KEY TAKEAWAYS
- Anonymous crypto accounts and privacy coins will be banned in the EU by 2027 under new AML rules (Regulation 2924/1624).
- CASPs must now follow strict anti-money laundering rules like traditional banks.
- The travel rule now applies to crypto; all transactions must include sender and receiver details, with no minimum threshold.
- Self-hosted wallets aren't banned, but CASPs must verify if users control them during transactions.
- Privacy concerns persist, with the risk of users shifting to unregulated or decentralised platforms.
- CASPs must upgrade systems to monitor transactions, verify users continuously, and comply with identity checks.
- The EU's stance may influence global crypto regulations, known as the "Brussels Effect.
INTRODUCTION
The European Union ("EU") is stepping up its fight against money laundering and terrorist financing. In 2024, it introduced a major set of new rules for financial institutions, including Crypto-Asset Service Providers ("CASPs"). One of the biggest changes is a ban on anonymous crypto accounts and privacy coins, which will come into effect in 2027. This change is part of Regulation (EU) 2924/1624 ("AMLR"), which outlines detailed rules that all EU countries must follow.
Wallet providers and smaller exchanges also anticipate compliance risks and a similar recalibration of their offerings. This highlights that CASPs must now navigate a fast-closing window to adapt. This article captures what lies ahead, how the EU's anti-money laundering overhaul is redrawing crypto compliance and what industry players need to do now to stay relevant legally.
KEY PROVISIONS OF THE AMLR
Under the AMLR, CASPs are classified as "obliged entities," meaning they must follow the same rules as traditional financial institutions, including due diligence and reporting. The regulation covers a broad range of CASPs, such as wallet providers and exchanges. Article 79 bans anonymous crypto accounts and wallets, requiring CASPs to identify and verify users, especially for transactions over €1,000.1 It also targets privacy coins, pushing CASPs to adopt strict risk controls, making it unlikely these assets will remain viable in the EU after 2027.
EXTENSION OF THE TRAVEL RULE
This restriction is further reinforced by the amended Transfer of Funds Regulation (EU) 2023/11132, which extends the Financial Action Task Force's Travel Rule to the realm of crypto-asset transfers. It mandates that CASPs collect and transmit comprehensive originator and beneficiary data for virtually all crypto transactions they facilitate, irrespective of the monetary value.3 This represents a departure from earlier discussions that considered a minimum threshold, effectively affecting transactional anonymity for individuals engaging with regulated CASPs. Moreover, when transfers involve a self-hosted (un-hosted) address, CASPs are obligated to verify whether the customer owns or controls that address.4
The regulation further clarifies that the prohibition does not apply to providers of hardware and software or self-hosted wallets insofar as they do not possess access to or control over these crypto-asset wallets.
PRIVACY CONCERNS AND REGULATORY ARBITRAGE
There have been reservations regarding this restriction; key contentions are around overhauling privacy-enhancing cryptocurrencies that safeguard sensitive commercial information or provide financial security to individuals in politically volatile environments. The erosion of transactional anonymity could incentivise users to migrate towards less regulated or entirely decentralised platforms to avoid AMLR scope. This could complicate rather than facilitate the oversight. For instance, when the U.S. increased scrutiny on initial coin offerings and decentralised finance protocols under the Securities and Exchange Commission rules, it led to substantial scrutiny, which pushed projects to jurisdictions such as Switzerland or Singapore with clear token guidelines or shifted foundations incorporated offshore.5 A similar pattern could emerge in response, particularly for privacy-centric and decentralised projects.
OPERATIONAL IMPLICATIONS FOR CASPS
Beyond the widely publicised delisting of privacy coins, CASPs will face the task of restructuring their compliance framework from the ground up. The following are a few areas which will require emphasis by CASPs:
- for real-time transaction oversight, implementing advanced blockchain analytics tools for continuous monitoring and identification across all transaction flows;
- building infrastructure to transmit sender/receiver information for every crypto transfer, adhering to the zero-threshold Travel Rule;
- enhancing customer due diligence and monitoring of user behaviour and transaction patterns beyond the initial KYC check for continuous scrutiny.
- establishing procedures to confirm customer control over unhosted wallets for significant transactions; and
- developing policies for handling anonymous crypto asset accounts, likely leading to delisting or restricting services.
This necessitates a fundamental re-evaluation of how CASPs design their systems, demanding the integration of enhanced identity verification protocols at the onboarding stage and throughout the entire lifecycle of user interactions and transactions.
CONCLUSION
The EU's comprehensive regulations are often set as a precedent that resonates globally. This is commonly referred to as the 'Brussels effect,' where EU rules become de facto global standards due to the size and influence of the EU market.6 This stance will likely influence regulatory discussion and policy in other jurisdictions worldwide, fortifying the end of on-chain anonymity for regulated crypto platforms.
The impact of effectively banning anonymous crypto accounts, wallets and anonymity-enhancing coins has already unfolded. Binance delisted privacy-focused tokens like Monero (XMR)7, citing regulatory alignment, a move followed by Kraken8, which then began geo-restricting access to similar tokens across the EU.
A key area to look for is the extent to which other jurisdictions mirror the EU's approach to privacy coins and the verification of un-hosted wallets. CASPs worldwide may need to reassess their offerings, compliance frameworks, and technological infrastructure to align with the emerging standards for identity verification and transaction transparency.
Footnotes
1. Regulation (EU) 2024/1624 of the European Parliament and of the Council of 31st May, 2024 (AMLR), (https://eur-lex.europa.eu/eli/reg/2024/1624/oj/eng )
2. Regulation (EU) 2023/113 of the European Parliament and of the Council of 31 May, 2023, (https://eur-lex.europa.eu/eli/reg/2023/1113/oj/eng?utm_source=chatgpt.com )
3. Article 14 of the Regulation (EU) 2023/113
4. Article 16 of the Regulation (EU) 2023/113
5. Decrypt, 'The Regulation Race: Why Singapore and Switzerland are Competing to Give Crypto a Home' (9 July, 2021),(https://decrypt.co/75557/the-regulation-race-why-singapore-and-switzerland-are-competing-to-give-crypto-a-home )
6. Anu Bradford, 'the Brussels Effect: How the European Union Rules the World', Columbia Law Archive ( March, 2020), (https://scholarship.law.columbia.edu/books/232/ )
7. Binance Square, 'Monero (XMR) Delisted From This Major Exchange: Reasons', (https://www.binance.com/en-ZA/square/post/14338287512874?utm_source=chatgpt.com )
8. Cointelegraph, 'Kraken to end Monero support in European Economic area', (https://cointelegraph.com/news/kraken-ends-monero-support-european-economic-area?utm_source=chatgpt.com )
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
