Crypto ATM / kiosk operator in Barbados

Primary Legislation: Digital Assets Act, 2019 (as amended).

Regulatory Body: The Financial Services Commission (FSC) Barbados is the primary regulator responsible for licensing, supervision, and enforcement under the Digital Assets Act.

Required License: A Virtual Asset Business License.

Exchange between virtual assets and fiat currencies.

Exchange between one or more forms of virtual assets.

The claim that this activity falls under definitions (1) and (2) of ‘Virtual Asset Business’ is now incorrect due to the November 2025 revision of the Virtual Assets & VASP Act in Barbados.

Legal Entity and Local Presence:

The applicant must typically be a Barbadian incorporated company or a foreign company registered in Barbados.

A registered office in Barbados.

The Act may imply or require key management personnel to be resident in Barbados, or at least regular physical presence for operational oversight.

The Digital Assets Act mandates that a VASP must maintain adequate financial resources to operate its business.

Virtual Asset Business Act, 2022 (VABA, 2022): This is the cornerstone legislation specifically designed to regulate VASPs in Barbados. It provides for the registration, licensing, supervision, and regulation of virtual asset businesses, bringing them squarely under the AML/CFT regime. It aligns Barbados's regulatory framework with FATF Recommendation 15 on new technologies.

Money Laundering and Financing of Terrorism (Prevention and Control) Act, 2011-23 (as amended) is Barbados's overarching AML/CFT legislation. Other sectoral statutes, including the Virtual Asset Service Providers regime (VABA), require covered entities to comply with the AML/CFT obligations set out in this Act for financial institutions and designated non‑financial businesses and professions (DNFBPs).

VASPs must be licensed or registered by the FSC to operate legally in Barbados. This process involves demonstrating robust internal controls, governance structures, and adequate financial resources, including a sound AML/CFT compliance program.

Identity Verification: Obtaining and verifying the identity of the customer (individual or legal entity) using reliable, independent source documents, data, or information.

For Individuals: Name, residential address, date of birth, nationality, unique identification number (e.g., passport, national ID).

For Legal Entities: Name, legal form, proof of existence, registered address, principal place of business, board of directors, and verification of individuals authorized to act on behalf of the entity.

Beneficial Ownership Identification: Identifying and taking reasonable measures to verify the identity of the beneficial owner(s) of the customer, especially for legal persons and arrangements. This includes understanding the ownership and control structure.

Purpose and Intended Nature of Business Relationship: Understanding the purpose and intended nature of the business relationship or occasional transaction.

Ongoing Monitoring: Conducting ongoing due diligence on the business relationship and scrutiny of transactions undertaken throughout the course of the relationship to ensure that the transactions are consistent with the VASP's knowledge of the customer, their business, and risk profile, including, where necessary, the source of funds or virtual assets.

Enhanced Due Diligence (EDD): Applying enhanced measures for higher-risk situations, including:

Politically Exposed Persons (PEPs)

Customers from high-risk jurisdictions (as identified by FATF or national assessments)

Complex or unusual transactions or business structures

Transactions involving high value or specific types of virtual assets deemed higher risk.

VASPs must determine the source of funds and source of wealth for high-risk customers.

Simplified Due Diligence (SDD) may be applied only where a documented, demonstrably low risk of money laundering or terrorist financing exists, in line with FATF and similar risk-based frameworks; it is not a blanket permission defined solely by the FSC and must follow proportionate, dynamic risk assessment criteria set by applicable AML regulators.

Obligation to Report: VASPs are legally obligated to report any suspicious transactions, including attempted transactions, to the Financial Intelligence Unit (FIU) of Barbados.

Grounds for Suspicion: This includes suspicion of money laundering, terrorist financing, proliferation financing, or any other criminal activity, regardless of the amount or value involved.

No Tipping-Off: VASPs and their employees are prohibited from disclosing to the customer or any third party that a report has been made or that a money laundering/terrorist financing investigation is being conducted.

Copies of identification documents, verification data, beneficial ownership information, and records of analysis performed.

Transaction Records: All transaction data, including dates, amounts, types of virtual assets, sender and recipient information, and any associated messages or instructions.

Regulator: Barbados Financial Services Commission (FSC)

Relatively New Framework: Enforcement actions often take time to materialize after a regulatory framework is put in place.

Focus on Compliance: The FSC might be prioritizing encouraging compliance and licensing rather than immediately resorting to public penalties, especially if entities are making efforts to regularize.

Jurisdiction Size: Smaller jurisdictions sometimes have different approaches to public disclosure compared to larger financial centers.