Crypto-funded debit card in Iceland

Regulator: The primary financial regulator is now the Seðlabanki Íslands (Central Bank of Iceland), which absorbed the functions of the former Financial Supervisory Authority (Fjármálaeftirlitið, FME) in January 2020. It is responsible for supervising financial undertakings, including those dealing with virtual assets, primarily from an AML/CFT perspective.

Focus: The Central Bank's focus has been on implementing AML/CFT regulations for Virtual Asset Service Providers (VASPs), aligning with FATF recommendations and EU directives. They require VASPs to register and comply with the AML/CFT Act.

No Publicly Announced Major Actions: Unlike larger countries where regulatory bodies regularly announce fines or other penalties against specific crypto firms for violations, Iceland has not had such public announcements in the last three years. This doesn't mean there are no regulatory activities, but rather that any actions taken may be less "significant" in the public domain (e.g., private warnings, compliance orders, or smaller, non-public fines) or against individuals rather than companies, or relate to older cases outside the requested timeframe.

Criminal Cases: While there haven't been public administrative actions from the financial regulator, criminal cases involving cryptocurrency fraud or theft can occur, handled by the police and prosecutors. However, such cases are typically against individuals for criminal offenses rather than administrative enforcement against a regulated entity, and no major, widely publicized criminal actions against a crypto company have emerged in the last 3 years that would fit "enforcement action" in the regulatory sense. The prominent "Cloud Mining" Ponzi scheme was investigated and prosecuted years ago, outside the specified 3-year window.

VASP Registration: Any entity providing services related to virtual assets, including the safekeeping and/or administration of virtual assets on behalf of customers (i.e., custody), is required to register as a Virtual Asset Service Provider (VASP) with the Central Bank of Iceland. This is not a "license" in the traditional sense of financial services but rather an AML/CFT registration that imposes significant obligations.

The registration is mandated by the Act on measures to combat money laundering and terrorist financing No. 140/2018, which transposes EU AML Directives (AMLD5, soon AMLD6) into Icelandic law.

Scope: This typically covers situations where the custodian holds private keys and has control over clients' virtual assets.

Act on measures to combat money laundering and terrorist financing No. 140/2018: https://www.althingi.is/lagas/nuna/2018140.html (Icelandic original)

MiCA Authorization: Under MiCA, "custody and administration of crypto-assets on behalf of clients" is explicitly defined as a crypto-asset service (Article 3, point 16). Providers of this service will be required to obtain authorization from their competent national authority (in Iceland, likely the Central Bank of Iceland) to operate as a Crypto-Asset Service Provider (CASP) (Article 59).

This authorization is a full financial services license, distinct from the current AML registration.

Mandatory Segregation: MiCA explicitly mandates strict segregation of client assets.

Article 67 (Obligations of crypto-asset service providers providing custody and administration of crypto-assets on behalf of clients), point 1: "A crypto-asset service provider providing custody and administration of crypto-assets on behalf of clients shall ensure that the crypto-assets of its clients are segregated from its own assets and from the assets of other clients."

Prudential Safeguards: MiCA (Article 66, point 10 and Article 67, point 7) requires CASPs to have robust prudential safeguards. These safeguards can take the form of:

Own funds (capital requirements).

An insurance policy.

This implies that CASPs must adopt industry-leading security practices, which in most cases for the majority of assets, would involve cold storage or highly secure offline solutions.

Electronic Money Tokens (EMTs):

Defined as a crypto-asset that purports to maintain a stable value by referencing the value of one single official currency (e.g., a EUR-backed stablecoin).

Issuers of EMTs must be authorized either as a credit institution (bank) or as an electronic money institution (EMI) under Directive 2009/110/EC (and thus under Act No. 87/2011 in Iceland) AND receive specific authorization under MiCA from the FSA.

EMIs issuing EMTs are subject to stricter prudential and governance requirements under MiCA than standard EMIs.

Holders of EMTs have a right to redeem their tokens at par (1:1) at any time, against the single fiat currency referenced, directly from the issuer.

Issuers of ARTs must be authorized by the competent authority (the FSA in Iceland) under MiCA.

This authorization process includes rigorous requirements regarding governance arrangements, capital requirements (minimum capital of €350,000 or 0.2% of the average amount of ARTs in circulation, whichever is higher), operational resilience, recovery and resolution plans, and robust internal controls.

Holders of ARTs have a right to redeem their tokens directly from the issuer.