Crypto ATM / kiosk operator in Italy
Physical kiosks that exchange cash for crypto (and sometimes vice versa). High-cash AML risk profile.
Crypto ATM is conditionally permitted in Italy with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- CASP authorization required under MiCA (implemented via Legislative Decree No. 129/2024) with minimum capital of €50,000–€150,000 scaled by services and risk profile – Bank of Italy or CONSOB competent authority depending on asset types
- Mandatory AML/KYC compliance under Legislative Decree No. 231/2007 (core AML framework) as amended by Legislative Decree No. 204/2024 (formally includes CASPs)
- EU Travel Rule (TFR recast) applies to all crypto transfers, requiring originator/beneficiary information collection and transmission
- Mandatory registration with OAM VASP Register (transitional until full CASP authorization under MiCA) per Ministerial Decree of Jan 17, 2022
- Suspicious Transaction Reporting (STR) to Italian Financial Intelligence Unit (UIF) under AML framework
- Transaction monitoring and beneficial ownership screening required
- Sanctions screening against EU Consolidated Financial Sanctions List, OFAC SDN List (extraterritorial), and UN Lists
- Data protection obligations under GDPR for all KYC/AML data processing
Key Restrictions
- Crypto ATM operators require full CASP authorization under MiCA from June 30, 2025 (transitional grace until Dec 30, 2025 for existing OAM-registered operators)
- Local presence/governance required: transparent ownership, board with finance/compliance experience, independent compliance/audit functions, and risk management systems
- Asset segregation and consumer protection requirements apply (no retail customer funds commingled with operating funds)
- Cash-in/cash-out operations likely treated as fiat-to-crypto exchange service, falling under CASP licensing scope
- Geographic restriction: cannot operate in Italy without Italian-authorised CASP status or EU passporting via home-member-state authorisation (with Italian authorities overseeing compliance)
Key Risks
- High-risk AML profile of cash-based crypto transactions attracts enhanced supervisory scrutiny from Bank of Italy and CONSOB
- Fines up to €5 million or 3% of annual turnover (corporate) / €700,000 (individuals) for non-compliance
- Suspension or revocation of business authorization for serious violations
- Transition period ambiguity: operators relying on pre-MiCA OAM registration must apply for full CASP authorization before deadlines or face enforcement
- OFAC extraterritorial strict liability applies even though Italy is EU-aligned — failure to block SDN-linked crypto addresses is a risk for US-connected operators
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
MiCA Regulation (EU) 2023/1114: https://www.boccadutri.com/micar-european-regulation-on-crypto-assets/
Legislative Decree No. 129/2024: https://www.lightspark.com/knowledge/is-crypto-legal-in-italy ; https://cms.law/en/int/expert-guides/cms-expert-guide-to-crypto-regulation/italy
Post-MiCA (from June 30, 2025): Licensing regime via CASP authorization; single EU passporting allows operation across member states without per-country re-licensing. Transitional grace until Dec 30, 2025, for existing operators.
Capital: €50,000–€150,000 minimum, scaled by services/risks.
AML/KYC: Strict compliance mandatory (Travel Rule, transaction monitoring, suspicious activity reporting); aligns with AMLD5 and GDPR for data protection.
Local Presence/Governance: Transparent ownership; board with finance/compliance experience; risk management systems; independent compliance/audit functions. No explicit branch required due to passporting, but Italian authorities oversee.
Other: Asset segregation, consumer protection, market abuse prevention.
Existing OAM-registered VASPs transition by applying before deadlines (June 30, 2025, for new ops; Dec 30, 2025, extension).
Primary Supervisory Authority: Bank of Italy (financial stability, systemic risk, cross-border issuance)
Secondary Authority: CONSOB (securities-related aspects, investor protection, MiCAR disclosure compliance)
Consob (Commissione Nazionale per le Società e la Borsa): Oversees investor protection and market integrity; authorizes crypto-asset service providers (CASPs) for most crypto-assets (excluding asset-referenced tokens (ARTs) and e-money tokens (EMTs)).
Bank of Italy (Banca d'Italia): Authorizes issuance of ARTs and EMTs; handles prudential supervision, financial stability, and AML compliance for CASPs.
Legislative Decree No. 129 (effective September 2024): Transposes EU MiCA into Italian law, regulating issuance and trading of crypto-assets, including ARTs and EMTs, with requirements for authorization, asset segregation, and consumer protection.
Pre-MiCA (until ~June 2025): Registration-only with OAM for VASPs (exchanges, custody); no full license needed but mandatory AML/KYC compliance. Investors urged to use registered firms.
Primary national law: Legislative Decree No. 231/2007, the core Italian AML/CFT framework, transposed from EU AML Directives (e.g., 2015/849 as amended by 2018/843), covering prevention of money laundering and terrorist financing via the financial system.
Legislative Decree No. 204/2024 (December 2024), amending AML Law to formally include CASPs.
Ministerial Decree (January 17, 2022), requiring registration with OAM for virtual currency services (e.g., exchanges, e-wallets) operating in Italy, implementing EU rules on virtual assets.
EU alignments: 5th AMLD (2018/843) and TFR recast extend rules to virtual assets and wallet providers.
OFAC: Applies to all U.S. persons and has extraterritorial reach; VASPs must block cryptoassets linked to SDN-listed persons/entities (including wallet addresses) and report to OFAC. Strict liability applies, with no crypto exceptions.
EU Consolidated Financial Sanctions List
OFAC SDN List (including crypto addresses)
UN Lists: https://www.un.org/securitycouncil/content/un-sc-consolidated-list
Fines up to €5 million or 3% of annual turnover for companies
Suspension or revocation of business authorization
Up to €700,000 for individuals
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — Crypto ATM/kiosk operators are permitted in Italy but require full CASP authorization under MiCA (via Legislative Decree No. 129/2024) with minimum €50k–€150k capital, strict AML/KYC including Travel Rule, OAM registration (transitional until June/Dec 2025), and supervision by Bank of Italy and/or CONSOB depending on asset types.
Questions this verdict aims to answer
- What money-transmitter / kiosk-specific license is required?
- What cash-transaction reporting thresholds apply?
- What enhanced-KYC obligations attach to cash-in / cash-out?