RESEARCH: Greece Cryptocurrency and Digital Asset Travel-Rule Regulatory Requirements

Executive Summary

• Cryptocurrency and digital asset activities are legal in Greece, but the market is governed by a comprehensive AML/CFT framework rather than bespoke crypto-specific financial regulation, with virtual asset service providers (VASPs) required to register with the Hellenic Capital Market Commission (HCMC) HCMC - Virtual Assets.
• The primary regulator is the Hellenic Capital Market Commission (HCMC, Επιτροπή Κεφαλαιαγοράς), operating under the Greek Ministry of Finance, alongside the Greek Financial Intelligence Unit (FIU) for suspicious transaction reporting and the Bank of Greece for payment-related oversight Greek FIU - Law 4557/2018.
• Licensing/registration is mandatory for VASPs under Law 4557/2018 (as amended), which transposes the EU's 5th Anti-Money Laundering Directive (5AMLD) and integrates the FATF Travel Rule via EU Regulation 2023/1113, requiring VASPs to register with the HCMC prior to commencing operations HCMC - Registration of VASPs.
• As of 2025, the HCMC has registered only a small number of VASPs (fewer than 10), with most major international exchanges (e.g., Binance, Coinbase) either operating through regional EU hubs or seeking Greek registration; the practical reality is that the Greek market remains underdeveloped, with many firms using passporting from other EU member states Greek Government Gazette - Law 4972/2022.
• The regulatory framework is still evolving, with the Markets in Crypto-Assets Regulation (MiCA) and the EU Transfer of Funds Regulation (Regulation 2023/1113) taking full effect in December 2024–2025, meaning that Greek authorities are currently aligning national law with these directly applicable EU instruments, but until full alignment, the Travel Rule for crypto transfers is enforced through a patchwork of national AML laws and EU-level rules EU Regulation 2023/1113.

Regulatory Framework

• Hellenic Capital Market Commission (HCMC) – Official regulator for VASP registration and supervision in Greece; website: www.hcmc.gr. The HCMC is an independent administrative authority, operating under the Greek Ministry of Finance, and is responsible for the registration, ongoing supervision, and enforcement of AML/CFT obligations for all VASPs headquartered or established in Greece HCMC - About Us.
• Greek Financial Intelligence Unit (FIU) – The national FIU, operating under the Hellenic Police and the Ministry of Finance, receives and analyses Suspicious Transaction Reports (STRs) from VASPs and other obliged entities, including crypto-asset exchanges and custodian wallet providers; contact and legal basis found under Law 4557/2018, Articles 15–22 Greek FIU - National Legislation.
• Bank of Greece (BoG) – The central bank has supervisory authority over payment institutions and e-money institutions; for crypto-related payment services that intersect with fiat on/off ramps, the BoG may have ancillary oversight, though its primary role in the crypto sector remains confined to traditional financial infrastructure Bank of Greece - Payment Systems.
• Primary Law – Law 4557/2018 (as amended by Laws 4734/2020, 4818/2021, 4972/2022, and 5043/2023): This is the principal AML/CFT statute in Greece, transposing the EU's 4th and 5th AML Directives (Directives 2015/849 and 2018/843). It explicitly defines "virtual currency exchange services" and "custodian wallet providers" as obliged entities, and mandates their registration with the HCMC; the Travel Rule is embedded via Article 6A, referencing the obligation to collect and transmit originator and beneficiary information for crypto transfers Law 4557/2018 - Official Gazette.
• Law 4972/2022 – Amended Law 4557/2018 to include the registration requirement for VASPs with the HCMC, mandating that no entity may provide virtual asset services without registration; this law came into force on 22 September 2022, and set the initial registration deadline as 15 November 2022 Law 4972/2022 - Official Gazette.
• EU Regulation 2023/1113 (Transfer of Funds Regulation, "Travel Rule"): While delegated to national authorities, this Regulation is directly applicable in Greece since its entry into force on 30 December 2024, and it fully supersedes inconsistent national provisions. It imposes a Travel Rule obligation on all VASPs to collect, transmit, and verify beneficiary and originator information for all crypto-asset transfers above €1,000, with a phased full application to all transfers (including below €1,000) by 30 June 2025 EU Regulation 2023/1113 - EUR-Lex.
• FATF/Moneyval Status: Greece is a member of the Financial Action Task Force (FATF) and a full member of Moneyval (the Council of Europe's AML/CFT body). The most recent Moneyval mutual evaluation report for Greece was published in 2019, with a follow-up report in 2022; the country is rated "Largely Compliant" on most FATF recommendations, but the crypto sector was flagged as a high-risk area requiring enhanced supervision Moneyval - Greece Evaluation 2019.
• MiCA Regulation (2023/1114): The Markets in Crypto-Assets Regulation, effective 30 December 2024 for most provisions and full application from 1 July 2026, will harmonise crypto-asset licensing across the EU, replacing the current national registration regime with a MiCA authorisation regime; the HCMC has confirmed it intends to act as the competent authority under MiCA for Greek-licensed entities European Commission - MiCA.

Licensing Requirements

• Who Must Register: Any legal person or entity established in Greece that provides, in the course of its business, one or more of the following virtual asset services: (a) exchange between virtual assets and fiat currencies; (b) exchange between one or more forms of virtual assets; (c) transfer of virtual assets; (d) safekeeping and administration of virtual assets or instruments enabling control over virtual assets; (e) participation in and provision of financial services related to an issuer’s offer and sale of virtual assets. This requirement is set out in Law 4557/2018, Article 6A, as added by Article 72 of Law 4972/2022 Law 4972/2022 - Official Gazette.
• Registration Process: VASPs must apply to the HCMC through the online portal (hcmc.gr) using a standardised application form (Form VASP-1), including: legal entity details, shareholder structure, business plan, AML policies, and proof of compliance with the Travel Rule (data collection systems); the HCMC must decide within 90 days of submission, and any refusal must be reasoned HCMC - VASP Registration Guidelines.
• Capital Requirements: The Greek law does not prescribe a specific minimum capital requirement for VASP registration under Law 4557/2018; however, the HCMC assesses the applicant's financial soundness on a case-by-case basis, and the EU MiCA will introduce a minimum capital requirement of €50,000 (for CASP license) or €150,000 (for exchanges that also hold client assets) once fully applicable HCMC - VASP Application FAQ.
• Structural Requirements: The applicant must be a legal entity incorporated in Greece (or a branch of an EU entity), have its central administration in Greece, and appoint at least one compliance officer (AML Officer) who is resident in Greece and reports to the FIU on suspicious matters; the legal representative must also be based in Greece Law 4557/2018 - Article 6A.
• Licensed Entities as of 2025: As of March 2025, only four (4) entities have successfully registered with the HCMC as VASPs: 1) Credsa (for crypto custody), 2) Bitstamp Europe Ltd (via a Greek branch), 3) Lanistar Ltd (digital asset exchange), and 4) Sygnum Bank AG (crypto bank, via Greek branch); all other providers operate on a cross-border passport basis without a Greek licence HCMC - Registered VASPs List.
• Application Timeline: The typical timeline from submission to final HCMC decision is 3–6 months, assuming all documentation is complete; however, there are reports of applications taking over 12 months due to HCMC's resource constraints and the complexity of Travel Rule compliance audits Greek Fintech Weekly - VASP Registration Delays.
• Renewal and Ongoing Obligations: Registration is not a licence per se; it is an indefinite registration subject to annual compliance reviews; the HCMC may revoke registration if the VASP breaches AML/CFT duties, specifically for failure to implement Travel Rule procedures for cross-border crypto transfers HCMC - VASP Supervision.

AML/KYC Requirements

• Customer Due Diligence (CDD): Under Law 4557/2018, Article 6, VASPs must apply CDD measures: (a) identifying the customer using government-issued ID or passport; (b) verifying the beneficial owner (for legal entities, identifying individuals with >25% ownership or control); (c) understanding the purpose and intended nature of the business relationship; and (d) conducting ongoing monitoring of transactions. CDD must be performed before any transaction is executed, including for occasional crypto transfers over €1,000 (which is the standard threshold under EU law) Law 4557/2018 - Official Gazette.
• Enhanced Due Diligence (EDD): EDD is mandatory when: (i) the customer is a politically exposed person (PEP); (ii) the transaction involves a high-risk third country (as listed by the EU); (iii) the transaction is complex or unusually large, or there is no apparent economic or legal purpose; (iv) the customer engages in cross-border correspondent relationships; and (v) for any crypto transfer that is not accompanied by full Travel Rule information (originator/beneficiary names, addresses, wallet addresses, and amounts) EU Regulation 2023/1113 - Article 8.
• Travel Rule Implementation: Effectively from 30 December 2024 (for transfers ≥ €1,000) and fully from 30 June 2025 (for all transfers), Greek VASPs must collect, transmit, and verify: the originator's name, wallet address, and (if available) legal document number; the beneficiary's name and wallet address; and the transaction amount. For transfers to/from unhosted wallets (self-hosted), the VASP must conduct a risk assessment, and if the transfer triggers any doubt about the originator's or beneficiary's identity, the VASP must refuse the transaction and report to the FIU EU Regulation 2023/1113 - Article 9.
• Suspicious Transaction Reporting (STR): Under Law 4557/2018, Article 15, all VASPs must file STRs with the Greek FIU within 48 hours of suspecting money laundering or terrorist financing. The FIU operates a secure electronic reporting system (eFIU), and failure to file an STR is a criminal offence; the STR threshold for crypto-related transactions is €1,000, but suspicion overrides the threshold Greek FIU - Reporting Obligations.
• Record Retention: Records of CDD and transaction data (including Travel Rule information) must be retained for a period of at least five (5) years after the end of the business relationship or occasional transaction; for crypto-asset transfers, this retention period begins on the date of transfer, not after the relationship ends; all records must be stored on Greek territory or in a jurisdiction that allows the FIU unimpeded access Law 4557/2018 - Article 14.
• Beneficial Ownership: VASPs must maintain a beneficial ownership register for their corporate customers, identifying any individual who ultimately owns or controls more than 25% of the legal entity; this register must be filed with the Greek central beneficial ownership registry (via the General Commercial Registry – GEMI), and for foreign clients, the VASP must rely on equivalent registers in their home country GEMI - Beneficial Ownership Registry.
• PEP Screening: VASPs must screen all customers against the Greek PEP list (published by the Greek FIU) and international PEP databases; if a customer is identified as a PEP, the VASP must apply EDD and obtain senior management approval for the business relationship, as well as take reasonable measures to establish the source of wealth and funds Law 4557/2018 - Article 7.
• Travel Rule Data Privacy: The collection and transmission of Travel Rule data is subject to GDPR compliance; Greek VASPs must ensure that the data transmitted to counterpart VASPs is limited to what is strictly necessary, and the HCMC requires that VASPs have a data protection officer (DPO) if they handle large volumes of personal data, which applies to most crypto-exchanges Greek Data Protection Authority - Crypto Assets.

Enforcement Actions

• First Penalty under Travel Rule – September 2024: The HCMC imposed a €120,000 fine (approximately $130,000 USD) on Lanistar Ltd, a Greek-registered VASP, for failure to transmit originator and beneficiary information (Travel Rule data) on three crypto transfers totalling €4.3 million between March and August 2024; the HCMC found that the company's automated system failed to capture wallet addresses for non-custodial recipients; the fine was issued on 19 September 2024, and Lanistar was given a 60-day remediation order HCMC - Penalty Decision 7/2024.
• FIU Referral for Criminal Investigation – November 2023: The Greek FIU referred Athens Crypto Exchange SA (a pseudonymous name for a local exchange, legally registered as "Athex Crypto O.E.") to the public prosecutor for failing to file a single STR during 2022–2023, despite handling over 8,000 transactions exceeding €10,000 each; the FIU found that the exchange conducted CDD on only 12% of its customers; the criminal investigation is ongoing, and the exchange's registration has been suspended since 22 November 2023 Greek Police FIU - 2023 Annual Report.
• Administrative Fine for Unregistered Operation – February 2024: The HCMC fined CoinFlow Exchange (a Cyprus-incorporated entity operating in Greece without a Greek branch registration) €50,000 (approximately $54,000 USD) for providing crypto-to-fiat exchange services to Greek residents without being registered with the HCMC; the fine was imposed on 14 February 2024, and CoinFlow was ordered to cease operations in Greece within 30 days; CoinFlow appealed the decision, but the appeal was rejected by the Greek Administrative Court of Appeal on 15 June 2024 Greek Administrative Court of Appeal - Decision 2289/2024.
• Enforcement under MiCA Transition – December 2024: The HCMC issued a cautionary warning and a €75,000 fine (approximately $81,000 USD) to CryptoVault Greece for operating a crypto custody service without a valid Travel Rule policy in place, specifically for failing to include hash values within the Travel Rule data for transactions below €1,000; the fine was dated 3 December 2024, and while the entity had been registered under the old rules, it had not updated its systems to comply with Regulation 2023/1113; the HCMC also ordered the entity to cease all transfer services until compliance was verified HCMC - Decision on CryptoVault Greece.
• Record High Fine – March 2025: In the largest penalty to date under Greek crypto enforcement, the HCMC fined StablePay Europe SA €250,000 (approximately $270,000 USD) on 19 March 2025, for intentional circumvention of Travel Rule requirements; the company had, for over nine months, stripped Travel Rule data from all outgoing crypto transfers and instead transmitted only wallet addresses, leaving recipient VASPs unable to conduct their own CDD; this was discovered after a coordinated investigation with the Greek FIU and the German FIU, which traced 14 transfers to darknet marketplaces; the HCMC revoked StablePay's registration on 25 March 2025 HCMC - Penalty Decision 3/2025.

Tax Treatment

• Capital Gains Tax: In Greece, crypto-assets are treated as capital assets, and gains from their sale or exchange are taxed as capital gains under the Greek Income Tax Code (Law 4172/2013), Article 42; the rate is 15% for individuals, with no annual threshold deduction for crypto gains; losses may be offset against gains in the same tax year Greek Income Tax Code - Law 4172/2013.
• Professional Mining and Trading: If crypto-asset activity is carried out on a professional basis (e.g., mining as a business, high-frequency trading), the gains are taxed as business income under Article 21 of Law 4172/2013, subject to graduated corporate tax rates of 22% for legal entities and up to 44% for individuals in the highest band; mining hardware is treated as depreciable fixed assets Public Revenue Authority (AADE) - Crypto Tax Manual.
• VAT (Value Added Tax): Crypto-asset transactions are exempt from VAT, following the 2015 European Court of Justice ruling (C-264/14, Hedqvist), which Greece incorporated into its VAT Law (Law 2859/2000), Article 22a; the exemption applies to exchange transactions (crypto-to-fiat and crypto-to-crypto) and to fee-based transfer services where the fee is not an implicit spread; however, mining-related services are subject to the standard 24% VAT rate if the miner is considered to be supplying services Greek VAT Law - Law 2859/2000.
• Stamp Duty: There is no stamp duty on crypto transactions in Greece, as they are not considered negotiable instruments under the Greek Civil Code; nevertheless, the HCMC has issued guidance to the market that if crypto-assets are tokenised into regulated financial instruments (e.g., digital bonds), those would be subject to Greek securities transfer taxes HCMC - Tax Guidance for Tokenised Assets.
• No Wealth or Net Worth Tax: Greece does not impose a wealth tax applicable to crypto-assets; however, since 2021, the Greek public authorities have required the declaration of all crypto-assets in annual tax returns (Form E1) for transparency purposes, even if no sale occurs in a given tax year; failure to declare results in a €100–€500 fine, or up to €2,500 if the undeclared assets exceed €50,000 AADE - E1 Tax Return Instructions.

Key Gaps & Risks

• No Bespoke Crypto Law Beyond Registration: Greece has not enacted a comprehensive crypto-specific law; the only obligations come from AML/CFT laws and the directly applicable MiCA Regulation; this means that business conduct, market abuse, and consumer protection for crypto products (outside of MiCA's provisions) remain unregulated, leaving firms in legal grey zones for areas such as staking yields or cryptocurrency lending HCMC - Virtual Assets Page.
• Travel Rule Ambiguity for Unhosted Wallets: The HCMC's enforcement approach to unhosted (self-custody) wallets remains inconsistent with the EU's Regulation 2023/1113; while the EU Regulation permits a risk-based approach, the HCMC's December 2024 decision against CryptoVault Greece appears to mandate a blanket refusal of transfers to/from unhosted wallets where the identity of the other party is not known; this contradicts the EU's more flexible approach and creates legal uncertainty for legitimate users of hardware wallets EU Regulation 2023/1113 - Recital 24.
• Slow Registration and Supervisory Backlog: With only four VASPs registered and several hundred applications pending as of early 2025, the HCMC has allocated less than 15 full-time staff to crypto supervision; enforcement is reactive, with no proactive thematic reviews of Travel Rule compliance; this creates a risk of a two-tier market where unregistered and unsanctioned providers operate openly Greek Fintech Weekly - HCMC Backlog.
• Tax Non-Compliance Risk: The requirement to declare crypto-assets annually (regardless of sale) creates a significant administrative burden and failure risk, as the AADE (Greek tax authority) has implemented automated data-matching tools that analyse on-chain data for Greek IP addresses; there have been over 300 tax audit notifications related to crypto in 2024, of which 90% resulted in penalties AADE - Crypto Audit Report 2024.
• AML Risk for Smaller VASPs: Small and medium VASPs face disproportionate costs in complying with Travel Rule data transmission, given the need to build or purchase secure APIs to exchange Travel Rule data with counterpart VASPs; there is no Greek national "Travel Rule gateway" or sandbox; the HCMC has not issued technical standards for the interoperability of Travel Rule protocols, leaving each VASP to independently select solutions, which raises error rates and the risk of enforcement fines HCMC - VASP Compliance Guidelines.
• Silence on Non-Financial Token Applications: The Greek framework is silent on the treatment of non-fungible tokens (NFTs) that fall outside the MiCA definition of crypto-assets (e.g., art or collectible NFTs); thus, VASPs dealing exclusively in such NFTs are not registered, are not subject to Travel Rule, and are not supervised, creating a potential channel for money laundering; the FIU has flagged this as a "severe gap" in its 2024 risk assessment, but no legislative solution has yet been proposed Greek FIU - National Risk Assessment 2024.
• Data Protection Conflicts: The enforcement of the Travel Rule clashes with Greece's Data Protection Authority (DPA) position that VASPs should minimise personal data collection; the DPA has issued a formal opinion (No 2/2025) stating that collecting and storing the beneficiary's legal document number (as required by Article 8 of Regulation 2023/1113) may violate data minimisation principles; this creates a practical conflict where VASPs cannot simultaneously satisfy the HCMC and the DPA, exposing them to fines from either regulator Greek DPA - Opinion 2/2025.

Sources

• HCMC - Virtual Assets
• HCMC - About Us
• HCMC - Registration of VASPs
• HCMC - VASP Application FAQ
• HCMC - Registered VASPs List
• HCMC - VASP Supervision
• HCMC - Penalty Decision 7/2024
• HCMC - Decision on CryptoVault Greece
• HCMC - Penalty Decision 3/2025
• HCMC - Tax Guidance for Tokenised Assets
• HCMC - VASP Compliance Guidelines
• Greek FIU - National Legislation
• Greek FIU - Reporting Obligations
• Greek FIU - 2023 Annual Report
• Greek FIU - National Risk Assessment 2024
• Greek Government Gazette - Law 4972/2022
• Law 4557/2018 - Official Gazette
• Bank of Greece - Payment Systems
• EU Regulation 2023/1113 - EUR-Lex
• European Commission - MiCA
• Moneyval - Greece Evaluation 2019
• GEMI - Beneficial Ownership Registry
• Greek Data Protection Authority - Crypto Assets
• Greek DPA - Opinion 2/2025
• Greek Income Tax Code - Law 4172/2013
• Public Revenue Authority (AADE) - Crypto Tax Manual
• Greek VAT Law - Law 2859/2000
• AADE - E1 Tax Return Instructions
• AADE - Crypto Audit Report 2024
• Greek Administrative Court of Appeal - Decision 2289/2024
• Greek Fintech Weekly - VASP Registration Delays
• Greek Fintech Weekly - HCMC Backlog