehensive internal AML/CTF policies and controls, business‑wide risk assessments (including for new products, technologies, and delivery channels), explicit allocation of responsibility for AML compliance to a member of the management body, mandatory staff training and fitness/integrity assessments, restrictions and conditions on outsourcing (especially cross‑border), expanded customer due diligence and beneficial ownership verification (including use of new central registers and an overseas entities register), and specific obligations to screen customers and beneficial owners against targeted financial sanctions lists.

Apply customer due diligence (CDD) and enhanced due diligence (EDD) for higher-risk cases.

Monitor transactions for suspicious activity.

Report suspicious transactions (STRs) to the General Directorate for the Prevention of Money Laundering (GDPML).

Implement internal controls, risk assessments, and staff training.

**Implement asset freezing measures** in accordance with UN Security Council Resolutions and relevant international sanctions.

**Reference:** Law No. 111/2019 (often referenced in legal summaries).

**UN Sanctions:** Albania, as a UN member state, is legally obliged to implement all UN Security Council Resolutions, which include sanctions against specific individuals, entities, and countries (e.g., related to terrorism financing, proliferation, human rights abuses). These are implemented into national law or through decrees by the Council of Ministers.

**UN Consolidated Sanctions List:** https://www.un.org/securitycouncil/sanctions/information

**EU Sanctions:** As an EU candidate country, Albania closely aligns its foreign policy and legal framework with the EU. This means it largely adopts and implements sanctions imposed by the European Union. EU sanctions can target individuals, entities, and entire sectors in non-EU countries.

**EU Sanctions Map / Consolidated List:** https://www.sanctionsmap.eu/

**OFAC Sanctions (U.S. Department of the Treasury's Office of Foreign Assets Control):** While OFAC sanctions are primarily U.S. law, they have significant extraterritorial reach.

Albanian VASPs that conduct transactions in USD, interact with U.S. persons or entities, use U.S.-based software/services (e.g., blockchain analytics tools, custodial services), or have any other nexus to the U.S. financial system, *must* comply with OFAC sanctions. Failure to do so can result in severe penalties from the U.S. government.

**OFAC Specially Designated Nationals (SDN) List:** https://home.treasury.gov/policy-issues/financial-sanctions/specially-designated-nationals-and-blocked-persons-list-sdn-human-readable-lists

**Screen all customers (individuals and entities) against relevant sanctions lists** (UN, EU, OFAC SDN, and any lists published by the Albanian authorities implementing these). This applies during onboarding (CDD) and throughout the customer relationship (ongoing monitoring).

Screen transactions: Monitor transactions for any links to sanctioned individuals, entities, or jurisdictions, and proactively block and freeze illicit transactions as required by U.S. Treasury rules under the GENIUS Act.

**Identify Beneficial Ownership:** Ascertain the ultimate beneficial owners (UBOs) of corporate customers and screen them against sanctions lists.

**Implement Freezing Mechanisms:** Immediately freeze any virtual assets or funds belonging to, or controlled by, sanctioned individuals or entities, and report this to the GDPML without delay.

**Prohibit engagement:** Refrain from engaging in any transactions or business relationships with sanctioned parties.

**Prohibition on engaging with entities or individuals located in comprehensively sanctioned jurisdictions:** Examples often include North Korea, Iran, Cuba, Syria, and specific regions within other countries (e.g., Crimea, certain parts of Russia and Ukraine).

**Restrictions on specific sectors or types of transactions:** Even in non-comprehensively sanctioned countries, certain sectors (e.g., defense, energy, finance) or transactions might be restricted under targeted sanctions.

**Administrative Fines:** Significant financial penalties can be imposed on VASPs for failing to implement adequate AML/CFT controls, including sanctions screening and reporting failures. These fines can range from thousands to hundreds of thousands of Euros, depending on the severity and recurrence of the violation.

**License Revocation:** The Bank of Albania (as the licensing and supervisory authority for DLT entities) can revoke the operating license of a VASP for serious or repeated breaches of AML/CFT and sanctions compliance obligations.

**Criminal Penalties:** Individuals responsible for severe violations (e.g., facilitating money laundering or terrorism financing, willful evasion of sanctions) can face imprisonment. Corporate entities can also face criminal charges and substantial fines.

**Reputational Damage:** Non-compliance can lead to significant reputational harm, loss of customer trust, and difficulty in obtaining banking or partnership services.