On-shore VASP in Iceland

Regulator: The primary financial regulator is now the Seðlabanki Íslands (Central Bank of Iceland), which absorbed the functions of the former Financial Supervisory Authority (Fjármálaeftirlitið, FME) in January 2020. It is responsible for supervising financial undertakings, including those dealing with virtual assets, primarily from an AML/CFT perspective.

Focus: The Central Bank's focus has been on implementing AML/CFT regulations for Virtual Asset Service Providers (VASPs), aligning with FATF recommendations and EU directives. They require VASPs to register and comply with the AML/CFT Act.

No Publicly Announced Major Actions: Unlike larger countries where regulatory bodies regularly announce fines or other penalties against specific crypto firms for violations, Iceland has not had such public announcements in the last three years. This doesn't mean there are no regulatory activities, but rather that any actions taken may be less "significant" in the public domain (e.g., private warnings, compliance orders, or smaller, non-public fines) or against individuals rather than companies, or relate to older cases outside the requested timeframe.

Criminal Cases: While there haven't been public administrative actions from the financial regulator, criminal cases involving cryptocurrency fraud or theft can occur, handled by the police and prosecutors. However, such cases are typically against individuals for criminal offenses rather than administrative enforcement against a regulated entity, and no major, widely publicized criminal actions against a crypto company have emerged in the last 3 years that would fit "enforcement action" in the regulatory sense. The prominent "Cloud Mining" Ponzi scheme was investigated and prosecuted years ago, outside the specified 3-year window.

VASP Registration: Any entity providing services related to virtual assets, including the safekeeping and/or administration of virtual assets on behalf of customers (i.e., custody), is required to register as a Virtual Asset Service Provider (VASP) with the Central Bank of Iceland. This is not a "license" in the traditional sense of financial services but rather an AML/CFT registration that imposes significant obligations.

The registration is mandated by the Act on measures to combat money laundering and terrorist financing No. 140/2018, which transposes EU AML Directives (AMLD5, soon AMLD6) into Icelandic law.

Scope: This typically covers situations where the custodian holds private keys and has control over clients' virtual assets.

Act on measures to combat money laundering and terrorist financing No. 140/2018: https://www.althingi.is/lagas/nuna/2018140.html (Icelandic original)

While not explicitly detailed solely for crypto-asset custody in current Icelandic law, general principles of financial services and AML/CFT best practices would strongly suggest the need for segregation. VASPs are expected to maintain clear records of ownership and transactions, and commingling of funds/assets would violate these principles and increase AML/CFT risks.

The AML Act requires VASPs to keep records of transactions and to identify beneficial owners, indirectly supporting the need for clear asset ownership distinctions.

There are no specific insurance or bonding requirements mandated for crypto custodians under the current AML-focused VASP registration framework. General business insurance would be expected, but no specific prudential safeguards for crypto custody are prescribed.

There are no specific legal mandates for the use of cold storage for crypto assets under current Icelandic law. However, robust security measures are expected as part of general operational risk management and AML/CFT compliance (e.g., preventing theft that could facilitate money laundering). Industry best practices for secure custody overwhelmingly recommend cold storage for the majority of assets.

MiCA Authorization: Under MiCA, "custody and administration of crypto-assets on behalf of clients" is explicitly defined as a crypto-asset service (Article 3, point 16). Providers of this service will be required to obtain authorization from their competent national authority (in Iceland, likely the Central Bank of Iceland) to operate as a Crypto-Asset Service Provider (CASP) (Article 59).

This authorization is a full financial services license, distinct from the current AML registration.

Regulation (EU) 2023/1114 on Markets in Crypto-Assets (MiCA): https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32023R1114

Relevant Articles: Chapter 2 (Authorization and operating conditions for CASPs), specifically Article 59, and Chapter 3 (Obligations of CASPs), specifically Section 6 for custody.

Mandatory Segregation: MiCA explicitly mandates strict segregation of client assets.

Article 67 (Obligations of crypto-asset service providers providing custody and administration of crypto-assets on behalf of clients), point 1: "A crypto-asset service provider providing custody and administration of crypto-assets on behalf of clients shall ensure that the crypto-assets of its clients are segregated from its own assets and from the assets of other clients."

It also requires making arrangements to ensure the timely return of clients' crypto-assets.

Prudential Safeguards: MiCA (Article 66, point 10 and Article 67, point 7) requires CASPs to have robust prudential safeguards. These safeguards can take the form of:

Own funds (capital requirements).

An insurance policy.

The amount of prudential safeguards depends on the services provided and the nature, scale, and complexity of operations, with specific thresholds set out in Annex IV.

MiCA does not mandate cold storage specifically but requires CASPs to implement robust security measures for the safekeeping of crypto-assets.

Article 67, point 2: "A crypto-asset service provider providing custody and administration of crypto-assets on behalf of clients shall establish, implement and maintain robust security policies and procedures regarding the access to, and the protection of, the crypto-assets, private cryptographic keys and, where applicable, the means of access to the crypto-assets of its clients."

This implies that CASPs must adopt industry-leading security practices, which in most cases for the majority of assets, would involve cold storage or highly secure offline solutions.

Under MiCA, an authorized Crypto-Asset Service Provider (CASP) that has obtained the specific authorization to provide "custody and administration of crypto-assets on behalf of clients" would essentially become the "qualified custodian." The authorization process ensures they meet the stringent capital, operational, security, governance, and organizational requirements laid out in MiCA.