Crypto ATM / kiosk operator in Oman
Physical kiosks that exchange cash for crypto (and sometimes vice versa). High-cash AML risk profile.
Crypto ATM is conditionally permitted in Oman with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- CDD required under Royal Decree No. 30/2016 (AML/CFT Law) and Ministerial Decision No. 63/2016 — must collect name, address, date of birth, nationality, and unique ID (passport/national ID) for all customers
- Beneficial ownership identification required — identify natural persons controlling 25% or more of shares/voting rights
- PEP screening and Enhanced Due Diligence (EDD) for PEPs required — including senior management approval for establishing relationships
- EDD required for higher-risk categories including non-face-to-face relationships (relevant for ATM/kiosk use), high-value transactions, and transactions involving high-risk jurisdictions
- Suspicious Transaction Report (STR) must be filed with the Oman Financial Intelligence Unit (OMAFIU) when funds are suspected to be proceeds of crime or related to terrorism financing
- No-tipping-off prohibition — cannot disclose STR filing to customer or third parties
- Transaction records and CDD records must be maintained
- Sanctions screening against UN and national lists required
Key Restrictions
- Crypto ATM/kiosk operators would need to be licensed under the CMA Virtual Assets Regulatory Framework (issued Nov 2023) — no standalone kiosk-specific license exists, but the CMA framework covers VASPs including trading/exchange services
- Central Bank of Oman (CBO) has issued ongoing warnings prohibiting banks and payment service providers under its supervision from facilitating cryptocurrency transactions — this may block the cash-handling/banking relationships essential for kiosk operations
- Physical kiosk cash-in/cash-out likely triggers the broad AML/CFT framework under Royal Decree No. 30/2016, with enhanced obligations for high-risk, non-face-to-face transactions
- No specific segregation-of-client-assets, cold-storage, or insurance rules exist yet under Omani law for VASPs — operators must look to CMA framework requirements
- No legally defined 'qualified custodian' definition exists in Oman's regulatory landscape
Key Risks
- CBO advisories currently prohibit regulated financial institutions from facilitating crypto transactions — this creates severe banking/partner risk as kiosks need cash-handling bank accounts and cash-loading services
- The CMA framework is newly issued (Nov 2023) and its practical implementation, enforcement scope, and licensing application process for VASPs (including kiosk operators) remain untested
- Cash-intensive nature of kiosk operations is inherently high-risk for AML/CFT — EDD obligations for non-face-to-face transactions are difficult to satisfy at a physical kiosk without robust identity verification technology
- Regulatory ambiguity: no crypto-specific cash transaction reporting threshold (CTR-equivalent) has been publicly established in Oman — operators may be subject to general suspicious transaction reporting only
- Oman is a MENAFATF member and subject to FATF mutual evaluations — any regulatory gap in VASP oversight could trigger enforcement or public censure, creating political/regulatory risk for operators
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Capital Market Authority (CMA) Virtual Assets Regulatory Framework (2023): The CMA issued a comprehensive regulatory framework for virtual assets in July 2023. This framework aims to regulate the activities of VASPs, including issuance, listing, and trading of virtual assets, ensuring compliance with international AML/CFT standards. It covers licensing requirements, corporate governance, market conduct, and crucial for this discussion, AML/CFT obligations.
Legal Reference: While the full official text is often subject to specific publication (e.g., in the Official Gazette), announcements from the CMA confirm its promulgation.
CMA Announcement: CMA Oman News - Issuance of Virtual Assets Regulatory Framework (This link might change or be archived; search CMA Oman for "Virtual Assets Regulatory Framework 2023")
Central Bank of Oman (CBO): The CBO has previously issued warnings regarding the risks of virtual currencies. However, in parallel with the CMA, it has also been working on developing its own regulatory framework for digital assets, particularly concerning digital currencies and payments.
Royal Decree No. 30/2016 on Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT Law), amended by Royal Decree No. 112/2020: This is the foundational law for AML/CFT in Oman. While it predates explicit crypto regulations, its broad definitions of "funds," "financial institutions," and "financial activities" are intended to encompass new technologies and virtual assets once they fall under a regulated scope. VASPs, once licensed, will be designated as financial institutions or designated non-financial businesses and professions (DNFBPs) under this law.
Royal Decree No. 30/2016 (Law on Combating Money Laundering and Terrorism Financing): This is the foundational AML/CFT law in Oman, outlining the obligations for financial institutions and designated non-financial businesses and professions (DNFBPs).
Ministerial Decision No. 63/2016 (Implementing Regulations of the Law on Combating Money Laundering and Terrorism Financing): This decision provides detailed regulations and guidelines for implementing Royal Decree 30/2016.
Identification and Verification (ID&V) of Customers:
Collecting identifying information such as name, address, date of birth, nationality, and unique identification number (e.g., passport, national ID card).
Verifying this information using reliable, independent source documents, data, or information (e.g., government-issued IDs, utility bills, biometric data).
Beneficial Ownership Identification:
Politically Exposed Persons (PEPs):
Enhanced Due Diligence (EDD):
Obligation to Report: If a VASP knows, suspects, or has reasonable grounds to suspect that funds are proceeds of a criminal activity or are related to terrorism financing, it must promptly file a Suspicious Transaction Report (STR) with the Oman Financial Intelligence Unit (OMAFIU).
No Tipping-Off: VASPs and their employees are prohibited from disclosing to the customer or any third party that an STR is being, or has been, submitted, or that an investigation is being conducted.
Transaction Records: All records of domestic and international transactions, including information on the origin and destination of the funds/virtual assets, transaction amount, date, and type.
CDD Records: Records of all information obtained through the CDD process (identification data, beneficial ownership information, business relationship purpose, etc.).
Central Bank of Oman (CBO): Has consistently issued warnings against dealing in cryptocurrencies for financial institutions under its supervision, citing risks such as volatility, money laundering, and lack of regulatory oversight. These warnings essentially act as a prohibition for banks and payment service providers. While these warnings are a form of regulatory action, they haven't been followed by publicly disclosed, named enforcement actions with specific fines against a particular entity for crypto-related violations that are distinct from broader financial regulations.
CBO Warnings against Crypto (Ongoing/Recurring)
Entity Targeted: Financial institutions regulated by CBO (e.g., banks, payment service providers) and the general public. Violation Type (Implied): Engaging in or facilitating cryptocurrency transactions, promoting crypto investments, or operating without proper licenses/oversight. These warnings aim to prevent such activities. Penalty Amount: Not applicable to a general warning. Any penalties for non-compliance by regulated entities would fall under existing financial regulations, but specific crypto-related fines haven't been publicly detailed.
CMA Issuance of Virtual Asset Regulatory Framework
Date: Announced and issued in November 2023.
CMA Oman Official Announcement (English): https://cma.gov.om/Home/News/NewsDetails/638363765101683416
LexisNexis Article discussing the framework: https://www.lexisnexis.com/research/attachments/20240321_042456_861_LexisNexisMiddleEast_Oman_VirtualAssetFramework_032024.pdf
Oman's Adherence to FATF Standards: Oman is a member of the Middle East and North Africa Financial Action Task Force (MENAFATF) and is committed to implementing the recommendations of the Financial Action Task Force (FATF). FATF Recommendation 15 specifically addresses new technologies, urging countries to regulate and supervise VASPs for AML/CFT purposes, including sanctions compliance.
Royal Decree No. 112/2020 (Amending some provisions of the AML/CFT Law) - Similar challenge for direct public link.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — Crypto ATM/kiosk operators may operate if licensed under the CMA's 2023 Virtual Assets Regulatory Framework and compliant with Royal Decree No. 30/2016 AML/CFT obligations, but face severe practical risk from CBO advisories that prohibit regulated financial institutions (including banks needed for cash handling) from facilitating crypto transactions.
Questions this verdict aims to answer
- What money-transmitter / kiosk-specific license is required?
- What cash-transaction reporting thresholds apply?
- What enhanced-KYC obligations attach to cash-in / cash-out?