Crypto ATM / kiosk operator in Moldova
Physical kiosks that exchange cash for crypto (and sometimes vice versa). High-cash AML risk profile.
Crypto ATM is conditionally permitted in Moldova with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- VASPs (including crypto ATM/kiosk operators) must comply with AML/CFT obligations per Law No. 308 (md.aml.law-no-308-of-22, md.aml.crucially-this-law-was-amended)
- Customer Due Diligence (CDD) required: obtain and verify customer name, date of birth, address, and identification number (passport/ID card) from reliable independent sources (md.aml.identification-and-verification-of-identity, md.aml.natural-persons-obtain-and-verify)
- Legal entity customers: obtain and verify name, legal form, address, registration number, and names of directors (md.aml.legal-entities-obtain-and-verify)
- Beneficial Ownership (UBO): identify and verify ultimate beneficial owners and understand ownership/control structure (md.aml.beneficial-ownership-ubo-identify-and)
- Purpose and intended nature of business relationship must be documented (md.aml.purpose-and-intended-nature-of)
- Ongoing monitoring of business relationships and transactions required, including scrutiny of transactions for consistency with customer risk profile (md.aml.ongoing-monitoring-continuously-monitor-the)
- Risk-Based Approach (RBA): classify customers and transactions as low, medium, or high risk (md.aml.risk-based-approach-rba, md.aml.vasps-must-classify-customers-and)
- Enhanced Due Diligence (EDD) required for PEPs, complex/unusually large transactions, unusual transaction patterns (md.aml.enhanced-due-diligence-edd-must, md.aml.transactions-involving-politically-exposed-persons, md.aml.complex-unusually-large-transactions-or)
- Reporting obligations to the FIU under Law No. 308 framework (md.aml.it-defines-the-general-obligations)
- Supervisory authority: National Bank of Moldova (BNM) oversees VASPs for AML/CFT compliance (md.aml.designates-the-national-bank-of)
Key Restrictions
- Licensing regime for VASPs under Law No. 182 — operators must obtain a license from the National Bank of Moldova (BNM) before operating (md.aml.establishes-a-licensing-regime-for, md.aml.key-aspects-of-law-no)
- Operator must be a registered/licensed VASP under Moldovan law; no specific crypto ATM/kiosk exemption exists (md.aml.establishes-a-licensing-regime-for)
- The regulatory framework for VASPs came into effect mid-2024 — operators must be registered, AML-compliant, and supervised (md.enforcement.outcome-a-new-regulatory-framework)
- Cash transaction reporting thresholds under AML Law No. 308 apply but specific threshold amounts were not provided in available facts — further due diligence needed
Key Risks
- New regulatory framework (effective mid-2024) — limited enforcement precedent specific to crypto ATMs; regulatory interpretation may evolve (md.enforcement.outcome-a-new-regulatory-framework)
- High-risk cash-intensive model (crypto ATM) is likely to attract EDD obligations and close BNM scrutiny for unusual or large cash transactions (md.aml.enhanced-due-diligence-edd-must, md.aml.complex-unusually-large-transactions-or)
- Criminal investigations involving cryptocurrency exist but focus on individuals/criminal groups — operators face reputational and legal risk if used for money laundering (md.enforcement.criminal-investigations-involving-cryptocurrency, md.enforcement.example-illustrative-of-typical-criminal)
- Language barrier: regulatory texts primarily in Romanian/Russian, increasing compliance complexity for foreign operators (md.aml.while-direct-links-to-consolidated)
- Moldova is in an enhancement phase with international partners calling for continued strengthening — regulatory requirements may tighten further (md.enforcement.focus-on-amlcft-framework-development)
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Law No. 308 of 22 December 2017 on preventing and combating money laundering and terrorist financing (Legea Nr. 308 din 22.12.2017 privind prevenirea și combaterea spălării banilor și finanțării terorismului):
Crucially, this law was amended to include VASPs as "reporting entities" (subiecți raportori) following the adoption of Law No. 182.
Law No. 182 of 21 July 2022 on the regulation of virtual assets (Legea Nr. 182 din 21.07.2022 privind reglementarea activelor virtuale):
It transposed relevant provisions of the EU's 5th AML Directive (5AMLD) concerning virtual assets and aligns with FATF Recommendation 15 on new technologies.
Key aspects of Law No. 182:
Defines "virtual assets" and "virtual asset service providers" (VASPs).
Establishes a licensing regime for VASPs.
Designates the National Bank of Moldova (BNM) as the supervisory authority for VASPs.
Mandates VASPs to comply with AML/CFT obligations as per Law No. 308.
Natural Persons: Obtain and verify the customer's name, date of birth, address, and an identification number (e.g., passport, ID card number). Verification must be based on reliable, independent source documents, data, or information.
Legal Entities: Obtain and verify the legal entity's name, legal form, address, registration number, and the names of directors/authorized persons.
Beneficial Ownership (UBO): Identify and verify the identity of the ultimate beneficial owner(s) of the customer, understanding the ownership and control structure.
Purpose and Intended Nature of the Business Relationship: Understand the reasons for the customer's transactions and the expected activity.
Ongoing Monitoring: Continuously monitor the business relationship and transactions to ensure they are consistent with the VASP's knowledge of the customer, their business, and risk profile. This includes scrutinizing transactions to ensure they are not suspicious.
Risk-Based Approach (RBA):
VASPs must classify customers and transactions based on their assessed AML/CFT risk (low, medium, high).
Enhanced Due Diligence (EDD): Must be applied in higher-risk situations, including:
Transactions involving politically exposed persons (PEPs).
Complex, unusually large transactions, or unusual patterns of transactions.
It defines the general obligations for reporting entities, the role of the Financial Intelligence Unit (FIU), and the overall framework for AML/CFT compliance.
Moldova has already made notable improvements to its AML/CFT regime and is now in a phase of further enhancement and risk mitigation, with international partners calling for continued strengthening rather than initial framework development.
Regulator: National Bank of Moldova (BNM), General Prosecutor's Office, Financial Intelligence Unit (FIU), National Anticorruption Center (CNA).
Outcome: A new regulatory framework for VASPs, requiring registration, AML/CFT compliance, and supervision, will come into effect in mid-2024. This sets the stage for future enforcement actions.
Criminal Investigations Involving Cryptocurrency:
Example (Illustrative of typical criminal reporting, not a specific crypto-focused regulatory action): News reports from Moldovan outlets (like IPN, Jurnal TV, Pro TV Chișinău) occasionally mention arrests related to fraud or illicit schemes where crypto is involved. However, these are criminal prosecutions, not regulatory actions against a VASP. Finding a direct, publicly reported case with all the requested details specific to crypto-related enforcement is challenging.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — Crypto ATM/kiosk operators are classified as VASPs under Moldova's Law No. 182 and can operate only after obtaining a license from the National Bank of Moldova (BNM) and fully complying with AML/CFT obligations under Law No. 308, including CDD, EDD for high-risk cash transactions, ongoing monitoring, and FIU reporting, under a regulatory framework that took effect in mid-2024.
Questions this verdict aims to answer
- What money-transmitter / kiosk-specific license is required?
- What cash-transaction reporting thresholds apply?
- What enhanced-KYC obligations attach to cash-in / cash-out?