Crypto ATM / kiosk operator in European Union
Physical kiosks that exchange cash for crypto (and sometimes vice versa). High-cash AML risk profile.
Crypto ATM is conditionally permitted in European Union with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- CASP authorization required under MiCA (EU 2023/1114) — transfer services class (EUR 50K minimum capital) plus likely exchange class (EUR 125K minimum capital) for fiat-to-crypto conversion at kiosks
- Travel Rule under Transfer of Funds Regulation (recast) applies at EUR 0 threshold — no de minimis — every transfer must be accompanied by originator/beneficiary information
- AMLD6 AML/CFT obligations apply — customer due diligence (CDD) mandatory for all cash transactions; enhanced due diligence (EDD) required for high-risk cash-in/cash-out operations
- Cash transaction reporting thresholds are set at national level by NCAs under AMLD6 — typical EU threshold is EUR 10,000 for cash transactions (may vary by member state)
- National Competent Authority oversight — home member state supervisor (e.g. AMF, BaFin, CNMV, CBI) with EU-wide passporting rights
- DAC8 tax reporting obligations effective 2026 — crypto transaction reporting to tax authorities
Key Restrictions
- Must obtain CASP authorization in home member state before deploying kiosks; transitional provisions vary (Germany until June 30, 2026; France ended March 31, 2025)
- Physical kiosk locations may require separate local business licensing or municipal permits beyond CASP authorization
- Cash transaction limits may be imposed at national level (e.g. EUR 10,000 cash threshold for reporting); some member states may ban cash crypto transactions entirely or impose lower limits
- Asset segregation and trust arrangements mandatory for client funds under MiCA custody rules if kiosk holds client assets
- EU-wide passporting available after CASP authorization — notify home NCA, 20 business day review
Key Risks
- High AML enforcement risk — crypto ATMs/kiosks are viewed as high-cash-risk by regulators; multiple NCAs actively warning unregistered operators (e.g. AFM Netherlands warnings, AMF France cease-and-desist against CryptoFlow)
- Supervisory fragmentation — 8 of 27 NCAs had not finalized MiCA enforcement guidelines as of Q1 2026, creating inconsistent requirements across member states
- Transitional provision variability — operators relying on grandfathering may face differing deadlines depending on which member state they are in
- Cash transaction reporting thresholds differ by member state — compliance complexity for multi-jurisdictional kiosk networks
- Physical kiosk compliance (cash handling, AML at point-of-sale, geofencing) is operationally intensive and subject to local regulatory divergence
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
National Competent Authorities — CASP authorization in home member state (AMF, BaFin, CNMV, CBI, etc.)
MiCA Regulation (EU 2023/1114) (2023) — Comprehensive CASP authorization, token issuance, white paper requirements — fully effective Dec 30, 2024
Transfer of Funds Regulation (recast) (2023) — Travel Rule — EUR 0 threshold (no de minimis)
AMLD6 (2024) — AML/CFT harmonization across EU
DAC8 (2024) — Crypto reporting directive for tax authorities — effective 2026
VASP: CASP authorization under MiCA via home NCA. 9 service classes: custody (EUR 50K), trading platform (EUR 150K), exchange (EUR 125K), order execution (EUR 50K), placing (EUR 50K), reception/transmission (EUR 50K), advice (EUR 50K), portfolio mgmt (EUR 50K), transfer services (EUR 50K). Prudential: higher of fixed minimum or 1/4 prior year fixed overhead.
EXCHANGE: CASP authorization with EU-wide passporting (notify home NCA, 20 business days). Transition: up to 18 months for existing operators (July 2026 deadline). France chose 6 months, Germany 12 months.
In January 2026, the French Autorité des Marchés Financiers (AMF) became the first NCA to publicly announce a formal enforcement action under MiCA, issuing a cease-and-desist order against an unregistered non-EU CASP (CryptoFlow Ltd., registered in the Cayman Islands) for soliciting French residents without authorization; the AMF noted this action as a "test case" for MiCA enforcement coordination across NCAs AMF MiCA Enforcement Action January 2026
A March 2026 analysis by the European Systemic Risk Board (ESRB) identified that 8 of the 27 EU NCAs had not yet finalized their MiCA enforcement guidelines by Q1 2026, creating "supervisory fragmentation risks" for CASPs operating across multiple member states; the ESRB warned that this could lead to inconsistent application of authorization requirements and investor protections by the April 2026 enforcement date ESRB Analysis of MiCA Supervisory Fragmentation
The European Commission's March 2026 enforcement update confirmed that the Netherlands Authority for the Financial Markets (AFM) had issued formal warnings to 14 crypto-asset firms for failing to submit complete authorization applications by the February 28, 2026 deadline; the AFM warned that firms without approved authorization by April 1, 2026, would face immediate suspension orders European Commission MiCA Enforcement Update March 2026
By April 2026, NCAs have the mandate under Article 114 to process authorization applications, monitor ongoing compliance, and initiate enforcement actions against non-compliant entities, particularly those operating without authorization and not covered by transitional provisions; enforcement powers include suspension of services, imposition of fines, and public warnings MiCA Article 114 Enforcement
Practical enforcement examples by April 2026 remain limited; however, in late 2025, the Dutch Authority for the Financial Markets (AFM) issued warnings against several unregistered crypto firms operating without transitional provisions AFM Crypto Warnings
The application of national transitional provisions under Article 127 is optional for Member States, leading to significant variability: for example, Germany has applied a transitional period until June 30, 2026 for existing CASPs, while France opted for a shorter period ending March 31, 2025, creating uneven enforcement intensity across jurisdictions BaFin Transitional Provisions; AMF France MiCA
By April 2026, ESMA and NCAs will have conducted at least one round of thematic reviews and supervisory stress tests on authorized CASPs, focusing on governance, custody of client assets, and disclosure requirements, as part of ESMA's 2025-2026 Supervisory Convergence Work Programme ESMA Work Programme 2025
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — Crypto ATM/kiosk operators require CASP authorization under MiCA (transfer services + exchange classes, EUR 50K–125K capital), must comply with EU Travel Rule (EUR 0 threshold), AMLD6 AML/CTF obligations with cash transaction reporting (typically EUR 10,000 at national level), and must incorporate locally in an EU member state with passporting rights across the EU.
Questions this verdict aims to answer
- What money-transmitter / kiosk-specific license is required?
- What cash-transaction reporting thresholds apply?
- What enhanced-KYC obligations attach to cash-in / cash-out?