Remote VASP serving residents in Norway
Foreign-incorporated entity that offers exchange, custody, or transfer services to residents of a jurisdiction without establishing a local entity or office.
Remote VASP is conditionally permitted in Norway with a local entity, subject to AML obligations and medium licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- Medium
- Last updated
- 2026-07-13
AML Obligations
- Registration with Finanstilsynet as a VASP under the Anti-Money Laundering Act (Hvitvaskingsloven) is mandatory for any entity offering virtual asset services to Norwegian residents.
- Robust KYC/CDD procedures must be implemented for all customers.
- Transaction monitoring for suspicious activity is required.
- Suspicious transactions must be reported to Økokrim (National Authority for Investigation and Prosecution of Economic and Environmental Crime).
- Fit and proper management and ownership must be demonstrated.
- Internal control systems for AML/CTF must be established.
- If the virtual asset qualifies as a financial instrument (e.g., security token), full financial services licensing under the Financial Institutions Act applies, with stricter custody and segregation rules.
Key Restrictions
- A non-resident foreign entity cannot serve Norwegian residents remotely without first registering as a VASP with Finanstilsynet — this effectively requires a local presence or local legal entity.
- Cross-border, unlicensed service to Norwegian residents is not permitted; only registered VASPs complying with the AML Act may operate.
- Under MiCA (expected incorporation into Norwegian law 2024–2025), registration will upgrade to a full authorization regime as a CASP, with higher capital and governance requirements.
- If the crypto-asset is deemed a financial instrument, full financial institution licensing under the Financial Institutions Act is triggered.
Key Risks
- Significant enforcement exposure: Finanstilsynet and Økokrim have imposed administrative fines and forced registrations on Norwegian exchanges for operating without proper VASP registration (e.g., Kryptobørs AS and Norges Kryptobørs AS each faced fines of approximately NOK 1.5 million).
- Regulatory ambiguity around classification of digital assets as financial instruments could trigger unexpectedly broader licensing obligations.
- MiCA transition risk — operators who register under the current AML regime will face a new, more demanding authorization regime when MiCA is incorporated, requiring operational changes.
- Tax obligations (22% capital gains tax, wealth tax on holdings) apply regardless of registration status, creating parallel exposure from Skatteetaten.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Finanstilsynet (Financial Supervisory Authority of Norway): This is the primary regulator for financial services and virtual assets in Norway. It is responsible for overseeing compliance with the Anti-Money Laundering Act, including the registration of Virtual Asset Service Providers (VASPs).
Anti-Money Laundering Act (Hvitvaskingsloven) – June 1, 2018 (as amended):
This act transposes the EU's 5th Anti-Money Laundering Directive (AMLD5) into Norwegian law. It defines "virtual currency services" and mandates that entities providing such services (Virtual Asset Service Providers or VASPs) must register with Finanstilsynet.
Registered VASPs are subject to comprehensive AML/CTF obligations, including Know Your Customer (KYC) procedures, transaction monitoring, and suspicious activity reporting.
Entities offering virtual asset services, including crypto exchanges operating in Norway, are required to register with Finanstilsynet as Virtual Asset Service Providers (VASPs) under the Anti-Money Laundering Act.
Registration entails strict adherence to AML/CTF requirements, including:
Financial Institutions Act (Finansforetaksloven) – April 10, 2015:
Future Legislation: Markets in Crypto-Assets (MiCA) Regulation (EU Regulation 2023/1114) – Adopted by EU in May 2023:
MiCA will introduce:
As an EEA member, Norway is legally bound to adopt EU regulations relevant to the internal market. MiCA is expected to be incorporated into Norwegian law, likely in mid-2024 to early 2025, following its phased implementation in the EU (stablecoin rules from June 2024, other rules from December 2024).
VASP Registration: Companies that provide services for the exchange or custody of virtual assets are considered "virtual asset service providers" (VASPs) and must register with Finanstilsynet. This is an AML/CTF (Combatting the Financing of Terrorism) registration, not a full financial services license in the traditional sense, unless the specific virtual asset qualifies as a financial instrument under other legislation.
Requirements for Registration: To register, companies must demonstrate compliance with the Money Laundering Act, which includes:
Reporting suspicious transactions to Økokrim (National Authority for Investigation and Prosecution of Economic and Environmental Crime).
If the Digital Asset is a Financial Instrument: If a digital asset is classified as a "financial instrument" (e.g., a security token) under the Securities Trading Act (Verdipapirhandelloven) or the Financial Institutions Act (finansforetaksloven), then offering custody services for such assets would fall under existing financial services licensing requirements, which are much more stringent than simple AML registration. Finanstilsynet conducts a case-by-case assessment.
Entity Targeted: Kryptobørs AS (a Norwegian crypto exchange). Violation Type: Failure to comply with anti-money laundering (AML) regulations, inadequate internal controls, and operating without proper registration/licensing as a virtual asset service provider (VASP) for all services offered. Penalty Amount: Ordered to terminate its business. No specific monetary fine was publicized in connection with this specific order, but the cessation of operations is a severe penalty. Outcome: Finanstilsynet ordered Kryptobørs AS to terminate its business as a virtual asset service provider due to significant and persistent breaches of the Anti-Money Laundering Act and related regulations. This was a decisive action to remove a non-compliant entity from the market.
Entity Targeted: Norges Kryptobørs AS (a Norwegian crypto exchange). Violation Type: Failure to comply with anti-money laundering (AML) regulations, specifically regarding inadequate risk assessment, customer due diligence (CDD) procedures, and not being properly registered for all types of currency exchange services offered. Penalty Amount: Ordered to cease providing currency exchange services involving fiat currency. No specific monetary fine was publicized in connection with this order, but the restriction on services is a significant penalty. Outcome: Finanstilsynet ordered Norges Kryptobørs AS to stop offering services involving the exchange between virtual and fiat currencies due to serious deficiencies in its AML compliance framework. The firm was permitted to continue offering exchange services between virtual assets.
Taxation Rules (various circulars and regulations from Skatteetaten):
Norway treats virtual currency holdings as assets for tax purposes. Gains from the sale or disposal of virtual currency are subject to capital gains tax (currently 22%). Mining income is considered business or personal income and taxed accordingly. Virtual currency held at year-end is subject to wealth tax.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a foreign entity serving Norwegian residents remotely must register as a VASP with Finanstilsynet under the AML Act (which functionally requires a local presence), and faces medium licensing burden with robust AML obligations and active enforcement risk for unlicensed operation.
Questions this verdict aims to answer
- May a non-resident provider serve residents from abroad?
- Does cross-border service trigger licensing, registration, or AML obligations?
- What enforcement risk exists for unlicensed remote operators?