Crypto ATM / kiosk operator in Bermuda
Physical kiosks that exchange cash for crypto (and sometimes vice versa). High-cash AML risk profile.
Crypto ATM is conditionally permitted in Bermuda with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- Registration with the BMA under the Digital Asset Business Act 2018 (DABA) as a 'digital asset business' – crypto ATM operation constitutes 'exchange' and/or 'payment services' under DABA's broad definition
- Must comply with the Proceeds of Crime (AML/ATF Financing) Regulations 2008, including customer due diligence (CDD) and enhanced due diligence (EDD) for cash transactions
- Cash-transaction reporting thresholds follow Bermuda's AML framework under POCA Regulations – cash transactions above the threshold must be reported to the Financial Intelligence Authority (FIA)
- Suspicious Transaction Reports (STRs) must be filed with the FIA for any cash transactions giving rise to suspicion
- Ongoing AML/ATF compliance monitored by the Bermuda Monetary Authority (BMA)
- Compliance with Digital Asset Business (Client Disclosure) Rules 2018 for client disclosure obligations
- Must maintain records as required under DABA and POCA Regulations
Key Restrictions
- Crypto ATM / kiosk operators must hold a DABA license (Class M or Class F) from the BMA – no standalone 'kiosk-specific' license exists; the activity falls under 'digital asset business'
- Operator must be incorporated in Bermuda or maintain economic substance there
- High minimum net asset requirements apply under DABA – Class M and Class F licences have stated minimum net asset thresholds
- Cash-in/cash-out kiosks likely require robust EDD policies due to high cash AML risk profile, aligning with the BMA's expectations under POCA Regulations
- Operator must comply with the Digital Asset Business (Cybersecurity) Rules 2018, including cybersecurity and operational resilience standards
- Must comply with the Digital Asset Business (Prudential Standards) (Annual Return) Rules 2018
Key Risks
- Enforcement precedent from Bittrex Global demonstrates that BMA actively investigates and enforces DABA custody and segregation requirements – relevant for kiosks holding customer cash or crypto in hot wallets
- Fines of up to US$250,000 and/or 5 years imprisonment for unlicensed digital asset business; up to US$10 million for DABA non-compliance
- Regulatory ambiguity: the Proposed Payment Services Act (PSA) may introduce a new framework for payment services (potentially covering kiosk cash-in/cash-out) with DABA exemptions, creating transitional uncertainty
- High operational cost due to capital requirements, local substance rules, and ongoing supervisory compliance under DABA full or modified licensing
- Reputational risk: Bermuda is a small jurisdiction with a high-profile regulatory environment – any non-compliance attracts significant scrutiny
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Digital Asset Business Act (DABA, 2018): Establishes licensing for "digital asset businesses" (broadly defined to include exchanges, trading, custody, issuance, stablecoins, and more) conducted in or from Bermuda; applies to entities incorporated inside or outside Bermuda.
Digital asset businesses in Bermuda (e.g., issuing, selling, redeeming tokens, exchanges, wallets, payment services) require licensing under the Digital Asset Business Act (DABA), with Class T (sandbox), Class M (modified), or Class F (full) licenses available. However, the stated minimum net assets of $100,000 and fees ($1,000 for Class T, $2,266 for Class M/F) are likely outdated; current evidence shows a Class F license has been actively issued and stablecoin/stellar blockchain initiatives are underway, indicating regulatory evolution that may have altered these specific requirements.
Supporting rules (2018): Digital Asset Business (Cybersecurity) Rules, (Client Disclosure) Rules, (Prudential Standards) (Annual Return) Rules.
Additional: Proceeds of Crime (AML/ATF Financing) Regulations 2008 for anti-money laundering.
Regulator: Bermuda Monetary Authority (BMA).
Fines up to US$250,000 and/or 5 years imprisonment for unlicensed digital asset business.
Fines up to US$10,000,000 for DABA breaches or non-compliance with BMA directions.
Entity targeted: Bittrex Global (Bermuda) Ltd (Class F Full DABA licensee, ceased operations in 2024). Violation type: Non-compliance with DABA requirements, including segregation of digital assets in the "Andromeda Omnibus Wallet," Digital Asset Custody Code of Practice (2019), AML/ATF, KYC, and UN Sanctions protocols (identified via 2022 onsite inspections). Penalty amount: Not specified in sources.
Unlicensed digital asset business: Fine up to US$250,000 and/or 5 years imprisonment.
Proposed Payment Services Act (PSA): Regulates payments/digital wallets, with DABA exemptions and stablecoin options
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — Crypto ATM/kiosk operators are permitted in Bermuda but must obtain a Class M or Class F DABA license, incorporate locally with economic substance, comply with POCA AML/ATF Regulations with cash-reporting obligations, and meet BMA's cybersecurity, custody, and prudential standards.
Questions this verdict aims to answer
- What money-transmitter / kiosk-specific license is required?
- What cash-transaction reporting thresholds apply?
- What enhanced-KYC obligations attach to cash-in / cash-out?