Remote VASP serving residents in Greece
Foreign-incorporated entity that offers exchange, custody, or transfer services to residents of a jurisdiction without establishing a local entity or office.
Remote VASP is conditionally permitted in Greece with a local entity, subject to AML obligations and medium licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- Medium
- Last updated
- 2026-07-13
AML Obligations
- Registration with the Hellenic Capital Market Commission (HCMC) under Law 4557/2018 (as amended by Laws 4734/2020, 4816/2021, 4991/2022) is mandatory.
- Customer Due Diligence (CDD) — identity verification of natural persons (full name, date of birth, nationality, address, ID/passport) and legal entities (beneficial owners >25%), plus understanding purpose of the business relationship.
- Enhanced Due Diligence (EDD) required for PEPs, high-risk third countries, complex/unusual transactions, non-face-to-face customers, and other higher-risk scenarios.
- Ongoing transaction monitoring and screening against EU/UN sanctions lists.
- Suspicious Transaction Reports (STRs) must be filed with the Hellenic Financial Intelligence Unit (FIU).
- Appointment of an AML Compliance Officer (and potentially a Deputy AML Compliance Officer).
- Regular staff training on AML/CFT obligations.
- Travel Rule compliance under Law 4991/2022 — collecting and transmitting originator and beneficiary information with virtual asset transfers.
- Record-keeping: CDD documents and transaction records must be retained for prescribed periods.
Key Restrictions
- The VASP must be incorporated in Greece and have its management and operational base within the country to effectively comply with Greek AML/CFT laws and HCMC supervision.
- Registration in HCMC's 'Register of Providers of Services of Virtual Assets' is required before offering services.
- No specific minimum capital requirement, but the HCMC assesses financial soundness as part of registration.
- Fit & Proper requirements apply to management/key personnel and significant shareholders.
Key Risks
- Unlicensed cross-border servicing of Greek residents without local incorporation/registration exposes operators to criminal enforcement for money laundering, fraud, and operating without authorization.
- Greek authorities have demonstrated willingness to pursue crypto-related fraud and unlicensed activities (enforcement actions against boiler-room scams, illegal mining operations).
- Regulatory ambiguity remains around whether pure remote/cross-border VASPs (no local presence) can ever be compliant given the requirement for local incorporation and operational base.
- EU sanctions and Travel Rule compliance add operational complexity for remote operators.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Law 4557/2018 (as amended), which transposed the EU's 5th Anti-Money Laundering Directive (AMLD5) and 6th Anti-Money Laundering Directive (AMLD6) into national law. This law defines "providers of services of virtual assets" and mandates their registration.
HCMC Decision No. 2/902/10.03.2021 (and subsequent amendments), which provides further details on the registration process and ongoing obligations.
While not explicitly always requiring a physical office, the VASP must be incorporated in Greece and have its management and operational base within the country to effectively comply with Greek AML/CFT laws and HCMC supervision.
Hellenic Capital Market Commission (HCMC) - Virtual Assets Page:
Establish and implement robust AML/CFT policies, procedures, and internal controls in line with national and EU requirements.
Conduct customer due diligence (CDD) and enhanced due diligence (EDD) where necessary.
Monitor transactions for suspicious activities and report them to the Hellenic Financial Intelligence Unit (FIU).
Appoint an AML Compliance Officer and potentially a Deputy AML Compliance Officer.
Regular staff training on AML/CFT.
Fit & Proper Requirements:
Submission: Submit the complete application package to the HCMC.
Decision: If approved, the VASP is entered into the HCMC's "Register of Providers of Services of Virtual Assets."
Law 4557/2018 (Government Gazette A' 139/30.07.2018): This is the primary Greek AML/CFT law, transposing the Fourth AML Directive (EU 2015/849). It established the general framework for obliged entities.
Law 4734/2020 (Government Gazette A' 199/08.10.2020): This crucial law amended Law 4557/2018 to transpose the Fifth AML Directive (5AMLD) into Greek law. It explicitly expanded the scope of obliged entities to include:
Law 4816/2021 (Government Gazette A' 118/09.07.2021): This law further amended Law 4557/2018, primarily to transpose aspects of the Sixth Anti-Money Laundering Directive (6AMLD) concerning the criminalization of money laundering offenses.
Law 4991/2022 (Government Gazette A' 214/11.11.2022): This law made further amendments to Law 4557/2018, primarily to incorporate the changes from the EU Regulation on information accompanying transfers of funds and certain crypto-assets (Travel Rule).
Enhanced Due Diligence (EDD): Required for higher-risk situations, such as:
Entity Targeted: A large international organized crime group operating "boiler rooms" (call centers) that defrauded investors across Europe, including Greece, using fake cryptocurrency investments. Violation Type: Investment fraud, aggravated fraud, money laundering, participation in a criminal organization. Outcome: Multiple arrests (at least 15 in Greece, others internationally), dismantling of call centers, freezing of assets. Criminal proceedings are ongoing.
Entity Targeted: Individuals involved in a fraudulent scheme that lured victims into investing in fake cryptocurrency platforms. Violation Type: Fraud, money laundering, establishment/participation in a criminal organization. Outcome: Arrests, ongoing investigations and criminal proceedings.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a remote VASP cannot serve Greek residents from abroad without first incorporating in Greece, registering with the HCMC, and complying with full AML/CFT obligations under Law 4557/2018; true cross-border remote operation without a local entity is not permitted.
Questions this verdict aims to answer
- May a non-resident provider serve residents from abroad?
- Does cross-border service trigger licensing, registration, or AML obligations?
- What enforcement risk exists for unlicensed remote operators?