🇮🇸Iceland

Detailed overview

Crypto-Regulation in Iceland

Iceland regulates crypto‑asset activity primarily as an anti‑money‑laundering (AML) matter. Any business that exchanges, transfers, safeguards, brokers the issuance or offers wallet custody of crypto‑assets is classified as a “virtual‑asset service provider” (VASP) and must be registered with the Central Bank of Iceland (CBI). Registration, not a full financial‑services licence, is granted under the Act on Measures against Money‑Laundering and Terrorist Financing 2018. The CBI assesses the owners and management for fitness, reviews the firm’s AML/CTF framework, and enters the firm in the public register. Once registered, the VASP is supervised for AML/CTF only; consumer and prudential rules do not yet apply. If the business also issues a stable‑coin or performs payment functions it will need the separate e‑money or payment‑institution licence. Iceland plans to transpose the EU Markets in Crypto‑Assets Regulation (MiCAR), so founders should anticipate a transition to a passport‑style licensing regime within the EEA.

- Competent authority

Central Bank of Iceland – Financial Supervision (CBI–FS) oversees registration, fit‑and‑proper tests and ongoing AML/CTF supervision of VASPs.

- Core statutes and rules (English titles)

- Act on Measures against Money‑Laundering and Terrorist Financing 2018 (AML Act).

- CBI Rules 151/2023 on registration of currency‑exchange and VASP businesses.

- CBI Rules 152/2023 on fit‑and‑proper assessments of directors and managers of VASPs.

- CBI tariff 165/2023 (application and supervision fees).

- Act on the Issuance and Handling of Electronic Money 2013 (for stable‑coins structured as e‑money).

- Act on Payment Services 2021 (PSD2 transposition).

- Act 56/2024 on market infrastructures based on distributed‑ledger technology (DLT trading venues).

- EU Regulation 2023/1114 (MiCAR) – slated for EEA incorporation; not yet in force domestically.

- Is your activity in scope?

A startup must register if it performs any of the following as a business: – exchanging fiat ↔︎ crypto or crypto ↔︎ crypto; – safeguarding, transferring or administering crypto for clients (wallet or custody); – brokering or facilitating an ICO/token sale; – providing digital‑wallet services or otherwise controlling crypto on behalf of others.

- Step‑by‑step registration roadmap

- Prepare a classification memo demonstrating why the planned services fall under the VASP definition in the AML Act. Keep this for the file (not submitted).

- Draft the AML/CTF programme

- enterprise‑wide risk assessment;

- written policies, controls and procedures;

- customer due‑diligence and travel‑rule processes (trigger at EUR 1 000 equivalent for crypto transfers);

- suspicious‑transaction reporting workflow to the FIU.

- Gather corporate documentation

- constitutional documents, ownership chart, ultimate beneficial owners (≥ 25 %);

- CVs, diplomas and criminal‑record extracts for directors & senior managers;

- proof of initial capital and liquidity (no statutory minimum, but the CBI expects resources proportionate to the risk).

- Fit‑and‑proper dossier – complete the questionnaires prescribed in Rules 152/2023 for each director, plus a collective suitability matrix.

- Submit the electronic application through the CBI service portal (“Operating licence and Registration”) with the non‑refundable fee listed in Tariff 165/2023.

- CBI initial review (≈ 2 weeks) – check for completeness; requests for clarification are common.

- Substantive assessment (4–10 weeks)

- CBI reviews AML framework, interviews key staff if needed, and performs reputational checks.

- Parallel fit‑and‑proper assessment is issued as a separate decision.

- Registration decision & publication – confirmed by formal letter; your firm is added to the public VASP list; registration is indefinite but conditional on ongoing compliance.

- Ongoing duties after registration

- AML/CTF – keep risk assessment, policies and training up to date; file suspicious‑transaction reports without delay.

- Travel rule – transmit originator/beneficiary data for crypto transfers ≥ EUR 1 000.

- Record‑keeping – retain KYC and transaction data for five years.

- Annual confirmation – notify the CBI of any organisational change, new products or material risk changes.

- Governance – any new director or manager must pass a fresh fit‑and‑proper test before taking office.

- Fees – pay the annual supervisory levy under Tariff 165/2023.

- When a full licence is required

- Issuing a stable‑coin backed by fiat → apply for an electronic‑money institution licence under the 2013 Act; this entails EUR 350 000 minimum initial capital and prudential rules.

- Processing payment transactions for third parties (e.g., crypto‑to‑fiat cards) → obtain a payment‑institution licence under the 2021 Act.

- Operating a DLT trading venue or settlement system → authorisation under Act 56/2024.

- Forthcoming changes – MiCAR

The Finance Ministry has stated that MiCAR will be incorporated into the EEA Agreement and transposed into Icelandic law; the CBI expects to replace the current registration regime with a MiCAR licensing framework and passporting across the EEA no later than mid‑2026.