Crypto ATM / kiosk operator in Portugal

Exchange of cryptocurrency for fiat currency and vice versa

Custodial services (storage of crypto-assets and encrypted keys)

Full compliance with Law No. 83/2017 (Anti-Money Laundering Law) and FATF standards is mandatory

KYC procedures: Identify and verify client identity, understand the nature of business relationships, and document beneficial ownership information in a Central Register

Ongoing transaction monitoring and regular reporting to Unidade de Informação Financeira (UIF)

Internal compliance programs including risk assessments, internal policies, and staff training

Compliance with restrictive measures approved by the UN or EU

Banco de Portugal (BdP, Bank of Portugal): Registers virtual asset service providers (VASPs) and supervises AML/CFT compliance; handles MiCA authorization applications for crypto-asset service providers (CASPs) starting July 2026.

Banco de Portugal (BdP) supervises compliance for CASPs and payment service providers; registered CASPs can operate under MiCA transitional rules until July 1, 2026.

Autoridade Tributária e Aduaneira (AT, Portuguese Tax and Customs Authority): Enforces crypto taxation, including reporting requirements.

Lei n.º 24-D/2022 (State Budget Law, effective January 1, 2023): Introduced 28% tax on crypto gains held <365 days; long-term gains (>365 days) tax-free unless involving tax havens or security tokens.

Law No. 69/2025 (December 2025): Incorporates MiCA and Transfer of Funds Regulation (TFR) into national law; treats CASPs as financial entities under AML rules; effective July 2026.

Portuguese AML Law: Governs VASP registration; VASPs registered by December 30, 2024, can operate under transitional MiCA rules until June 30, 2026.

For transactions involving self-hosted wallets, CASPs must request proof of ownership/control for amounts of EUR 1,000 or more (per TFR Chapter III, Section 1, Article 1(5)).

Enhanced measures for self-hosted wallets when a regulated entity is involved: data collection/retention by originating CASP, plus verification for ≥EUR 1,000.

CASPs must collect, retain, and share Travel Rule data (e.g., originator/beneficiary details for unique transfer identification) for transparency in transfers.

Requirements include data verification, recordkeeping, security measures, and alignment with TFR for AML/CFT (e.g., immediate/secure sharing).

February 2024 bill: Mandates annual IRS declaration of crypto assets.

September 2025: Eurojust coordinated an operation halting a cryptocurrency investment fraud exceeding 100 million euros across Europe, resulting in five arrests including the alleged main perpetrator.