Centralized exchange in Norway
Order-book exchange that takes custody of user assets and matches trades between users.
CEX is conditionally permitted in Norway with a local entity, subject to AML obligations and medium licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- Medium
- Last updated
- 2026-07-13
AML Obligations
- VASP registration with Finanstilsynet under the Anti-Money Laundering Act (Hvitvaskingsloven) transposing AMLD5
- Implement robust KYC procedures for all customers (customer due diligence/CDD)
- Establish robust internal control systems for AML/CTF
- Monitor transactions for suspicious activity
- Report suspicious transactions to Økokrim
- Ensure fit and proper management and ownership
- Travel Rule obligations will apply when MiCA is incorporated into Norwegian law (expected mid-2024 to early 2025) — CASPs will need to comply with information-sharing requirements on crypto transfers
- Under the current AML registration regime, no specific segregation mandate exists for VASPs unless the asset qualifies as a financial instrument; MiCA will introduce strict custody and segregation requirements for CASPs
Key Restrictions
- Must register as a VASP with Finanstilsynet — this is an AML/CTF registration, not a full financial services license
- If a crypto-asset is classified as a financial instrument (e.g., security token), additional licensing under the Financial Institutions Act and Securities Trading Act may apply
- Under MiCA (expected to be incorporated soon), VASPs will need to upgrade to CASP authorization — a more capital-intensive and comprehensive licensing regime
- No specific legal mandate for cold storage, but Finanstilsynet expects robust security measures including cold storage as best practice
- No explicit legal mandate for segregation of client crypto assets under current VASP regime (unless asset is a financial instrument); MiCA will introduce segregation requirements
- No specific insurance/bonding mandate for crypto custodians under current regime
Key Risks
- Enforcement precedent: Kryptobørs AS and Norges Kryptobørs AS were both penalized for AML compliance failures and operating without proper VASP registration — demonstrates active enforcement
- Regulatory ambiguity around classification of crypto-assets as financial instruments could create unexpected licensing obligations
- Transitional risk: MiCA implementation will shift from AML registration to full CASP authorization, raising capital/compliance costs
- Tax exposure: Virtual currency gains subject to 22% capital gains tax; holdings at year-end subject to wealth tax; unclear tax treatment can create reporting risk
- No explicit custody segregation rules under current VASP regime creates operational risk until MiCA harmonization
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Finanstilsynet (Financial Supervisory Authority of Norway): This is the primary regulator for financial services and virtual assets in Norway. It is responsible for overseeing compliance with the Anti-Money Laundering Act, including the registration of Virtual Asset Service Providers (VASPs).
Anti-Money Laundering Act (Hvitvaskingsloven) – June 1, 2018 (as amended):
This act transposes the EU's 5th Anti-Money Laundering Directive (AMLD5) into Norwegian law. It defines "virtual currency services" and mandates that entities providing such services (Virtual Asset Service Providers or VASPs) must register with Finanstilsynet.
Registered VASPs are subject to comprehensive AML/CTF obligations, including Know Your Customer (KYC) procedures, transaction monitoring, and suspicious activity reporting.
Entities offering virtual asset services, including crypto exchanges operating in Norway, are required to register with Finanstilsynet as Virtual Asset Service Providers (VASPs) under the Anti-Money Laundering Act.
Registration entails strict adherence to AML/CTF requirements, including:
Financial Institutions Act (Finansforetaksloven) – April 10, 2015:
Future Legislation: Markets in Crypto-Assets (MiCA) Regulation (EU Regulation 2023/1114) – Adopted by EU in May 2023:
MiCA will introduce:
As an EEA member, Norway is legally bound to adopt EU regulations relevant to the internal market. MiCA is expected to be incorporated into Norwegian law, likely in mid-2024 to early 2025, following its phased implementation in the EU (stablecoin rules from June 2024, other rules from December 2024).
VASP Registration: Companies that provide services for the exchange or custody of virtual assets are considered "virtual asset service providers" (VASPs) and must register with Finanstilsynet. This is an AML/CTF (Combatting the Financing of Terrorism) registration, not a full financial services license in the traditional sense, unless the specific virtual asset qualifies as a financial instrument under other legislation.
Requirements for Registration: To register, companies must demonstrate compliance with the Money Laundering Act, which includes:
Establishing robust internal control systems for AML/CTF.
Performing customer due diligence (CDD) procedures.
Monitoring transactions for suspicious activity.
Reporting suspicious transactions to Økokrim (National Authority for Investigation and Prosecution of Economic and Environmental Crime).
Ensuring fit and proper management and ownership.
No Specific Mandate for VASPs: There are no specific legal mandates for insurance or bonding solely for virtual asset custodians under the current AML registration regime.
No Explicit Legal Mandate: Norwegian law does not explicitly mandate the use of cold storage for virtual assets.
Security Best Practice: However, Finanstilsynet expects companies providing virtual asset services to have robust security measures in place to protect client assets. Cold storage (offline storage of private keys) is widely recognized as a critical security best practice for managing the risks associated with holding cryptocurrencies and would be considered an essential component of a sound risk management framework by the regulator.
If classified as a Financial Instrument: If the virtual asset is deemed a financial instrument, then the rules under the Financial Institutions Act for safeguarding client funds/assets would apply, which mandates strict segregation from the firm's own assets.
No Specific Definition: Norway does not currently have a specific legal definition of a "qualified custodian" exclusively for virtual assets, akin to definitions found in some other jurisdictions (e.g., the U.S.).
MiCA's Scope: MiCA provides a comprehensive regulatory framework for crypto-asset markets and service providers (CASPs) not already covered by existing financial services legislation. It aims to harmonize rules across the EU/EEA, ensure consumer protection, market integrity, and financial stability.
Impact on Custody: MiCA introduces specific and stringent requirements for "custody and administration of crypto-assets on behalf of clients" as a regulated crypto-asset service.
Authorization, Not Just Registration: Under MiCA, entities wishing to provide custody services for crypto-assets (that are not financial instruments) will need to obtain authorization from their national competent authority (Finanstilsynet in Norway) as a Crypto-Asset Service Provider (CASP). This is a much more demanding process than the current AML registration.
Entity Targeted: Kryptobørs AS (a Norwegian crypto exchange). Violation Type: Failure to comply with anti-money laundering (AML) regulations, inadequate internal controls, and operating without proper registration/licensing as a virtual asset service provider (VASP) for all services offered. Penalty Amount: Ordered to terminate its business. No specific monetary fine was publicized in connection with this specific order, but the cessation of operations is a severe penalty. Outcome: Finanstilsynet ordered Kryptobørs AS to terminate its business as a virtual asset service provider due to significant and persistent breaches of the Anti-Money Laundering Act and related regulations. This was a decisive action to remove a non-compliant entity from the market.
Entity Targeted: Norges Kryptobørs AS (a Norwegian crypto exchange). Violation Type: Failure to comply with anti-money laundering (AML) regulations, specifically regarding inadequate risk assessment, customer due diligence (CDD) procedures, and not being properly registered for all types of currency exchange services offered. Penalty Amount: Ordered to cease providing currency exchange services involving fiat currency. No specific monetary fine was publicized in connection with this order, but the restriction on services is a significant penalty. Outcome: Finanstilsynet ordered Norges Kryptobørs AS to stop offering services involving the exchange between virtual and fiat currencies due to serious deficiencies in its AML compliance framework. The firm was permitted to continue offering exchange services between virtual assets.
Taxation Rules (various circulars and regulations from Skatteetaten):
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — centralized exchanges may operate in Norway by registering as VASPs with Finanstilsynet under the Anti-Money Laundering Act, with comprehensive AML/CTF obligations; however, MiCA is expected to be incorporated soon, transitioning the regime to a full CASP authorization model with stricter custody, segregation, and capital requirements.
Questions this verdict aims to answer
- What exchange / VASP license applies?
- What custody segregation rules apply to user assets?
- What market-conduct and listing rules apply?
- What travel-rule obligations apply on withdrawals?