EBA AML/CFT Newsletter

And a happy new year!

With regard to anti-money laundering and countering the financing of terrorism (AML/CFT), the final Guidelines require that relevant checks are performed, including customer due diligence (CDD) checks on the token holders that have submitted a redemption claim. The Guidelines also require that, if the issuer is not subject to money laundering and terrorist financing (ML/TF) obligations, such activities must be performed by an intermediary which is an obliged entity under the Anti-Money Laundering Directive (AMLD). 

MiCAR entered into force on 29 June 2023 and will apply from 30 December 2024. Titles III and IV of MiCAR regarding the offering to the public and the admission to trading of ARTs and EMTs became applicable on 30 June 2024.

To inform our approach to the delivery of such mandates, we sought the views of the private sector on specific aspects of these mandates. Over 150 representatives from 67 EU trade associations participated in a roundtable on 24 October 2024. They provided valuable feedback ahead of the public consultation, which will be launched in Q1 2025. We will submit our response to the European Commission’s Call for Advice in October 2025.

In November, we published two sets of final Guidelines that set, for the first time, common EU standards on the governance arrangements and the policies, procedures and controls that financial institutions should have in place to be able to comply with Union and national restrictive measures.

The first set of Guidelines is addressed to all institutions within the EBA’s supervisory remit (credit institutions, e-money institutions and payment institutions). They include provisions that are necessary to ensure that financial institutions’ governance and risk management systems are sufficient to address the risk that they might breach or evade restrictive measures. The second set of Guidelines is specific to payment service providers (PSPs) and crypto-asset service providers (CASPs). The Guidelines specify what PSPs and CASPs should do to comply with restrictive measures when performing transfers of funds or crypto-assets.

In November 2024, we published the 2024 risk assessment of the European banking system. One chapter in this Report focuses on financial crime risks.

Banks in Europe continue to rate ML/TF risk as significant, with 13% considering it a main driver of operational risk. Risks related to the implementation of restrictive measures in connection with the Russian war of aggression against Ukraine also continue to be a priority for banks. Although less significant, the risk of the laundering of proceeds of frauds is now considered of high significance for 22% banks, against 18% in spring 2024.

Until recently, most crypto-asset businesses operated in an unregulated environment. With the implementation of the MiCAR and the Transfer of Funds and Certain Crypto Assets Regulation (FTR), this is now changing.

In December, to help firms navigate the evolving regulatory landscape, we published an explainer that summarises key information and resources on the intersection of crypto and AML/CFT. From general requirements to the implications of the grandfathering clause, this document is an essential resource!

As a result, CASPs are now ‘obliged entities’ for AML/CFT purposes. Consequently, all EBA AML/CFT Technical Standards and EBA Guidelines that address financial institutions will apply to CASPs as well. CASPs are encouraged to consult our website for further information.

The MiCAR sets out that “Crypto-asset service providers that provided their services in accordance with applicable law before 30 December 2024, may continue to do so until 1 July 2026 or until they are granted or refused an authorisation pursuant to Article 63, whichever is sooner.” This transitional provision gives CASPs that already operated under an applicable framework (AMLD or a domestic AML/CFT regime) before the date of application of the MiCAR on 30 December 2024 the possibility to continue to provide their services while applying for a CASP license under the MiCAR.

The FTR, and the changes to the AMLD introduced by this Regulation, apply to grandfathered CASPs as they do to other credit and financial institutions. 

Submissions to our AML/CFT database (EuReCA) continue to grow. In 2024 alone, EuReCA received 787 material weaknesses in respect of 267 entities reported by the European authorities. Credit institutions remain the most frequently reported entities, although there has been a rise in submissions related to payment institutions and e-money institutions. Most material weaknesses relate to deficiencies in CDD procedures, particularly in respect to the effectiveness of the ongoing transaction monitoring. The improper use of technology was a factor in more than half of all cases.

Over 2024, information submitted to EuReCA also reveals an increase in the number and type of corrective measures applied by supervisors with 377 in total. Since last year, there has been an increase in the number of financial institutions that have been subject to orders to comply and pecuniary fines. In addition, stronger measures, such as the withdrawal of authorisation, have been applied.

Potential benefits of tokenised deposits include the programmability and automation of transfers, while potential challenges include issues relating to consumer protection, operational risk, and the application of the AML/CFT framework.

In December, we published a Report outlining our findings from the fourth and final round of implementation reviews of competent authorities’ approaches to tackling ML/TF risks in the banking sector. With the conclusion of this round, we have now assessed all forty competent authorities that are responsible for the AML/CFT supervision in all EU/EEA Member states.

Between January 2023 and June 2024, we assessed fourteen competent authorities from nine member states that are responsible for tackling ML/TF risks in banks. We then issued recommended actions tailored to each competent authority to support their AML/CFT work. Overall, while we continued to identify issues and shortcoming in this last round of reviews, the progress made since the first round suggests that the effectiveness of AML/CFT supervision will facilitate the effective implementation of the new AML/CFT package. This is the result of the actions taken by competent authorities following our recommendations.

In December, we published a Report on the functioning of AML/CFT colleges in 2023. This Report sets out the findings and observations from our monitoring of colleges. The Report finds that competent authorities continued to improve the functioning of AML/CFT colleges. Nevertheless, further progress is needed especially in two key areas, namely: adjusting the functioning of AML/CFT colleges to the ML/TF risks to which the underlying firm is exposed, and discussing the need for a common approach or joint action. Lastly, the Report includes some targeted recommendations addressed to competent authorities to further improve the effectiveness of AML/CFT colleges going forward.

Since the same considerations apply to electronic money issuers (EMIs) and PSPs, the EBA proposes to retain the structure and approach set out in the RTS on the criteria for the appointment of CCPs for EMIs and PSPs, and extend existing provisions to CASPs (leaving the provisions that apply to EMIs and PSPs unchanged). We also propose to introduce new provisions for CASPs where necessary in light of their business model and operation.

The consultation runs until 04 February 2025.

In Q1 2025, we will publish a Report on the lessons learnt so far in addressing ML/TF risks through the supervision of CASPs ahead of the application of MiCAR. The Report summarises insights gained from the work of EU supervisors in supervising CASPs to date.

During 2024, the EBA and ESMA have undertaken extensive research on these topics including interactions with the relevant stakeholders, specifically focusing on the assessment of specific elements related to decentralised finance (DeFi) and the lending and borrowing of crypto-assets. The Report will feature a comprehensive analysis and assessment of the identified risks, including ML/TF risks.

The AML/CFT team have been working hard this year on a variety of products, so of course, no end-of-year round up would be complete without an update from us -  give the video a watch here. It's available as a sneak preview for our newsletter subscribers, before its published on our social media channels at the end of the week - enjoy!