Crypto ATM / kiosk operator in Bhutan
Physical kiosks that exchange cash for crypto (and sometimes vice versa). High-cash AML risk profile.
Crypto ATM is not permitted in Bhutan.
Verdict Details
- Permitted
- no
- Local entity required
- No
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- Standard CDD obligations apply under the AMLCFT Act 2018: collect name, date of birth, nationality, unique ID number (citizenship ID), residential address for individuals
- Legal persons: collect legal name, legal form, proof of existence, registered office address, names of directors/senior management
- Beneficial ownership identification and verification required
- Ongoing due diligence and transaction monitoring required
- Enhanced CDD (EDD) for higher-risk situations, PEPs, and complex transactions — cash-in/cash-out ATM operations would likely trigger EDD
- Suspicious Transaction Reports (STRs) must be filed to the FIU (housed within RMA) for any transaction with reasonable grounds of suspicion — no monetary threshold
- Record-keeping: minimum 5 years for identification data, transaction records, and business correspondence
- No-tipping-off prohibition applies
- FATF Travel Rule likely expected by RMA for virtual asset transfers, though not explicitly codified for VASPs in Bhutanese law
- Cash-transaction reporting thresholds: no specific statutory cash-threshold amount identified in available facts for Bhutan — STR trigger is suspicion-based regardless of amount
Key Restrictions
- Crypto trading for the general public is heavily restricted and effectively prohibited through the formal financial system — RMA directives prohibit licensed financial institutions from processing virtual-asset transactions
- No licensed or regulated cryptocurrency exchanges exist for public access in Bhutan
- No distinct licensing framework exists for VASPs or crypto ATM/kiosk operators
- RMA has issued public warnings about the unregulated nature of cryptocurrencies, prohibiting financial institutions from facilitating crypto activities
- Any crypto ATM operation for the public would be operating outside the formal financial system and likely subject to enforcement action
Key Risks
- Direct enforcement risk — RMA has taken a prohibitive stance; operating a crypto ATM for the general public would likely be considered unlawful
- No legal pathway to comply — no VASP licensing framework exists, making any compliant structure impossible under current law
- State monopoly risk — Bhutan's crypto engagement is channeled exclusively through state-owned Druk Holdings & Investments (DHI) for mining, not public retail services
- Regulatory evolution risk — the landscape may change with the Gelephu Mindfulness City (GMC) framework, but currently no framework for public-facing crypto services
- Financial institution blackout — since licensed banks/FIs cannot process crypto transactions, cash-to-crypto conversion would lack a compliant banking channel
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
For the Public and Licensed Financial Institutions: The Royal Monetary Authority of Bhutan (RMA) has adopted a cautious and prohibitive stance. There is no legal framework to permit or regulate private crypto trading, exchanges, or virtual asset service providers (VASPs) for the general public. Licensed financial institutions (banks, non-bank financial institutions) are generally prohibited from dealing with virtual assets, processing transactions related to them, or providing services to crypto businesses. This effectively acts as a de facto ban on public participation in the unregulated crypto market.
For State-Owned Entities: In contrast, Bhutan has strategically engaged with cryptocurrency through Druk Holdings & Investments (DHI), the sovereign wealth fund. DHI has been involved in Bitcoin mining and holds significant crypto assets, indicating a state-controlled, strategic adoption rather than an open market approach.
RMA Circulars and Public Notices: The RMA has issued warnings and advisories to the public and financial institutions concerning the risks of cryptocurrencies, highlighting their unregulated nature, volatility, and potential for fraud and money laundering. These directives effectively prohibit licensed financial institutions from facilitating crypto-related transactions. Specific circular numbers and dates are often for internal circulation or specific institutions, but the general public advisories are consistent.
Crypto Trading: For the general public in Bhutan, crypto trading is heavily restricted and effectively prohibited through the formal financial system. The RMA's stance discourages and prevents licensed financial institutions from processing transactions related to virtual assets. This means individuals cannot easily buy or sell cryptocurrencies via traditional banking channels within Bhutan.
Crypto Exchanges: There are no licensed or regulated cryptocurrency exchanges operating for the public within Bhutan. The regulatory environment does not support their establishment or operation for public access. Any involvement would be considered operating outside the formal financial system and could carry significant risks for participants.
Royal Monetary Authority Act of Bhutan (2010): This foundational Act grants the RMA broad powers to regulate financial institutions, manage monetary policy, and oversee payment systems. The RMA utilizes this authority to issue circulars and public notices concerning risks associated with virtual assets. While not directly naming crypto, it provides the legal basis for the RMA's supervisory and prohibitive actions.
Anti-Money Laundering and Countering Financing of Terrorism Act of Bhutan (AMLCFT Act) 2018: This is the cornerstone legislation for AML/CFT in Bhutan. While it may not explicitly name "cryptocurrency" or "virtual assets" in all its provisions, its broad definitions and regulatory scope are intended to cover evolving financial instruments and services that fall under the FATF's purview.
Identification and Verification:
Individuals: Collecting and verifying the customer's name, date of birth, nationality, unique identification number (e.g., citizenship ID), residential address. This typically involves using reliable, independent source documents, data, or information.
Legal Persons/Entities (e.g., companies): Collecting and verifying the legal name, legal form, proof of existence, powers governing the entity, address of registered office, and names of directors and senior management.
Beneficial Ownership: Identifying and verifying the natural persons who ultimately own or control the customer, or the natural person on whose behalf a transaction is being conducted.
Ongoing Due Diligence: Conducting ongoing monitoring of the business relationship and transactions to ensure they are consistent with the entity's knowledge of the customer, their business, and risk profile, including the source of funds.
Enhanced CDD (EDD): For higher-risk situations, such as customers from high-risk jurisdictions, Politically Exposed Persons (PEPs), or complex transactions. EDD would involve obtaining additional information, increasing transaction monitoring, and obtaining senior management approval.
Obligation to Report: Any transaction (regardless of amount) where there are reasonable grounds to suspect that it may be linked to money laundering, terrorist financing, or other criminal activity must be reported.
Reporting Mechanism: Reports are submitted to the FIU (which is housed within the RMA) in a prescribed format.
Duration: Records must generally be kept for a minimum of five (5) years after the business relationship has ended or after the date of the transaction.
No Tipping-Off: Reporting entities and their employees are prohibited from disclosing to the customer or any third party that an STR has been or will be filed.
FATF "Travel Rule": The FATF's Interpretive Note 15 (Recommendation 16) requires VASPs to obtain and transmit originator and beneficiary information for virtual asset transfers. While not explicitly codified in Bhutanese law for VASPs, the RMA would likely expect VASPs to comply with this as part of their broader AML/CFT obligations, consistent with international standards.
Licensing: As of current public information, Bhutan does not have a distinct licensing framework specifically for VASPs. However, depending on the nature of their activities (e.g., if they provide services similar to traditional financial institutions), they may be required to obtain a license under the Financial Institutions Act or operate under specific regulatory guidance from the RMA.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Not permitted — Bhutan's RMA has adopted a prohibitive stance toward private crypto services for the general public, with no VASP licensing framework, effectively prohibiting crypto ATM/kiosk operations for retail access; only state-controlled crypto engagement via Druk Holdings & Investments (DHI) is recognized.
Questions this verdict aims to answer
- What money-transmitter / kiosk-specific license is required?
- What cash-transaction reporting thresholds apply?
- What enhanced-KYC obligations attach to cash-in / cash-out?