← Regulations / United Kingdom / Operating Models / Crypto ATM

Crypto ATM / kiosk operator in United Kingdom

Physical kiosks that exchange cash for crypto (and sometimes vice versa). High-cash AML risk profile.

Conditional AI-Generated · Unreviewed

Crypto ATM is conditionally permitted in United Kingdom with a local entity, subject to AML obligations and high licensing burden.

Verdict Details

Permitted
conditional
Local entity required
Yes
Licensing burden
High
Last updated
2026-07-13

AML Obligations

  • FCA registration required under Money Laundering Regulations 2017 (amended) — includes CDD, EDD, ongoing monitoring, and transaction monitoring obligations (gb.licensing.role-the-primary-conduct-regulator, gb.licensing.legislation-money-laundering-regulations-2017-amended, gb.licensing.vasp)
  • Wire transfer rules (Travel Rule) for crypto transfers over relevant thresholds — VASPs must collect, share, and verify sender/receiver information (gb.licensing.scope-cryptoasset-businesses-operating-in)
  • Sanctions screening obligations — must immediately freeze and restrict assets of designated persons, report holdings or suspected sanctions evasion to OFSI (gb.aml.ofsi-enforcement-uk-vasps-must, gb.aml.fca-oversight-registered-vasps-under)
  • No services to sanctioned jurisdictions or designated persons globally; UK firms must block transactions even in unregulated markets if involving UK nexus (gb.aml.no-services-to-sanctioned-jurisdictions)
  • Prohibited dealings with prescribed countries — Russia (post-2022 embargoes), North Korea, Iran, Syria-linked entities; crypto transfers to/from these are high-risk and often blocked (gb.aml.prohibited-dealings-with-prescribed-countries)
  • Unlimited fines, asset seizures, or imprisonment up to 7-10 years under Sanctions and Anti-Money Laundering Act 2018 and FSMA; OFSI can impose monetary penalties (gb.aml.civilcriminal-fines-unlimited-fines-asset)
  • Financial promotions compliance required — crypto classified as restricted mass-market investments; risk warnings mandatory, no misleading promotions, incentive restrictions (gb.licensing.legislation-financial-promotions-order-crypto-amendment, gb.licensing.exchange)

Key Restrictions

  • FCA registration is mandatory — ~85% rejection/withdrawal rate; only ~40 firms registered, making this a very high-barrier licensing process for crypto ATM operators (gb.licensing.vasp, gb.licensing.regulator-fca)
  • Crypto derivatives banned for retail since 2021 — though ATMs involve spot exchange, this signals the FCA's restrictive approach (gb.licensing.exchange)
  • No EU passporting post-Brexit — must be UK-incorporated and registered (gb.licensing.exchange)
  • Cash-in / cash-out at physical kiosks likely triggers heightened AML scrutiny under the FCA's expectations for high-risk cash-equivalent transactions; specific cash-transaction reporting thresholds not explicitly detailed in provided facts but high-cash risk profile is flagged
  • Cryptoasset businesses must register with the FCA regardless of where their customers are — operating from outside the UK to serve UK residents also requires registration (gb.licensing.scope-cryptoasset-businesses-operating-in)

Key Risks

  • Extremely high FCA rejection/withdrawal rate (~85%) and only ~40 registered firms — real risk that a crypto ATM application is rejected or withdrawn, leaving the operator unregistered and subject to enforcement (gb.licensing.vasp, gb.licensing.regulator-fca)
  • FCA enforcement track record — fines, suspensions, or permanent closures for unregistered firms; high-profile clashes with Binance signal aggressive oversight (gb.aml.fca-actions-fines-suspensions-or)
  • Cash-intensive nature of ATM/kiosk model makes it a high-risk profile for AML — likely to attract enhanced scrutiny from FCA during registration and ongoing supervision
  • Future FSMA-based regime (2025–2026) will expand regulated activities to include trading platforms, intermediation, lending, staking, stablecoins — may introduce additional requirements for ATM operators (gb.licensing.vasp)
  • Unlimited fines and up to 7-10 years imprisonment under sanctions and AML legislation — severe consequences for non-compliance (gb.aml.civilcriminal-fines-unlimited-fines-asset)

Evidence

This verdict synthesizes the following facts. Each fact links to its primary source(s).

licensing 80% confidence

FCA — Crypto registration (MLR 2017), financial promotions, AML supervision — ~85% rejection rate

[primary] FCA
licensing 20% confidence

Money Laundering Regulations 2017 (amended) (2017) — AML/KYC — crypto exchanges and custodian wallet providers

licensing 20% confidence

Financial Services and Markets Act 2000 (amended 2023) (2023) — Crypto as regulated activity, financial promotions regime

licensing 20% confidence

Financial Promotions Order (crypto amendment) (2023) — Crypto classified as restricted mass-market investments — effective Oct 8, 2023

licensing 20% confidence

VASP: FCA registration required for all cryptoasset businesses (exchange + custodian wallet providers). ~85% rejection/withdrawal rate. Only ~40 firms registered. Future comprehensive FSMA-based regime (2025-2026) will cover trading platforms, intermediation, lending, staking, stablecoins.

licensing 20% confidence

EXCHANGE: FCA registration + financial promotions rules (risk warnings mandatory, no misleading promotions, incentive restrictions). Crypto derivatives banned for retail (since 2021). No EU passporting post-Brexit.

licensing 20% confidence

Role: The primary conduct regulator for financial services firms and markets in the UK. It is responsible for implementing and enforcing regulations related to cryptoassets.

licensing 20% confidence

AML Supervision: Registers and supervises cryptoasset businesses under the Money Laundering Regulations.

licensing 20% confidence

Scope: Cryptoasset businesses operating in the UK (regardless of where their customers are) are required to register with the FCA. This includes:

aml 60% confidence

OFSI Enforcement: UK VASPs must immediately freeze and restrict assets of designated persons (DPs), report holdings or suspected sanctions evasion to OFSI (e.g., via crypto transfers by DPs), and avoid processing transactions involving sanctioned parties; OFSI's 2022 Cryptoassets Threat Assessment highlights risks like pseudonymity enabling evasion.

[primary] legislation.gov.uk [primary] assets.publishing.service.gov.uk — OFSI Cryptoassets Threat Assessment [primary] legislation.gov.uk — Contents
aml 60% confidence

OFAC/EU/UN Sanctions: UK firms must comply with OFSI-implemented sanctions, which align with UN and EU lists but are UK-specific; primary sanctions bind all UK persons, while secondary sanctions (e.g., post-2022 Russia/Ukraine measures) restrict third-party dealings with sanctioned countries like Russia. No direct OFAC jurisdiction applies unless involving US nexus, but UK warnings echo US DOJ concerns on sanctions circumvention via crypto.

[primary] legislation.gov.uk [primary] assets.publishing.service.gov.uk — OFSI Cryptoassets Threat Assessment [primary] legislation.gov.uk — Contents
aml 60% confidence

FCA Oversight: Registered VASPs under the Financial Services and Markets Act (FSMA) must integrate sanctions screening into AML/CTF frameworks, with new rules from 2027 expanding custody definitions and requiring FCA approval by Feb 2028.

[primary] legislation.gov.uk [primary] assets.publishing.service.gov.uk — OFSI Cryptoassets Threat Assessment [primary] legislation.gov.uk — Contents
aml 60% confidence

No services to sanctioned jurisdictions or DPs globally; UK firms must block transactions even in unregulated markets if involving UK nexus.

[primary] legislation.gov.uk [primary] assets.publishing.service.gov.uk — OFSI Cryptoassets Threat Assessment [primary] legislation.gov.uk — Contents
aml 60% confidence

Prohibited dealings with prescribed countries like Russia (post-2022 embargoes), North Korea, Iran, or Syria-linked entities; crypto transfers to/from these are high-risk and often blocked.

[primary] legislation.gov.uk [primary] assets.publishing.service.gov.uk — OFSI Cryptoassets Threat Assessment [primary] legislation.gov.uk — Contents
aml 60% confidence

Civil/Criminal Fines: Unlimited fines, asset seizures, or imprisonment up to 7-10 years under Sanctions and Anti-Money Laundering Act 2018 and FSMA; OFSI can impose monetary penalties.

[primary] legislation.gov.uk [primary] assets.publishing.service.gov.uk — OFSI Cryptoassets Threat Assessment [primary] legislation.gov.uk — Contents
aml 90% confidence

FCA Actions: Fines, suspensions, or permanent closures for unregistered firms missing 2027-2028 deadlines; e.g., FCA clashes with Binance over compliance.

[primary] legislation.gov.uk [primary] assets.publishing.service.gov.uk — OFSI Cryptoassets Threat Assessment [primary] legislation.gov.uk — Contents

Verdict Attribution

Source:
AI-Generated · Unreviewed
AI synthesized:
2026-07-13 (deepseek-chat)
Last updated:
2026-07-13
Confidence:
medium

This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.

Conditional — crypto ATM/kiosk operators are permitted in the UK only upon obtaining FCA registration (very high barrier, ~85% rejection rate) and must comply with full AML/CTF obligations under the Money Laundering Regulations 2017, sanctions screening, financial promotions rules, and the upcoming FSMA-based regime; specific cash-transaction reporting thresholds for ATMs are not detailed in available facts, which limits confidence on that sub-question.

Questions this verdict aims to answer

  • What money-transmitter / kiosk-specific license is required?
  • What cash-transaction reporting thresholds apply?
  • What enhanced-KYC obligations attach to cash-in / cash-out?