Crypto ATM / kiosk operator in Slovenia
Physical kiosks that exchange cash for crypto (and sometimes vice versa). High-cash AML risk profile.
Crypto ATM is conditionally permitted in Slovenia with a local entity, subject to AML obligations and medium licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- Medium
- Last updated
- 2026-07-13
AML Obligations
- Registration with FURS under ZPPML-1 (current regime) before commencing operations.
- Implementation of robust internal AML/CFT policies, procedures, and controls.
- Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD) measures — mandatory for cash-in/cash-out operations due to high AML risk.
- Risk assessment frameworks (covering customer, product, and geographical risks).
- Record-keeping of transactions and customer data.
- Reporting of suspicious transactions to the Office for Money Laundering Prevention (UPPD).
- Appointment of an AML officer.
- Training for relevant employees.
- Fit and proper assessment for management and beneficial owners.
- If processing fiat payments (e.g., cash-to-crypto), may require a Payment Institution (PI) or Electronic Money Institution (EMI) license from the Bank of Slovenia under ZPlaS-1 (PSD2 transposition), which carries additional AML obligations.
Key Restrictions
- Must register with FURS under ZPPML-1 before operating any crypto ATM/kiosk.
- If the kiosk involves holding or processing fiat payments (cash in/out), a separate Payment Institution (PI) or EMI license from the Bank of Slovenia may be required under ZPlaS-1.
- Under future MiCA regime (coming into full effect for most CASPs by mid-2025-2026), a CASP license from a designated national competent authority (likely ATVP or Bank of Slovenia) will be required, with higher capital and governance requirements.
- No specific cash-transaction reporting threshold (CTR-equivalent) identified in the facts for Slovenia specifically; general AML suspicious transaction reporting obligations apply.
- No explicit statutory requirement for cold storage or segregation of client crypto assets from operator's own assets under current ZPPDFT-2 regime (though expected as best practice).
Key Risks
- High-cash AML risk profile of crypto ATMs attracts heightened supervisory scrutiny from UPPD/FURS.
- No specific statutory minimum capital or PI insurance requirement currently under ZPPDFT-2 for VASPs — but this may change under MiCA, and gaps may expose the operator to supervisory action.
- Potential for dual regulatory burden: VASP registration (FURS) + payment services license (Bank of Slovenia) if the ATM model involves fiat handling.
- Enforcement precedents are opaque — UPPD does not typically name specific companies in enforcement actions, creating uncertainty about actual supervisory practices.
- Future MiCA transition creates regulatory timeline risk: current registration model will be replaced by a full CASP licensing regime with prudential requirements.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Requirement: Registration with FURS under ZPPML-1.
Current Regime (ZPPML-1): Registration. Slovenia currently requires VASPs to register with FURS before they can operate. This is a registration for AML/CTF purposes, focusing on preventing illicit financial activities, rather than a full operational license that would typically cover aspects like prudential requirements, consumer protection, or market integrity comprehensively.
Competent Authority: The Financial Administration of the Republic of Slovenia (FURS) (Finančna uprava Republike Slovenije) is the primary supervisory authority for AML/CTF compliance, including the registration and supervision of VASPs.
Activities Covered: Providing platforms or services where users can buy/sell virtual currencies with fiat currencies (e.g., EUR, USD) or exchange one virtual currency for another (e.g., BTC for ETH).
If processing fiat payments for crypto transactions (e.g., enabling users to deposit/withdraw EUR to/from an exchange account):
This could require a Payment Institution (PI) license or Electronic Money Institution (EMI) license from the Bank of Slovenia (Banka Slovenije). This is separate from VASP registration and is generally a more robust licensing process.
VASP Registration: Entities providing services of safeguarding private cryptographic keys on behalf of clients, or holding, storing, and transferring virtual currencies, are classified as "virtual asset service providers" (VASPs) under ZPPDFT-2.
Obligation to Register: VASPs must register with the Office for Money Laundering Prevention (UPPD). This is a registration requirement, not a full prudential licensing regime akin to banks or investment firms, but it entails strict AML/CFT compliance obligations.
Requirements for Registration:
Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD) measures.
Record-keeping of transactions and customer data.
Reporting of suspicious transactions to UPPD.
Appointment of an AML officer.
Training for relevant employees.
Fit and proper assessment for management and beneficial owners (though not as extensive as for licensed financial institutions).
Issuing warnings and guidance: Educating the public about risks and informing businesses about compliance requirements, especially in anticipation of EU-wide regulations like MiCA (Markets in Crypto-Assets).
Anti-Money Laundering (AML) and Counter-Financing of Terrorism (CFT) supervision: The Office for Money Laundering Prevention (UPPD - Urad RS za preprečevanje pranja denarja) is the primary authority here. While they conduct supervision and impose measures, details of individual enforcement actions against specific companies (with fine amounts and outcomes) are not usually made public in the same way as in some other jurisdictions.
AML/CFT Supervisory Activities (General):
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — Crypto ATM operators may operate in Slovenia under the current VASP registration regime (ZPPML-1/FURS), but must also assess whether their cash-handling activities trigger a separate Payment Institution or EMI license under ZPlaS-1 (PSD2); the future MiCA regime will introduce a full CASP license with higher prudential requirements.
Questions this verdict aims to answer
- What money-transmitter / kiosk-specific license is required?
- What cash-transaction reporting thresholds apply?
- What enhanced-KYC obligations attach to cash-in / cash-out?