Nine months to the AMLR: what AMLA’s final CDD standards mean for CASP compliance teams
The AMLR applies from 10 July 2027. AMLA’s final draft CDD standards show what supervisors will expect from CASPs, and what an MLRO can test now.
For most EU crypto-asset service providers, the first half of 2026 revolved around one date. The MiCA transitional period closed on 1 July 2026, and since then any firm serving EU clients without CASP authorisation is in breach of EU law. ESMA confirmed there would be no extension, and a pending application gives no cover.
For the firms that made it through, the next deadline is just as fixed. On 10 July 2027 the Anti-Money Laundering Regulation (Regulation (EU) 2024/1624, the AMLR) starts to apply directly in every Member State, replacing the national laws that transposed the current directive. On 1 October 2026, AMLA published its final draft regulatory technical standards on customer due diligence, which give compliance teams a detailed preview of what supervisors will expect.
This piece sets out what changes for CASPs, where the drafts add precision, and what an MLRO can do in the nine months that remain.
A CASP is a financial institution, with crypto-specific extras
The AMLR does not create a separate crypto category. CASPs fall within the definition of financial institution (Article 2(1)(6)), which borrows the MiCA definition and carves out only advice on crypto-assets. Every duty a financial institution owes applies, plus a handful of provisions written specifically for crypto.
The most visible is the threshold for occasional transactions. Most obliged entities apply full CDD to occasional transactions from EUR 10,000. For CASPs the line sits at EUR 1,000 (Article 19(3)(a)), and below that line the CASP must still identify the customer and verify the identity (Article 19(3)(b)). There is no KYC-free tier.
| Trigger | Obligation | Source |
|---|---|---|
| Account opening | Full CDD | AMLR Art. 19(1)(a) |
| Occasional transaction of EUR 1,000 or more | Full CDD | AMLR Art. 19(3)(a) |
| Occasional transaction below EUR 1,000 | Identify and verify the customer | AMLR Art. 19(3)(b) |
| Transfer to or from a self-hosted address | Risk assessment plus at least one mitigating measure | AMLR Art. 40(1) |
| Self-hosted transfer above EUR 1,000 | Assess whether the customer owns or controls the address | TFR Arts. 14(5) and 16(2), already in force |
Where AMLA's final drafts add precision
AMLA's package of 1 October includes final draft RTS under Article 28(1) AMLR (the content of CDD) and under Article 19(9) AMLR (occasional and linked transactions). Both now sit with the Commission. They become binding only once adopted and published in the Official Journal, but they are the clearest signal available of how supervisors will read the regulation.
Four points matter directly for crypto.
Business relationship by repetition. For certain CASPs, the Article 19(9) draft treats three or more transactions within twelve months as indicating a business relationship. A customer who repeatedly uses a swap or on-ramp service will stop being "occasional" quickly, and the full CDD set follows.
Linked transactions. The same draft uses a one-month window for linking transactions. A EUR 2,500 purchase split into three transfers inside a month still crosses the EUR 1,000 line. Monitoring logic has to aggregate across that window and across every identifier that resolves to the same customer: accounts, deposit addresses, payment instruments.
Remote identity verification. The Article 28(1) draft treats electronic identification at assurance level substantial or high as the default remote route. Document-based remote verification remains available as an alternative the obliged entity has to justify. Onboarding flows built entirely on document scans will need a written rationale, ideally per market.
Wallet addresses in sanctions screening. Screening extends to digital wallet addresses where the sanctions lists include them, and for financial institutions the check repeats on every new designation. A name-only screen at onboarding will fall short. Address-level screening needs to run on each list update against the whole customer base and every address associated with it.
Self-hosted wallets: a risk assessment duty
Much commentary describes the AMLR as banning privacy coins and self-custody. The text is narrower. Article 79 prohibits CASPs from keeping anonymous crypto-asset accounts, or accounts that allow anonymisation, including through anonymity-enhancing coins. The definition of those coins (Article 2(1)(25)) covers assets whose anonymising feature is optional as well as built-in, which matters for listing decisions. Recital 160 places self-hosted wallet providers without access to or control over the wallets outside the prohibition.
Transfers to and from self-hosted addresses fall under Article 40. The CASP identifies and assesses the risk, then applies one or more mitigating measures: identifying and verifying the counterparty on a risk basis, obtaining additional information on the origin and destination of the assets, enhanced ongoing monitoring, or another appropriate measure. AMLA must issue guidelines on these measures by 10 July 2027 and has not yet published a draft. Until it does, the TFR ownership check above EUR 1,000 and the EBA Travel Rule Guidelines remain the working reference.
AMLA direct supervision and the 31 December data point
From 2028, AMLA will directly supervise up to 40 credit and financial institutions or groups. Eligibility requires activity in at least six Member States, including the home state, and a residual risk profile classified as high. The first selection must begin by 1 July 2027 and will run on data as of 31 December 2026. AMLA said it expected the provisional list of eligible entities to be finalised by the end of September 2026; at the time of writing we have not seen it published.
For a passported CASP, two consequences follow. First, the Member State count is partly open: a host state served under the freedom to provide services counts only once minimum activity thresholds, still to be fixed in RTS, are met. Second, the year-end snapshot is less than three months away. A group that could plausibly qualify should already know which figures it will report and who owns them.
The penalty frame shifts as well. For selected entities, AMLA's basic fine for serious CDD breaches found in two or more Member States starts at EUR 500,000. For CASPs that remain with national supervisors, the maximum penalty for financial institutions must be at least EUR 10 million or 10% of annual turnover.
A nine-month plan for the MLRO
| Area | What to test now | Evidence a supervisor will ask for |
|---|---|---|
| Occasional transactions | Every transaction below EUR 1,000 triggers identification and verification | Flow documentation and sampled customer records |
| Linking and repetition | Aggregation across a one-month window; a rolling 12-month transaction count per customer | Rule definitions and back-testing results |
| Identity route | eID coverage by market; written justification wherever document-based remote verification is used | Onboarding policy with a per-market rationale |
| Address screening | Known wallet addresses re-screened on every sanctions list update | Timestamped screening logs |
| Self-hosted transfers | Ownership evidence above EUR 1,000; documented risk-based measures below it | Case records showing which measure was applied and why |
| Outsourcing | Each outsourced check mapped against Article 18; the CASP stays fully liable and some tasks cannot be outsourced | Outsourcing register and oversight records |
| AMLA eligibility | Member State count computed the way AMLA will compute it; named owner for the 31 December data | Eligibility calculation with data lineage |
The standard underneath all of it
The AMLR keeps returning to one requirement: obliged entities must be able at all times to demonstrate to their supervisor that the measures they took were appropriate to the risks. For a CASP processing thousands of transfers a day, that turns every alert into an evidence question. Why was this transfer cleared? What did the analyst see? Which rule fired, and which obligation does it implement?
Avus is built around that question. Each alert is investigated against the full context available for it (KYC and screening results, Travel Rule data, internal records and blockchain analytics). Alert rules are written in natural language, so the policy and its implementation can be read side by side. Every decision along the escalation path, from analyst to compliance officer to MLRO, is recorded with its reasoning. We call it Proof of Why, and from July 2027 it is exactly what a supervisor will ask to see.
Sources
- Regulation (EU) 2024/1624 (AMLR), Arts. 2, 18, 19, 20, 22, 40, 79 and Recital 160
- Regulation (EU) 2023/1113 (TFR), Arts. 14 and 16
- Regulation (EU) 2024/1620 (AMLA Regulation), Arts. 12 and 13
- Directive (EU) 2024/1640 (AMLD6)
- AMLA, "AMLA finalises key standards for the private sector", 1 October 2026
- AMLA, "AMLA takes next step toward 2027 selection of entities for direct supervision", 12 May 2026
- ESMA statement on the end of MiCA transitional measures (17 April 2026), summarised by AMLBot
- Didit, "AMLR for crypto: what crypto-asset service providers must verify", 3 October 2026
- RegWatch, "AMLR compliance checklist: ready by 10 July 2027"
This article is for information only and does not constitute legal advice.