Self-custodial wallet / non-custodial software in Norway
Publisher of software where users hold their own private keys. The publisher never holds, controls, or has access to user funds.
Self-custodial wallet is conditionally permitted in Norway without local incorporation, subject to AML obligations and none licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- No
- Licensing burden
- None
- Last updated
- 2026-07-13
AML Obligations
- No AML obligations attach because the publisher never holds, controls, or has access to user funds or private keys.
- The Anti-Money Laundering Act (Hvitvaskingsloven) defines VASPs as entities providing exchange OR custody services — mere software publishing without custody does not meet that threshold.
- If the wallet software were bundled with a custodial service layer (e.g., an integrated on-ramp where the publisher controls keys), VASP registration with Finanstilsynet and full AML/CTF obligations would apply (KYC, CDD, transaction monitoring, suspicious activity reporting to Økokrim).
Key Restrictions
- The publisher must not exercise any form of custody, control, or access over user private keys or funds — even temporarily or programmatically — or VASP classification will be triggered.
- If the wallet software additionally offers exchange, conversion, or fiat on-ramp/off-ramp services where the publisher is counterparty, those activities require VASP registration with Finanstilsynet.
- Under MiCA (expected incorporation into Norwegian law), 'custody and administration of crypto-assets on behalf of clients' will be a regulated CASP activity requiring authorization — but non-custodial software publishing should remain excluded as the publisher is not providing custody.
- General consumer-protection laws (e.g., misleading advertising, product liability) apply to software distribution, but no crypto-specific consumer-protection framework currently applies to non-custodial wallet publishers.
Key Risks
- Regulatory ambiguity: Finanstilsynet guidance focuses on exchange and custody services; non-custodial wallet software publishing falls in a grey zone not explicitly addressed. Future MiCA implementation could clarify or expand the scope.
- If the software monetizes through integrated third-party services (e.g., swap APIs, staking) where the publisher receives fees, this could be interpreted as providing virtual asset services, triggering VASP obligations.
- Tax obligations for users are clear (capital gains tax at 22%, wealth tax on holdings), but the publisher has no tax reporting obligations as a non-custodial software provider.
- Enforcement precedent: Kryptobørs AS and Norges Kryptobørs AS were sanctioned for AML failures — these cases involved custodial exchange services, demonstrating that Finanstilsynet actively enforces VASP obligations where custody exists.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Finanstilsynet (Financial Supervisory Authority of Norway): This is the primary regulator for financial services and virtual assets in Norway. It is responsible for overseeing compliance with the Anti-Money Laundering Act, including the registration of Virtual Asset Service Providers (VASPs).
Anti-Money Laundering Act (Hvitvaskingsloven) – June 1, 2018 (as amended):
This act transposes the EU's 5th Anti-Money Laundering Directive (AMLD5) into Norwegian law. It defines "virtual currency services" and mandates that entities providing such services (Virtual Asset Service Providers or VASPs) must register with Finanstilsynet.
Registered VASPs are subject to comprehensive AML/CTF obligations, including Know Your Customer (KYC) procedures, transaction monitoring, and suspicious activity reporting.
VASP Registration: Companies that provide services for the exchange or custody of virtual assets are considered "virtual asset service providers" (VASPs) and must register with Finanstilsynet. This is an AML/CTF (Combatting the Financing of Terrorism) registration, not a full financial services license in the traditional sense, unless the specific virtual asset qualifies as a financial instrument under other legislation.
Requirements for Registration: To register, companies must demonstrate compliance with the Money Laundering Act, which includes:
Entity Targeted: Kryptobørs AS (a Norwegian crypto exchange). Violation Type: Failure to comply with anti-money laundering (AML) regulations, inadequate internal controls, and operating without proper registration/licensing as a virtual asset service provider (VASP) for all services offered. Penalty Amount: Ordered to terminate its business. No specific monetary fine was publicized in connection with this specific order, but the cessation of operations is a severe penalty. Outcome: Finanstilsynet ordered Kryptobørs AS to terminate its business as a virtual asset service provider due to significant and persistent breaches of the Anti-Money Laundering Act and related regulations. This was a decisive action to remove a non-compliant entity from the market.
Evidence fact no.enforcement.entity-targeted-norges-kryptobrs-as-a not found (may have been renamed).
Future Legislation: Markets in Crypto-Assets (MiCA) Regulation (EU Regulation 2023/1114) – Adopted by EU in May 2023:
MiCA will introduce:
MiCA's Scope: MiCA provides a comprehensive regulatory framework for crypto-asset markets and service providers (CASPs) not already covered by existing financial services legislation. It aims to harmonize rules across the EU/EEA, ensure consumer protection, market integrity, and financial stability.
Taxation Rules (various circulars and regulations from Skatteetaten):
Norway treats virtual currency holdings as assets for tax purposes. Gains from the sale or disposal of virtual currency are subject to capital gains tax (currently 22%). Mining income is considered business or personal income and taxed accordingly. Virtual currency held at year-end is subject to wealth tax.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a non-custodial wallet software publisher may operate in Norway without VASP registration or AML obligations provided it never holds, controls, or has access to user private keys or funds; any bundled custody, exchange, or fee-intermediated crypto services would trigger VASP registration and full AML/CTF compliance under the Hvitvaskingsloven, with MiCA expected to introduce a more comprehensive CASP licensing regime in the future.
Questions this verdict aims to answer
- Does software publishing trigger VASP / MSB classification?
- Do AML obligations attach when no custody exists?
- What disclosure or consumer-protection rules apply?