Since October 15th 2018, the Norwegian government has released a full act allowing companies to work legally in the virtual money landscape.
The new law focuses on the AML/KYC routines and procedures to enable financial companies to qualify as a legally financial service provider.
1. Incorporating of a Norwegian limited responsibility company. 1BTC
2. Establishing of a corporate bank account with a full online access, possibility to add USD and EUR currency account. 1BTC
3. Applying for the full financial license, including the D-number for EU citizens. 1BTC
The process for part 1-2 takes about 1 week. Part 3 can take 8-12 weeks or more after registering the company.
For the details of the financial license, please refer to the English translation below (Google translation)
From 15 October, providers subject to new regulations must comply with the requirements of the Money Laundering Act. A transitional period has been granted for registration with the Financial Supervisory Authority until 15 January 2019. The regulations are announced on lovdata.no.
Finanstilsynet will ensure that virtual currency exchange and retention providers comply with the money laundering rules. However, it does not have any tasks related to the monitoring of other parts of these providers, such as investor protection or advice requirements.
Impact on service providers
Suppliers of virtual currency and official currency exchange services, as well as virtual currency retention services (hereinafter referred to as "service providers") are covered by the Laundering Act's requirements of 15 October, on the date of the entry into force of the new Money Laundering Act. The law applies to reporting companies established in Norway, including branches of foreign companies.
The obligations under the Money Laundering Act apply to providers of exchange services between virtual currency and official currency, as well as virtual currency retention services (these are referred to as reporting obligations). This includes platforms and services that allow customers to trade or exchange a type of virtual currency for an official currency (such as Norwegian kroner), including platforms that facilitate trading and exchanges by connecting buyers and sellers. All exchanges between virtual currency and official currencies from all countries are included. This applies regardless of the form of payment, ie if you buy / sell virtual currency by credit card, cash, e-money, etc. Changes between different types of virtual currency (eg from Bitcoin to Ethereum) are not included.
Furthermore, the retention of private cryptographic keys on behalf of customers involves the transfer, storage or purchase of virtual currency. Storage solutions that do not store private cryptographic keys (often referred to as non-custodial wallets) are not covered by the regulations.
Virtual currency is defined as " (...) a digital expression of value that is not issued by a central bank or public authority, which is not necessarily linked to an official currency and which has no legal status as currency or money but which is accepted as payment method and which can be transferred, stored or traded electronically. "Loyalty programs and the like, such as bonus points, are not covered by the definition.
Service providers are subject to the regulatory framework by virtue of the services they offer, regardless of how the service is organized. This also covers service providers that currently operate without being registered in the enterprise register, which operate over private accounts.
If you are in doubt if your service / business is to be regarded as subject to reporting under the Money Laundering Rule, you can contact the Financial Supervisory Authority.
What does it mean to be required to report?
Reporting obligations under the Money Laundering Rule must comply with a number of requirements for preventing and detecting money laundering of proceeds from criminal offenses and terrorist financing. The Financial Supervisory Authority's theme for money laundering provides reviews and links to regulations and guidance.
How to register?
Information that Finanstilsynet must have in connection with registration, is stated in Section 1-3 of the Regulations:
- organizational form and organization number
- business address
- service offered
- name, place of residence and birth or D number of
1st general manager or persons in equivalent position
2. board members or persons in equivalent position
3. any other contact persons
It follows from the requirements for what to be registered that service providers must be registered in the enterprise register, and it is assumed that the operation of the services takes place over their own company account. As part of the registration, the entity must attach documents describing:
i) the type of service offered, with description of the exchange service / exchange platform and / or storage service, types of virtual currencies that can be exchanged and / or stored, etc., and
ii) the company's money laundering routines, cf. the new Money Laundering Act section 8. The routines must, among other things, be adapted to the nature and scope of the business, based on the company's risk assessment, cf. new Money Laundering Act section 7. See also Circular 24/2016 for more information.
If the information that follows the registration request is incomplete, the Danish Financial Supervisory Authority will not register the enterprise.
Impact on consumers
Virtual currency, in the form of exchange and storage services, is subject to new regulation on the laundering area only. Finanstilsynet refers to previous warnings about the risks associated with buying and owning virtual currency, including the warning of February 12, 2018. There is no protection in the legislation that will cover your loss if a platform that swaps or stores such currencies goes bankrupt or falls down.
Service providers must be registered with the Financial Supervisory Authority by 15 January 2019. Consumers should therefore check whether Norwegian service providers are registered before establishing a customer relationship. Users must be aware that registration by a service provider at the Danish Financial Supervisory Authority does not mean that they are subject to the same control mechanisms as other licensed entities. For example, registration with the FSA does not imply any suitability assessment of the actors, etc., etc. examined.
Service providers must comply with the Money Laundering Act, including customer requirements. Consequently, customers must expect to identify and receive questions such as the purpose of a transaction or the funds originally, etc. If the customer does not provide the necessary information, they must claim to be rejected by the service provider. Service providers are obliged to send Økokrim message in case of suspicious transactions.
The regulation states that there are providers of the aforementioned services that are required to report and consequently not everyone who exchanges the virtual currency is included. Individuals who buy or sell their own virtual currency for private purposes, or occasionally and delimited, assist friends and acquainted with the purchase and sale of their virtual currency will not be required to report under the money laundering rules.
Effects on financial companies
When service providers become required to report under the Money Laundering Act, they also have an impact on providers of financial services that have or may receive service providers as customers.
The whitewashing rules, like international regulations and norms (from FATF and EU), do not allow all groups and / or sectors to be denied financial services solely because of the group / sector's inherent money laundering risk (so-called de-risking). This also applies to virtual exchange and storage services providers. In Finanstilsynet's " Guidance - Money Laundering Rules" (Circular 24/2016), Item 8 " Rejection and Closure of CustomerRelationships"it appears that the risk of money laundering or terrorist financing may provide grounds for the actual termination under section 21 of the Financial Contracts Act. Such a risk must nevertheless be specifically justified in circumstances pertaining to the individual customer and therefore there is no basis for rejecting or terminating a customer relationship solely because the customer offers exchange or retention services for virtual currency. However, in the circumstances, there may be grounds for rejecting and terminating the customer relationship if, for example, the provider is not registered with the Danish Financial Supervisory Authority, in cases where customer control can not be carried out, or if the continuation of the customer relationship results in risk for transactions related to the proceeds of criminal offenses or related to terrorist activities.
As mentioned above, Finanstilsynet expects that service providers create a company account limited to the business, and it is therefore expected that the service providers' banking associations will facilitate this.
We note that other reporting agents, for their own compliance with customer control requirements, can not base customer checks performed by service providers, cf. new Money Laundering Act, Section 22.
Suppliers of virtual currency exchange and retention services will be discussed in the Danish Financial Supervisory Authority's next risk assessment of under supervision. It is assumed that the inherent money laundering and terrorist financing risk is high for this sector. A more detailed explanation is mentioned in the consultation memorandum for a new money laundering regulation. Reference is also made to the review in the National Risk Assessment of Money Laundering and Terror Financing, and Report and Threat Assessment of Recent Payment Services from the National Intergovernmental Analysis and Intelligence Center (NTAES).
The Money Laundering Regulations provision for the application of the Money Laundering Act for virtual currency implements the EU acquis in this area (the so-called Fifth Money Laundering Directive). The Global Action Platform for Anti-Money Laundering and Terror Financing, the Financial Action Task Force (FATF), also signals new international standards for virtual currency services. Developments in international regulations and norms will also affect the design and application of Norwegian regulations and practices in this area. It is also expected that similar rules will be introduced in other countries, so that the requirements for service providers will apply quite similarly across national borders.