CASP wallet screening and transaction monitoring: what EU supervisors expect

The legal frame

Three instruments carry the EU AML regime, and a fourth sits beside them. Regulation (EU) 2023/1113 applies the travel rule to crypto transfers and, through its amendments to Directive (EU) 2015/849, subjects MiCA-authorised CASPs to the same AML/CFT obligations and supervision as credit and financial institutions. On 16 January 2024 the EBA extended its ML/TF risk-factor guidelines to CASPs, cataloguing risk factors across customers, products, delivery channels and geography and explaining how CASPs should adjust their mitigating measures, including the use of blockchain analytics tools. On 4 July 2024 it issued the travel-rule guidelines, specifying what information must accompany a transfer, the steps CASPs and intermediary CASPs must take to detect missing or incomplete information, and what to do when it is lacking. Both guideline sets apply from 30 December 2024. The legislative mandate behind them names the hard cases: identification and verification measures for transfers to or from self-hosted addresses, enhanced diligence in high-risk situations, and relationships with CASPs from outside the EU.

The fourth instrument is the EBA's pair of guidelines on internal policies, procedures and controls to implement EU and national restrictive measures, EBA/GL/2024/14 and, for payment service providers and CASPs specifically, EBA/GL/2024/15, applicable from 30 December 2025. They treat sanctions screening as a discipline distinct from wallet attribution: every party to a transfer is screened against the applicable lists, originator and beneficiary information and any listed wallet addresses included; alerts are investigated on a documented procedure; and a confirmed match with a designated person, or an entity owned or controlled by one, is to be frozen and blocked in a suspense account pending instructions from the competent national authority, and reported. That outcome does not depend on a risk score, and rejecting or returning the transfer does not discharge the freezing obligation.

Three inputs

A vendor analytics tool typically covers one input: address analytics, the clustering and attribution that estimates whose wallet you face and what it has touched. A framework that satisfies the EBA texts needs two more. It needs travel-rule data handling: pipelines that attach originator and beneficiary information to outbound transfers, which may not be initiated until that is done (Article 14(8)), detect what is missing on inbound ones, request it and set the counterparty a deadline for providing it within the limits in the EBA's travel-rule guidelines (three working days for transfers within the EU and five for transfers received from outside it, counted from the day the gap is identified; up to seven days in the two cases the guidelines list, a chain of more than two parties including intermediaries and non-banks, and a chain with a provider based outside the EU) and report a counterparty that repeatedly fails to supply it, and drive a documented, risk-based procedure when information does not arrive, since the Regulation requires a decision at that point.

It also needs counterparty CASP due diligence: knowing whether the platform on the other side is a MiCA-authorised CASP, a provider regulated outside the EU under a framework as robust as MiCA and the AML Directive (which the EBA's risk-factor guidelines treat as risk-reducing), with Article 19b of the AML Directive framing the diligence for correspondent-type relationships (licensing or registration status, the nature of the business and the quality of its supervision, the counterparty's AML/CFT controls, senior management approval and documented responsibilities), or a provider under a weaker regime or none, and, on a separate axis, whether it or its addresses are sanctions-listed, with the relationship treated accordingly.

Self-hosted addresses cut across all three inputs and deserve their own written rules, and the legal triggers are fixed. For every transfer to or from a self-hosted address the CASP must obtain and hold the originator and beneficiary information; where the amount exceeds EUR 1,000 it must take adequate measures to assess whether the address is owned or controlled by its own customer (Articles 14(5) and 16(2) of the Regulation). The guidelines list the acceptable methods, from a signed message or a test transfer to attended verification, permit whitelisting once ownership or control is established, and address the case where the address turns out to belong to a third person, where identification can rest on reliable independent data. Self-hosted transfers are not prohibited. The policy has to say which methods you accept, which additional mitigating measures under Article 19a of the AML Directive apply, and which transfers you will not execute at all.

The questions that decide supervisory meetings

In our experience, the weakness that recurs in authorisation files and supervisory reviews is the absence of ownership. Concretely: who set the risk-score thresholds at which transfers are blocked or escalated, and where is the analysis that justifies them against your own risk assessment? What is the false-positive rate, who clears alerts, with what training and what four-eyes control? When did you last test the tool's coverage against your actual asset and counterparty mix, and what changed as a result? When does a screening hit become a suspicious transaction report, on what criteria, and how long does that take? One answer is fixed in advance: risk-score thresholds are yours to set, but a confirmed sanctions designation match is frozen and reported whatever the score says, and the file should show that. A CASP that can answer these questions from its own documents is in a strong position. One whose answer is the vendor's default settings has told the supervisor that its core AML control was calibrated by a third party with no knowledge of its business.

The same file supports your bank onboarding

There is also a commercial reason to build this properly. The EBA's risk-factor guidelines are addressed to CASPs and to the banks that serve them alike, and they treat business with crypto providers that are not authorised under MiCA and sit under weaker AML regimes as a risk-increasing factor for the bank. A bank onboarding a CASP will therefore examine the same framework described above: the screening architecture, the calibration governance, the self-hosted policy, the counterparty exposure measurement.

The screening file is the core of the bank file. For CASPs in Switzerland the commercial logic is the same although the substantive rules are not. FINMA has treated crypto intermediation as financial intermediation for years, and under its practice on payments on the blockchain (Guidance 02/2019) a supervised institution may transfer to or from an external wallet only where the wallet belongs to its own customer, or to a third party it has identified as it would a client, with ownership proven by suitable technical means in either case and without the exception for unregulated wallets that the FATF standard allows. A Swiss bank onboarding a Swiss CASP will test the screening file against that stricter external-wallet practice.

What this means for you

• Own your calibration. Thresholds, list selections and alert routing are your decisions; document why they fit your risk assessment, and revisit them when your asset mix changes.
• Write the self-hosted policy. Ownership or control above EUR 1,000, the methods you accept, and what you refuse: the Regulation and the guidelines name this case, and supervisors ask for it by name.
• Treat counterparty CASPs like correspondents. Where the relationship with a non-EU crypto provider is a correspondent relationship in law, Article 19b of the AML Directive applies: licensing or registration status, the nature of the business and the quality of its supervision, an assessment of its AML/CFT controls, senior management approval, documented responsibilities and regular refresh. For every other counterparty CASP the same file is good practice: authorisation status, jurisdiction and exposure history, refreshed on a cycle.
• Rehearse the missing-data procedure. The Regulation and the guidelines do not prescribe one sequence. They require documented, risk-based criteria for deciding whether to execute, reject, return or suspend a deficient inbound transfer; a deadline by which the counterparty must provide missing information, counted from the day the gap is identified (no more than three working days for transfers within the EU and five for transfers received from outside it, and up to seven days in the two cases the guidelines list, a chain of more than two parties including intermediaries and non-banks, and a chain with a provider based outside the EU); a separate report to the competent authority where a counterparty repeatedly fails to supply information, to be made without undue delay and at the latest three months after identifying it; and a suspicious transaction report only where the transfer is in fact suspicious, missing information is one factor in that assessment. Your logs should show each decision and its basis.
• Reuse the file. The framework that satisfies the EBA texts is the framework a bank will test at onboarding. It supports acceptance without guaranteeing it, since acceptance remains the bank's own commercial decision; build it to the stricter standard once.

Isak Legal advises crypto-asset service providers and the institutions that serve them on EU and Swiss AML frameworks, screening governance and MiCA authorisation readiness. See our Digital Assets and Sanctions and AML pages, or get in touch.

This client update is provided for general information only, reflects the position as at 27 September 2026 and does not constitute legal advice or create a lawyer-client relationship. The EBA guidelines and their supervisory application evolve; verify the current texts at the official sources linked above before acting. For advice on a specific matter, please contact us.