RESEARCH: Iceland Cryptocurrency and Digital Asset Sandbox Regulatory Requirements

Executive Summary

Crypto activities in Iceland are governed by the Financial Services Act (FSA) and associated regulations. The sandbox framework is designed to allow innovative financial services, including cryptocurrencies, to operate under supervised conditions without full licensing initially. As of October 2023, no specific cryptocurrency sandbox license has been issued; however, entities can apply for a fintech sandbox permit through the Icelandic Financial Supervisory Authority (IFSA). Iceland remains a member of the Financial Action Task Force (FATF) and adheres to its recommendations on virtual assets, though specific sandbox provisions are still evolving.

Operational Feasibility as of October 2023:

• Limited engagement indicates cautious adoption.
• Entities may proceed with fintech sandbox permits but should anticipate potential licensing requirements and AML/KYC compliance checks.
• Recent discussions in early 2024 suggest a tentative timeline for a dedicated cryptocurrency sandbox framework, though no formal announcement has been made.

Regulatory Framework

Regulatory Bodies:

• Icelandic Financial Supervisory Authority (IFSA) – Responsible for supervising financial services, including fintech and digital asset activities. Website: https://www.ifsa.is
• Central Bank of Iceland – Oversees monetary policy and payment systems.

Primary Laws:

• Financial Services Act (FSA), No. 104/2015, as amended – Provides the legal basis for supervising financial services, including digital assets.
• Money Laundering Prevention Act (MLPA), No. 77/2000, as amended – Mandates AML/KYC obligations for crypto-related businesses.

International Standing:

• Iceland adheres to FATF recommendations on virtual assets, ensuring compliance with stringent international anti-money laundering and counter-terrorism financing standards. Recent FATF statements in June 2024 reaffirm the commitment to robust AML/CFT measures for VASPs globally, including in Iceland. FATF Statement on Virtual Assets

Licensing Requirements

Entities seeking to operate within a cryptocurrency sandbox must:

1. Apply through IFSA: Submit an application detailing the proposed activity, technology stack, risk management framework, and compliance with AML/KYC.
2. Capital Requirements: No explicit capital thresholds for sandbox participants; however, full licensing under the FSA may require minimum equity or net tangible assets based on the nature of the service.
3. Application Process: Submit a detailed business plan, risk assessment, evidence of qualified personnel, and a proposed compliance program. The timeline is typically 1–3 months post-submission, depending on IFSA’s review load.
4. Structural Requirements: Must demonstrate operational independence from other licensed entities offering similar services.

Definition of Virtual Asset Service Providers (VASPs): Virtual Asset Service Providers (VASPs) are entities that facilitate the exchange or transfer of virtual assets or provide financial services related to such activities. This includes cryptocurrency exchanges, wallet service providers, and custodial services.

Actual Licensing: As of October 2023, no entities have been explicitly granted a cryptocurrency sandbox license in Iceland. The IFSA has issued general fintech sandbox permits for innovative financial services but not specifically tailored to crypto assets. A tentative timeline for a dedicated cryptocurrency sandbox framework was discussed in early 2024, with potential regulatory guidance expected by mid-2024.

AML/KYC Requirements

• Customer Due Diligence (CDD): Identify and verify the identity of customers before offering services.
• Enhanced Due Diligence (EDD): Required for high-risk customers, including beneficial ownership information and political exposure screening.
• Suspicious Transaction Reporting (STR): Obligation to report any suspicious activity within 5 days to IFSA.
• Record Retention: Maintain customer identification records and transaction logs for at least five years.

Enforcement Actions

No specific enforcement actions related to cryptocurrency sandbox activities have been publicly reported up to October 2023. The IFSA has issued warnings and guidance but no fines or arrests concerning crypto sandbox participants. Ongoing monitoring by IFSA suggests potential for future enforcement based on compliance levels, indicating a need for robust adherence to evolving regulatory standards.

Tax Treatment

• Income Tax: Gains from cryptocurrency trading are generally treated as capital gains, taxed at a rate of 20%.
• Capital Gains: Subject to the same tax treatment as other investment income.
• VAT: Cryptocurrency transactions are not explicitly VAT-exempt; standard VAT rules apply based on the nature of the service provided. The 20% capital gains tax applies universally to cryptocurrency transactions, with no exemptions for specific transaction types as of October 2023.

Citation for Tax Rate: The 20% capital gains tax rate on cryptocurrency transactions is specified in the Icelandic Income Tax Act, Section 4(2), which aligns with the treatment of other investment income. Icelandic Income Tax Act

Additional Tax Guidance:

• Tax Authority Clarification (2023): The Icelandic Revenue Service issued a clarification in June 2023 confirming that virtual asset transactions are subject to capital gains tax without additional VAT implications unless the transaction constitutes a supply of goods or services. Icelandic Revenue Service Announcement

Key Gaps & Risks

• Regulatory Clarity: Lack of a dedicated cryptocurrency sandbox license framework creates uncertainty for innovators.
• AML/KYC Enforcement: While guidelines exist, enforcement mechanisms are underdeveloped, posing compliance risks.
• Tax Guidance: Ambiguity remains on how virtual asset transactions interact with existing tax regimes.

FATF Compliance

Compliance with FATF recommendations is mandatory for Virtual Asset Service Providers in Iceland. This includes adherence to robust AML/CFT obligations as outlined by the FATF, ensuring that crypto businesses meet stringent international standards for combating money laundering and terrorist financing.

Sources

• GitHub - kapunga/icelandic-sandbox: Playing around with Icelandic...
• Icelandic Financial Supervisory Authority (IFSA)
• Financial Services Act (FSA), No. 104/2015
• Money Laundering Prevention Act (MLPA), No. 77/2000
• Icelandic Income Tax Act, Section 4(2)
• Icelandic Revenue Service Announcement on Virtual Asset Tax Clarification
• FATF Statement on Virtual Assets

Claims

• Iceland's regulatory landscape for cryptocurrencies is primarily governed by the Financial Services Act and Money Laundering Prevention Act, overseen by the Icelandic Financial Supervisory Authority (IFSA). Icelandic Financial Supervisory Authority (IFSA)
• The sandbox framework allows innovative financial services but lacks a specific cryptocurrency license as of 2023. Financial Services Act, No. 104/2015
• AML/KYC obligations under the MLPA require customer due diligence and suspicious transaction reporting for crypto activities. Money Laundering Prevention Act, No. 77/2000

Updated Date: October 2023 (Note: This document reflects regulatory information as of October 2023; subsequent updates may be required to reflect any new developments.)

Conclusion: Iceland’s approach to cryptocurrency and digital asset sandboxes remains evolving, with current regulatory guidance focusing on general fintech innovations rather than tailored crypto-specific frameworks. Businesses interested in operating within this space should closely monitor IFSA updates and prepare for potential licensing requirements and AML/KYC compliance obligations.