Centralized exchange in Italy
Order-book exchange that takes custody of user assets and matches trades between users.
CEX is conditionally permitted in Italy without local incorporation, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- No
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- Travel Rule (TFR) compliance mandatory for all crypto transfers — must obtain and transmit originator/beneficiary info (aligned with AMLD5 and MiCA)
- Customer due diligence (CDD) and KYC under Legislative Decree No. 231/2007 (Italian AML law) as amended by Legislative Decree No. 204/2024 to include CASPs
- Transaction monitoring and suspicious activity reporting (SAR) to Italian competent authorities
- Registration with OAM (Organismo per la Gestione degli Elenchi di Agenti in Attività Finanziaria e dei Mediatori Creditizi) — mandatory for VASPs pre-MiCA; transition to CASP licensing post-MiCA
- Sanctions screening against EU Consolidated Financial Sanctions List and OFAC SDN List (including crypto addresses)
- Data protection compliance under GDPR for all KYC/AML data processing
- Registration with OAM mandatory for virtual currency service providers (exchanges, wallets) under Ministerial Decree Jan 17, 2022
Key Restrictions
- Must obtain CASP (Crypto-Asset Service Provider) authorization under MiCA as implemented by Legislative Decree No. 129/2024 — for centralized exchanges, authorization is lodged with CONSOB (not Bank of Italy)
- Capital minimum of €50,000–€150,000 scaled by services and risk profile
- Asset segregation requirements apply — user assets must be segregated from operator assets
- Transparent ownership, board with finance/compliance experience, independent compliance and audit functions required
- Governance plans, fit-and-proper assessments for management/owners, AML policies, and risk management systems must be documented and submitted
- Market abuse prevention rules apply under MiCA — market-conduct and disclosure obligations for listed crypto-assets
- Transitional grace period: existing OAM-registered VASPs must apply for CASP authorization by June 30, 2025 (new ops) or by Dec 30, 2025 (extension for existing operators)
- Pre-MiCA (until ~June 2025): operates under registration-only regime with OAM; no full license but mandatory AML/KYC compliance
Key Risks
- Enforcement exposure: fines up to €5 million or 3% of annual turnover for companies, up to €700,000 for individuals, plus potential suspension or revocation of authorization
- Transition risk between OAM registration regime (pre-MiCA) and full CASP authorization (post-June 30, 2025) — operators failing to meet deadlines may face disruption or enforcement
- OFAC extraterritorial reach applies strict liability for sanctions violations — no crypto exception; must block SDN-tied crypto addresses
- Regulatory ambiguity in dual-supervisor model (Bank of Italy vs. CONSOB) — jurisdictional split may create compliance gaps for mixed-service offerings
- Travel Rule implementation complexity for crypto-to-crypto and self-hosted wallet transfers
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
MiCA Regulation (EU) 2023/1114: https://www.boccadutri.com/micar-european-regulation-on-crypto-assets/
Legislative Decree No. 129/2024: https://www.lightspark.com/knowledge/is-crypto-legal-in-italy ; https://cms.law/en/int/expert-guides/cms-expert-guide-to-crypto-regulation/italy
Decree No. 218/2024 (effective Jan 1, 2025): https://www.binance.com/en/square/post/33345454531865
Pre-MiCA (until ~June 2025): Registration-only with OAM for VASPs (exchanges, custody); no full license needed but mandatory AML/KYC compliance. Investors urged to use registered firms.
Post-MiCA (from June 30, 2025): Licensing regime via CASP authorization; single EU passporting allows operation across member states without per-country re-licensing. Transitional grace until Dec 30, 2025, for existing operators.
Capital: €50,000–€150,000 minimum, scaled by services/risks.
AML/KYC: Strict compliance mandatory (Travel Rule, transaction monitoring, suspicious activity reporting); aligns with AMLD5 and GDPR for data protection.
Local Presence/Governance: Transparent ownership; board with finance/compliance experience; risk management systems; independent compliance/audit functions. No explicit branch required due to passporting, but Italian authorities oversee.
Other: Asset segregation, consumer protection, market abuse prevention.
Prepare documentation: Governance plans, fit-and-proper assessments for management/owners, capital proof, AML policies, risk systems.
Lodge with competent authority (Bank of Italy for custody/ARTs/EMTs; Consob for exchanges/platforms).
Undergo review for compliance; authorization grants EU-wide passporting.
Existing OAM-registered VASPs transition by applying before deadlines (June 30, 2025, for new ops; Dec 30, 2025, extension).
Primary Legislation: Regulation (EU) 2023/1114 — Markets in Crypto-Assets (MiCA)
Italian Implementation: Legislative Decree 2024 (approved to adapt national legislation to MiCA requirements); Law Decree 95/2025 (extending VASP registration deadlines)
Primary Supervisory Authority: Bank of Italy (financial stability, systemic risk, cross-border issuance)
Secondary Authority: CONSOB (securities-related aspects, investor protection, MiCAR disclosure compliance)
Consob (Commissione Nazionale per le Società e la Borsa): Oversees investor protection and market integrity; authorizes crypto-asset service providers (CASPs) for most crypto-assets (excluding asset-referenced tokens (ARTs) and e-money tokens (EMTs)).
Bank of Italy (Banca d'Italia): Authorizes issuance of ARTs and EMTs; handles prudential supervision, financial stability, and AML compliance for CASPs.
Legislative Decree No. 129 (effective September 2024): Transposes EU MiCA into Italian law, regulating issuance and trading of crypto-assets, including ARTs and EMTs, with requirements for authorization, asset segregation, and consumer protection.
CONSOB: Oversees securities-related aspects and ensures investor protection compliance with MiCAR disclosure rules.
Primary national law: Legislative Decree No. 231/2007, the core Italian AML/CFT framework, transposed from EU AML Directives (e.g., 2015/849 as amended by 2018/843), covering prevention of money laundering and terrorist financing via the financial system.
Legislative Decree No. 129/2024 (effective September 2024), aligning with EU MiCAR for CASP authorization and operations.
Legislative Decree No. 204/2024 (December 2024), amending AML Law to formally include CASPs.
Ministerial Decree (January 17, 2022), requiring registration with OAM for virtual currency services (e.g., exchanges, e-wallets) operating in Italy, implementing EU rules on virtual assets.
EU alignments: 5th AMLD (2018/843) and TFR recast extend rules to virtual assets and wallet providers.
OFAC: Applies to all U.S. persons and has extraterritorial reach; VASPs must block cryptoassets linked to SDN-listed persons/entities (including wallet addresses) and report to OFAC. Strict liability applies, with no crypto exceptions.
EU/UN: Integrated into MiCA and Italian AML rules; screening prevents dealings with sanctioned parties, with Travel Rule enhancing controls for crypto transfers.
EU Consolidated Financial Sanctions List
OFAC SDN List (including crypto addresses)
MiCA Regulation: EU Regulation 2023/1114 – https://eur-lex.europa.eu/eli/reg/2023/1114/oj
Italian MiCA Decree: Legislative Decree no. 129/2024 – https://www.gazzettaufficiale.it/ (search decree)
OAM VASP Register: https://www.organismo-am.it/
EU Sanctions: https://data.europa.eu/data/datasets/consolidated-list-of-persons-groups-and-entities-subject-to-eu-financial-sanctions?locale=en
Fines up to €5 million or 3% of annual turnover for companies
Suspension or revocation of business authorization
Up to €700,000 for individuals
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — centralized exchanges may operate in Italy under CASP MiCA authorization (via CONSOB) with asset segregation, Travel Rule, AML/KYC obligations and minimum capital of €50k–€150k; pre-MiCA transition via OAM registration until mid-2025; EU passporting available post-authorization with no local entity required.
Questions this verdict aims to answer
- What exchange / VASP license applies?
- What custody segregation rules apply to user assets?
- What market-conduct and listing rules apply?
- What travel-rule obligations apply on withdrawals?