Crypto ATM / kiosk operator in Greece

Law 4557/2018 (as amended), which transposed the EU's 5th Anti-Money Laundering Directive (AMLD5) and 6th Anti-Money Laundering Directive (AMLD6) into national law. This law defines "providers of services of virtual assets" and mandates their registration.

HCMC Decision No. 2/902/10.03.2021 (and subsequent amendments), which provides further details on the registration process and ongoing obligations.

Exchanges: Providers engaged in the exchange between virtual assets and fiat currencies, or between one or more virtual assets.

Establish and implement robust AML/CFT policies, procedures, and internal controls in line with national and EU requirements.

Conduct customer due diligence (CDD) and enhanced due diligence (EDD) where necessary.

Monitor transactions for suspicious activities and report them to the Hellenic Financial Intelligence Unit (FIU).

Appoint an AML Compliance Officer and potentially a Deputy AML Compliance Officer.

Fit & Proper Requirements:

While not explicitly always requiring a physical office, the VASP must be incorporated in Greece and have its management and operational base within the country to effectively comply with Greek AML/CFT laws and HCMC supervision.

The national AML regime does not impose specific initial capital requirements as stringent as a licensing regime. However, VASPs are expected to have adequate financial resources to operate responsibly and comply with their obligations. The HCMC will assess the financial soundness as part of the registration.

Hellenic Capital Market Commission (HCMC) - Virtual Assets Page:

Law 4557/2018 (Government Gazette A' 139/30.07.2018): This is the primary Greek AML/CFT law, transposing the Fourth AML Directive (EU 2015/849). It established the general framework for obliged entities.

Law 4734/2020 (Government Gazette A' 199/08.10.2020): This crucial law amended Law 4557/2018 to transpose the Fifth AML Directive (5AMLD) into Greek law. It explicitly expanded the scope of obliged entities to include:

Providers engaged in exchange services between virtual currencies and fiat currencies.

Identification and Verification of the Customer:

Enhanced Due Diligence (EDD): Required for higher-risk situations, such as:

Situations where the customer is not physically present for identification purposes (non-face-to-face).

Transaction Records: All relevant records relating to domestic and international transactions, sufficient to reconstruct individual transactions. This includes dates, amounts, types of virtual assets, sender, and recipient information.

Screen customers against sanction lists (e.g., EU, UN).

CDD Information: Copies of the documents and data obtained through the CDD process (e.g., identification documents, beneficial ownership information).

Regularly review transactions to ensure they are consistent with the VASP's knowledge of the customer, their business, and risk profile, including, where necessary, the source of funds.

Understanding the Purpose and Intended Nature of the Business Relationship: VASPs must understand why the customer is using their services and the expected pattern of transactions.

Law 4991/2022 (Government Gazette A' 214/11.11.2022): This law made further amendments to Law 4557/2018, primarily to incorporate the changes from the EU Regulation on information accompanying transfers of funds and certain crypto-assets (Travel Rule).

Entity Targeted: A large international organized crime group operating "boiler rooms" (call centers) that defrauded investors across Europe, including Greece, using fake cryptocurrency investments. Violation Type: Investment fraud, aggravated fraud, money laundering, participation in a criminal organization. Outcome: Multiple arrests (at least 15 in Greece, others internationally), dismantling of call centers, freezing of assets. Criminal proceedings are ongoing.

Entity Targeted: Individuals operating an illegal cryptocurrency mining farm. Violation Type: Theft of electricity, illegal operation. While not a direct "crypto violation," it's significant as it involves crypto-related activities leading to criminal charges. Outcome: Arrests, charges filed for electricity theft, seizure of equipment. Criminal proceedings.

Entity Targeted: Individuals involved in a fraudulent scheme that lured victims into investing in fake cryptocurrency platforms. Violation Type: Fraud, money laundering, establishment/participation in a criminal organization. Outcome: Arrests, ongoing investigations and criminal proceedings.