Get your compliance DONE. AML guidance from Shoulder Compliance, Malta.

Written by the team at Shoulder Compliance, Malta.

Contact Us
Contact Us
AMLR FOR CRYPTO-ASSET SERVICE PROVIDERS

Anti-money laundering regulation (AMLR) for crypto-asset service providers

CASPs become full financial institutions for AML purposes, with some rules written just for them.

Talk to an expert
Anti-money laundering regulation (AMLR) for crypto-asset service providers

Under Regulation (EU) 2024/1624, a crypto-asset service provider is a financial institution (Article 2(1)(6)(i)) and an obliged entity under Article 3. From 10 July 2027, the Regulation governs your customer due diligence directly.

What is different for CASPs

  • A lower threshold. Article 19(3) requires full CDD for occasional transactions of EUR 1,000 or more. Below that, you still apply the identification measures in Article 20(1)(a). The general threshold for other obliged entities is EUR 10,000.
  • Self-hosted addresses. Article 40 tells CASPs to assess the risk of transfers to and from self-hosted addresses and apply proportionate measures. Examples in the text include verifying the originator or beneficiary, asking for more information about where the assets come from and go, and enhanced monitoring. AMLA must issue guidelines on this by 10 July 2027.
  • Correspondent relationships. Article 37 sets enhanced due diligence for cross-border relationships with non-EU entities offering similar services: check licensing, assess controls, get senior management approval and document responsibilities.
  • No anonymous accounts. Article 79 bans anonymous crypto-asset accounts and accounts that obscure transactions, expressly including through anonymity-enhancing coins.

Malta angle

Many Maltese CASPs came through the VFA regime and then MiCA. The MFSA wrote to the industry in June 2026 saying the VFA transitional measures ended on 30 June 2026, so a firm still operating needs its MiCA authorisation. The MFSA letter has the detail. AML supervision stays a separate question and you should expect the FIAU to keep asking about travel rule controls until AMLR guidance replaces its current procedures.

A practitioner view

The EUR 1,000 trigger sounds like a small tweak. For an exchange with many small retail swaps it is the line between onboarding only on a nominal basis and running a full CDD pipeline for each customer. Test your volume data against it now, because it drives staffing.

What this means for you

Map your products to the CASP definition first, then to the self-hosted and correspondent rules. If you would like a gap view before the guidelines arrive, send an enquiry or schedule a no-obligation call with us. Related reading: AMLR in the EU, payments and e-money, the Malta view.

General information, not legal advice.

Talk to an expert