Crypto ATM / kiosk operator in Iceland
Physical kiosks that exchange cash for crypto (and sometimes vice versa). High-cash AML risk profile.
Crypto ATM is conditionally permitted in Iceland with a local entity, subject to AML obligations and medium licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- Medium
- Last updated
- 2026-07-13
AML Obligations
- VASP registration with the Central Bank of Iceland (Seðlabanki Íslands) is mandatory — this is not a full license but a mandatory AML registration under Act No. 140/2018 (transposing AMLD5).
- Customer due diligence (CDD) and ongoing monitoring under the Act on Measures Against Money Laundering and Terrorist Financing No. 140/2018.
- Record-keeping of transactions and beneficial ownership identification required under the AML Act.
- Cash-transaction reporting obligations — Iceland's AML framework follows EU AMLD5 standards; cash-in/cash-out at kiosks above EUR 10,000 (or equivalent ISK) triggers mandatory suspicious transaction reporting (STR) to the Financial Intelligence Unit.
- Any transaction involving physical cash at a kiosk that is unusual or suspicious must be reported regardless of threshold.
- Pending MiCA implementation: full CASP authorization (including prudential safeguards, own funds, or insurance under Article 66-67) will eventually supersede or supplement current AML registration.
Key Restrictions
- Operator must be physically present or represented in Iceland — VASP registration requires a registered entity with the Central Bank.
- Current framework is AML-registration only (not a full license); full MiCA CASP authorization will be required once MiCA is fully transposed (phased in from 2024-2025).
- No specific kiosk/money-transmitter license exists — crypto ATM operators fall under the general VASP registration umbrella.
- Segregation of customer crypto assets is not yet explicitly mandated in current law but becomes mandatory under MiCA.
Key Risks
- Regulatory ambiguity — no publicly announced enforcement actions or formal guidance specific to crypto ATMs/kiosks in the last three years, making compliance expectations uncertain.
- Cash-intensive business model raises inherent AML/CFT red flags; Icelandic regulator may scrutinize kiosk operators heavily for cash-transaction reporting gaps.
- MiCA transition risk — operators currently under AML registration may need to upgrade to full CASP authorization with capital/insurance requirements, creating cost and timeline exposure.
- No specific prudential or insurance requirements currently, but general business insurance expectations create ambiguity about adequate coverage.
- Small market size may limit operational viability for dedicated kiosk networks.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Regulator: The primary financial regulator is now the Seðlabanki Íslands (Central Bank of Iceland), which absorbed the functions of the former Financial Supervisory Authority (Fjármálaeftirlitið, FME) in January 2020. It is responsible for supervising financial undertakings, including those dealing with virtual assets, primarily from an AML/CFT perspective.
Focus: The Central Bank's focus has been on implementing AML/CFT regulations for Virtual Asset Service Providers (VASPs), aligning with FATF recommendations and EU directives. They require VASPs to register and comply with the AML/CFT Act.
Central Bank of Iceland (Seðlabanki Íslands) on Virtual Assets:
AML/CFT Act in Iceland: Iceland has implemented the 5th Anti-Money Laundering Directive (AMLD5), which covers virtual asset service providers. The legal framework is primarily the Act on Measures Against Money Laundering and Terrorist Financing No. 140/2018.
VASP Registration: Any entity providing services related to virtual assets, including the safekeeping and/or administration of virtual assets on behalf of customers (i.e., custody), is required to register as a Virtual Asset Service Provider (VASP) with the Central Bank of Iceland. This is not a "license" in the traditional sense of financial services but rather an AML/CFT registration that imposes significant obligations.
The registration is mandated by the Act on measures to combat money laundering and terrorist financing No. 140/2018, which transposes EU AML Directives (AMLD5, soon AMLD6) into Icelandic law.
Scope: This typically covers situations where the custodian holds private keys and has control over clients' virtual assets.
Act on measures to combat money laundering and terrorist financing No. 140/2018: https://www.althingi.is/lagas/nuna/2018140.html (Icelandic original)
Central Bank of Iceland - AML/CFT: https://www.cb.is/financial-supervision/aml-cft/
The AML Act requires VASPs to keep records of transactions and to identify beneficial owners, indirectly supporting the need for clear asset ownership distinctions.
MiCA Authorization: Under MiCA, "custody and administration of crypto-assets on behalf of clients" is explicitly defined as a crypto-asset service (Article 3, point 16). Providers of this service will be required to obtain authorization from their competent national authority (in Iceland, likely the Central Bank of Iceland) to operate as a Crypto-Asset Service Provider (CASP) (Article 59).
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — Crypto ATM/kiosk operators may serve Iceland residents subject to VASP AML registration with the Central Bank of Iceland (Act No. 140/2018), but must prepare for the upcoming MiCA transition to a full CASP authorization with prudential requirements; no kiosk-specific license exists, and the lack of enforcement precedent creates moderate regulatory ambiguity.
Questions this verdict aims to answer
- What money-transmitter / kiosk-specific license is required?
- What cash-transaction reporting thresholds apply?
- What enhanced-KYC obligations attach to cash-in / cash-out?