EBA AML/CFT Newsletter

In January, we published a report with ESMA that analyses recent developments in the crypto-assets market, specifically focusing on decentralised finance (DeFi) and crypto lending, borrowing, and staking. This analysis contributes to the European Commission’s upcoming report to the European Parliament and Council, as required by Article 142 of MiCAR.

The report provides an in-depth look at the DeFi landscape, identifying key risks such as ICT vulnerabilities and the potential for money laundering and terrorist financing (ML/TF). It also examines the business models and associated risks in the crypto lending, borrowing, and staking markets, noting challenges such as information asymmetries and systemic risks.

In February 2025, we published the findings of a peer review on tax integrity and dividend arbitrage schemes. This peer review looked at follow-up actions European supervisors, prudential and AML/CFT alike, completed since the EBA issuance, in April 2020, of an action plan on dividend arbitrage trading schemes.

It also considered tax integrity issues more broadly. The peer review found a number of good practices, but also revealed specific areas for improvement for EU supervisors in the areas of tax integrity and formulated specific recommendations and follow-up measures.

In November, we published two sets of Guidelines on internal policies, procedures and controls to ensure the implementation of Union and national restrictive measures. The Guidelines set out the common EU standards on the governance arrangements and the policies, procedures and controls financial institutions should have in place to be able to comply with Union and national restrictive measures. The Guidelines have now been translated into all official EU languages and were published on the EBA website on 11 February 2025.

The deadline for competent authorities to confirm their intention to comply with the Guidelines or to provide their justification for non compliance is 11 April 2025. Compliance notifications are public and can be accessed on the EBA website.

In March, we launched a consultation on four draft technical standards (RTS) that will be central to the EU’s future AML/CFT regime. These draft technical standards will form part of our response to the European Commission’s Call for Advice.

The public consultation is open until 6 June 2025. There will be a public hearing on 10 April. Registrations for the public hearing are open until 8 April, 16:00 CET.

The consultation paper consists of four RTSs:

While the new EU AML/CFT package is now legally in force, the EBA will retain its AML/CFT responsibilities until the end of 2025, while AMLA is set up.

During the transition phase, we monitor risks, set common standards and work closely with national supervisors, the European Commission and AMLA to minimise disruption and ensure continuity in the EU’s fight against financial crime (see more explanation here).

The EBA is currently focusing on establishing cooperation mechanisms to ensure a holistic approach to the fight against financial crime. For instance, we are working on handing over EuReCA, the EBA’s AML/CFT database, to AMLA. And together with ESMA and EIOPA, we are preparing an agreement on how AMLA and the ESAs will cooperate to ensure that we can share information, and that synergies between our respective areas of competence are factored into the policy-making process, making the EU’s fight against financial crime more targeted and effective.

In March, we published the Consumer Trends Report (CTR). The CTR summarises the views of national consumer protection authorities, consumer associations, industry associations and national ombudsmen, among others.

This year, the information we obtained suggests that ‘de-risking’ remains an important issue for EU consumers.

De-risking occurs if a financial institution decides not to provide a financial service to a customer. It can be a necessary risk-management tool. But de-risking can also be unwarranted, for example if an institution does not take into account an individual customers’ risk profile. The information we received for the CTR does not distinguish between warranted and unwarranted derisking.

We are now assessing possible next steps because access to basic financial products and services is an important public interest goal. In the meantime, institutions and their supervisors should have regard to our Guidelines on derisking, which we issued last year. Our factsheet on de-risking has more information.

Between 4 December 2024 and 4 February 2025, we publicly consulted on amendments to Commission Delegated Regulation (EU) 2018/1108. We proposed to extend its scope to crypto-asset service providers (CASPs). The draft RTS specifies the criteria for CASPs to appoint a central contact point to ensure compliance with the host Member State’s AML/CFT obligations. A public hearing was held 16 January.

We are now reviewing the responses and feedback received. The final draft RTS is expected to be published in Q2 2025.