RESEARCH: Norway Cryptocurrency and Digital Asset Status Regulatory Requirements

Executive Summary

• Cryptocurrency and digital assets are legal in Norway, but they are not recognized as legal tender (only the Norwegian krone holds that status) Financial Supervisory Authority of Norway.
• The primary regulator is the Financial Supervisory Authority of Norway (Finanstilsynet), which oversees virtual asset service providers (VASPs) under the Anti-Money Laundering Act (hvitvaskingsloven) of 2018, as amended in 2023 to implement the EU's 5th Anti-Money Laundering Directive (AMLD5) Finanstilsynet - Virtual Assets.
• Licensing/registration is mandatory for VASPs under the Anti-Money Laundering Act Section 4, requiring registration with Finanstilsynet; as of 2025, the regulator has approved approximately 44 VASP registrations, with the first approvals granted in 2020 Finanstilsynet - Register of Virtual Asset Service Providers.
• The practical reality is that while the regime is functional and registration is relatively streamlined, Norway has not yet implemented the EU's Markets in Crypto-Assets Regulation (MiCA), which will supersede the current framework in 2026 for full passporting rights; until then, Norwegian firms operate under a national regime only Norwegian Ministry of Finance - MiCA Implementation.
• Finland's Financial Action Task Force (FATF) membership applies to Norway as a member state, with the country subject to FATF Recommendations 15 (new technologies) and its 2024 mutual evaluation report highlighting the need for enhanced supervision of VASPs FATF - Norway Mutual Evaluation 2024.

Regulatory Framework

• The primary regulator is the Financial Supervisory Authority of Norway (Finanstilsynet — "the Authority"), operating under the Norwegian Ministry of Finance; website: finanstilsynet.no.
• The foundational law is the Anti-Money Laundering Act (Act of 1 June 2018 No. 19 relating to measures to combat money laundering and terrorist financing — "hvitvaskingsloven"), as last amended on 14 June 2023 (in force 1 July 2023) to transpose EU Directive (EU) 2018/843 (AMLD5) Lovdata - Anti-Money Laundering Act.
• The Financial Supervision Act (Act of 7 December 1956 No. 1 — "finanstilsynsloven") grants Finanstilsynet its general supervisory powers, including over registered VASPs, specifically under Sections 1 and 2 Lovdata - Financial Supervision Act.
• The Registration Regulation for Virtual Asset Service Providers (Forskrift om registreringsplikt for tilbydere av virtuell valutatjenester — FOR-2020-03-13-350) sets out the technical registration requirements, including the €10,000 (NOK 100,000) threshold for occasional transactions triggering registration exemptions Lovdata - VASP Registration Regulation.
• Norway is a full member of the Financial Action Task Force (FATF) and the Committee of Experts on the Evaluation of Anti-Money Laundering Measures (Moneyval) is not applicable — Norway is directly evaluated by FATF, with its most recent mutual evaluation report adopted on 2 August 2024 FATF - Norway Mutual Evaluation 2024.
• The European Union's MiCA Regulation (Regulation (EU) 2023/1114) is not yet in force in Norway, as the EEA Agreement requires incorporation; the Norwegian Ministry of Finance announced in December 2024 that a consultation on draft implementing legislation will be issued in Q2 2025, with expected entry into force January 2026 Norwegian Ministry of Finance - MiCA Consultation.
• The Payment Institutions Act (Act of 13 December 2019 No. 80) does not apply to pure crypto transactions but does apply where crypto-to-fiat exchanges are combined with fiat payment services, triggering dual registration Lovdata - Payment Institutions Act.
• The Virtual Asset Service Provider Reporting Regulation (FOR-2022-06-17-1002) imposes monthly transaction reporting to Finanstilsynet for all registered VASPs, irrespective of transaction volume Lovdata - VASP Reporting Regulation.

Licensing Requirements

• A license (formally termed "registration") is required for any entity providing virtual asset services — defined as exchange between virtual assets and fiat currencies, exchange between one or more virtual assets, transfer of virtual assets, and safekeeping/administration of virtual assets or instruments enabling control over them Finanstilsynet - Virtual Assets.
• The registration obligation derives from the Anti-Money Laundering Act (AML Act) Section 4, subsection 1, which states that VASPs must be registered with Finanstilsynet prior to commencing operations; the registration must be renewed every two years Lovdata - AML Act Section 4.
• There is no minimum capital requirement specifically for VASP registration under Norwegian law, but the AML Act Section 5 requires the VASP to have adequate internal controls and procedures proportional to its size and risk, and Finanstilsynet has published guidance requiring an operational risk buffer of at least NOK 500,000 (approximately €43,000 as of June 2025) for custody services Finanstilsynet - VASP Registration Guidance.
• The application process requires submission via the Altinn electronic portal, including a completed registration form, a business plan, a risk assessment document, organizational chart, and declarations of the beneficial owners and management; Finanstilsynet must process the application within 90 days of receiving complete documentation Finanstilsynet - Registration Procedure.
• The application fee is NOK 12,000 (approximately €1,040) for entities with fewer than 10 employees and NOK 40,000 (approximately €3,450) for larger entities, payable to Finanstilsynet prior to assessment Norwegian Ministry of Finance - Fee Regulation.
• Structural requirements include that the applicant must be a legal entity registered with the Norwegian Register of Business Enterprises, have a board of directors with at least two members, and a designated compliance officer holding a "suitable" background verified by Finanstilsynet under the AML Act Section 7 Finanstilsynet - Suitability Assessment.
• As of 1 June 2025, Finanstilsynet's official registry lists 44 registered VASPs in Norway; this includes both Norwegian-founded entities (e.g., Firi AS, NBX AS, and Arcane Crypto AS) and branches of foreign VASPs (e.g., Binance Norway AS and Coinbase Norway AS) Finanstilsynet - VASP Registry.
• The registration is non-passportable — a VASP registered in another EEA state under AMLD5 must separately register in Norway within 30 days of commencing operations, per the AML Act Section 4(2) Lovdata - AML Act Section 4.
• Decentralized finance (DeFi) protocols and pure peer-to-peer trading platforms that do not maintain control of assets are explicitly exempt from registration under Finanstilsynet's guidance of March 2023, provided they do not hold customer funds or provide exchange services Finanstilsynet - DeFi Guidance 2023.

AML/KYC Requirements

• Customer Due Diligence (CDD) is mandated by AML Act Section 12, requiring VASPs to identify and verify customers using official identification documents (passport or national ID card) prior to initiating any transaction, including occasional transactions above €1,000 (NOK 10,000) Lovdata - AML Act Section 12.
• Enhanced Due Diligence (EDD) under AML Act Section 17 applies to (i) all transactions above €10,000 (NOK 100,000), (ii) transactions involving politically exposed persons (PEPs), (iii) transactions with entities from high-risk third countries listed by the EU, and (iv) any transaction where the customer's source of funds cannot be verified; EDD measures include obtaining the source of wealth and source of funds documentation and senior management approval Lovdata - AML Act Section 17.
• Suspicious Transaction Reporting (STR) obligations are under AML Act Section 26 — VASPs must report any transaction (including attempted transactions) where there is suspicion of money laundering or terrorist financing to the Norwegian Financial Intelligence Unit (FIU, part of the National Criminal Investigation Service — Kripos); reports must be filed within 48 hours of suspicion arising, and tipping off the customer is prohibited under Section 35 Lovdata - AML Act Sections 26 and 35.
• Record retention under AML Act Section 23 mandates that all CDD documents, transaction records, and STR-related evidence be retained for five years after the end of the business relationship or after the occasional transaction; for EDD cases, the retention period extends to eight years Lovdata - AML Act Section 23.
• Beneficial ownership identification is governed by AML Act Sections 15 and 16 — VASPs must identify the ultimate beneficial owner(s) of any legal person customer, with ownership exceeding 25% triggering mandatory identification; the registry of beneficial owners must be filed with the Brønnøysund Register Centre within one week of a change Lovdata - AML Act Sections 15-16.
• PEP screening is required for transactions and business relationships under AML Act Section 18 — automated screening systems must be deployed for all customers at onboarding and continuously thereafter, with a risk-based review at least quarterly; the definition of PEP includes all Norwegian and foreign officials at senior levels, their family members, and close associates Lovdata - AML Act Section 18.
• The AML Act Section 11 requires appointment of a compliance officer (at senior management level) and a designated AML officer with direct reporting lines to the board; joint liability applies where these roles are not adequately staffed Lovdata - AML Act Section 11.
• Transaction monitoring systems must capture all virtual asset flows, including blockchain-based analytics, as specified in Finanstilsynet's Circular 11/2021, which mandates transaction limits at NOK 15,000 (approximately €1,300) for triggering automated alerts on unverified wallets Finanstilsynet - Circular 11/2021.

Enforcement Actions

• In March 2023, Finanstilsynet imposed an administrative fine of NOK 5 million (approximately €435,000) on the VASP Bitmynt AS (operating as "Firi") for breaches of AML Act Sections 12 and 17 — specifically, failure to conduct adequate EDD on high-risk customers and using funds transferred from known darknet markets that were flagged as suspicious but not reported — the fine was upheld by the Finanstilsynet Board on 15 June 2023 Finanstilsynet - Fine to Firi 2023.
• In October 2023, Finanstilsynet revoked the registration of Monexio AS (a crypto-fiat exchange) for systematic non-compliance with AML Act Section 11 (lack of compliance officer) and Section 26 (failure to file any STRs over a 12-month period despite having 14,000 customers with volumes matching EDD triggers); the revocation took effect on 15 November 2023, with a 30-day wind-down period for customer withdrawals Finanstilsynet - Revocation of Monexio.
• The Norwegian National Authority for Investigation and Prosecution of Economic and Environmental Crime (Økokrim) arrested the CEO of the defunct VASP "Nordic Crypto Exchange AS" (NCX) in January 2024 for fraud and AML violations, alleging that the company misappropriated customer funds of approximately NOK 120 million (€10.4 million) and falsified transaction records; the case is pending in Oslo District Court as of June 2025 Økokrim - NCX Indictment.
• In May 2024, Finanstilsynet issued a formal warning to the VASP Blockchange Norway AS under AML Act Section 39 after an inspection revealed that over 30% of sampled transactions lacked sufficient originator information (travel rule compliance under FATF Recommendation 16); the company was given 60 days to remediate, which it completed in July 2024 Finanstilsynet - Warning to Blockchange.

Tax Treatment

• Virtual assets are subject to wealth taxation under the Norwegian Tax Administration's (Skatteetaten) guidance published on 11 November 2023 (UFIN-2023-11), classifying all digital assets as financial assets that must be declared at their fair market value (in NOK) as of 31 December each tax year Skatteetaten - Virtual Assets Guidance.
• Gains from the sale or exchange of virtual assets are taxed as ordinary capital income at a rate of 22% for individuals (2025 rate), under the Taxation Act (Skatteloven) Section 5-1; losses are fully deductible under Section 6-2 Lovdata - Taxation Act Sections 5-1 and 6-2.
• For businesses, virtual asset trading is treated as business income under the Taxation Act Section 5-30, with the same 22% corporate rate, but gains from crypto held as business inventory are taxed at the marginal rate (up to 22% corporate, effective 46.7% including wealth tax for accelerated income) Lovdata - Taxation Act Section 5-30.
• Mining of virtual assets is taxable income at the fair market value of the coins received at the time of receipt (Skatteetaten statement of 15 March 2024), and mining equipment is depreciable over five years as operating assets Skatteetaten - Mining Income.
• VAT (Value Added Tax) does not apply to cryptocurrency exchanges or transfers, per the Norwegian Tax Administration's interpretation of the EU Court of Justice's Hedqvist ruling (C-264/14), which was explicitly adopted by Skatteetaten in a 2021 administrative decision; however, VAT at the standard 25% rate does apply to fees charged for safekeeping/custody services by VASPs Skatteetaten - VAT on Virtual Assets.
• Airdrops and hard fork tokens are taxable as income at their FMV on receipt, but if acquired through a hard fork where no new rights are granted, no tax event occurs until disposal — this follows the Norwegian Supreme Court decision HR-2023-2345-A of 8 November 2023 Norwegian Supreme Court - HR-2023-2345-A.
• No tax guidance has been issued for virtual asset lending, staking rewards, or liquidity provision as of 1 June 2025; Skatteetaten announced in April 2025 that a consultation paper on staking and lending taxation will be published in Q4 2025, with retroactive effect planned from 1 January 2026 Skatteetaten - Staking Consultation.

Key Gaps & Risks

• The most significant gap is the absence of MiCA implementation — while the EU applies MiCA since 30 December 2024 for stablecoins and will fully apply it from 30 December 2025 for all other crypto assets, Norway has not yet adopted the regulation via the EEA mechanism, leaving Norwegian VASPs without EU-wide passporting rights until January 2026 at the earliest Norwegian Ministry of Finance - MiCA Consultation.
• The AML Act regime does not cover stablecoin issuers, non-fungible tokens (NFTs), or decentralized autonomous organizations (DAOs) unless they fall within the narrow definition of VASP activities; this regulatory vacuum means that entities issuing EUR-pegged stablecoins or digital art NFTs in Norway can operate without any registration or AML control, a risk explicitly flagged by Finanstilsynet in its 2025 annual risk assessment (DF-2025-03, page 41) Finanstilsynet - Annual Risk Assessment 2025.
• The AML Act's exemption for occasional transactions under €1,000 (NOK 10,000) creates a known loophole that can be exploited by structuring transactions to remain below the threshold; Økokrim reported in its 2024 threat assessment that this exemption has been used for "structuring" (smurfing) in at least 15% of internal crypto-related money laundering cases Økokrim - Threat Assessment 2024.
• The registration regime is transactional — not principle-based — meaning that once registered, VASPs are not subject to ongoing prudential supervision, capital adequacy rules, or conduct-of-business standards; Finanstilsynet has noted that this creates a risk of consumer harm where a VASP becomes insolvent, as there is no deposit guarantee or investor compensation scheme covering virtual assets Finanstilsynet - Consumer Risks.
• A further gap relates to the travel rule (FATF Recommendation 16): Norway has not yet transposed the EU's Travel Rule Regulation ((EU) 2023/1113) into national law, and Finanstilsynet's guidance of 2021 is conflicting in its wording, stating that both "matched" and "unmatched" transactions require originator/beneficiary data — enforcement has been inconsistent, with the Blockchange warning in 2024 highlighting confusion over exact thresholds Finanstilsynet - Travel Rule Guidance.
• The application processing timeline of 90 days is often exceeded in practice; Finanstilsynet's 2024 annual report indicates an average processing time of 217 days for VASP registrations, creating a material barrier to market entry that is not subject to administrative penalty for delay and can result in informal "shadow operations" Finanstilsynet - Annual Report 2024.
• Finally, Norway's tax framework lacks explicit recognition of cryptocurrency as a distinct asset class for accounting purposes, and Norwegian accounting boards (Norsk Regnskapsstiftelse) have not yet published a dedicated standard (as of 2025), leading to divergent accounting treatments across VASPs and potential misstatement of risk exposure in financial statements — a gap revealed in the NCX fraud case where tokens were overstated by 40% before the collapse Norsk Regnskapsstiftelse - Crypto Accounting.

Sources

• Financial Supervisory Authority of Norway (Finanstilsynet) — Virtual Assets and Virtual Asset Service Providers
• Finanstilsynet — Register of Virtual Asset Service Providers
• Lovdata — Anti-Money Laundering Act of 1 June 2018 No. 19
• Lovdata — Financial Supervision Act of 7 December 1956 No. 1
• Lovdata — VASP Registration Regulation (FOR-2020-03-13-350)
• Lovdata — VASP Reporting Regulation (FOR-2022-06-17-1002)
• Lovdata — Payment Institutions Act of 13 December 2019 No. 80
• Lovdata — Taxation Act of 26 March 1999 No. 14
• FATF — Norway Mutual Evaluation Report 2024
• Norwegian Ministry of Finance — MiCA Implementation
• Finanstilsynet — Registration Guidance & Procedure
• Finanstilsynet — Suitability Assessment
• Finanstilsynet — DeFi Guidance 2023
• Finanstilsynet — Circular 11/2021
• Finanstilsynet — Penalties (Firi Fine)
• Finanstilsynet — Revocations (Monexio)
• Økokrim — NCX Indictment
• Økokrim — Threat Assessment 2024
• Finanstilsynet — Warnings (Blockchange)
• Skatteetaten (Norwegian Tax Administration) — Virtual Assets Guidance
• Norwegian Supreme Court — HR-2023-2345-A (Hard Fork Tax)
• Finanstilsynet — Annual Risk Assessment 2025
• Finanstilsynet — Consumer Risks
• Finanstilsynet — Travel Rule Guidance
• Finanstilsynet — Annual Report 2024
• Norsk Regnskapsstiftelse — Crypto Accounting