Crypto ATM / kiosk operator in Croatia
Physical kiosks that exchange cash for crypto (and sometimes vice versa). High-cash AML risk profile.
Crypto ATM is conditionally permitted in Croatia with a local entity, subject to AML obligations and medium licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- Medium
- Last updated
- 2026-07-13
AML Obligations
- Registration with USPN (Ministry of Finance – Financial Intelligence Office) as a VASP under the Croatian Anti-Money Laundering and Terrorist Financing Act (Zakon o sprječavanju pranja novca i financiranja terorizma) which transposes AMLD5
- Implement robust KYC/CDD (Know Your Customer/Customer Due Diligence) procedures for all customers
- Enhanced Due Diligence (EDD) for higher-risk transactions — cash-in/cash-out at kiosks likely triggers EDD obligations given the high-cash AML risk profile
- Ongoing monitoring of transactions
- Reporting suspicious activities to the Financial Intelligence Office (USPN)
- Appointing an AML Officer (nominated person)
- Establishing and maintaining comprehensive internal AML/CFT policies and procedures
- Conducting a robust risk assessment covering operations, customers, products, and geographies
- Record-keeping obligations under the AML framework
Key Restrictions
- Must incorporate a legal entity in Croatia with a registered office in Croatia to apply for USPN VASP registration
- Operating a crypto ATM/kiosk falls under the VASP definition (exchange between virtual assets and fiat currencies) and requires USPN registration — no specific 'kiosk' license exists, but the VASP registration is mandatory
- No specific cash-transaction reporting threshold is explicitly identified in source facts for Croatia; general suspicious transaction reporting applies
- From 30 December 2025, MiCA (Regulation EU 2023/1114) will introduce a harmonized CASP licensing regime — operators must transition to a full license from a competent national authority (likely HANFA in coordination with USPN)
- No specific cold storage mandates, segregation rules, or insurance/bonding requirements currently mandated by national law for VASPs
Key Risks
- Cash-intensive nature of crypto ATMs creates elevated AML/CTF risk profile that may attract heightened supervisory scrutiny from USPN
- Absence of explicit national cash-transaction reporting thresholds creates regulatory ambiguity around reporting obligations for cash-in/cash-out kiosk transactions
- No specific qualified custodian definition or segregation/insurance/cold storage mandates at national level — gaps that may be addressed under MiCA from Dec 2025
- Transition from current registration regime to full MiCA CASP licensing by Dec 2025 imposes upcoming compliance cost and license migration risk
- Kiosk operators unfamiliar with EU AML frameworks may face enforcement exposure for inadequate EDD on cash transactions
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Office for Anti-Money Laundering (Ured za sprječavanje pranja novca – USPN): This is the primary authority responsible for supervising the implementation of AML/CFT measures by obliged entities, including VASPs. They maintain the register of VASPs.
Current Regime (Pre-MiCA): Croatia operates a registration regime for VASPs, primarily for AML/CFT supervision. This means entities providing virtual asset services must register with the USPN and comply with AML obligations. It is not a full financial services license in the traditional sense, but an AML registration.
Future Regime (Post-MiCA): From December 30, 2025, MiCA will introduce a harmonized licensing regime across the EU. Entities providing "crypto-asset services" (as defined by MiCA) will require a license from a competent national authority (likely HANFA in Croatia, in coordination with USPN for AML aspects) in one EU member state, which will then allow them to operate across the entire EU ("passporting"). This will replace the national AML registrations for the services covered by MiCA.
Services related to the exchange between virtual assets and fiat currencies.
Exchanges (Fiat-to-Crypto and Crypto-to-Crypto):
Generally, a legal entity incorporated in Croatia is required to apply for registration.
A registered office in Croatia is necessary.
AML/KYC Framework: This is the most critical aspect:
AML/CFT Policies and Procedures: Comprehensive internal rules and procedures for customer due diligence (CDD), enhanced due diligence (EDD), ongoing monitoring, record-keeping, and reporting suspicious transactions.
Risk Assessment: A robust risk assessment methodology for identifying and mitigating money laundering and terrorist financing risks associated with the VASP's operations, customers, products, and geographies.
Regulation (EU) 2023/1114 on Markets in Crypto-Assets (MiCA): https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32023R1114 (Note: MiCA has a phased implementation, with most provisions for CASPs applying from 30 December 2025).
VASPs are required to register with the Ministry of Finance – Financial Intelligence Office (Ured za sprječavanje pranja novca) as part of their AML/CTF obligations.
This registration requires compliance with the Croatian Anti-Money Laundering and Terrorist Financing Act (Zakon o sprječavanju pranja novca i financiranja terorizma), which transposes EU AML Directives (specifically AMLD5).
Implementing robust KYC/CDD (Know Your Customer/Customer Due Diligence) procedures.
Reporting suspicious activities to the Financial Intelligence Office.
Appointing an AML Officer.
Establishing internal AML policies and procedures.
Zakon o sprječavanju pranja novca i financiranja terorizma (Anti-Money Laundering and Terrorist Financing Act):
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — crypto ATM/kiosk operators are permitted in Croatia as VASPs, subject to USPN AML registration, local entity incorporation, robust KYC/CDD/EDD procedures, and suspicious transaction reporting; a harmonized MiCA CASP licensing regime will apply from December 30, 2025.
Questions this verdict aims to answer
- What money-transmitter / kiosk-specific license is required?
- What cash-transaction reporting thresholds apply?
- What enhanced-KYC obligations attach to cash-in / cash-out?