Crypto ATMs in Europe: A Wide-Open Door That's Finally Closing

A crypto ATM lets someone insert cash and walk away minutes later with bitcoin, or another cryptocurrency, in a digital wallet, no bank account or exchange account required. Which means little to no identity verification, “know your customer” (KYC) checks, are conducted. Some machines work the other way too, converting crypto back into cash. What started as a novelty just over a decade ago has, at its peak in early 2025, grown into a global network of nearly 38,000 machines.[1]

That simplicity is what made crypto ATMs attractive for money laundering. In the early years, many machines required no ID-verification at all, and where checks did exist they were often minimal. Oversight, meanwhile, was fragmented across dozens of small, loosely supervised operators. That combination, cash in, no questions asked, crypto out, made the machines a convenient way to convert illicit cash into a portable, borderless asset. It also enabled structuring: splitting large sums into smaller transactions across several machines, or several people, to stay under reporting thresholds. That has since changed on paper; operators are now required to verify identity before a transaction goes through, though how consistently that happens in practice still varies. Fees have always been steep, too, and remain among the highest anywhere in the crypto industry.[2] For an ordinary buyer that’s a poor deal. For someone moving illicit cash quickly and quietly, the cost was never really the point.

The main check on this has come from the Markets in Crypto-Assets Regulation (MiCAR). Which every Crypto-Asset Service Provider (CASP) needs to be fully compliant with from 1 July 2026, either by obtaining full MiCAR authorization or by ceasing operations. Under MiCAR, an operator that lets people exchange cash for crypto is providing a regulated crypto-asset service and needs a licence as a CASP, complete with the ongoing identity checks and real-time transaction monitoring that many ATM operators were never built for.

Even so, Europe has never been the centre of gravity for this industry. Of an estimated 27,367 crypto ATMs currently in operation worldwide, down from the nearly 38,000 recorded at their early 2025 peak, Europe accounts for roughly 5% of the total, while the United States alone is home to around 70%.[3] Industry forecasts had generally pointed toward continued global growth in the years ahead, but MiCAR has put Europe on a different path than the rest of the world.[4] That divergence is already visible among some of the region’s most prominent operators: of a small sample of ten well known European crypto ATM operators, more than half no longer appear to be running any machines at all, some because they could not meet MiCAR’s requirements, others because they now hold a CASP licence but have shifted away from the ATM business altogether. Either way, the machines still running in Europe are increasingly concentrated among operators that have had to prove themselves to a regulator.[5]

Does that mean the laundering risk is now lower? In the parts of Europe where MiCAR is actually being enforced, yes: fewer machines, run by fewer and better-supervised operators, is a real reduction in exposure. But the risk hasn’t disappeared, it has moved. The machines still standing are increasingly the ones operating in, or close to, a compliance grey zone: technically licensed somewhere in the EU, but passported into markets where day to day supervision is thin, or relying on an interpretation of MiCAR’s scope that no regulator has yet challenged And fraud, scammers directing victims, often older people, to feed cash into a machine under false pretenses, has become at least as visible a problem as laundering itself.

MiCAR’s promise only holds, though, if every member state actually implements it, since a licence from one EU country is meant to work across all 27. Poland is the clearest illustration of why that assumption doesn’t hold automatically. As of MiCAR’s full entry into force, Poland is the only member state without a functioning domestic licensing regime, after President Karol Nawrocki vetoed the implementing law three tim es.[6] Roughly 2,000 Polish crypto businesses, ATM operators included, cannot get licensed at home and must instead obtain a license elsewhere in the EU and passport it back in, or simply move the business abroad. That gap carries extra weight given where Poland is located: it borders both the Kaliningrad exclave and Belarus, areas that are central to EU and US sanctions enforcement against Russia. Without a functioning licensing regime, crypto ATMs in Poland are operating with less oversight in exactly the region where oversight matters most.

That risk is bigger than it might seem, and certainly not purely theoretical. While you could probably never carry a bag of physical cash across the Poland-Belarus border to launder it, the same is not true for crypto ATMs. With those, a redemption code, whether printed on paper or stored in an app, can cross that same border with ease. It carries the same underlying risk and the same consequences as smuggling cash, yet it slips past the very sanctions enforcement built to catch that kind of movement. That is a real and pressing risk. It is a reminder that a gap in one member state’s implementation is not a national curiosity. Through the same passporting rules meant to close it, it becomes a shared European exposure.

Want to know more?

Contact use at: info@compliancechamps.com

Crypto ATMs in Europe: A Wide-Open Door That’s Finally Closing

Want to know more?

Contact details

COOLS Urban Office Lofts

Over Compliance Champs

Services