The proposed changes extend the scope of these Guidelines to crypto-asset service providers (CASPs). The consultation runs until 31 August 2023.

CASPs as well as other credit and financial institutions are exposed to ML/TF risks. For CASPs, these risks can be increased, due to, for example, the use of innovative technologies, instant transfers of crypto assets across the world and services that contain privacy-enhancing features.

The EBA is proposing to amend its ML/TF risk factors guidelines to set common, regulatory expectations of the steps CASPs should take to identify and mitigate these risks effectively.

The amendments introduce new sector-specific guidance for CASPs, which highlights factors that may indicate the CASP’s exposure to the higher or lower ML/TF risk. CASPs should consider these factors when carrying out the ML/TF risk assessments of their business and customers at the outset and during the business relationship. The Guidelines also explain how they should adjust their customer due diligence (CDD) in line with those risks. Furthermore, the amendments include guidance to other credit and financial institutions on risks to consider when engaging in a business relationship with a CASP or when they are otherwise exposed to crypto assets.

Specific guidance for AML/CFT supervisors of CASPs will be delivered through the amendments to the EBA risk-based supervision Guidelines, which are under consultation until 29 June 2023. They will be further complemented with amendments to the Guidelines to prevent the abuse of fund transfers for ML/TF purposes, and new Guidelines on policies and procedures for compliance with restrictive measures. Through these products, the EBA continues its work on strengthening the EU’s AML/CFT defences.

Consultation process

Comments to the consultation paper can be sent by clicking on the "send your comments" button on the EBA’s consultation page. The deadline for the submission of comments is 31 August 2023.

The EBA will hold a virtual public hearing on the consultation paper on 7 June 2023 from 14:00 to 16:00 Paris time. The EBA invites interested stakeholders to register using this link by 5 June 2023 at 16:00 CEST. The dial-in details will be communicated to those who have registered for the meeting.

All contributions received will be published following the end of the consultation, unless requested otherwise.

The scope of the consultation, and of the consultation questions, is limited to the amendments and additions.

Legal basis, background and next steps

Directive (EU) 2015/849 puts the risk-based approach at the centre of the EU’s anti-money laundering and countering the financing of terrorism (AML/CFT) regime. The requirements in this Directive were complemented by the mandate given to the EBA under Articles 17 and 18(4) of Directive (EU) 2015/849 on customer due diligence and the factors credit and financial institutions should consider when assessing the money laundering and terrorist financing risk associated with individual business relationships and occasional transactions.

In July 2021, the European Commission published a legislative package with four proposals to reform the EU legal and institutional AML/CFT framework. One of these proposals, the recast Transfer of Funds Regulation, has already been agreed provisionally. The Provisional Agreement Resulting from Interinstitutional Negotiations of 5 October 2022 (2021/0241 (COD)) includes a number of mandates for the EBA. One of these mandates, laid down in Article 38, mandates the EBA to issue guidelines on the risk variables and risk factors to be taken into account by crypt-asset service providers when entering into business relationship or carrying out transactions in crypto assets.

Once adopted, the Markets in Crypto-assets (MiCA) Regulation will bring crypto-asset services and activities within the EU regulatory scope. At the same time, CASPs will become subject to EU AML/CFT obligations and supervision. This will ensure that the AML/CTF regulatory and supervisory framework is aligned with international recommendations and that ML/TF risks associated with this sector are addressed and effectively managed.