The new crypto-asset framework is now fully implemented (07/04/2025)

On 31 December 2024, the new EU crypto-asset framework entered into force. This includes MiCAR (Regulation (EU) 2023/1114), the transfer of funds and certain crypto-assets Regulation (Regulation (EU) 2023/1113) and amendments to Directive (EU) 2015/849. CASPs must put in place robust systems and controls to ensure that they are not misused for illicit activities.

We published an overview of all financial crime requirements that apply to CASPs here.

EBA and ESMA report on recent developments in crypto-assets (07/04/2025)

In January, we published a report with ESMA that analyses recent developments in the crypto-assets market, specifically focusing on decentralised finance (DeFi) and crypto lending, borrowing, and staking. This analysis contributes to the European Commission’s upcoming report to the European Parliament and Council, as required by Article 142 of MiCAR.

The report provides an in-depth look at the DeFi landscape, identifying key risks such as ICT vulnerabilities and the potential for money laundering and terrorist financing (ML/TF). It also examines the business models and associated risks in the crypto lending, borrowing, and staking markets, noting challenges such as information asymmetries and systemic risks.

EBA hosts a workshop on AML/CFT SupTech (07/04/2025)

In January 2025, the EBA, in coordination with the European Commission’s AMLA Task Force, hosted a workshop for AML/CFT supervisors on SupTech and AI. The aim was to explore the opportunities afforded by new technologies, and to identify best practices to support their effective adoption. Supervisors from all EU Member States and some third countries attended.

Technology can make AML/CFT supervision more effective and efficient by optimising workflows and supporting informed decision-making, but it needs to be targeted to meet specific supervisory needs. It also needs to be designed to make sure that appropriate safeguards are in place, especially where sensitive data is being processed. For this reason, close cooperation between IT, AML/CFT and data protection experts is important.

The use of SupTech in AML/CFT supervision is still at an early stage, with 35% of competent authorities exploring, developing, or implementing, their first SupTech tool. Going forward, closer collaboration between AML/CFT supervisors could be conducive to the development of common, innovative  solutions that enhance the effectiveness of AML/CFT supervision across the EU.

ESMA asks supervisors to consider ML/TF risks when authorising CASPs (07/04/2025)

In January, ESMA issued a “Supervisory Briefing” to assist national competent authorities in the practical application of the Market in Crypto Assets Regulation (MiCA) requirements for authorising crypto-asset service providers (CASPs). It promotes harmonised authorisation practices across the EU, and highlights how different factors, such as CASP size, complexity, cross-border activity, and business models, can influence the level of scrutiny required during the authorisation process.

With regard to AML/CFT, ESMA highlights that ML/TF risks in the sector are often increased, which means that national competent authorities need to consider these risks as part of their authorisation processes. Where necessary, MiCAR authorities should consult and cooperate with AML/CFT authorities in this context.  

EBA Peer review on tax integrity (07/04/2025)

In February 2025, we published the findings of a peer review on tax integrity and dividend arbitrage schemes. This peer review looked at follow-up actions European supervisors, prudential and AML/CFT alike, completed since the EBA issuance, in April 2020, of an action plan on dividend arbitrage trading schemes.

It also considered tax integrity issues more broadly. The peer review found a number of good practices, but also revealed specific areas for improvement for EU supervisors in the areas of tax integrity and formulated specific recommendations and follow-up measures.

The Restrictive Measures Guidelines have been translated into all EU languages (07/04/2025)

In November, we published two sets of Guidelines on internal policies, procedures and controls to ensure the implementation of Union and national restrictive measures. The Guidelines set out the common EU standards on the governance arrangements and the policies, procedures and controls financial institutions should have in place to be able to comply with Union and national restrictive measures. The Guidelines have now been translated into all official EU languages and were published on the EBA website on 11 February 2025.

The deadline for competent authorities to confirm their intention to comply with the Guidelines or to provide their justification for non compliance is 11 April 2025. Compliance notifications are public and can be accessed on the EBA website.

The EBA consults on new rules related to the anti- money laundering and countering the financing of terrorism package (03/04/2025)

In March, we launched a consultation on four draft technical standards (RTS) that will be central to the EU’s future AML/CFT regime. These draft technical standards will form part of our response to the European Commission’s Call for Advice.

The public consultation is open until 6 June 2025. There will be a public hearing on 10 April. Registrations for the public hearing are open until 8 April, 16:00 CET.

The consultation paper consists of four RTSs:

The EBA supports the smooth transition to the new legal and institutional AML/CFT framework (07/04/2025)

While the new EU AML/CFT package is now legally in force, the EBA will retain its AML/CFT responsibilities until the end of 2025, while AMLA is set up.

During the transition phase, we monitor risks, set common standards and work closely with national supervisors, the European Commission and AMLA to minimise disruption and ensure continuity in the EU’s fight against financial crime (see more explanation here).

The EBA is currently focusing on establishing cooperation mechanisms to ensure a holistic approach to the fight against financial crime. For instance, we are working on handing over EuReCA, the EBA’s AML/CFT database, to AMLA. And together with ESMA and EIOPA, we are preparing an agreement on how AMLA and the ESAs will cooperate to ensure that we can share information, and that synergies between our respective areas of competence are factored into the policy-making process, making the EU’s fight against financial crime more targeted and effective.

The EBA’s Consumer Trends Report 2024/25 finds that de-risking remains a key issue facing EU consumers (07/04/2025)

In March, we published the Consumer Trends Report (CTR). The CTR summarises the views of national consumer protection authorities, consumer associations, industry associations and national ombudsmen, among others.

This year, the information we obtained suggests that ‘de-risking’ remains an important issue for EU consumers.

De-risking occurs if a financial institution decides not to provide a financial service to a customer. It can be a necessary risk-management tool. But de-risking can also be unwarranted, for example if an institution does not take into account an individual customers’ risk profile. The information we received for the CTR does not distinguish between warranted and unwarranted derisking.

We are now assessing possible next steps because access to basic financial products and services is an important public interest goal. In the meantime, institutions and their supervisors should have regard to our Guidelines on derisking, which we issued last year. Our factsheet on de-risking has more information.

The EBA is finalising its draft RTS on the criteria to appoint a central contact point for CASPs (07/04/2025)

Between 4 December 2024 and 4 February 2025, we publicly consulted on amendments to Commission Delegated Regulation (EU) 2018/1108. We proposed to extend its scope to crypto-asset service providers (CASPs). The draft RTS specifies the criteria for CASPs to appoint a central contact point to ensure compliance with the host Member State’s AML/CFT obligations. A public hearing was held 16 January.

We are now reviewing the responses and feedback received. The final draft RTS is expected to be published in Q2 2025.

The EBA’s work and progress in 2024 (16/12/2024)

To round off the year, we have produced a short video highlighting key areas of our work and progress in 2024. The video cuts through the jargon that may hinder European citizens from fully understanding the role of the EBA, and details everything you need to know in a fuss-free way.

We wish you a merry and peaceful Christmas! (16/12/2024)

And a happy new year!

The EBA Guidelines on redemption plans under MiCAR (16/12/2024)

In October, we published the final Guidelines on redemption plans under the Markets in Crypto-Assets Regulation (MiCAR). The Guidelines specify, inter alia, the content of the redemption plan to be developed by issuers of asset-referenced tokens (ARTs) and e-money tokens (EMTs). The content includes the liquidation strategies of the reserve of assets, the mapping of critical activities, the content of the redemption claims, the main steps of the redemption process, and the elements that may lead the authority to trigger the plan.

The EBA hosted an industry roundtable to inform its work on aspects of the future EU AML/CFT regime (16/12/2024)

In June, the new EU AML/CFT framework entered into force. This framework includes a single AML/CFT rulebook that will be directly applicable in all Member States, a harmonised AML/CFT supervision framework, and a new EU AML/CFT Authority, AMLA. In March, the European Commission asked the EBA to provide its advice on important aspects of the new EU AML/CFT framework to ensure that AMLA can begin to operate efficiently and effectively.

The EBA issues final guidance on internal policies, procedures and controls to ensure the effective implementation of Union and national sanctions (16/12/2024)

In November, we published two sets of final Guidelines that set, for the first time, common EU standards on the governance arrangements and the policies, procedures and controls that financial institutions should have in place to be able to comply with Union and national restrictive measures.

The EBA publishes its annual Risk Assessment of the European banking system (16/12/2024)

In November 2024, we published the 2024 risk assessment of the European banking system. One chapter in this Report focuses on financial crime risks.

The EBA summarises AML/CFT requirements for the EU’s Crypto-Assets Sector (16/12/2024)

Until recently, most crypto-asset businesses operated in an unregulated environment. With the implementation of the MiCAR and the Transfer of Funds and Certain Crypto Assets Regulation (FTR), this is now changing.

The EBA’s AML/CFT Guidelines now also apply to CASPs from December 2024 (16/12/2024)

MiCAR introduced a single rulebook for the regulation and supervision of a broader range of crypto-asset issuance, trading, and service provision. Simultaneously, amendments to the AMLD, introduced by the FTR, extended the scope of AML/CFT obligations to include CASPs. This new legal framework comes into effect from December 2024.

Grandfathered CASPs are subject to all AML/CFT requirements (16/12/2024)

The MiCAR sets out that “Crypto-asset service providers that provided their services in accordance with applicable law before 30 December 2024, may continue to do so until 1 July 2026 or until they are granted or refused an authorisation pursuant to Article 63, whichever is sooner.” This transitional provision gives CASPs that already operated under an applicable framework (AMLD or a domestic AML/CFT regime) before the date of application of the MiCAR on 30 December 2024 the possibility to continue to provide their services while applying for a CASP license under the MiCAR.

EuReCA database update (16/12/2024)

Submissions to our AML/CFT database (EuReCA) continue to grow. In 2024 alone, EuReCA received 787 material weaknesses in respect of 267 entities reported by the European authorities. Credit institutions remain the most frequently reported entities, although there has been a rise in submissions related to payment institutions and e-money institutions. Most material weaknesses relate to deficiencies in CDD procedures, particularly in respect to the effectiveness of the ongoing transaction monitoring. The improper use of technology was a factor in more than half of all cases.

The EBA assesses potential benefits and challenges of tokenised deposits (16/12/2024)

In December, we published a Report to facilitate awareness of tokenised deposits. The Report also aims to promote convergence in the classification of tokenised deposits in contrast with EMTs issued by credit institutions under the MiCAR. As part of this Report, we examined the benefits and challenges in relation to AML/CFT.

The EBA publishes a factsheet on countering terrorist financing (16/12/2024)

In December, we published a factsheet that summarises key information and resources on the detection of terrorist financing and targeted financial sanctions against terrorism for an effective approach. 

The EBA published a Report on competent authorities' approaches to the AML/CFT supervisions of banks (16/12/2024)

In December, we published a Report outlining our findings from the fourth and final round of implementation reviews of competent authorities’ approaches to tackling ML/TF risks in the banking sector. With the conclusion of this round, we have now assessed all forty competent authorities that are responsible for the AML/CFT supervision in all EU/EEA Member states.

The EBA Report on the functioning of AML/CFT colleges in 2023 (16/12/2024)

In December, we published a Report on the functioning of AML/CFT colleges in 2023. This Report sets out the findings and observations from our monitoring of colleges. The Report finds that competent authorities continued to improve the functioning of AML/CFT colleges. Nevertheless, further progress is needed especially in two key areas, namely: adjusting the functioning of AML/CFT colleges to the ML/TF risks to which the underlying firm is exposed, and discussing the need for a common approach or joint action. Lastly, the Report includes some targeted recommendations addressed to competent authorities to further improve the effectiveness of AML/CFT colleges going forward.

The EBA proposes criteria to appoint a central contact point for CASPs to strengthen the fight against money-laundering and terrorism financing (16/12/2024)

In December, we published a consultation paper on draft Regulatory Technical Standards (RTS) setting out the criteria for determining the circumstances in which CASPs should appoint a central contact point (CCP) to ensure compliance with local AML/CFT obligations of the host Member State. The draft RTS also sets out the functions of those central contact points.

Upcoming EBA Report on tackling ML/TF risk through crypto asset services supervision: lessons learnt from recent cases (16/12/2024)

In Q1 2025, we will publish a Report on the lessons learnt so far in addressing ML/TF risks through the supervision of CASPs ahead of the application of MiCAR. The Report summarises insights gained from the work of EU supervisors in supervising CASPs to date.

The EBA/ESMA Report on recent developments in crypto-assets will soon be published (16/12/2024)

Also in Q1 2025, the EBA and ESMA will publish a Report on the recent developments in crypto-assets. MiCAR mandates the European Commission, after consulting the EBA and ESMA, to submit a Report to the European Parliament and Council on recent developments in crypto-assets.

The EBA publishes a report on ‘virtual IBANs' (18/07/2024)

In May, we published a Report on ‘virtual IBANs’ (vIBANs). The Report explains the key characteristics of vIBANs and provides an overview of use cases that we have observed in the market. We observed that the industry issues vIBANs in different ways and for different purposes.

EBA Guidelines on internal governance arrangements for issuers of ARTs under MiCAR (18/07/2024)

In June, we published the Final Report on the Guidelines on the minimum content of the governance arrangements for issuers of asset-referenced tokens (ARTs) under The Markets in Crypto-assets Regulation (MiCAR). These Guidelines specify the governance provisions with which the issuers should comply, taking into account the proportionality principle.

Joint EBA and ESMA Guidelines on the suitability assessment of the members of the management body and on the assessment of shareholders and members with qualifying holdings for issuers of ARTs and CASPs under MiCAR (18/07/2024)

In June, the EBA and ESMA published Joint Guidelines on the suitability of members of the management body, and on the assessment of shareholders and members with qualifying holdings for issuers of ARTs and crypto-asset service providers (CASPs) under MiCAR. These two sets of Guidelines are part of the ongoing efforts of the EBA and ESMA to foster a transparent, secure and well-regulated crypto-assets market.

The ML/TF Risk Factors Guidelines have been translated into all EU languages (19/07/2024)

In January, we extended the Guidelines on money laundering and terrorist financing risk factors to CASPs. The Guidelines set out the risk factors that CASPs should consider when assessing ML/TF risk and how they should mitigate those risks. The Guidelines have now been translated into all official EU languages and were published on the EBA website on 28 June 2024.

EBA workshop on risk assessment and EBA training on crypto-assets for EU supervisors (19/07/2024)

In May, we led a two-day workshop for 350 EU AML/CFT supervisors on the effective components of ML/TF risk assessments from both an entity-level and sectoral perspective. 21 expert speakers from 14 EU AML/CFT competent authorities, the European Central Bank (ECB) and the industry provided their insights in a series of presentations and interactive panel discussions.

The EBA issues ‘travel rule’ guidance to tackle ML/TF in transfers of funds and crypto assets (19/07/2024)

In July, we issued new Guidelines on the ‘travel rule’ to tackle the abuse of transfers of funds and crypto assets for ML/TF purposes. The Guidelines specify the information that should accompany a transfer of funds or crypto assets and the steps that payment service providers (PSPs), intermediary PSPs (IPSPs), CASPs and intermediary CASPs (ICASPs) should take to detect missing or incomplete information. The Guidelines also outline the actions to take if a transfer of funds or a transfer of crypto-assets lacks the required information.

The EBA announces the priorities for the supervision of issuers of ARTs and EMTs for 2024/2025 (19/07/2024)

In July, we announced the priorities for the supervision of ART and EMT issuers under MiCAR for 2024/2025. Most MiCAR provisions relevant to ART and EMT issuers entered into application on 30 June 2024. To promote supervisory convergence and ensure an effective supervision of ART and EMT issuers, the EBA established four key supervisory priorities areas: 1) internal governance and risk management; 2) financial resilience (including, where applicable, own funds requirements and reserve of assets); 3) technology risk management; and 4) financial crime risk management.

The EBA welcomes the establishment of the new AML/CFT authority (AMLA) (19/07/2024)

In June, we welcomed the entry into force of the new framework that will transform the way that Europe tackles ML/TF. We will transfer our standalone anti-money laundering and countering the financing of terrorism (AML/CFT) mandates, powers and resources to AMLA by the end of 2025. Throughout the transition phase, the EBA will also support competent authorities to prepare for AMLA and will coordinate with the European Commission’s AMLA taskforce.

EBA issues guidance to crypto-asset service providers to effectively manage their exposure to ML/TF risks (30/04/2024)

In January, we extended our Guidelines on money laundering and terrorist financing (ML/TF) risk factors to crypto-asset service providers (CASPs). CASPs can be abused for financial crime purposes, including ML/TF. The risk of this happening can be increased as a result of, for example, the speed of crypto-asset transfers or because some products contain features that allow the user’s identity to be hidden.

The EBA Risk‐Based Supervision Guidelines have been translated into all EU languages (30/04/2024)

In December 2023, we published new Guidelines for AML/CFT supervisors of CASPs. These Guidelines extend the Risk‐Based Supervision Guidelines to set clear expectations of the steps supervisors should take to identify and manage ML/TF risks in this sector and are an important step forward in the EU’s fight against financial crime. The Guidelines have now been translated into all official EU languages. You can find them at this link.

The Guidelines on restrictive measures and the ‘Travel Rule’ are now being finalised (30/04/2024)

In November 2023, we launched a consultation on new EBA ‘Travel Rule’ Guidelines. The main objective of these Guidelines is to prevent the abuse of funds and crypto-assets transfers for terrorist financing and other financial crime purposes. We held a virtual public hearing on 17 January with over 120 participants from both, payment service and crypto asset service providers. The consultation closed in February 2024. We received more than 30 responses, which are now being analysed.

The EBA publishes follow-up on the Peer Review on the Joint ESAs Guidelines on the prudential assessment of the acquisition of qualifying holdings (30/04/2024)

In February, we published a follow up to the EBA 2021 peer review report on the application of the Joint ESAs Guidelines on the prudential assessment of the acquisition of qualifying holdings. The review assesses the adequacy and effectiveness of the actions undertaken by the competent authorities subject to the previous review and finds good progress in remedying the deficiencies identified in 2021. All competent authorities have taken the need to respond to the assessment of the initial peer review seriously and most have adopted measures to remedy the deficiencies identified. We noted particular improvements in relation to the steps competent authorities have taken to identify and act upon suspicion of ML/TF.

The Commission asks the EBA for advice on aspects of the new AML regime (30/04/2024)

In March, we received a 'Call for Advice' (CfA) from the European Commission on important aspects of the future EU AML/CFT framework. Our response will form the basis of legal instruments that the new AML/CFT Authority (AMLA) will prepare and ensure that AMLA can begin to operate quickly once established.

The EBA’s work on de-risking (30/04/2024)

In March, we published a factsheet on de-risking. De-risking is the refusal to enter into, or a decision to terminate, business relationships with individual customers or categories of customers associated with higher ML/TF risk, or to refuse to carry out higher ML/TF risk transaction.

EuReCA database update (02/05/2024)

Our AML/CFT database (EuReCA) is collecting information about the AML/CFT material weaknesses identified by supervisor and measures taken in response to such material weaknesses. Following the publication of the RTS in the Official Journal of the European Union on 16 February 2024, the database is ready to start collecting information on natural persons associated with the infringements.

The EBA’s work on virtual IBANs (30/04/2024)

Over the last few years, we have observed that some credit, payment and e-money institutions issue "virtual IBANs” (vIBANs). A vIBAN is a number/ identifier that is used by PSPs to re-route payments to a payment account (the ‘master account’). Contrary to standard IBANs, vIBANs may not contain the country code of the jurisdiction in which the master account is held.

The EBA consults on the MICAR Guidelines on redemption plans (02/05/2024)

In March 2024, we launched the public consultation on the Guidelines for the plans to orderly redeem asset-referenced tokens (ARTs) or e-money tokens (EMTs) based on Articles 47 and 55 of MiCAR in the event that the issuer fails to fulfil its obligations under MiCAR. 

The EBA assesses competent authorities’ approaches to the AML/CFT supervision of banks (08/01/2024)

In July 2023, we published the 2022 review of competent authorities’ approaches to tackling money laundering and terrorist financing (ML/TF) risks in the banking sector. We assessed 12 competent authorities from 9 Member States and we concluded that supervisors are making progress in the fight against ML/TF.

Some competent authorities in the sample have extensively changed their approach to anti-money laundering and countering the financing of terrorism (AML/CFT) supervision of banks, which is now broadly effective. Cooperation between supervisors has also improved. Nevertheless, most supervisors in this sample were asked to do more to tackle ML/TF risk in the banking sector. We provided advice to competent authorities on the steps they should take to strengthen their approach.

Happy New Year! (08/01/2024)

We wish you a happy and prosperous new year.

The EBA publishes its Opinion on ML/TF Risks in the EU’s financial sector (08/01/2024)

In July 2023, we published an Opinion on the risks of ML/TF in the EU's financial sector. The Opinion also sets out what competent authorities can do to mitigate those risks.

We published this Opinion against the background of a changing risk landscape, which impacts financial institutions’ AML/CFT compliance and alters competent authorities’ approaches to supervision. While financial institutions' awareness of ML/TF risks is increasing and AML/CFT supervision is improving, AML/CFT systems and controls are not always effective. In particular, significant challenges remain in institutions’ approaches to transaction monitoring and reporting of suspicious transactions.

The EBA contributes to safeguard Not-for-Profit Organisations’ access to financial services that are essential for the delivery of humanitarian aid across the world (08/01/2024)

In March 2023, we updated the Guidelines on ML/TF risks factors and included guidance that sets out what financial institutions should do to identify and assess ML/TF risk associated with Not-for-Profit organisations (NPOs). This is to support financial institutions in managing ML/TF risks associated with NPOs effectively, instead of denying them access to financial services. The Guidelines are applicable across the EU since October 2023.

In July 2023, to complement these Guidelines and to engage further with NPOs, we published a joint factsheet together with the European Commission to clarify the information NPOs might have to provide to financial institutions to open an account or to carry out a specific transaction. The factsheet also explains the reasons why financial institutions may require this information.

Cooperation between AML/CFT supervisors is improving (08/01/2024)

In August 2023, we published our third Report on the functioning of AML/CFT colleges. We found that competent authorities have taken important steps to improve the functioning of AML/CFT colleges. This resulted in the exchange of more substantive and useful information. Nevertheless, not all AML/CFT colleges have reached full maturity, and at the time of our review, approximately 50 colleges had not yet held their first meeting.

The Report highlights good practices to further strengthen the effectiveness of AML/CFT colleges going forward.

The EBA met representatives of the payment institution sector to discuss AML/CFT compliance (08/01/2024)

In November 2023, we organised an Industry Roundtable with Members of the European Payment Institutions Federation (EPIF) as a follow up to the EBA Report on ML/TF risks associated with payment institutions, published in June 2023. The Roundtable’s objective was to constructively exchange on what the sector can do to improve their AML/CFT systems and controls. Discussions focused on ensuring adequate oversight of agent networks and the hallmarks of an effective approach to ongoing transaction monitoring in the sector.

Simultaneously, we continue our work with competent authorities to foster the exchange of information and good practices in relation to the supervision of the payment institution sector.

The EBA consults on ‘Travel Rule’ Guidelines (08/01/2024)

In November 2023, we launched a public consultation on new Guidelines to prevent the abuse of funds and crypto-assets transfers for terrorist financing and other financial crime purposes.

These 'Travel Rule' Guidelines specify the steps that Payment Service Providers (PSPs), Intermediary PSPs (IPSPs), crypto-asset service providers (CASPs) and Intermediary CASPs (ICASPs) should take to detect missing or incomplete information that accompanies a transfer of funds or crypto-assets. The consultation runs until 26 February 2024. We will also hold a virtual public hearing on 17 January 2024 from 14:00 to 16:00 CET.

The EBA extends AML/CFT Guidelines to CASP supervisors (second revision) (08/01/2024)

In November 2023, we published the second revision of the Risk-Based Supervision Guidelines. The revision extends the scope of the Guidelines to AML/CFT supervisors of CASPs. The amendments include guidance that competent authorities should consider when assessing ML/TF risks associated with CASPs.

CASPs can present high ML/TF risks. They also operate across borders. For this reason, a common supervisory approach to tackling ML/TF risks in that sector is crucial. The amended Guidelines highlight the importance of a consistent approach in setting supervisory expectations, where multiple competent authorities are responsible for the supervision of the same institutions. The Guidelines also emphasise the importance of training so that staff from competent authorities have the technical skills and expertise necessary to carry out their tasks.

The EBA publishes its annual Risk Assessment of the European banking system (08/01/2024)

In December 2023, we published the 2023 risk assessment of the European banking system, with a chapter focusing on financial crime risks.

Banks appear to have improved their awareness of ML/TF risk compared to 2022 but seem to continue to attribute less significance to ML/TF risk than to other operational risk aspects.

By contrast, AML/CFT supervisors express ongoing concerns about banks’ AML/CFT controls which are often in place but not always effective. In particular, according to supervisors, many banks fail to consider TF risks properly. According to AML/CFT supervisors, 70% of banks rely too heavily on the screening of targeted financial sanctions lists instead of monitoring risks associated with terrorist financing.

The EBA consults on Guidelines on internal policies, procedures and controls to support the implementation of Union and national restrictive measures (08/01/2024)

In December 2023, we launched a public consultation on two sets of Guidelines on internal policies, procedures and controls to ensure the implementation of Union and national restrictive measures. Restrictive measures are binding on any person or entity under the jurisdiction of Member States. They comprise individual measures, i.e., targeted financial sanctions, and sectoral measures, i.e., financial and economic measures or embargoes.

Through these Guidelines, the EBA creates, for the first time in the EU, a common understanding, among PSPs, CASPs and their supervisors, of the steps they need to take to be able to comply with restrictive measures. The consultation runs until 25 March 2024. We will also hold a virtual public hearing on 8 February 2024 from 10:00 to 12:00 CET.

The EBA supports EU AML/CFT supervisors to prepare for the new EU AML/CFT framework (08/01/2024)

The establishment of a new EU Anti-Money Laundering Authority (AMLA) will bring significant changes to the way competent authorities approach AML/CFT supervision. Therefore, we have set up a Forum to support competent authorities in preparing their transition plans. The objective of the Forum is to contribute to the smooth transition to the new institutional framework.

The EBA and ESMA consult on regulatory instruments under Regulation (EU) 2023/1114 (MiCAR) that are relevant from a financial crime perspective (08/01/2024)

As a part of the MiCAR, the EBA and ESMA were given several mandates that are key to ensuring that ML/TF risks are identified and tackled. These include mandates in relation to:

• authorisations and notifications;
• assessments for the acquisition of qualifying holdings;
• suitability assessments of members of management bodies and of shareholders and members with qualifying holdings;
• governance arrangements;
• colleges;
• redemption plan; and
• transfer services.

CASPs and issuers of E-Money Tokens (EMTs) will be obliged entities under the Anti-Money Laundering Directive (AMLD). Issuers of asset-referenced tokens (ARTs) are not necessarily financial institutions or ‘obliged entities’ for AML/CFT purposes. ARTs have nevertheless to ensure that they are not used for financial crime purposes. The draft instruments set out what institutions and their supervisors should do to maintain the integrity of the sector once MiCAR applies. The consultation papers and final reports once published can be found on ESMA and EBA’s respective websites.

The EBA is finalising AML/CFT Guidelines for CASPs (08/01/2024)

We are finalising amendments to the Risk Factors Guidelines, which now contain specific guidance for CASPs on factors that they need to consider when entering a business relationship with their customers. The guidance for credit and financial institutions was also extended to highlight risk factors they need to consider when dealing with customers that are CASPs.

EBA publishes EuReCA Factsheet (29/06/2023)

In January 2022, the EBA launched EuReCA, its central anti-money laundering and countering the financing of terrorism (AML/CFT) database.

The EBA has now published a factsheet that summarises what EuReCA is, who reports into it and how the EBA uses information from EuReCA to foster an effective approach by EU supervisors to tackling financial crime risks in their sector. It also provides some statistics and examples from EuReCA’s first year.

EBA Guidelines on the use of Remote Customer Onboarding Solutions enter into force (29/06/2023)

In March, the EBA published the Guidelines on the use of Remote Customer Onboarding Solutions under Article 13(1) of Directive (EU) 2015/849 in all EU official languages, triggering the compliance notification period and their subsequent entry into force.

The Guidelines set out a common understanding by competent authorities of the steps financial sector operators should take to ensure safe and effective remote customer onboarding practices in line with applicable AML/CFT legislation and the EU’s data protection framework.

The deadline for competent authorities to provide their compliance notification with these Guidelines was 30 May 2023. The EBA published the compliance table on its website.

EBA consults on guidelines for AML/CFT supervisors of CASPs (29/06/2023)

In March, the EBA launched a consultation on its proposal to amend its Guidelines on risk-based supervision to extend them to AML/CFT supervisors of Crypto-Asset Services Providers (CASPs).

The proposed amendments include guidance on the sources of information competent authorities should consider when assessing money laundering and terrorism financing (ML/TF) risks associated with CASPs. They also highlight the importance of a consistent approach to setting supervisory expectations where multiple competent authorities are responsible for the supervision of the same institutions. Additionally, the amendments emphasise the significance of training to ensure that staff from competent authorities have the technical skills and expertise necessary for the execution of their functions.

The consultation closed on 29 June 2023.

EBA issues Guidelines to tackle de-risking and safeguard access to financial services to vulnerable customers (29/06/2023)

In March, the EBA issued guidelines amending the ML/TF risk factors guidelines on the effective management of ML/TF risks and access to financial services', following a three -month consultation and a public hearing.

The purpose of the new guidelines is to ensure that customers have access to the financial services they need to fully participate in society and that they are not denied such access on unsubstantiated AML/CFT grounds or without a valid reason. The guidelines set common expectations of effective money ML/TF risk management practices in those situations.

EBA publishes three AML/CFT Q&As (29/06/2023)

Earlier this year, the EBA published answers to three questions that were submitted through its Q&A process.

Q&A 5100, published in February, clarifies the relationship between the EBA’s guidelines on outsourcing and section 4 of the AMLD on reliance on a third party provider.

Q&A 6048,  published in March clarifies the conditions under which Payment Initiation Service Provider (PISPs) should conduct customer due diligence.

Q&A 5818, also published in March, clarifies the conditions under which electronic money institutions and payment services providers having set up establishments in another Member State may be required to appoint a central contact point in that Member State.

EBA publishes report on convergence of supervisory practices (29/06/2023)

In May, the EBA published and submitted the European Parliament and the Council its annual report to on the degree of convergence between supervisory practices.

The latest Report on supervisory convergence for 2022  highlights the efforts made by prudential supervisors to take ML/TF risks into account when conducting the Supervisory Review and Evaluation Process (SREP) assessment and the synergies developed between AML/CFT and prudential supervisory colleges. The EBA found that prudential supervisors had incorporated AML/CFT into their supervisory priorities in 2022 and followed up on AML/CFT-related concerns.

EBA consults on draft RTS and ITS on supervisory colleges (29/06/2023)

In May the EBA launched a consultation on the draft regulatory technical standards (RTS) and implementing technical standards (ITS)  on the functioning of supervisory colleges amending the RTS and ITS on colleges of supervisors published by the European Commission in January 2016.

Some of the proposed revisions aim to enhance cooperation and information exchange between AML/CFT colleges and prudential supervisory colleges. Notably, under the EBA’s proposals, lead supervisors of AML/CFT colleges would be requested to participate as observers in prudential colleges.

The consultation closes 30 August, and a public hearing took place on 28 June 2023.

EBA proposes to extend the ML/TF Risk Factors Guidelines to CASPs (29/06/2023)

In May, the EBA initiated a public consultation on amendments to the Guidelines on MLK/TF risk factors. The proposed amendments extend the scope of the Guidelines to include crypto-asset service providers (CASPs) and highlight the ML/TF risks these providers should considered when carrying out risk assessments of their business or customers. The proposed amendments also include the risks that other credit and financial institutions should  consider when engaging in a business relationship with a CASP or when they are otherwise exposed to crypto assets.

The proposed amendments were necessary to fulfil  the mandates given to the EBA under the recast Transfer of Funds Regulation. The deadline for submission of comments in response to the consultation is 31 August 2023.

EBA assesses ML/TF risk in payment institutions (29/06/2023)

In June the EBA published the findings from its assessment of the scale and nature of ML/TF risks associated with payment institutions. It considered how payment institutions identify and manage ML/TF risks and what supervisors do to mitigate those risks when considering an application for the authorisation of a payment institution and during the life of a payment institution.

The sector consists of a heterogenous set of institutions of different sizes and business models, each carrying different levels of ML/TF risk. Nevertheless, the EBA’s findings suggest that overall, the sector does not manage ML/TF risk adequately. AML/CFT internal controls in payment institutions are often insufficient to prevent or detect ML/TF.

The EBA’s findings also suggest that not all competent authorities are currently doing enough to supervise the sector effectively. As a result, payment institutions with weak AML/CFT controls can operate in the EU, for example by establishing themselves in Member States where authorisation and AML/CFT supervision processes are less stringent to passport their activities cross-border afterwards.

EBA Annual Report (29/06/2023)

In June the EBA published its latest Annual Report. The report highlights the EBA’s continued leading work to reduce the risk of financial crime within the EU.   

In 2022, this included consolidating the regulatory framework and preparing to deliver ten new mandates under the recast Regulation on the transfer of funds and crypto-assets; launching the central database, EuReCA; continuing in-depth reviews of competent authorities’ approaches to tackling ML/TF risk; building supervisory capacity and fostering cooperation and information exchange in AML/CFT colleges.

EBA reports on competent authorities’ approaches to the AML/CFT supervision of banks (29/06/2023)

The EBA will publish its third report competent authorities’ approaches to the AML/CFT supervision of banks. The report provides a summary of the main findings and recommendations from this third round of reviews.

During this third round of reviews, the EBA assessed twelve competent authorities from nine EU and EEA Member States that are responsible for the AML/CFT supervision of banks in the EU and in the EEA.

EBA Data Protection Impact Assessment (29/06/2023)

The EBA has been working on a revised version of the Data Protection Impact Assessment (DPIA) on EuReCA.

An update of the summary of the DPIA will be published once the RTS on the AML/CFT central database is approved by the European Commission.

Opinion on ML/TF risks affecting the EU financial sector (29/06/2023)

The EBA is working on the next Opinion on the ML/TF risks affecting the EU financial sector, which is issued every two years.

As was the case in previous years, the EBA identifies ML/TF risks that cut across all sectors and risks that are specific to each of the 11 sectors within the EBA’s AML/CFT remit. For the first time, this report will include a sectoral risk assessment of crypto asset service providers.

EuReCA approaching 1-year anniversary! (16/12/2022)

In January the EBA launched EuReCA, the European Reporting system for AML/CFT material weaknesses. EuReCA is the only EU central database that brings together in one space information on serious deficiencies in individual financial institutions’ systems and controls that expose these institutions to money laundering and terrorist financing (ML/TF) risk.  EuReCA also contains information on the measures competent authorities imposed on financial institutions to correct those deficiencies.

The EBA receives new mandates under the revised Regulation on information accompanying transfers of funds (TFR) (16/12/2022)

On 29 June 2022 the co-legislators reached a provisional agreement on the revised TFR. According to this agreement, the EBA will be assigned 10 legislative mandates on different aspects of the TFR. The new mandates include:

• guidance on the steps crypto assets service providers (CASPs) need to take to comply with the TFR,
• the AML/CFT supervision of CASPs,
• the systems and controls payment service providers and CASPs have to put in place to comply with restrictive measures (financial sanctions) regimes.

The EBA sets up two Technical Expert Groups to inform the EBA’s work on new TFR mandates (16/12/2022)

In October, the EBA issued a public call for interest for two expert groups (TEG) to advise on its work under the revised TFR.

Both groups have now been set up. One group brings together experts on crypto assets service providers and anti-money laundering and countering the financing of terrorism (TEG-CASPs/AML), and the other one brings together experts on restrictive measures regimes (TEG-RMRs). TEG members participate in their personal capacity and provide independent expertise. They do not represent national interests or the interests of their organisation or employer. For transparency purposes, the EBA published the name of members of each TEG on its website.

The EBA published final Remote Customer Onboarding Guidelines (16/12/2022)

In November, the EBA published the final Guidelines on remote customer onboarding. The Guidelines  establish common EU standards on the development and implementation of sound, risk-sensitive initial customer due diligence policies and processes in the remote customer onboarding context. They set out the steps credit and financial institutions should take to ensure safe and effective remote customer onboarding practices in line with applicable AML/CFT legislation and the EU’s data protection framework.

The Guidelines apply to all credit and financial institutions that are within the scope of the Anti-money Laundering Directive (AMLD).

AML/CFT in the EU Supervisory Digital Finance Academy (16/12/2022)

In October, the European Commission together with the European Supervisory Authorities (ESAs) and the Florence School of Banking and Finance (Robert Schuman Centre, EUI) launched the EU Supervisory Digital Finance Academy (EU-SDFA).

The EU-SDFA provides participants with the knowledge necessary to carry out effective supervision of the application of digital technologies in finance by credit and financial institutions and supervisors’ use of technology. It also includes an AML/CFT module, which is provided by the EBA.

Financial crime risk remains a priority for prudential supervisors (16/12/2022)

In October, the EBA published the European Supervisory Examination Programme (ESEP) for 2023. The ESEP sets priorities for prudential supervisors across the EU. One of ESEP’s four priorities relates to financial crime. Accordingly, supervisors are expected to consider ML/TF risks from a prudential perspective and to verify that institutions’ internal control and governance frameworks are sufficient to enable them to comply with financial sanctions.

The EBA trains AML/CFT supervisors (16/12/2022)

In December, the EBA hosted a 3-day training event on effective, risk-based AML/CFT supervision to follow up on its findings from its ongoing programme of intrusive reviews of competent authorities’ approaches to AML/CFT supervision. The training was provided by EBA staff with input from 16 competent authorities across the EU who shared best practices and discussed real life cases through presentations, Q&As and panel discussions. Approx. 300 supervisors from AML/CFT, prudential and resolution authorities participated in the training. Competent authorities can access the training materials on the EBA’s learning hub.

The EBA consults on Guidelines to tackle de-risking (16/12/2022)

In December, following up on its Opinion on de-risking, the EBA launched a public consultation on new Guidelines to tackle de-risking. The consultation covers two set of Guidelines.

The first set consists of a new section to the EBA’s ML/TF risk factors Guidelines dedicated to not-for-profit organisations and set out what financial institutions should do to identify and tackle ML/TF risk associated with these customers.

The EBA publishes 2022 Risk Assessment Report (16/12/2022)

In December, the EBA published its Risk Assessment Report for 2022. This report provides an in-depth assessment of the state of health of the EU banking sector. In relation to financial crime, the report highlights that banks are attributing less importance to ML/TF risks, following a shift in focus towards risks related to the implementation of restrictive measures following the Russian war of aggression against Ukraine and risks relating to the circumvention of sanctions.

The EBA reviews implementation of authorisation guidelines for payment services providers (16/12/2022)

The EBA is carrying out a peer review on the authorisation of payment institutions (PIs) and electronic money institutions (EMIs) under the Payment Services Directive.

The peer review assesses supervisory practices across the EU in the authorisation of PIs and EMIs including the implementation of the EBA Guidelines on the information to be provided for the authorisation of PIs and EMIs and for the registration of account information service providers under PSD2. It will also identify shortcomings, good practices and provide targeted recommendations to competent authorities with the overall aim to further strengthen consistency and convergence of the assessment of applications for authorisations of PIs and EMIs across Europe.

The report will be published in early 2023.

Best wishes for a joyous year-end season (16/12/2022)

We’d like to thank you for your interest in our work and wish you and your dear ones a joyous end of the year and a great beginning of 2023.

Click on the image below for animation and sound. 

Guidelines on the role and responsibilities of the AML/CFT compliance officer (02/09/2022)

In June 2022, we published our new Guidelines on the role of AML/CFT compliance officers.

These Guidelines create, for the first time, a common understanding across EU Member States, of credit or financial institutions’ AML/CFT governance arrangements. They complement but do not replace relevant guidelines by the EBA on wider governance arrangements and suitability checks. 

Update on EuReCA [corrigendum] (02/09/2022)

Since the launch of the EBA’s new AML/CFT database ‘EuReCA’ (the European Reporting system for material AML/CFT weaknesses) on 31 January 2022, competent authorities have reported 98 ‘material weaknesses’, which relate to serious deficiencies that they have identified in individual financial institutions and 52 measures they have taken to rectify those deficiencies.

Training for AML/CFT supervisors of the life insurance sector (02/09/2022)

In April 2022, we provided AML/CFT training to more than 100 supervisors responsible for the supervision of the life insurance sector in the EU. Mr. Patrick Hoedjes, Head of the Oversight Department at EIOPA and a member of the EBA’s AML/CFT Standing Committee, opened the session and provided an introductory speech.

EBA’s response to the Call for Advice on the review of the PSD2 (02/09/2022)

In June 2022, we published a response to the Call for Advice on the review of the Payment Services Directive (PSD2), which proposed to the European Commission several amendments to the Directive to address various issues identified by the EBA. The proposal aims, among others, to address issues related to the move from open banking to open finance, to clarify the application of strong customer authentication and other security requirements, to define the scope of the Directive and key terms, as well as to identify the interplay between PSD2 and other EU legal acts.

Joint ESAs Report on the withdrawal of authorisation for serious breaches of AML/CFT rules (02/09/2022)

In June 2022, we published a joint Report, together withESMA and EIOPA, on the withdrawal of authorisation for serious breaches of AML/CFT rules. The report provides a comprehensive analysis on the completeness, adequacy and uniformity of the applicable laws and practices on the withdrawal of license for serious breaches of the AML/CFT rules.

Annual Report (02/09/2022)

In June 2022, the EBA published its 2021 Annual Report. The report summarises the EBA’s main achievements and key publications in 2021. On the AML/CFT side, it focusses on the building of the infrastructure in the EU to lead, coordinate and monitor AML/CFT supervision.

Political agreement reached on the recast of the 2015 Funds Transfer Regulation and new EBA mandates (02/09/2022)

One year ago, the European Commission published an AML/CFT packageconsisting of 4 legislative proposals that once implemented will transform the Union’s legal and institutional AML/CFT framework.

One of these proposals is the recast of the 2015 Funds Transfer Regulation. This recast serves to bring the EU’s legal framework in line with the Financial Action Task Force (FATF) standards which extended the application of its Recommendation 16 to virtual asset service providers. It means that to ensure traceability, these entities, which will now be included in the regulatory perimeter by the Market in Crypto Assets Regulation, will have to include information about the originator and beneficiary of the crypto-assets transfers, just as PSPs/IPSPs currently do for wire transfers. This is known as the “travel rule”.

Report on the functioning of AML/CFT colleges (02/09/2022)

On 1 September 2022, we published a second report on the Functioning of AML/CFT colleges in 2021. The report is based on data and information collected by the EBA from competent authorities or through EBA staff participation in AML/CFT college meetings.

Guidelines on effective ML/TF risk management and access to financial services (‘Anti-derisking Guidelines’) (02/09/2022)

As a follow-up from the EBA Opinion on de-risking (published in January 2022), the EBA is working on a new set of guidelines to tackle further the negative impact of de-risking and to strike the right balance between financial inclusion and compliance with the current EU AML/CFT framework.

New Director of the Innovation, Conduct and Consumers Department (29/04/2022)

The newly appointed Director of the Innovation, Conduct and Consumers Department, Marilin Pikaro, joined the EBA on 1 March.

Prior to joining the EBA Ms Pikaro was a special advisor to the European Commission, and her experience includes work for the Estonian Criminal Police and as a Chief Compliance Officer and member of the Executive team and Management Board at Luminor.

De-risking Opinion and Report (29/04/2022)

In January we published an Opinion and a report on the scale and impact of de-risking in the EU. We worked with competent authorities across the EU, and with external stakeholders, to better understand why credit and financial institutions decide to de-risk particular categories of customers instead of managing the risks associated therewith.

Call for Advice on Digital Finance (29/04/2022)

In January 2022 the EBA, along with the other ESAs, submitted the joint response to the European Commission’s February 2021 Call for Advice on Digital Finance. The ESAs identified that the use of innovative technologies in the EU financial sector is facilitating changes to value chains, that dependencies on digital platforms are increasing rapidly, and that new mixed-activity groups are emerging. These trends open up a range of opportunities for both EU consumers and financial institutions, but also pose new or elevated risks.

EuReCA update (29/04/2022)

In January we launched our central EU AML/CFT database, EuReCA, the European Reporting system for material AML/CFT weaknesses. EuReCA is based on the draft Regulatory Technical Standards (RTS) published in December 2021 that define key terms and type of information to report to EuReCA. EuReCA brings together in one place information from competent authorities (CAs) across the EU that relates to serious AML/CFT shortcomings in individual financial institutions, and the measures CAs have taken to rectify those shortcomings.

EuReCA will be key to strengthening AML/CFT supervision and coordinating supervisory efforts across the EU.

Luanda Leaks (29/04/2022)

In February we published the findings of our assessment of competent authorities’ responses to the 2020 Luanda Leaks. We found that competent authorities across the EU adopted significantly different approaches for identifying and tackling the risks highlighted by the information contained in the leaks, and that these approaches varied beyond what the EBA would have expected under a risk-based approach.

However, we also identified good practices, including steps by competent authorities to put in place dedicated processes to identify and swiftly react to instances of crystallised ML/TF risk. The  EBA Risk-Based AML/CFT Supervision Guidelines can also support competent authorities to better identify, assess and manage emerging ML/TF risks holistically and across all areas of supervision.

EBA updates SREP Guidelines with explicit AML/CFT references (29/04/2022)

In March, the EBA published its revised Guidelines on common procedures and methodologies for the supervisory review and evaluation process (EBA SREP Guidelines).

The revised Guidelines reflect changes to the EU’s legal framework. They also set out how prudential supervisors should take ML/TF risks into account in SREP, in line with the EBA's Opinion on ML/TF risks in SREP.

Remote customer onboarding (29/04/2022)

At the end of the last year, the EBA launched a public consultation on its draft Guidelines on the use of remote customer onboarding solutions. These Guidelines set out a common understanding by competent authorities of the steps financial sector operators should take to ensure safe and effective remote customer onboarding practices in line with applicable AML/CFT legislation and the EU’s data protection framework.

EBA calls for the financial inclusion of refugees (29/04/2022)

In March, we published a first  statement on the situation in Ukraine, calling all competent authorities to ensure all financial institutions properly implement restrictive measures adopted by the Council of the EU.  We highlighted the importance of sanctions compliance and of institutions taking advantage of the flexibility enshrined in EU AML/CFT law to provide refugees with access to at least basic financial products.

EBA asked financial institutions to follow a risk-based approach when providing financial products to refugees from Ukraine, using the EBA’s 2021 ML/TF Risk Factors Guidelines and the EBA’s 2016 Opinion on the Application of Customer Due Diligence Measures for Asylum Seekers.

In April we published a statement on financial inclustion in the context of the invastion in Ukraine.  The statement sets out what financial institutions and their AML/CFT supervisors can do to facilitate access by refugees from Ukraine to the EU’s financial system and what financial institutions and AML/CFT supervisors can do to protect vulnerable customers from abuse by criminals and to tackle emerging financial crime risks.

EBA assesses effectiveness of AML/CFT supervision (29/04/2022)

In March, we published our second report on competent authorities’ approaches to the AML/CFT supervision of banks. We found that several competent authorities in last year’s sample had engaged in meaningful reforms but that the effectiveness of their approaches was often hampered by insufficient ML/TF risk assessments and failure to translate those risk assessments into their supervisory practices and plans.

EBA chairperson writes to co-legislators about the AML/CFT package (29/04/2022)

In March, the EBA's chairperson, Jose Manuel Campa, wrote to the European Parliament, the Council and the Commission co-legislators about the importance of cooperation in the future EU AML/CFT framework, a holistic approach to tackling ML/TF and the criteria for selecting institutions that will be directly supervised by the future AMLA.

The Chairperson emphasised that ML/TF cannot be fought effectively in isolation, and that building on the synergies that exist between the AML/CFT, prudential and conduct frameworks will remain important to protect the European Union from financial crime.

Revised Guidelines on Risk-Based AML/CFT Supervision (29/04/2022)

In April, the EBA published the translations of the Guidelines on Risk-Based Supervision (revised).

The revised Guidelines enter into effect on 4 July 2022.