Crypto ATM / kiosk operator in British Virgin Islands
Physical kiosks that exchange cash for crypto (and sometimes vice versa). High-cash AML risk profile.
Crypto ATM is conditionally permitted in British Virgin Islands with a local entity, subject to AML obligations and medium licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- Medium
- Last updated
- 2026-07-13
AML Obligations
- VASP Registration under the VASP Act 2022 is mandatory for crypto ATM / kiosk operations, which fall under exchange / transfer / payment processor categories — submit business plan, director/officer/CO details, AML/CFT policies, and application fee.
- Travel Rule applies to all virtual asset transactions with a USD 0 threshold — no de minimis exemption for cash-in/cash-out ATM transactions.
- Customer due diligence (CDD) required under the AML Regulations 2020 (amended 2022/2024) and AMLTFCoP — enhanced due diligence (EDD) applies to cash-intensive activities typical of kiosk operations.
- Appoint an FSC-approved AML compliance officer and a Money Laundering Reporting Officer (MLRO); notify FSC within 14 days if MLRO ceases office, apply for replacement approval within 21 days.
- Sanctions screening against UN, UK (extended to BVI), and OFAC SDN lists (practically required for US dollar exposure); file reports with Sanctions Unit and SARs to FIA upon identifying designated persons.
- Record retention per BVI Data Protection Act — retain IP addresses, wallet details, transaction hashes for AML/CFT purposes.
- Annual financial reporting to the FSC; fit and proper person requirements for senior officers and beneficial owners; prior FSC approval of senior officer appointments.
Key Restrictions
- Must incorporate a BVI Business Company (BVIBC) with a registered agent and registered office in the BVI; FSC may require a local director.
- No minimum capital specified in VASP Act, but applicants must provide audited financial projections and proof of sufficient capital to sustain operations.
- SIBA licensing may also be required if crypto ATM activities involve defined investments (e.g., exchange-like functionality), unless an exclusion applies.
- Cash-based nature of kiosk operations triggers heightened EDD and AML scrutiny — operators must have documented, FSC-submitted AML/CFT manuals, cybersecurity policies, and business continuity plans.
- Sanctions breaches (circumvention or contravention) are criminal offenses punishable by up to 6 months imprisonment or ~US$5,000 fine (summary) or up to 7 years/unlimited fine (indictment).
Key Risks
- High-cash AML risk profile of crypto ATMs may invite elevated FSC supervisory scrutiny and enforcement action for inadequate EDD/CDD procedures.
- OFAC extraterritoriality risk — US-traded or USD-pegged virtual assets flowing through BVI-registered kiosks could trigger OFAC enforcement even if not legally binding in BVI.
- Travel Rule compliance (USD 0 threshold) imposes heavy operational burden on cash-based kiosk transactions where counterparty identification is inherently difficult.
- No separate kiosk-specific or money-transmitter license exists — regulatory classification uncertainty could expose operators to retroactive enforcement if FSC recharacterizes activities.
- EU sanctions (e.g., Russia-related) are not directly binding but practical alignment expected by 2026; non-compliance could affect correspondent/banking relationships.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Virtual Assets Service Providers Act 2022: Enacted 2022, came into effect February 1, 2023
Virtual Asset Service Providers Act, 2022 (VASP Act): Core law requiring registration/licensing for VASPs; effective February 1, 2023. Covers exchange, transfer, custody, and related services but excludes mere issuance of virtual assets.
BVI Financial Services Commission Guidance on Regulation of Virtual Assets: Issued 2020, provides regulatory clarity on virtual asset activities
British Virgin Islands Financial Services Commission (FSC): Oversees all virtual asset service provider (VASP) registration, licensing, supervision, enforcement, and compliance monitoring, including AML/CFT obligations and transaction reporting.
VASP Registration: Mandatory for VASP activities; submit in the FSC's approved form, specifying the category, with a business plan, details of directors/senior officers/compliance officer (meeting fit and proper criteria), AML/CTF/PF policies, and application fee.
SIBA Licensing: Required if virtual asset activities involve defined investments (e.g., exchanges), unless excluded under SIBA Schedules 2 (Parts A/B/C).
No minimum capital specified in VASP Act; share capital based on operational expenses.
Applicants must provide audited financial projections and proof of sufficient capital to sustain operations.
Incorporate a BVI Business Company (BVIBC): Unique name, registered agent, registered office; minimum 1 director initially (at least 2 individual directors post-registration; FSC may require local director).
Fit and proper person requirements for senior officers and beneficial owners
Prior FSC approval of senior officer appointments
Annual financial reporting to the FSC
Anti-money laundering and counter-terrorist financing (AML/CFT) obligations
Supporting laws: Anti-Money Laundering Regulations, 2008 (AML Regs); Securities and Investment Business Act (SIBA); Financing and Money Services Act, 2009 (FMSA).
Anti-Money Laundering Regulations, 2020 (AML Regulations/AMLR) (amended 2022/2024): Core rules on customer due diligence, reporting, and controls.
Anti-Money Laundering and Terrorist Financing Code of Practice (AMLTFCoP/AMLTFCOP): Detailed AML/CFT/PF obligations for relevant businesses.
Adoption and Legislation: The Travel Rule integrates FATF Recommendations 15 and 16 into BVI law via Sections 19(4), Part VA, and Sections 41B through 41F of the AMLTFCoP, alongside the AMLR and Virtual Assets Service Providers Act, 2022 (VASP Act). Official guidance is in the BVI FSC's VASP Travel Rule Guidance (PDF: https://www.bvifsc.vg/sites/default/files/vasp_travel_guidance_f.pdf).
Threshold Amounts: USD 0—all virtual asset transactions, with no de minimis threshold.
Covered VASPs: Applies to all individuals and entities operating as VASPs in or from the BVI, including those registered under the VASP Act with the BVI Financial Services Commission (FSC). Entities offering virtual asset services must register.
Technical Implementation Requirements: VASPs must implement controls for Travel Rule compliance, including documented AML/CFT policies, procedures, continuous customer due diligence (CDD), transaction monitoring, and sanctions screening within 24 hours (e.g., freezing assets, reporting). They must demonstrate reasonable steps for compliance and align with FATF's risk-based approach, reporting to the FSC and Financial Investigation Agency (FIA).
Appointing an AML compliance officer (approved by the FSC) to oversee adherence and liaise with authorities, plus a Money Laundering Reporting Officer (MLRO) to handle internal reporting; notify FSC within 14 days if MLRO ceases office and apply for replacement approval within 21 days.
Submitting governance documents like AML/CFT manuals, cybersecurity policies, and business continuity plans during registration.
Retaining records (e.g., IP addresses, wallet details, transaction hashes) per the BVI Data Protection Act for AML/CFT/PF purposes.
UN and UK sanctions (extended to BVI) directly apply to BVI-incorporated bodies, residents, and relevant businesses like VASPs, requiring risk-based policies to screen customers against UN, UK, and extended EU lists.
OFAC sanctions lack legal force in BVI but are practically required for VASPs with US exposure, including blocking virtual currencies linked to OFAC's Specially Designated Nationals (SDN) list, prohibiting unauthorized transactions, and reporting within 10 business days.
Upon identifying designated persons/assets: file reports with the Sanctions Unit (via Governor's Office), submit Suspicious Activity Reports (SARs) to FIA under the Counter-Terrorism Act, 2021, and freeze assets.
Breaches (e.g., contravening or circumventing sanctions) are criminal offenses: up to 6 months imprisonment or ~US$5,000 fine (summary conviction); up to 7 years imprisonment or unlimited fine (indictment).
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — crypto ATM/kiosk operations are permitted in the BVI but require VASP registration under the VASP Act 2022, a locally incorporated BVIBC, FSC approval of senior officers, comprehensive AML/CFT programs including Travel Rule compliance at USD 0 threshold, and sanctions screening, with possible SIBA licensing overlay depending on activity characterization.
Questions this verdict aims to answer
- What money-transmitter / kiosk-specific license is required?
- What cash-transaction reporting thresholds apply?
- What enhanced-KYC obligations attach to cash-in / cash-out?