Crypto ATM / kiosk operator in Norway
Physical kiosks that exchange cash for crypto (and sometimes vice versa). High-cash AML risk profile.
Crypto ATM is conditionally permitted in Norway with a local entity, subject to AML obligations and medium licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- Medium
- Last updated
- 2026-07-13
AML Obligations
- VASP registration with Finanstilsynet under the Anti-Money Laundering Act (Hvitvaskingsloven) is mandatory for any entity providing virtual asset exchange services, including ATM/kiosk operators
- Implement robust KYC procedures for all customers before any transaction
- Perform customer due diligence (CDD) on all users of the ATM/kiosk
- Monitor all transactions for suspicious activity
- Report suspicious transactions to Økokrim (National Authority for Investigation and Prosecution of Economic and Environmental Crime)
- Establish robust internal control systems for AML/CTF
- Ensure fit and proper management and ownership
- Cash transaction reporting thresholds apply under the Money Laundering Act — no specific crypto-ATM threshold was provided in the facts, but Norway's general cash transaction rules would apply (typically EUR 10,000 equivalent for cash transactions under AML frameworks)
- Enhanced due diligence for high-risk cash transactions (cash-in/cash-out at kiosks would inherently present elevated AML risk)
- Ongoing transaction monitoring obligations apply to all crypto-fiat conversions at kiosks
Key Restrictions
- Must register as a VASP with Finanstilsynet before commencing operations
- Must have a physical/local presence in Norway (registration requires Norwegian entity or branch)
- Must comply with the Financial Institutions Act if any crypto-asset offered qualifies as a 'financial instrument' (security token) — which would trigger a much higher licensing burden
- MiCA (yet to be incorporated into Norwegian EEA law) will introduce a full CASP authorization regime, replacing the current VASP registration — transitional arrangements will apply
Key Risks
- Enforcement precedent: Kryptobørs AS and Norges Kryptobørs AS were penalized for operating without proper VASP registration and inadequate AML controls — ATM operators face similar exposure
- High cash volumes at kiosks attract enhanced scrutiny from Finanstilsynet and Økokrim for money laundering risk
- MiCA transition risk — the regulatory regime is about to change from AML registration to full CASP authorization, creating operational and compliance discontinuity
- Tax reporting complexity: all crypto transactions are taxable events (22% capital gains tax), and year-end holdings are subject to wealth tax — kiosk operators must handle reporting obligations for customers
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Finanstilsynet (Financial Supervisory Authority of Norway): This is the primary regulator for financial services and virtual assets in Norway. It is responsible for overseeing compliance with the Anti-Money Laundering Act, including the registration of Virtual Asset Service Providers (VASPs).
Anti-Money Laundering Act (Hvitvaskingsloven) – June 1, 2018 (as amended):
This act transposes the EU's 5th Anti-Money Laundering Directive (AMLD5) into Norwegian law. It defines "virtual currency services" and mandates that entities providing such services (Virtual Asset Service Providers or VASPs) must register with Finanstilsynet.
Registered VASPs are subject to comprehensive AML/CTF obligations, including Know Your Customer (KYC) procedures, transaction monitoring, and suspicious activity reporting.
Entities offering virtual asset services, including crypto exchanges operating in Norway, are required to register with Finanstilsynet as Virtual Asset Service Providers (VASPs) under the Anti-Money Laundering Act.
Registration entails strict adherence to AML/CTF requirements, including:
Financial Institutions Act (Finansforetaksloven) – April 10, 2015:
Future Legislation: Markets in Crypto-Assets (MiCA) Regulation (EU Regulation 2023/1114) – Adopted by EU in May 2023:
VASP Registration: Companies that provide services for the exchange or custody of virtual assets are considered "virtual asset service providers" (VASPs) and must register with Finanstilsynet. This is an AML/CTF (Combatting the Financing of Terrorism) registration, not a full financial services license in the traditional sense, unless the specific virtual asset qualifies as a financial instrument under other legislation.
Requirements for Registration: To register, companies must demonstrate compliance with the Money Laundering Act, which includes:
Establishing robust internal control systems for AML/CTF.
Performing customer due diligence (CDD) procedures.
Monitoring transactions for suspicious activity.
Reporting suspicious transactions to Økokrim (National Authority for Investigation and Prosecution of Economic and Environmental Crime).
Ensuring fit and proper management and ownership.
Entity Targeted: Kryptobørs AS (a Norwegian crypto exchange). Violation Type: Failure to comply with anti-money laundering (AML) regulations, inadequate internal controls, and operating without proper registration/licensing as a virtual asset service provider (VASP) for all services offered. Penalty Amount: Ordered to terminate its business. No specific monetary fine was publicized in connection with this specific order, but the cessation of operations is a severe penalty. Outcome: Finanstilsynet ordered Kryptobørs AS to terminate its business as a virtual asset service provider due to significant and persistent breaches of the Anti-Money Laundering Act and related regulations. This was a decisive action to remove a non-compliant entity from the market.
Entity Targeted: Norges Kryptobørs AS (a Norwegian crypto exchange). Violation Type: Failure to comply with anti-money laundering (AML) regulations, specifically regarding inadequate risk assessment, customer due diligence (CDD) procedures, and not being properly registered for all types of currency exchange services offered. Penalty Amount: Ordered to cease providing currency exchange services involving fiat currency. No specific monetary fine was publicized in connection with this order, but the restriction on services is a significant penalty. Outcome: Finanstilsynet ordered Norges Kryptobørs AS to stop offering services involving the exchange between virtual and fiat currencies due to serious deficiencies in its AML compliance framework. The firm was permitted to continue offering exchange services between virtual assets.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — crypto ATM/kiosk operators in Norway must register as VASPs with Finanstilsynet under the Anti-Money Laundering Act, implement full AML/KYC programs including suspicious transaction reporting to Økokrim, and should expect a transition to MiCA CASP authorization once incorporated into EEA law; cash-intensive operations carry elevated enforcement risk as demonstrated by prior penalties against Norwegian crypto exchanges.
Questions this verdict aims to answer
- What money-transmitter / kiosk-specific license is required?
- What cash-transaction reporting thresholds apply?
- What enhanced-KYC obligations attach to cash-in / cash-out?