On-shore VASP in Norway

Finanstilsynet (Financial Supervisory Authority of Norway): This is the primary regulator for financial services and virtual assets in Norway. It is responsible for overseeing compliance with the Anti-Money Laundering Act, including the registration of Virtual Asset Service Providers (VASPs).

Anti-Money Laundering Act (Hvitvaskingsloven) – June 1, 2018 (as amended):

This act transposes the EU's 5th Anti-Money Laundering Directive (AMLD5) into Norwegian law. It defines "virtual currency services" and mandates that entities providing such services (Virtual Asset Service Providers or VASPs) must register with Finanstilsynet.

Registered VASPs are subject to comprehensive AML/CTF obligations, including Know Your Customer (KYC) procedures, transaction monitoring, and suspicious activity reporting.

Financial Institutions Act (Finansforetaksloven) – April 10, 2015:

Future Legislation: Markets in Crypto-Assets (MiCA) Regulation (EU Regulation 2023/1114) – Adopted by EU in May 2023:

Entities offering virtual asset services, including crypto exchanges operating in Norway, are required to register with Finanstilsynet as Virtual Asset Service Providers (VASPs) under the Anti-Money Laundering Act.

Registration entails strict adherence to AML/CTF requirements, including:

VASP Registration: Companies that provide services for the exchange or custody of virtual assets are considered "virtual asset service providers" (VASPs) and must register with Finanstilsynet. This is an AML/CTF (Combatting the Financing of Terrorism) registration, not a full financial services license in the traditional sense, unless the specific virtual asset qualifies as a financial instrument under other legislation.

Requirements for Registration: To register, companies must demonstrate compliance with the Money Laundering Act, which includes:

If the Digital Asset is a Financial Instrument: If a digital asset is classified as a "financial instrument" (e.g., a security token) under the Securities Trading Act (Verdipapirhandelloven) or the Financial Institutions Act (finansforetaksloven), then offering custody services for such assets would fall under existing financial services licensing requirements, which are much more stringent than simple AML registration. Finanstilsynet conducts a case-by-case assessment.

No Specific Mandate for VASPs: There are no specific legal mandates for insurance or bonding solely for virtual asset custodians under the current AML registration regime.

No Explicit Legal Mandate: Norwegian law does not explicitly mandate the use of cold storage for virtual assets.

Security Best Practice: However, Finanstilsynet expects companies providing virtual asset services to have robust security measures in place to protect client assets. Cold storage (offline storage of private keys) is widely recognized as a critical security best practice for managing the risks associated with holding cryptocurrencies and would be considered an essential component of a sound risk management framework by the regulator.

Impact on Custody: MiCA introduces specific and stringent requirements for "custody and administration of crypto-assets on behalf of clients" as a regulated crypto-asset service.

Authorization, Not Just Registration: Under MiCA, entities wishing to provide custody services for crypto-assets (that are not financial instruments) will need to obtain authorization from their national competent authority (Finanstilsynet in Norway) as a Crypto-Asset Service Provider (CASP). This is a much more demanding process than the current AML registration.

Entity Targeted: Kryptobørs AS (a Norwegian crypto exchange). Violation Type: Failure to comply with anti-money laundering (AML) regulations, inadequate internal controls, and operating without proper registration/licensing as a virtual asset service provider (VASP) for all services offered. Penalty Amount: Ordered to terminate its business. No specific monetary fine was publicized in connection with this specific order, but the cessation of operations is a severe penalty. Outcome: Finanstilsynet ordered Kryptobørs AS to terminate its business as a virtual asset service provider due to significant and persistent breaches of the Anti-Money Laundering Act and related regulations. This was a decisive action to remove a non-compliant entity from the market.

Entity Targeted: Norges Kryptobørs AS (a Norwegian crypto exchange). Violation Type: Failure to comply with anti-money laundering (AML) regulations, specifically regarding inadequate risk assessment, customer due diligence (CDD) procedures, and not being properly registered for all types of currency exchange services offered. Penalty Amount: Ordered to cease providing currency exchange services involving fiat currency. No specific monetary fine was publicized in connection with this order, but the restriction on services is a significant penalty. Outcome: Finanstilsynet ordered Norges Kryptobørs AS to stop offering services involving the exchange between virtual and fiat currencies due to serious deficiencies in its AML compliance framework. The firm was permitted to continue offering exchange services between virtual assets.

Taxable Event: A taxable event occurs when you dispose of your cryptocurrency, which includes:

Gain Calculation: The capital gain is calculated as the sales price (or fair market value at the time of exchange/use) minus the acquisition cost (what you paid for it) and any associated transaction costs.

Tax Rate: Capital gains from cryptocurrency are taxed as ordinary income (alminnelig inntekt).

Basis Method: Skatteetaten typically requires the use of the FIFO (First-In, First-Out) method for calculating the acquisition cost when multiple units of the same cryptocurrency have been purchased at different times.

Taxation: Wealth tax is levied by both the state and the municipality. The rates and thresholds vary, but typically range from 0.7% to 1.1% on net assets above certain thresholds.