Insights

Insights›Client Update

AML duties of EU crypto-asset service providers, from the travel rule to the 2027 rulebook

Michael Isak|30 June 2026, updated 28 September 2026|Client Update|5-minute read

The AML obligations of EU crypto-asset service providers predate MiCA. Exchange and custodian wallet providers have been obliged entities since the fifth AML Directive's transposition date in January 2020; since 30 December 2024 the EU travel rule has applied to in-scope crypto-asset transfers with the full information and verification requirements applying regardless of amount, and the same regulation made crypto-asset service providers financial institutions under the EU's AML law. From 10 July 2027 the single rulebook adds a further layer, harmonised and directly applicable, inside the new AMLA architecture. Three layers result, each with its own date; they are set out below with the questions authorisation teams and supervisors are asking CASPs today.

The status change that already happened

The AML side moved first. Directive (EU) 2018/843 brought virtual-currency exchange providers and custodian wallet providers into the obliged-entity framework, with transposition due by 10 January 2020. Since 30 December 2024, Regulation (EU) 2023/1113 has applied: the EU version of the travel rule, requiring crypto-asset service providers to collect, verify and transmit originator and beneficiary information on in-scope transfers of crypto-assets. Unlike the funds regime, where the EUR 1,000 mark reduces what must accompany or be verified on low-value transfers, the full information and verification requirements apply to crypto-asset transfers regardless of amount; the Regulation's only EUR 1,000 threshold for crypto concerns the ownership assessment of self-hosted addresses. The same regulation amended Directive (EU) 2015/849 to bring CASPs within the definition of financial institutions, which in practical terms means that an EU CASP is an AML-obliged institution today, under current law.

One perimeter point deserves a note. The AML definition of a crypto-asset service provider excludes the service of providing advice on crypto-assets, so a MiCA-authorised firm whose only crypto-asset service is advice is not a financial institution on that account alone, although other activities or national law may still bring it within AML obligations. The AMLR carries the same exclusion.

LAYER 1 · AUTHORISATION MiCA (Regulation (EU) 2023/1114): licence, governance, capital, conduct; passportable across the EU LAYER 2 · TRANSFERS, since 30 December 2024 Travel rule (Regulation (EU) 2023/1113): originator and beneficiary data on in-scope crypto transfers, whatever the amount LAYER 3 · AML SINGLE RULEBOOK, from 10 July 2027 AMLR (Regulation (EU) 2024/1624): existing AML programme moves onto a directly applicable rulebook; mostly national supervision

Figure 1: The three regulatory layers on EU CASPs. Sources: EUR-Lex (as at 26 September 2026).

Three layers, three deadlines, one programme

The EU perimeter has three layers. MiCA's general application and the crypto travel rule share the same date, 30 December 2024 (MiCA's stablecoin titles applied from 30 June 2024); the AMLR follows on 10 July 2027. MiCA governs who may provide crypto-asset services at all: authorisation, governance, capital and conduct, with the EU passport as the principal commercial benefit. For providers that were operating lawfully under national law before 30 December 2024, the transitional period under Article 143(3) ended on 1 July 2026 at the latest, or earlier where an authorisation is granted or refused first or where the Member State shortened or disapplied it; a pending application does not extend it.

The travel rule governs the transfers themselves, and it generates most of the day-to-day compliance work: messaging infrastructure, counterparty CASP due diligence, and the handling of transfers involving self-hosted addresses, which the regulation subjects to specific requirements without prohibiting them. And from 10 July 2027 the customer-due-diligence layer changes basis: Regulation (EU) 2024/1624 makes CASPs obliged entities under the directly applicable single rulebook, replacing Directive (EU) 2015/849, which Directive (EU) 2024/1640 repeals with effect from that date. The travel rule itself does not move: Regulation (EU) 2023/1113 continues to apply after July 2027, and the partial end of validity EUR-Lex records for 9 July 2027 is limited to Article 38, the provision that amended the 2015 directive. What changes is the surrounding AML programme, harmonised across the Union inside the AMLA supervisory architecture we describe in our update on the 2027 rulebook.

On timing, note that AMLA itself, established by Regulation (EU) 2024/1620, has been operational since mid-2025; its direct supervision of a first cohort of around 40 selected entities or groups, each operating in at least six Member States, begins in 2028, and most CASPs will remain supervised by their national authorities within that architecture. A CASP that runs these as three separate projects duplicates its own work: the licence application, the travel-rule plumbing and the AML programme draw on the same governance, the same risk assessment and the same data model.

The questions supervisors ask

From authorisation files and supervisory practice, the pressure points are consistent. Can you demonstrate travel-rule compliance with counterparties in jurisdictions that have no travel rule, and do your policies say what happens when required information does not arrive? How do you risk-assess and document transfers involving self-hosted wallets? Does your counterparty due diligence distinguish between regulated CASPs, unregulated platforms and sanctioned venues, and is exposure to the latter measured at all? Is your sanctions screening wallet-aware, or does it screen names while value moves through addresses? For groups, the Swiss overlay matters too: Switzerland treats crypto intermediation within its existing framework under the Anti-Money Laundering Act supervised by FINMA, with its own long-standing expectations, so an EU-Swiss group runs two regimes that overlap in substance and differ in detail.

What this means for you

  • Stop dating the AML obligation to 2027. The travel rule and financial-institution status have applied since the end of 2024; supervision under current law is live.
  • Build one programme for three layers. MiCA governance, travel-rule operations and AMLR readiness should share one risk assessment and one data model.
  • Document the hard cases, and make screening wallet-aware. Self-hosted wallets, information-poor counterparties and exposure to non-equivalent jurisdictions are where files are judged, and name-based screening alone does not answer how sanctioned value reaches you.
  • EU-Swiss groups: map both regimes. The two regimes differ in detail, and the differences belong in a written group policy.

Isak Legal advises crypto-asset service providers, fintechs and financial institutions on EU and Swiss regulatory strategy, MiCA authorisation planning and AML programme design. See our Digital Assets and Sanctions and AML pages, or get in touch.

This client update is provided for general information only, reflects the position as at 26 September 2026 and does not constitute legal advice or create a lawyer-client relationship. Verify the current texts, technical standards and guidance at the official sources linked above before acting. For advice on a specific matter, please contact us.