This Regulation lays down rules on the information on payers and payees accompanying transfers of funds, in any currency, and on the information on originators and beneficiaries accompanying transfers of crypto-assets, for the purposes of preventing, detecting and investigating money laundering and terrorist financing, where at least one of the payment service providers or crypto-asset service providers involved in the transfer of funds or transfer of crypto-assets is established or has its registered office, as applicable, in the Union. In addition, this Regulation lays down rules on internal policies, procedures and controls to ensure implementation of restrictive measures where at least one of the payment service providers or crypto-asset service providers involved in the transfer of funds or transfer of crypto-assets is established or has its registered office, as applicable, in the Union.
Article 2 -
Scope
1. This Regulation shall apply to transfers of funds, in any currency, which are sent or received by a payment service provider or an intermediary payment service provider established in the Union. It shall also apply to transfers of crypto-assets, including transfers of crypto-assets executed by means of crypto-ATMs, where the crypto-asset service provider, or the intermediary crypto-asset service provider, of either the originator or the beneficiary has its registered office in the Union.
2. This Regulation shall not apply to the services listed in Article 3, points (a) to (m) and point (o), of Directive (EU) 2015/2366.
3. This Regulation shall not apply to transfers of funds or to transfers of electronic money tokens, as defined in Article 3(1), point (7), of Regulation (EU) 2023/1114, carried out using a payment card, an electronic money instrument, a mobile phone or any other digital or IT prepaid or postpaid device with similar characteristics, provided that the following conditions are met:
(a)
that card, instrument or device is used exclusively to pay for goods or services; and
(b)
the number of that card, instrument or device accompanies all transfers flowing from the transaction.
However, this Regulation shall apply when a payment card, an electronic money instrument, a mobile phone or any other digital or IT prepaid or postpaid device with similar characteristics is used in order to effect a transfer of funds or electronic money tokens between natural persons acting as consumers for purposes other than trade, business or professional activity.
4. This Regulation shall not apply to persons that have no activity other than to convert paper documents into electronic data and that do so pursuant to a contract with a payment service provider, or to persons that have no activity other than to provide payment service providers with messaging or other support systems for transmitting funds or with clearing and settlement systems.
This Regulation shall not apply to a transfer of funds where any of the following conditions is met:
(a)
it involves the payer withdrawing cash from the payer’s own payment account;
(b)
it constitutes a transfer of funds to a public authority as payment for taxes, fines or other levies within a Member State;
(c)
both the payer and the payee are payment service providers acting on their own behalf;
(d)
it is carried out through cheque images exchanges, including truncated cheques.
This Regulation shall not apply to a transfer of crypto-assets where any of the following conditions is met:
(a)
both the originator and the beneficiary are crypto-asset service providers acting on their own behalf;
(b)
the transfer constitutes a person-to-person transfer of crypto-assets carried out without the involvement of a crypto-asset service provider.
Electronic money tokens, as defined in Article 3(1), point (7), of Regulation (EU) 2023/1114, shall be treated as crypto-assets under this Regulation.
5. A Member State may decide not to apply this Regulation to transfers of funds within its territory to a payee’s payment account permitting payment exclusively for the provision of goods or services where all of the following conditions are met:
(a)
the payment service provider of the payee is subject to Directive (EU) 2015/849;
(b)
the payment service provider of the payee is able to trace back, through the payee, by means of a unique transaction identifier, the transfer of funds from the person who has an agreement with the payee for the provision of goods or services;
(c)
the amount of the transfer of funds does not exceed EUR 1 000.
Article 3 -
Definitions
For the purposes of this Regulation, the following definitions apply:
(1)
‘terrorist financing’ means terrorist financing as defined in Article 1(5) of Directive (EU) 2015/849;
(2)
‘money laundering’ means the money laundering activities referred to in Article 1(3) and (4) of Directive (EU) 2015/849;
(3)
‘payer’ means a person that holds a payment account and allows a transfer of funds from that payment account or, where there is no payment account, that gives a transfer of funds order;
(4)
‘payee’ means a person that is the intended recipient of the transfer of funds;
(5)
‘payment service provider’ means the categories of payment service provider referred to in Article 1(1) of Directive (EU) 2015/2366, natural or legal persons benefiting from a waiver pursuant to Article 32 thereof and legal persons benefiting from a waiver pursuant to Article 9 of Directive 2009/110/EC, providing transfer of funds services;
(6)
‘intermediary payment service provider’ means a payment service provider that is not the payment service provider of the payer or of the payee and that receives and transmits a transfer of funds on behalf of the payment service provider of the payer or of the payee or of another intermediary payment service provider;
(7)
‘payment account’ means a payment account as defined in Article 4, point (12), of Directive (EU) 2015/2366;
(8)
‘funds’ means funds as defined in Article 4, point (25), of Directive (EU) 2015/2366;
(9)
‘transfer of funds’ means any transaction at least partially carried out by electronic means on behalf of a payer through a payment service provider, with a view to making funds available to a payee through a payment service provider, irrespective of whether the payer and the payee are the same person and irrespective of whether the payment service provider of the payer and that of the payee are one and the same, including:
(a)
a credit transfer as defined in Article 4, point (24), of Directive (EU) 2015/2366;
(b)
a direct debit as defined in Article 4, point (23), of Directive (EU) 2015/2366;
(c)
a money remittance as defined in Article 4, point (22), of Directive (EU) 2015/2366, whether national or cross-border;
(d)
a transfer carried out using a payment card, an electronic money instrument, a mobile phone or any other digital or IT prepaid or postpaid device with similar characteristics;
(10)
‘transfer of crypto-assets’ means any transaction with the aim of moving crypto-assets from one distributed ledger address, crypto-asset account or other device allowing the storage of crypto-assets to another, carried out by at least one crypto-asset service provider acting on behalf of either an originator or a beneficiary, irrespective of whether the originator and the beneficiary are the same person and irrespective of whether the crypto-asset service provider of the originator and that of the beneficiary are one and the same;
(11)
‘batch file transfer’ means a bundle of several individual transfers of funds or transfers of crypto-assets put together for transmission;
(12)
‘unique transaction identifier’ means a combination of letters, numbers or symbols determined by the payment service provider, in accordance with the protocols of the payment and settlement systems or messaging systems used for the transfer of funds, or determined by a crypto-asset service provider, which permits the traceability of the transaction back to the payer and the payee or the traceability of the transfer of crypto-assets back to the originator and the beneficiary;
(13)
‘person-to-person transfer of crypto-assets’ means a transfer of crypto-assets without the involvement of any crypto-asset service provider;
(14)
‘crypto-asset’ means a crypto-asset as defined in Article 3(1), point (5), of Regulation (EU) 2023/1114, except where falling within the categories listed in Article 2(2), (3) and (4) of that Regulation or otherwise qualifying as funds;
(15)
‘crypto-asset service provider’ means a crypto-asset service provider as defined in Article 3(1), point (15), of Regulation (EU) 2023/1114, where performing one or more crypto-asset services as defined in Article 3(1), point (16), of that Regulation;
(16)
‘intermediary crypto-asset service provider’ means a crypto-asset service provider that is not the crypto-asset service provider of the originator or of the beneficiary and that receives and transmits a transfer of crypto-assets on behalf of the crypto-asset service provider of the originator or of the beneficiary, or of another intermediary crypto-asset service provider;
(17)
‘crypto-asset automated teller machines’ or ‘crypto-ATMs’ means physical or on-line electronic terminals that enable a crypto-asset service provider to perform, in particular, the activity of transfer services for crypto-assets, as referred to in Article 3(1), point (16)(j), of Regulation (EU) 2023/1114;
(18)
‘distributed ledger address’ means an alphanumeric code that identifies an address on a network using distributed ledger technology (DLT) or similar technology where crypto-assets can be sent or received;
(19)
‘crypto-asset account’ means an account held by a crypto-asset service provider in the name of one or more natural or legal persons and that can be used for the execution of transfers of crypto-assets;
(20)
‘self-hosted address’ means a distributed ledger address not linked to either of the following:
(a)
a crypto-asset service provider;
(b)
an entity not established in the Union and providing services similar to those of a crypto-asset service provider;
(21)
‘originator’ means a person that holds a crypto-asset account with a crypto-asset service provider, a distributed ledger address or a device allowing the storage of crypto-assets, and allows a transfer of crypto-assets from that account, distributed ledger address, or device, or, where there is no such account, distributed ledger address, or device, a person that orders or initiates a transfer of crypto-assets;
(22)
‘beneficiary’ means a person that is the intended recipient of the transfer of crypto-assets;
(23)
‘legal entity identifier’ or ‘LEI’ means a unique alphanumeric reference code based on the ISO 17442 standard assigned to a legal entity;
(24)
‘distributed ledger technology’ or ‘DLT’ means distributed ledger technology as defined in Article 3(1), point (1), of Regulation (EU) 2023/1114.
CHAPTER II - Obligations on payment service providers
Section 1 - Obligations on the payment service provider of the payer
Article 4 -
Information accompanying transfers of funds
1. The payment service provider of the payer shall ensure that transfers of funds are accompanied by the following information on the payer:
(a)
the name of the payer;
(b)
the payer’s payment account number;
(c)
the payer’s address including the name of the country, official personal document number and customer identification number, or, alternatively, the payer’s date and place of birth; and
(d)
subject to the existence of the necessary field in the relevant payments message format, and where provided by the payer to its payment service provider, the current LEI of the payer or, in its absence, any available equivalent official identifier.
2. The payment service provider of the payer shall ensure that transfers of funds are accompanied by the following information on the payee:
(a)
the name of the payee;
(b)
the payee’s payment account number; and
(c)
subject to the existence of the necessary field in the relevant payments message format, and where provided by the payer to its payment service provider, the current LEI of the payee or, in its absence, any available equivalent official identifier.
3. By way of derogation from paragraph 1, point (b), and paragraph 2, point (b), in the case of a transfer not made to or from a payment account, the payment service provider of the payer shall ensure that the transfer of funds is accompanied by a unique transaction identifier rather than the payment account number.
4. Before transferring funds, the payment service provider of the payer shall verify the accuracy of the information referred to in paragraph 1 and, where applicable, in paragraph 3, on the basis of documents, data or information obtained from a reliable and independent source.
5. Verification as referred to in paragraph 4 of this Article shall be deemed to have taken place where one of the following applies:
(a)
the identity of the payer has been verified in accordance with Article 13 of Directive (EU) 2015/849 and the information obtained pursuant to that verification has been retained in accordance with Article 40 of that Directive;
(b)
Article 14(5) of Directive (EU) 2015/849 applies to the payer.
6. Without prejudice to the derogations provided for in Articles 5 and 6, the payment service provider of the payer shall not execute any transfer of funds before ensuring full compliance with this Article.
Article 5 -
Transfers of funds within the Union
1. By way of derogation from Article 4(1) and (2), where all payment service providers involved in the payment chain are established in the Union, transfers of funds shall be accompanied by at least the payment account number of both the payer and the payee or, where Article 4(3) applies, the unique transaction identifier, without prejudice to the information requirements laid down in Regulation (EU) No 260/2012, where applicable.
2. Notwithstanding paragraph 1, the payment service provider of the payer shall, within three working days of receiving a request for information from the payment service provider of the payee or from the intermediary payment service provider, make available the following:
(a)
for transfers of funds exceeding EUR 1 000, whether such transfers are carried out in a single transaction or in several transactions which appear to be linked, the information on the payer or the payee in accordance with Article 4;
(b)
for transfers of funds not exceeding EUR 1 000 that do not appear to be linked to other transfers of funds which, together with the transfer in question, exceed EUR 1 000, at least:
(i)
the names of the payer and of the payee; and
(ii)
the payment account numbers of the payer and of the payee or, where Article 4(3) applies, the unique transaction identifier.
3. By way of derogation from Article 4(4), in the case of transfers of funds referred to in paragraph 2, point (b), of this Article, the payment service provider of the payer need not verify the information on the payer unless the payment service provider of the payer:
(a)
has received the funds to be transferred in cash or in anonymous electronic money; or
(b)
has reasonable grounds for suspecting money laundering or terrorist financing.
Article 6 -
Transfers of funds to outside the Union
1. In the case of a batch file transfer from a single payer where the payment service providers of the payees are established outside the Union, Article 4(1) shall not apply to the individual transfers bundled together therein, provided that the batch file contains the information referred to in Article 4(1), (2) and (3), that that information has been verified in accordance with Article 4(4) and (5), and that the individual transfers carry the payment account number of the payer or, where Article 4(3) applies, the unique transaction identifier.
2. By way of derogation from Article 4(1), and, where applicable, without prejudice to the information required in accordance with Regulation (EU) No 260/2012, where the payment service provider of the payee is established outside the Union, transfers of funds not exceeding EUR 1 000 that do not appear to be linked to other transfers of funds which, together with the transfer in question, exceed EUR 1 000, shall be accompanied by at least:
(a)
the names of the payer and of the payee; and
(b)
the payment account numbers of the payer and of the payee or, where Article 4(3) applies, the unique transaction identifier.
By way of derogation from Article 4(4), the payment service provider of the payer need not verify the information on the payer referred to in this paragraph unless the payment service provider of the payer:
(a)
has received the funds to be transferred in cash or in anonymous electronic money; or
(b)
has reasonable grounds for suspecting money laundering or terrorist financing.
Section 2 - Obligations on the payment service provider of the payee
Article 7 -
Detection of missing information on the payer or the payee
1. The payment service provider of the payee shall implement effective procedures to detect whether the fields relating to the information on the payer and the payee in the messaging or payment and settlement system used to effect the transfer of funds have been filled in using characters or inputs admissible in accordance with the conventions of that system.
2. The payment service provider of the payee shall implement effective procedures, including, where appropriate, monitoring after or during the transfers, in order to detect whether the following information on the payer or the payee is missing:
(a)
for transfers of funds where the payment service provider of the payer is established in the Union, the information referred to in Article 5;
(b)
for transfers of funds where the payment service provider of the payer is established outside the Union, the information referred to in Article 4(1), points (a), (b) and (c), and Article 4(2), points (a) and (b);
(c)
for batch file transfers where the payment service provider of the payer is established outside the Union, the information referred to in Article 4(1), points (a), (b) and (c), and Article 4(2), points (a) and (b), in respect of that batch file transfer.
3. In the case of transfers of funds exceeding EUR 1 000, whether those transfers are carried out in a single transaction or in several transactions which appear to be linked, before crediting the payee’s payment account or making the funds available to the payee, the payment service provider of the payee shall verify the accuracy of the information on the payee referred to in paragraph 2 of this Article on the basis of documents, data or information obtained from a reliable and independent source, without prejudice to the requirements laid down in Articles 83 and 84 of Directive (EU) 2015/2366.
4. In the case of transfers of funds not exceeding EUR 1 000 that do not appear to be linked to other transfers of funds which, together with the transfer in question, exceed EUR 1 000, the payment service provider of the payee need not verify the accuracy of the information on the payee, unless the payment service provider of the payee:
(a)
effects the pay-out of the funds in cash or in anonymous electronic money; or
(b)
has reasonable grounds for suspecting money laundering or terrorist financing.
5. Verification as referred to in paragraphs 3 and 4 of this Article shall be deemed to have taken place where one of the following applies:
(a)
the identity of the payee has been verified in accordance with Article 13 of Directive (EU) 2015/849 and the information obtained pursuant to that verification has been retained in accordance with Article 40 of that Directive;
(b)
Article 14(5) of Directive (EU) 2015/849 applies to the payee.
Article 8 -
Transfers of funds with missing or incomplete information on the payer or the payee
1. The payment service provider of the payee shall implement effective risk-based procedures, including procedures based on the risk-sensitive basis referred to in Article 13 of Directive (EU) 2015/849 for determining whether to execute, reject or suspend a transfer of funds lacking the required complete payer and payee information and for taking the appropriate follow-up action.
Where the payment service provider of the payee becomes aware, when receiving a transfer of funds, that the information referred to in Article 4(1), points (a), (b) and (c), Article 4(2), points (a) and (b), Article 5(1), or Article 6, is missing or incomplete or has not been filled in using characters or inputs admissible in accordance with the conventions of the messaging or payment and settlement system as referred to in Article 7(1), the payment service provider of the payee shall, on a risk-sensitive basis:
(a)
reject the transfer; or
(b)
request the required information on the payer and the payee before or after crediting the payee’s payment account or making the funds available to the payee.
2. Where a payment service provider repeatedly fails to provide the required information on the payer or the payee, the payment service provider of the payee shall:
(a)
take steps, which may initially include the issuing of warnings and setting of deadlines, before proceeding to a rejection, restriction or termination in accordance with point (b) if the required information is still not provided; or
(b)
directly reject any future transfers of funds from that payment service provider, or restrict or terminate its business relationship with that payment service provider.
The payment service provider of the payee shall report that failure, and the steps taken, to the competent authority responsible for monitoring compliance with anti-money laundering and counter-terrorist financing provisions.
Article 9 -
Assessment and reporting
The payment service provider of the payee shall take into account missing or incomplete information on the payer or the payee as a factor when assessing whether a transfer of funds, or any related transaction, is suspicious and whether it is to be reported to the Financial Intelligence Unit (FIU) in accordance with Directive (EU) 2015/849.
Section 3 - Obligations on intermediary payment service providers
Article 10 -
Retention of information on the payer and the payee accompanying the transfer
Intermediary payment service providers shall ensure that all the information received on the payer and the payee that accompanies a transfer of funds is retained with the transfer.
Article 11 -
Detection of missing information on the payer or the payee
1. The intermediary payment service provider shall implement effective procedures to detect whether the fields relating to the information on the payer and the payee in the messaging or payment and settlement system used to effect the transfer of funds have been filled in using characters or inputs admissible in accordance with the conventions of that system.
2. The intermediary payment service provider shall implement effective procedures, including, where appropriate, monitoring after or during the transfers, in order to detect whether the following information on the payer or the payee is missing:
(a)
for transfers of funds where the payment service providers of the payer and the payee are established in the Union, the information referred to in Article 5;
(b)
for transfers of funds where the payment service provider of the payer or of the payee is established outside the Union, the information referred to in Article 4(1), points (a), (b) and (c), and Article 4(2), points (a) and (b);
(c)
for batch file transfers where the payment service provider of the payer or of the payee is established outside the Union, the information referred to in Article 4(1), points (a), (b) and (c), and Article 4(2), points (a) and (b), in respect of that batch file transfer.
Article 12 -
Transfers of funds with missing information on the payer or the payee
1. The intermediary payment service provider shall establish effective risk-based procedures for determining whether to execute, reject or suspend a transfer of funds lacking the required payer and payee information and for taking the appropriate follow-up action.
Where the intermediary payment service provider becomes aware, when receiving a transfer of funds, that the information referred to in Article 4(1), points (a), (b) and (c), Article 4(2), points (a) and (b), Article 5(1), or Article 6, is missing or has not been filled in using characters or inputs admissible in accordance with the conventions of the messaging or payment and settlement system as referred to in Article 7(1), that intermediary payment service provider shall on a risk-sensitive basis:
(a)
reject the transfer; or
(b)
request the required information on the payer and the payee before or after the transmission of the transfer of funds.
2. Where a payment service provider repeatedly fails to provide the required information on the payer or the payee, the intermediary payment service provider shall:
(a)
take steps, which may initially include the issuing of warnings and setting of deadlines, before proceeding to a rejection, restriction or termination in accordance with point (b) if the required information is still not provided; or
(b)
directly reject any future transfers of funds from that payment service provider or restrict or terminate its business relationship with that payment service provider.
The intermediary payment service provider shall report that failure, and the steps taken, to the competent authority responsible for monitoring compliance with anti-money laundering and counter-terrorist financing provisions.
Article 13 -
Assessment and reporting
The intermediary payment service provider shall take into account missing information on the payer or the payee as a factor when assessing whether a transfer of funds, or any related transaction, is suspicious, and whether it is to be reported to the FIU in accordance with Directive (EU) 2015/849.
CHAPTER III - Obligations on crypto-asset service providers
Section 1 - Obligations on the crypto-asset service provider of the originator
Article 14 -
Information accompanying transfers of crypto-assets
1. The crypto-asset service provider of the originator shall ensure that transfers of crypto-assets are accompanied by the following information on the originator:
(a)
the name of the originator;
(b)
the originator’s distributed ledger address, in cases where a transfer of crypto-assets is registered on a network using DLT or similar technology, and the crypto-asset account number of the originator, where such an account exists and is used to process the transaction;
(c)
the originator’s crypto-asset account number, in cases where a transfer of crypto-assets is not registered on a network using DLT or similar technology;
(d)
the originator’s address, including the name of the country, official personal document number and customer identification number, or, alternatively, the originator’s date and place of birth; and
(e)
subject to the existence of the necessary field in the relevant message format, and where provided by the originator to its crypto-asset service provider, the current LEI or, in its absence, any other available equivalent official identifier of the originator.
2. The crypto-asset service provider of the originator shall ensure that transfers of crypto-assets are accompanied by the following information on the beneficiary:
(a)
the name of the beneficiary;
(b)
the beneficiary’s distributed ledger address, in cases where a transfer of crypto-assets is registered on a network using DLT or similar technology, and the beneficiary’s crypto-asset account number, where such an account exists and is used to process the transaction;
(c)
the beneficiary’s crypto-asset account number, in cases where a transfer of crypto-assets is not registered on a network using DLT or similar technology; and
(d)
subject to the existence of the necessary field in the relevant message format, and where provided by the originator to its crypto-asset service provider, the current LEI or, in its absence, any other available equivalent official identifier of the beneficiary.
3. By way of derogation from paragraph 1, point (c), and paragraph 2, point (c), in the case of a transfer of crypto-assets not registered on a network using DLT or similar technology and not made to or from a crypto-asset account, the crypto-asset service provider of the originator shall ensure that the transfer of crypto-assets is accompanied by a unique transaction identifier.
4. The information referred to in paragraphs 1 and 2 shall be submitted in advance of, or simultaneously or concurrently with, the transfer of crypto-assets and in a secure manner and in accordance with Regulation (EU) 2016/679.
The information referred to in paragraphs 1 and 2 shall not be required to be attached directly to, or be included in, the transfer of crypto-assets.
5. In the case of a transfer of crypto-assets made to a self-hosted address, the crypto-asset service provider of the originator shall obtain and hold the information referred to in paragraphs 1 and 2 and shall ensure that the transfer of crypto-assets can be individually identified.
Without prejudice to specific risk mitigating measures taken in accordance with Article 19b of Directive (EU) 2015/849, in the case of a transfer of an amount exceeding EUR 1 000 to a self-hosted address, the crypto-asset service provider of the originator shall take adequate measures to assess whether that address is owned or controlled by the originator.
6. Before transferring crypto-assets, the crypto-asset service provider of the originator shall verify the accuracy of the information referred to in paragraph 1 on the basis of documents, data or information obtained from a reliable and independent source.
7. Verification as referred to in paragraph 6 of this Article shall be deemed to have taken place where one of the following applies:
(a)
the identity of the originator has been verified in accordance with Article 13 of Directive (EU) 2015/849 and the information obtained pursuant to that verification has been retained in accordance with Article 40 of that Directive;
(b)
Article 14(5) of Directive (EU) 2015/849 applies to the originator.
8. The crypto-asset service provider of the originator shall not allow for the initiation, or execute any transfer, of crypto-assets before ensuring full compliance with this Article.
Article 15 -
Batch file transfers of crypto-assets
In the case of a batch file transfer of crypto-assets from a single originator, Article 14(1) shall not apply to the individual transfers bundled together therein, provided that the batch file contains the information referred to in Article 14(1), (2) and (3), that that information has been verified in accordance with Article 14(6) and (7), and that the individual transfers carry the distributed ledger address of the originator, where Article 14(2), point (b), applies, the crypto-asset account number of the originator, where Article 14(2), point (c), applies, or the unique transaction identifier, where Article 14(3) applies.
Section 2 - Obligations on the crypto-asset service provider of the beneficiary
Article 16 -
Detection of missing information on the originator or the beneficiary
1. The crypto-asset service provider of the beneficiary shall implement effective procedures, including, where appropriate, monitoring after or during the transfers, in order to detect whether the information referred to in Article 14(1) and (2) on the originator and the beneficiary is included in, or follows, the transfer or batch file transfer of crypto-assets.
2. In the case of a transfer of crypto-assets made from a self-hosted address, the crypto-asset service provider of the beneficiary shall obtain and hold the information referred to in Article 14(1) and (2) and shall ensure that the transfer of crypto-assets can be individually identified.
Without prejudice to specific risk mitigating measures taken in accordance with Article 19b of Directive (EU) 2015/849, in the case of a transfer of an amount exceeding EUR 1 000 from a self-hosted address, the crypto-asset service provider of the beneficiary shall take adequate measures to assess whether that address is owned or controlled by the beneficiary.
3. Before making the crypto-assets available to the beneficiary, the crypto-asset service provider of the beneficiary shall verify the accuracy of the information on the beneficiary referred to in Article 14(2) on the basis of documents, data or information obtained from a reliable and independent source.
4. Verification as referred to in paragraphs 2 and 3 of this Article shall be deemed to have taken place where one of the following applies:
(a)
the identity of the beneficiary has been verified in accordance with Article 13 of Directive (EU) 2015/849 and the information obtained pursuant to that verification has been retained in accordance with Article 40 of that Directive;
(b)
Article 14(5) of Directive (EU) 2015/849 applies to the beneficiary.
Article 17 -
Transfers of crypto-assets with missing or incomplete information on the originator or the beneficiary
1. The crypto-asset service provider of the beneficiary shall implement effective risk-based procedures, including procedures based on the risk-sensitive basis referred to in Article 13 of Directive (EU) 2015/849, for determining whether to execute, reject, return or suspend a transfer of crypto-assets lacking the required complete information on the originator and the beneficiary and for taking the appropriate follow-up action.
Where the crypto-asset service provider of the beneficiary becomes aware that the information referred to in Article 14(1) or (2), or in Article 15, is missing or incomplete, that crypto-asset service provider shall, on a risk-sensitive basis and without undue delay:
(a)
reject the transfer or return the transferred crypto-assets to the originator’s crypto-asset account; or
(b)
request the required information on the originator and the beneficiary before making the crypto-assets available to the beneficiary.
2. Where a crypto-asset service provider repeatedly fails to provide the required information on the originator or the beneficiary, the crypto-asset service provider of the beneficiary shall:
(a)
take steps, which may initially include the issuing of warnings and setting of deadlines, before proceeding to a rejection, restriction or termination in accordance with point (b) if the required information is still not provided; or
(b)
directly reject any future transfers of crypto-assets to or from, or restrict or terminate its business relationship with, that crypto-asset service provider.
The crypto-asset service provider of the beneficiary shall report that failure, and the steps taken, to the competent authority responsible for monitoring compliance with anti-money laundering and counter-terrorist financing provisions.
Article 18 -
Assessment and reporting
The crypto-asset service provider of the beneficiary shall take into account missing or incomplete information on the originator or the beneficiary as a factor when assessing whether a transfer of crypto-assets, or any related transaction, is suspicious and whether it is to be reported to the FIU in accordance with Directive (EU) 2015/849.
Section 3 - Obligations on intermediary crypto-asset service providers
Article 19 -
Retention of information on the originator and the beneficiary accompanying the transfer
Intermediary crypto-asset service providers shall ensure that all the information received on the originator and the beneficiary that accompanies a transfer of crypto-assets is transmitted with the transfer and that records of such information are retained and made available on request to the competent authorities.
Article 20 -
Detection of missing information on the originator or the beneficiary
The intermediary crypto-asset service provider shall implement effective procedures, including, where appropriate, monitoring after or during the transfers, in order to detect whether the information on the originator or the beneficiary referred to in Article 14(1), points (a), (b) and (c), and Article 14(2), points (a), (b) and (c), has been submitted previously, simultaneously or concurrently with the transfer or batch file transfer of crypto-assets, including where the transfer is made to or from a self-hosted address.
Article 21 -
Transfers of crypto-assets with missing information on the originator or the beneficiary
1. The intermediary crypto-asset service provider shall establish effective risk-based procedures, including procedures based on the risk-sensitive basis referred to in Article 13 of Directive (EU) 2015/849, for determining whether to execute, reject, return or suspend a transfer of crypto-assets lacking the required information on the originator and the beneficiary and for taking the appropriate follow up action.
Where the intermediary crypto-asset service provider becomes aware, when receiving a transfer of crypto-assets, that the information referred to in Article 14(1), points (a), (b) and (c), and Article 14(2), points (a), (b) and (c), or Article 15(1), is missing or incomplete, that intermediary crypto-asset service provider shall, on a risk-sensitive basis and without undue delay:
(a)
reject the transfer or return the transferred crypto-assets; or
(b)
request the required information on the originator and the beneficiary before making the transmission of the transfer of crypto-assets.
2. Where the crypto-asset service provider repeatedly fails to provide the required information on the originator or the beneficiary, the intermediary crypto-asset service provider shall:
(a)
take steps, which may initially include the issuing of warnings and setting of deadlines, before proceeding to a rejection, restriction or termination in accordance with point (b) if the required information is still not provided; or
(b)
directly reject any future transfers of crypto-assets to or from, or restrict or terminate its business relationship with, that crypto-asset service provider.
The intermediary crypto-asset service provider shall report that failure, and the steps taken, to the competent authority responsible for monitoring compliance with anti-money laundering and counter-terrorist financing provisions.
Article 22 -
Assessment and reporting
The intermediary crypto-asset service provider shall take into account missing information on the originator or the beneficiary as a factor when assessing whether a transfer of crypto-assets, or any related transaction, is suspicious, and whether it is to be reported to the FIU in accordance with Directive (EU) 2015/849.
CHAPTER IV - Common measures applicable by payment service providers and crypto-asset service providers
Article 23 -
Internal policies, procedures and controls to ensure implementation of restrictive measures
Payment service providers and crypto-asset service providers shall have in place internal policies, procedures and controls to ensure the implementation of Union and national restrictive measures when performing transfers of funds and crypto-assets under this Regulation.
The European Banking Authority (EBA) shall issue guidelines by 30 December 2024 specifying the measures referred to in this Article.
CHAPTER V - Information, data protection and record-retention
Article 24 -
Provision of information
Payment service providers and crypto-asset service providers shall respond fully and without delay, including by means of a central contact point in accordance with Article 45(9) of Directive (EU) 2015/849, where such a contact point has been appointed, and in accordance with the procedural requirements laid down in the national law of the Member State in which they are established or have their registered office, as applicable, to enquiries exclusively from the authorities responsible for preventing and combating money laundering or terrorist financing of that Member State concerning the information required under this Regulation.
Article 25 -
Data protection
1. The processing of personal data under this Regulation is subject to Regulation (EU) 2016/679. Personal data that is processed pursuant to this Regulation by the Commission or EBA is subject to Regulation (EU) 2018/1725.
2. Personal data shall be processed by payment service providers and crypto-asset service providers on the basis of this Regulation only for the purposes of the prevention of money laundering and terrorist financing and shall not be further processed in a way that is incompatible with those purposes. The processing of personal data on the basis of this Regulation for commercial purposes shall be prohibited.
3. Payment service providers and crypto-asset service providers shall provide new clients with the information required pursuant to Article 13 of Regulation (EU) 2016/679 before establishing a business relationship or carrying out an occasional transaction. That information shall be provided in a concise, transparent, intelligible and easily accessible form in accordance with Article 12 of Regulation (EU) 2016/679 and shall, in particular, include a general notice concerning the legal obligations of payment service providers and crypto-asset service providers under this Regulation when processing personal data for the purposes of the prevention of money laundering and terrorist financing.
4. Payment service providers and crypto-asset service providers shall ensure at all times that the transmission of any personal data on the parties involved in a transfer of funds or a transfer of crypto-assets is conducted in accordance with Regulation (EU) 2016/679.
The European Data Protection Board shall, after consulting EBA, issue guidelines on the practical implementation of data protection requirements for transfers of personal data to third countries in the context of transfers of crypto-assets. EBA shall issue guidelines on suitable procedures for determining whether to execute, reject, return or suspend a transfer of crypto-assets in situations where compliance with data protection requirements for the transfer of personal data to third countries cannot be ensured.
Article 26 -
Record retention
1. Information on the payer and the payee or on the originator and beneficiary shall not be retained for longer than strictly necessary. Payment service providers of the payer and of the payee shall retain records of the information referred to in Articles 4 to 7, and crypto-asset service providers of the originator and beneficiary shall retain records of the information referred to in Articles 14 to 16, for a period of five years.
2. Upon expiry of the retention period referred to in paragraph 1, payment service providers and crypto-asset service providers shall ensure that the personal data is deleted, unless otherwise provided for by national law which determines under which circumstances payment service providers and crypto-asset service providers may or shall further retain such data. Member States may allow or require further retention only after they have carried out a thorough assessment of the necessity and proportionality of such further retention, and where they consider it to be justified as necessary for the prevention, detection or investigation of money laundering or terrorist financing. That further retention period shall not exceed five years.
3. Where, on 25 June 2015, legal proceedings concerned with the prevention, detection, investigation or prosecution of suspected money laundering or terrorist financing are pending in a Member State, and a payment service provider holds information or documents relating to those pending proceedings, the payment service provider may retain that information or those documents in accordance with national law for a period of five years from 25 June 2015. Member States may, without prejudice to national criminal law on evidence applicable to ongoing criminal investigations and legal proceedings, allow or require the retention of such information or documents for a further period of five years where the necessity and proportionality of such further retention has been established for the prevention, detection, investigation or prosecution of suspected money laundering or terrorist financing.
Article 27 -
Cooperation among competent authorities
The exchange of information among competent authorities and with relevant third-country authorities under this Regulation shall be subject to Directive (EU) 2015/849.
CHAPTER VI - Sanctions and monitoring
Article 28 -
Administrative sanctions and measures
1. Without prejudice to the right to provide for and impose criminal sanctions, Member States shall lay down the rules on administrative sanctions and measures applicable to breaches of the provisions of this Regulation and shall take all measures necessary to ensure that they are implemented. The sanctions and measures provided for shall be effective, proportionate and dissuasive and shall be consistent with those laid down in accordance with Chapter VI, Section 4, of Directive (EU) 2015/849.
Member States may decide not to lay down rules on administrative sanctions or measures for breach of the provisions of this Regulation which are subject to criminal sanctions in their national law. In that case, Member States shall communicate to the Commission the relevant criminal law provisions.
2. Member States shall ensure that, where obligations apply to payment service providers and crypto-asset service providers, in the event of a breach of provisions of this Regulation sanctions or measures can, subject to national law, be applied to the members of the management body of the relevant service provider and to any other natural person who, under national law, is responsible for the breach.
3. Member States shall notify the rules referred to in paragraph 1 to the Commission and to the permanent internal committee on anti-money-laundering and countering terrorist financing referred to in Article 9a(7) of Regulation (EU) No 1093/2010. Member States shall notify the Commission and that permanent internal committee without undue delay of any subsequent amendments thereto.
4. In accordance with Article 58(4) of Directive (EU) 2015/849, competent authorities shall have all the supervisory and investigatory powers that are necessary for the exercise of their functions. In the exercise of their powers to impose administrative sanctions and measures, competent authorities shall cooperate closely to ensure that those administrative sanctions or measures produce the desired results and to coordinate their action when dealing with cross-border cases.
5. Member States shall ensure that legal persons can be held liable for the breaches referred to in Article 29 committed for their benefit by any person acting individually or as part of an organ of that legal person, and having a leading position within the legal person based on any of the following:
(a)
power to represent the legal person;
(b)
authority to take decisions on behalf of the legal person;
(c)
authority to exercise control within the legal person.
6. Member States shall also ensure that legal persons can be held liable where the lack of supervision or control by a person referred to in paragraph 5 of this Article has made it possible to commit one of the breaches referred to in Article 29 for the benefit of that legal person by a person under its authority.
7. Competent authorities shall exercise their powers to impose administrative sanctions and measures in accordance with this Regulation in any of the following ways:
(a)
directly;
(b)
in collaboration with other authorities;
(c)
under their responsibility by delegation to such other authorities;
(d)
by application to the competent judicial authorities.
In the exercise of their powers to impose administrative sanctions and measures, competent authorities shall cooperate closely in order to ensure that those administrative sanctions or measures produce the desired results and to coordinate their action when dealing with cross-border cases.
Article 29 -
Specific provisions
Member States shall ensure that their administrative sanctions and measures include at least those laid down in Article 59(2) and (3) of Directive (EU) 2015/849 in the event of the following breaches of this Regulation:
(a)
repeated or systematic failure by a payment service provider to accompany the transfer of funds with the required information on the payer or the payee, in breach of Article 4, 5 or 6, or by a crypto-asset service provider to accompany the transfer of crypto-assets with the required information on the originator and beneficiary, in breach of Article 14 or 15;
(b)
repeated, systematic or serious failure by a payment service provider or crypto-asset service provider to retain records, in breach of Article 26;
(c)
failure by a payment service provider to implement effective risk-based procedures, in breach of Article 8 or 12, or by a crypto-asset service provider to implement effective risk-based procedures, in breach of Article 17;
(d)
serious failure by an intermediary payment service provider to comply with Article 11 or 12 or by an intermediary crypto-asset service provider to comply with Article 19, 20 or 21.
Article 30 -
Publication of sanctions and measures
In accordance with Article 60(1), (2) and (3) of Directive (EU) 2015/849, the competent authorities shall publish administrative sanctions and measures imposed in the cases referred to in Articles 28 and 29 of this Regulation without undue delay, including information on the type and nature of the breach and the identity of the persons responsible for it, if necessary and proportionate after a case-by-case evaluation.
Article 31 -
Application of sanctions and measures by competent authorities
1. When determining the type of administrative sanctions or measures and the level of administrative pecuniary sanctions, the competent authorities shall take into account all relevant circumstances, including those listed in Article 60(4) of Directive (EU) 2015/849.
2. As regards administrative sanctions and measures imposed in accordance with this Regulation, Article 62 of Directive (EU) 2015/849 shall apply.
Article 32 -
Reporting of breaches
1. Member States shall establish effective mechanisms to encourage the reporting to competent authorities of breaches of this Regulation.
Those mechanisms shall include at least those referred to in Article 61(2) of Directive (EU) 2015/849.
2. Payment service providers and crypto-asset service providers, in cooperation with the competent authorities, shall establish appropriate internal procedures for their employees, or persons in a comparable position, to report breaches internally through a secure, independent, specific and anonymous channel, proportionate to the nature and size of the payment service provider or the crypto-asset service provider concerned.
Article 33 -
Monitoring
1. Member States shall require competent authorities to monitor effectively and to take the measures necessary to ensure compliance with this Regulation and encourage, through effective mechanisms, the reporting of breaches of the provisions of this Regulation to competent authorities.
2. By 31 December 2026, and every three years thereafter, the Commission shall submit a report to the European Parliament and to the Council on the application of Chapter VI, with particular regard to cross-border cases.
CHAPTER VII - Implementing powers
Article 34 -
Committee procedure
1. The Commission shall be assisted by the Committee on the Prevention of Money Laundering and Terrorist Financing. That Committee shall be a committee within the meaning of Regulation (EU) No 182/2011.
2. Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply.
CHAPTER VIII - Derogations
Article 35 -
Agreements with countries and territories which do not form part of the territory of the Union
1. The Commission may authorise any Member State to conclude an agreement with a third country or with a territory outside the territorial scope of the Treaty on European Union and the Treaty on the Functioning of the European Union (TFEU) as referred to in Article 355 TFEU (the ‘country or territory concerned’), which contains derogations from this Regulation, in order to allow transfers of funds between that country or territory and the Member State concerned to be treated as transfers of funds within that Member State.
Such agreements may be authorised only where all of the following conditions are met:
(a)
the country or territory concerned shares a monetary union with the Member State concerned, forms part of the currency area of that Member State or has signed a monetary convention with the Union represented by a Member State;
(b)
payment service providers in the country or territory concerned participate directly or indirectly in payment and settlement systems in that Member State;
(c)
the country or territory concerned requires payment service providers under its jurisdiction to apply the same rules as those established under this Regulation.
2. A Member State wishing to conclude an agreement as referred to in paragraph 1 shall submit a request to the Commission and provide it with all the information necessary for the appraisal of the request.
3. Upon receipt by the Commission of such a request, transfers of funds between that Member State and the country or territory concerned shall be provisionally treated as transfers of funds within that Member State until a decision is reached in accordance with this Article.
4. If, within two months of receipt of the request, the Commission considers that it does not have all the information necessary for the appraisal of the request, it shall contact the Member State concerned and specify the additional information required.
5. Within one month of receipt of all the information that it considers to be necessary for the appraisal of the request, the Commission shall notify the requesting Member State accordingly and shall transmit copies of the request to the other Member States.
6. Within three months of the notification referred to in paragraph 5 of this Article, the Commission shall decide by means of an implementing act in accordance with Article 34(2) whether to authorise the Member State concerned to conclude the agreement that is the subject of the request.
The Commission shall, in any event, adopt a decision as referred to in the first subparagraph of this paragraph within 18 months of receipt of the request.
CHAPTER IX - Other provisions
Article 36 -
Guidelines
EBA shall issue guidelines addressed to the competent authorities and the payment service providers in accordance with Article 16 of Regulation (EU) No 1093/2010 on measures to be taken in accordance with this Regulation, in particular as regards the implementation of Articles 7, 8, 11 and 12 of this Regulation. By 30 June 2024, EBA shall issue guidelines addressed to the competent authorities and to the crypto-asset service providers on measures to be taken as regards the implementation of Articles 14 to 17 and Articles 19 to 22 of this Regulation.
EBA shall issue guidelines specifying technical aspects of the application of this Regulation to direct debits as well as the measures to be taken by payment initiation service providers, as defined in Article 4, point (18), of Directive (EU) 2015/2366, under this Regulation, taking into account their limited role in payment transactions.
EBA shall issue guidelines, addressed to competent authorities, on the characteristics of a risk-based approach to supervision of crypto-asset service providers and the steps to be taken when conducting such supervision.
EBA shall ensure a regular dialogue with stakeholders on the development of technical interoperable solutions with the view of facilitating the implementation of the requirements laid down in this Regulation.
Article 37 -
Review
1. By 12 months after the entry into force of a Regulation on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, the Commission shall review this Regulation and shall, if appropriate, propose amendments in order to ensure a consistent approach and alignment with the Regulation on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing.
2. By 1 July 2026, the Commission, after consulting EBA, shall issue a report assessing the risks posed by transfers to or from self-hosted addresses or entities not established in the Union, as well as the need for specific measures to mitigate those risks, and propose, if appropriate, amendments to this Regulation.
3. By 30 June 2027, the Commission shall submit to the European Parliament and to the Council a report on the application and enforcement of this Regulation accompanied, if appropriate, by a legislative proposal.
The report referred to in the first subparagraph shall include the following elements:
(a)
an assessment of the effectiveness of the measures provided for in this Regulation and of compliance with this Regulation by payment service providers and crypto-asset service providers;
(b)
an assessment of the technological solutions for complying with the obligations imposed on crypto-asset service providers under this Regulation, including of the latest development of technologically sound and interoperable solutions for complying with this Regulation and of the use of DLT analytic tools for identifying the origin and destination of transfers of crypto-assets and for performing a ‘know your transaction’ (KYT) assessment;
(c)
an assessment of the effectiveness and suitability of the de minimis thresholds related to transfers of funds, in particular with respect to the scope of application and the set of information accompanying transfers, and an assessment of the need to lower or remove such thresholds;
(d)
assessment of the costs and benefits of introducing de minimis thresholds related to the set of information accompanying transfers of crypto-assets, including an assessment of the related money laundering and terrorist financing risks;
(e)
an analysis of the trends in the use of self-hosted addresses to perform transfers without the involvement of a third party, together with an assessment of the related money laundering and terrorist financing risks and an evaluation of the need, effectiveness and enforceability of additional mitigation measures, such as specific obligations on providers of hardware and software wallets and limitation, control or prohibition of transfers involving self-hosted addresses.
That report shall take into account new developments in the field of anti-money laundering and counter-terrorist financing, as well as relevant evaluations, assessments and reports in that field drawn up by international organisations and standard setters, law enforcement authorities and intelligence agencies, crypto-asset service providers or other reliable sources.
CHAPTER X - Final provisions
Article 38 -
Amendments to Directive (EU) 2015/849
Directive (EU) 2015/849 is amended as follows:
(1)
in Article 2(1), point (3), points (g) and (h) are deleted;
(2)
Article 3 is amended as follows:
(a)
in point (2), the following point is added:
‘(g)
crypto-asset service providers;’;
(b)
point (8) is replaced by the following:
‘(8)
‘correspondent relationship’ means:
(a)
the provision of banking services by one bank as the correspondent to another bank as the respondent, including providing a current or other liability account and related services, such as cash management, international funds transfers, cheque clearing, payable-through accounts and foreign exchange services;
(b)
the relationships between and among credit institutions and financial institutions, including where similar services are provided by a correspondent institution to a respondent institution, and including relationships established for securities transactions or funds transfers or relationships established for transactions in crypto-assets or transfers of crypto-assets;’;
(c)
points 18 and 19 are replaced by the following:
‘(18)
“crypto-asset” means a crypto-asset as defined in Article 3(1), point (5), of Regulation (EU) 2023/1114 of the European Parliament and of the Council (*1), except where falling within the categories listed in Article 2(2), (3) and (4) of that Regulation or otherwise qualifying as funds;
(19)
“crypto-asset service provider” means a crypto-asset service provider as defined in Article 3(1), point (15), of Regulation (EU) 2023/1114, where performing one or more crypto-asset services as defined in Article 3(1), point (16), of that Regulation, with the exception of providing advice on crypto-assets as referred to in Article 3(1), point (16)(h), of that Regulation;
(*1) Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023 on markets in crypto-assets, and amending Regulations (EU) No 1093/2010 and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/1937 (OJ L 150, 9.6.2023, p. 40).’;"
(d)
the following point is added:
‘(20)
“self-hosted address” means a self-hosted address as defined in Article 3, point (20), of Regulation (EU) 2023/1113 of the European Parliament and of the Council (*2).
(*2) Regulation (EU) 2023/1113 of the European Parliament and of the Council of 31 May 2023 on information accompanying transfers of funds and certain crypto-assets and amending Directive (EU) 2015/849 (OJ L 150, 9.6.2023, p. 1).’;"
(3)
in Article 18, the following paragraphs are added:
‘5. By 30 December 2024, EBA shall issue guidelines on risk variables and risk factors to be taken into account by crypto-asset service providers when entering into business relationships or carrying out transactions in crypto-assets.
6. EBA shall clarify, in particular, how the risk factors listed in Annex III shall be taken into account by crypto-asset service providers including when carrying out transactions with persons and entities which are not covered by this Directive. To that end, EBA shall pay particular attention to products, transactions and technologies that have the potential to facilitate anonymity, such as privacy wallets, mixers or tumblers.
Where situations of higher risk are identified, the guidelines referred to in paragraph 5 shall include enhanced due diligence measures that obliged entities shall consider applying to mitigate such risks, including the adoption of appropriate procedures to detect the origin or destination of crypto-assets.’
;
(4)
the following articles are inserted:
‘Article 19a
1. Member States shall require crypto-asset service providers to identify and assess the risk of money laundering and terrorist financing associated with transfers of crypto-assets directed to or originating from a self-hosted address. To that end, crypto-asset service providers shall have in place internal policies, procedures and controls. Member States shall require crypto-asset service providers to apply mitigating measures commensurate with the risks identified. Those mitigating measures shall include one or more of the following:
(a)
taking risk-based measures to identify, and verify the identity of, the originator or beneficiary of a transfer made to or from a self-hosted address or the beneficial owner of such originator or beneficiary, including through reliance on third parties;
(b)
requiring additional information on the origin and destination of the transferred crypto-assets;
(c)
conducting enhanced ongoing monitoring of those transactions;
(d)
any other measure to mitigate and manage the risks of money laundering and terrorist financing as well as the risk of non-implementation and evasion of targeted financial sanctions and proliferation financing-related targeted financial sanctions.
2. By 30 December 2024, EBA shall issue guidelines to specify the measures referred to in this Article, including the criteria and means for identification and verification of the identity of the originator or beneficiary of a transfer made to or from a self-hosted address, in particular through reliance on third parties, taking into account the latest technological developments.
Article 19b
1. By way of derogation from Article 19, with respect to cross-border correspondent relationships involving the execution of crypto-asset services as defined in Article 3(1), point (16), of Regulation (EU) 2023/1114, with the exception of point (h) of that point, with a respondent entity not established in the Union and providing similar services, including transfers of crypto-assets, Member States shall, in addition to the customer due diligence measures laid down in Article 13 of this Directive, require crypto-asset service providers, when entering into a business relationship with such an entity, to:
(a)
determine if the respondent entity is licensed or registered;
(b)
gather sufficient information about the respondent entity to understand fully the nature of the respondent’s business and to determine from publicly available information the reputation of the entity and the quality of supervision;
(c)
assess the respondent entity’s AML/CFT controls;
(d)
obtain approval from senior management before establishing new correspondent relationships;
(e)
document the respective responsibilities of each party to the correspondent relationship;
(f)
with respect to payable-through crypto-asset accounts, be satisfied that the respondent entity has verified the identity of, and performed ongoing due diligence on, the customers having direct access to accounts of the correspondent entity, and that it is able to provide relevant customer due diligence data to the correspondent entity, upon request.
Where crypto-asset service providers decide to terminate correspondent relationships for reasons relating to anti-money laundering and counter-terrorist financing policy, they shall document and record their decision.
Crypto-asset service providers shall update the due diligence information for the correspondent relationship on a regular basis or when new risks emerge in relation to the respondent entity.
2. Member States shall ensure crypto-asset service providers take into account the information referred to in paragraph 1 in order to determine, on a risk-sensitive basis, the appropriate measures to be taken to mitigate the risks associated with the respondent entity.
3. By 30 June 2024, EBA shall issue guidelines to specify the criteria and elements that crypto-asset service providers shall take into account when conducting the assessment referred to in paragraph 1 and the risk mitigating measures referred to in paragraph 2, including the minimum action to be taken by crypto-asset service providers where the respondent entity is not registered or licensed.’
;
(5)
the following article is inserted:
‘Article 24a
By 1 January 2024, EBA shall issue guidelines specifying how the enhanced customer due diligence measures in this Section apply when obliged entities perform crypto-asset services as defined in Article 3(1), point (16), of Regulation (EU) 2023/1114, with the exception of point (h) of that point, as well as transfers of crypto-assets as defined in Article 3, point (10), of Regulation (EU) 2023/1113. In particular, EBA shall specify how and when those obliged entities shall obtain additional information on the originator and beneficiary.’
;
(6)
in Article 45, paragraph 9 is replaced by the following:
‘9. Member States may require electronic money issuers as defined in Article 2, point (3), of Directive 2009/110/EC, payment service providers as defined in Article 4, point (11), of Directive (EU) 2015/2366 and crypto-asset service providers established on their territory in forms other than a branch, and whose head office is situated in another Member State, to appoint a central contact point in their territory. That central contact point shall ensure, on behalf of the entity operating on a cross-border basis, compliance with AML/CFT rules and shall facilitate supervision by supervisors, including by providing supervisors with documents and information on request.’
;
(7)
in Article 47, paragraph 1 is replaced by the following:
‘1. Member States shall ensure that currency exchange and cheque-cashing offices and trust or company service providers are licensed or registered, and that providers of gambling services are regulated.’
;
(8)
in Article 67, the following paragraph is added:
‘3. Member States shall adopt and publish, by 30 December 2024, the laws, regulations and administrative provisions necessary to comply with Article 2(1), point 3, Article 3, point (2)(g), Article 3, points (8), (18), (19) and (20), Article 19a(1), Article 19b(1) and (2), Article 45(9) and Article 47(1). They shall immediately communicate the text of those measures to the Commission.
They shall apply those measures from 30 December 2024.’.
Article 39 -
Repeal
Regulation (EU) 2015/847 is repealed with effect from the date of application of this Regulation.
References to the repealed Regulation shall be construed as references to this Regulation and shall be read in accordance with the correlation table in Annex II.
Article 40 -
Entry into force
This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.
It shall apply from 30 December 2024.
This Regulation shall be binding in its entirety and directly applicable in all Member States.
