Crypto under the AMLR: correspondent relationships with CASPs and self-hosted addresses
Articles 37 and 38 AMLR set enhanced measures for relationships with crypto-asset service providers and for transactions with self-hosted addresses. What CASPs and the banks that serve them must do.
Crypto-asset service providers licensed under MiCA are obliged entities under the AMLR on the same footing as banks and payment institutions. The regulation adds two crypto-specific provisions: enhanced measures for correspondent-type relationships with CASPs (Article 37) and risk-mitigating measures for transactions with self-hosted addresses (Article 38). AMLA's Guidelines on enhanced due diligence for crypto are in final draft.
Correspondent relationships with CASPs
When a CASP or a bank provides services to another CASP, in particular one established in a third country, the relationship is treated like correspondent banking: understand the respondent's business and reputation, assess its AML controls, obtain senior approval, document the responsibilities of each party, and never deal with an unlicensed or shell provider. The prohibition on shell banks in Article 39 applies by analogy.
Self-hosted addresses
For transfers to or from an address not held by a CASP, the AMLR requires risk-mitigating measures proportionate to the risk: identifying the originator or beneficiary who controls the address, verifying ownership of the address for transfers above the threshold set in the Transfer of Funds Regulation, using blockchain analytics, and applying enhanced measures where the address is linked to high-risk activity.
What it means for CASPs
- Onboarding must capture the same identity data as for any customer, with the CDD RTS as the reference.
- Transaction monitoring must work on-chain and off-chain, with the expected profile of Article 25 including the wallets a customer uses.
- Travel-rule data under the Transfer of Funds Regulation and AML reporting under Article 69 must line up.
What it means for banks serving crypto businesses
Banks that hold accounts for CASPs need a documented assessment of the CASP's controls, refreshed periodically, and a view on the CASP's own exposure to self-hosted addresses.
What to do now
- Classify your counterparties: licensed CASPs in the EU, licensed elsewhere, unlicensed; the measures differ.
- Decide the ownership-verification method for self-hosted addresses and test it on live transfers.
- Align the travel-rule data set with the AML customer file.
The dashboard tracks the crypto Guidelines under Enhanced Due Diligence and shows CASP-specific instruments when the entity filter is set to crypto-asset service provider.