On-shore VASP in Italy
Locally-incorporated VASP that operates under full local jurisdiction, holding all required licenses and registrations.
On-shore VASP is conditionally permitted in Italy with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- Full AML/KYC compliance mandatory under Legislative Decree No. 231/2007 (core Italian AML framework, transposing EU AML Directives)
- Travel Rule compliance required for all crypto-asset transfers
- Transaction monitoring and suspicious activity reporting required
- Registration with OAM (Organismo per la gestione degli elenchi degli Agenti e dei Mediatori) — pre-MiCA registration requirement, continuing under transitional regime
- Sanctions screening against EU Consolidated Financial Sanctions List, OFAC SDN List (extraterritorial reach), and UN sanctions lists
- Customer due diligence (CDD) and KYC procedures aligned with AMLD5 and GDPR
- Asset segregation and consumer protection obligations
- Reporting to Bank of Italy (prudential/AML oversight) and/or CONSOB (investor protection)
- Legislative Decree No. 204/2024 formally includes CASPs under Italian AML law
Key Restrictions
- Must be locally incorporated or established under an EU passport regime — Italian authorities (Bank of Italy, CONSOB) maintain supervisory oversight
- Authorization required from Bank of Italy (for custody, ARTs, EMTs) or CONSOB (for exchanges, trading platforms) under MiCA CASP licensing regime
- Minimum capital requirement of €50,000–€150,000, scaled by services and risk profile
- Fit-and-proper assessments required for management and beneficial owners
- Transparent ownership structure and board with finance/compliance experience required
- Independent compliance and audit functions must be established
- Governance plans, AML policies, and risk management systems must be documented and submitted with application
- Existing OAM-registered operators must transition to full MiCA authorization by deadlines: June 30, 2025 (new operations) or December 30, 2025 (extension for existing operators)
Key Risks
- Enforcement exposure: fines up to €5 million or 3% of annual turnover for companies; up to €700,000 for individuals; suspension or revocation of authorization
- Regulatory ambiguity during the transition period (pre-June 2025 vs. post-MiCA) — overlapping OAM registration and new CASP authorization requirements
- OFAC extraterritorial enforcement risk — U.S. sanctions apply even to Italian-based VASPs handling USD or US-person transactions
- High compliance burden from dual supervision (Bank of Italy + CONSOB) depending on service types offered
- GDPR/data protection obligations intersect with AML/KYC data collection, creating compliance tension
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
MiCA Regulation (EU) 2023/1114: https://www.boccadutri.com/micar-european-regulation-on-crypto-assets/
Legislative Decree No. 129/2024: https://www.lightspark.com/knowledge/is-crypto-legal-in-italy ; https://cms.law/en/int/expert-guides/cms-expert-guide-to-crypto-regulation/italy
Decree No. 218/2024 (effective Jan 1, 2025): https://www.binance.com/en/square/post/33345454531865
Pre-MiCA (until ~June 2025): Registration-only with OAM for VASPs (exchanges, custody); no full license needed but mandatory AML/KYC compliance. Investors urged to use registered firms.
Post-MiCA (from June 30, 2025): Licensing regime via CASP authorization; single EU passporting allows operation across member states without per-country re-licensing. Transitional grace until Dec 30, 2025, for existing operators.
Capital: €50,000–€150,000 minimum, scaled by services/risks.
AML/KYC: Strict compliance mandatory (Travel Rule, transaction monitoring, suspicious activity reporting); aligns with AMLD5 and GDPR for data protection.
Local Presence/Governance: Transparent ownership; board with finance/compliance experience; risk management systems; independent compliance/audit functions. No explicit branch required due to passporting, but Italian authorities oversee.
Other: Asset segregation, consumer protection, market abuse prevention.
Prepare documentation: Governance plans, fit-and-proper assessments for management/owners, capital proof, AML policies, risk systems.
Lodge with competent authority (Bank of Italy for custody/ARTs/EMTs; Consob for exchanges/platforms).
Undergo review for compliance; authorization grants EU-wide passporting.
Existing OAM-registered VASPs transition by applying before deadlines (June 30, 2025, for new ops; Dec 30, 2025, extension).
Primary Legislation: Regulation (EU) 2023/1114 — Markets in Crypto-Assets (MiCA)
Italian Implementation: Legislative Decree 2024 (approved to adapt national legislation to MiCA requirements); Law Decree 95/2025 (extending VASP registration deadlines)
Primary Supervisory Authority: Bank of Italy (financial stability, systemic risk, cross-border issuance)
Secondary Authority: CONSOB (securities-related aspects, investor protection, MiCAR disclosure compliance)
Consob (Commissione Nazionale per le Società e la Borsa): Oversees investor protection and market integrity; authorizes crypto-asset service providers (CASPs) for most crypto-assets (excluding asset-referenced tokens (ARTs) and e-money tokens (EMTs)).
Bank of Italy (Banca d'Italia): Authorizes issuance of ARTs and EMTs; handles prudential supervision, financial stability, and AML compliance for CASPs.
Legislative Decree No. 129 (effective September 2024): Transposes EU MiCA into Italian law, regulating issuance and trading of crypto-assets, including ARTs and EMTs, with requirements for authorization, asset segregation, and consumer protection.
CONSOB: Oversees securities-related aspects and ensures investor protection compliance with MiCAR disclosure rules.
Primary national law: Legislative Decree No. 231/2007, the core Italian AML/CFT framework, transposed from EU AML Directives (e.g., 2015/849 as amended by 2018/843), covering prevention of money laundering and terrorist financing via the financial system.
Legislative Decree No. 129/2024 (effective September 2024), aligning with EU MiCAR for CASP authorization and operations.
Legislative Decree No. 204/2024 (December 2024), amending AML Law to formally include CASPs.
Ministerial Decree (January 17, 2022), requiring registration with OAM for virtual currency services (e.g., exchanges, e-wallets) operating in Italy, implementing EU rules on virtual assets.
EU alignments: 5th AMLD (2018/843) and TFR recast extend rules to virtual assets and wallet providers.
OFAC: Applies to all U.S. persons and has extraterritorial reach; VASPs must block cryptoassets linked to SDN-listed persons/entities (including wallet addresses) and report to OFAC. Strict liability applies, with no crypto exceptions.
EU/UN: Integrated into MiCA and Italian AML rules; screening prevents dealings with sanctioned parties, with Travel Rule enhancing controls for crypto transfers.
EU Consolidated Financial Sanctions List
OFAC SDN List (including crypto addresses)
MiCA Regulation: EU Regulation 2023/1114 – https://eur-lex.europa.eu/eli/reg/2023/1114/oj
Italian MiCA Decree: Legislative Decree no. 129/2024 – https://www.gazzettaufficiale.it/ (search decree)
OAM VASP Register: https://www.organismo-am.it/
EU Sanctions: https://data.europa.eu/data/datasets/consolidated-list-of-persons-groups-and-entities-subject-to-eu-financial-sanctions?locale=en
Fines up to €5 million or 3% of annual turnover for companies
Suspension or revocation of business authorization
Up to €700,000 for individuals
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — On-shore VASPs can operate in Italy by obtaining full MiCA CASP authorization (post-June 30, 2025) from Bank of Italy/CONSOB, with mandatory local governance, capital of €50k–€150k, strict AML/KYC/Travel Rule compliance, and sanctions screening obligations.
Questions this verdict aims to answer
- What license(s) are required to operate locally?
- What capital, governance, and reporting obligations apply?
- What is the application process and timeline?