Spain ends anonymous crypto ATM use: ID required on every transaction from October 28

Crypto ATM anonymity is coming to an end in Spain, as the country introduces mandatory identity verification for every transaction conducted through cryptocurrency kiosks. The move marks a significant shift for a market where customers have used these machines to buy and sell digital assets, sometimes without undergoing the same identification procedures required by traditional financial institutions.

The change comes through Royal Decree 813/2026, published in Spain’s Official State Gazette on October 8. The regulation amends the country’s existing anti-money-laundering framework to require the identification and verification of people conducting transactions through cryptocurrency ATMs.

Under the revised rules, identification becomes compulsory for these transactions rather than being triggered only when a customer crosses a specified monetary threshold. The decree also recognizes physical and digital versions of Spain’s national identity document within the applicable identification framework.

However, the changes are not all effective immediately. The decree generally enters into force 20 days after publication, on October 28, 2026, while certain provisions concerning electronic identification and recordkeeping have an 18-month transitional period.

The government’s move reflects a broader effort to bring cryptocurrency activity more firmly within the financial system’s established safeguards. While a crypto ATM offers a convenient route into digital assets, the ability to transact without adequate identity checks can complicate efforts to trace suspicious activity.

Spain’s regulatory shift is particularly significant because the country has one of Europe’s largest concentrations of cryptocurrency ATMs, with machines serving customers in major urban markets.

FATF evaluation puts pressure on Spanish regulators

The new requirements arrive as Spain prepares for an assessment by the Financial Action Task Force (FATF), the international body responsible for developing standards to combat money laundering and terrorist financing.

The evaluation is expected to examine the effectiveness of Spain’s safeguards, including customer identification, regulatory supervision and the resources available to authorities responsible for monitoring financial activity.

Madrid has already acknowledged the reputational risks associated with gaps in its framework. In the explanatory text accompanying Royal Decree-Law 25/2026, published in September, the Spanish government warned that inadequate controls could leave Spain “percibida como una jurisdicción con debilidades” — perceived as a jurisdiction with weaknesses, in preventing criminal financing and the evasion of international financial sanctions.

The warning underscores why cryptocurrency businesses have become a regulatory priority. Digital assets can move across borders quickly, and investigators may face additional challenges when transactions pass through intermediaries that collect insufficient customer information.

Spain is also strengthening the capacity of its financial intelligence system. Royal Decree 813/2026 includes measures affecting the country’s anti-money-laundering framework, while the broader reform package addresses weaknesses in oversight and compliance.

For regulators, the challenge is not simply to introduce additional rules but to demonstrate that those rules work in practice. A FATF evaluation considers both technical compliance and the effectiveness of a country’s measures against financial crime.

New rules bring crypto firms further into the AML system

The ATM identification requirement is part of a wider regulatory push rather than an isolated intervention. On September 29, Spain adopted Royal Decree-Law 25/2026, which amended its 2010 anti-money-laundering legislation to strengthen the obligations applying to crypto-asset service providers.

The measure also addresses compliance with the European Union’s Transfer of Funds Regulation, Regulation (EU) 2023/1113, commonly associated with the crypto-asset travel rule. This framework requires relevant information about originators and beneficiaries to accompany covered transfers, helping authorities and regulated businesses assess transactions for potential financial crime.

Spain’s earlier failure to fully align its national framework with the EU regulation had prompted infringement proceedings from the European Commission. The Spanish government cited that enforcement process and the approaching FATF assessment among the reasons for strengthening its rules.

Together, the two measures signal a more comprehensive approach to crypto oversight. A crypto ATM operator will face stronger customer-identification expectations, while crypto-asset service providers are brought more explicitly into the country’s anti-money-laundering obligations.

Implementation will be crucial. Operators must establish reliable verification procedures, protect customer information and ensure their compliance systems meet applicable legal requirements. The transitional arrangements for certain electronic identification provisions also mean businesses need to distinguish between immediate legal obligations and requirements subject to a longer implementation period.

For customers, the practical consequence is clear: access to cryptocurrency through physical kiosks will increasingly depend on verified identity rather than anonymity.

Spain joins a wider international crackdown

Spain’s approach comes amid growing international scrutiny of cryptocurrency ATMs, which have attracted attention from regulators concerned about fraud, scams and money laundering.

In Canada, authorities have announced plans to prohibit cryptocurrency ATMs, citing concerns about their use in financial crime. Some US jurisdictions have also moved against the machines, while other regulators have pursued operators over alleged compliance failures.

These measures reflect different policy choices. A ban removes a particular access channel, whereas Spain is pursuing tighter controls intended to make transactions more traceable without prohibiting the machines outright.

That distinction matters for the cryptocurrency industry. Physical kiosks provide a relatively accessible way for customers to exchange cash for digital assets, but their convenience also creates challenges when operators fail to establish adequate customer checks or maintain appropriate transaction records.

Mandatory verification could raise operating costs, require technical upgrades and introduce additional steps for customers. Businesses that already use robust identity controls may face a smaller adjustment than operators whose services have relied heavily on low-friction transactions.

The longer-term effect will depend on enforcement, compliance costs and whether customers migrate to other channels. Stronger identification requirements may help investigators connect transactions to individuals, but identity checks alone cannot eliminate fraud or money laundering.

Spain’s reforms therefore represent a test of whether stricter oversight can address the risks associated with cryptocurrency kiosks while preserving legitimate access to digital assets.

As the FATF evaluation approaches, the country will need to demonstrate that its updated rules translate into effective supervision. For the wider industry, the message is increasingly difficult to ignore: anonymity at the point of crypto access is facing mounting regulatory pressure, and operators must prepare for more demanding compliance standards.