EU Travel Rule, AML, Sanctions & DAC8 — CASP Compliance 2026

TFR implementation — uniform on paper, national in delivery

The EU Travel Rule under Regulation (EU) 2023/1113 (TFR) has applied since 30 December 2024 (Article 40), alongside MiCA. As a regulation it applies directly in every member state without transposition, so the obligations themselves are identical. The EBA Travel Rule Guidelines (EBA/GL/2024/11, 4 July 2024) give the common reading of the detail.

What differs is the delivery. Each member state designates the AML/CFT supervisor for CASPs, the financial intelligence unit that receives suspicious-transaction reports, the language for supervisory correspondence, and the penalties for breaches, with minimums for repeated or systematic failures set by Article 29. A CASP serving several member states needs a map of those counterparties, not a separate Travel Rule build for each.

This guide starts with that baseline, then works through the rest of the financial-crime stack a CASP carries alongside its MiCA authorisation: the self-hosted wallet rules, the FATF Recommendation 16 standard the TFR implements, the AMLR and AMLA package landing in 2027, DAC8 crypto-asset tax reporting from 2026, sanctions screening, and GDPR. They sit in different rulebooks but share the same customer data and the same onboarding flow, run by the same operations team, so it pays to plan them together.

The TFR framework baseline

Originator and beneficiary information accompanies every transfer of crypto-assets involving a CASP, regardless of value (Article 14):

• Originator: name; distributed-ledger address and crypto-asset account number where used; address including country, official personal document number and customer identification number, or alternatively date and place of birth; LEI where available
• Beneficiary: name; distributed-ledger address and crypto-asset account number where used; LEI where available

The information travels before, with or alongside the transfer, securely and in line with GDPR (Article 14(4)). It does not have to sit on-chain.

No de minimis exemption. Unlike the fiat side of the regulation, the crypto-asset rules have no value threshold below which the information can be left out.

Self-hosted addresses. For transfers to or from a self-hosted address, the CASP obtains and holds the information and ensures the transfer can be identified individually. Above EUR 1,000, it must also take adequate measures to assess whether the address is owned or controlled by its own customer (Articles 14(5) and 16(2)).

Record-keeping. Article 26 requires the information to be kept for five years, then deleted unless national law provides otherwise. Keep it in the same retrievable infrastructure as MiCA Article 68 records.

Cross-CASP information exchange. Industry protocols (TRISA, OpenVASP, TRP, Notabene, Sumsub Travel Rule) handle the technical layer.

Who you deal with in each member state

The table lists the financial intelligence unit in nine large markets. The AML supervisor for CASPs is designated nationally and is often, but not always, the MiCA NCA; confirm it, and the language the authority expects, on its website before filing.

Member state	FIU
Germany	Financial Intelligence Unit (Zentralstelle für Finanztransaktionsuntersuchungen)
France	TRACFIN
Netherlands	FIU-Nederland
Ireland	Garda Financial Intelligence Unit
Luxembourg	Cellule de renseignement financier (CRF)
Estonia	Financial Intelligence Unit (Rahapesu Andmebüroo)
Lithuania	Financial Crime Investigation Service (FNTT)
Spain	SEPBLAC
Italy	Unità di Informazione Finanziaria (UIF)

We have not listed national TFR guidance documents or enforcement cases: we could not find a public source for the per-country claims an earlier version of this page made, so we removed them.

What this means for operators

One build, several reporting lines. The Travel Rule stack is the same everywhere; suspicious-transaction reporting has to reach the right FIU in each market where the CASP has customers or an establishment.

Language follows the market. Supervisory correspondence and customer-facing AML communications in the languages each authority expects.

Penalties stay national. TFR Article 29 sets minimums for repeated or systematic failures, and from July 2027 AMLD6 Article 55 sets minimum maximum fines; levels and enforcement practice still differ by member state.

The AMLR narrows the variation from July 2027. A single rulebook applies directly, and AMLA’s methodology steers national supervisors. Robust infrastructure built now carries over.

How the self-hosted wallet rule works

Self-hosted wallets (wallets where the user holds the private keys directly, not at a CASP) get specific treatment under the TFR. For CASP-to-CASP transfers the rule is binary: collect originator and beneficiary information on every transfer, regardless of value. The self-hosted wallet path is where the one quantitative line in an otherwise zero-threshold regime sits, at EUR 1,000.

EUR 1,000 or less. The CASP obtains and holds the originator and beneficiary information for transfers to or from self-hosted addresses and ensures each transfer can be identified, but the TFR does not require it to assess whether the customer owns or controls the address.

Above EUR 1,000. The CASP must take adequate measures to assess whether its customer owns or controls the self-hosted wallet involved in the transfer (Articles 14(5) and 16(2)). The Regulation does not prescribe the method; in practice the market options are:

• Signed-message proof — the customer signs a message from the self-hosted wallet that proves control
• Micro-transfer verification — the customer sends a small (sub-threshold) test transfer that confirms control
• Chain-analytics-driven heuristics — pattern analysis suggesting customer ownership

Each option trades off user experience against technical reliability, and each meets a different level of supervisory acceptance. The EBA guidelines (EBA/GL/2024/11, published 4 July 2024) accept any verification method that delivers reliable evidence of customer control. The AMLR adds a second layer from 10 July 2027. Article 40 requires CASPs to assess the ML/TF risk of every transfer to or from a self-hosted address and apply mitigating measures, such as identifying and verifying the originator or beneficiary, asking for information on origin and destination, or enhanced ongoing monitoring. Separately, Article 19(3) requires full customer due diligence for occasional transactions of EUR 1,000 or more. The TFR sets the data that accompanies the transfer; the AMLR sets the risk and CDD duties.

A common pitfall is reading the EUR 1,000 rule as a transfer ban. It is not. A CASP can serve self-hosted-wallet transfers above the threshold; it applies the ownership assessment and, from July 2027, the AMLR risk measures. Treating the rule as a ban manufactures a customer-experience problem the law does not require.

What the beneficiary CASP does with incomplete transfers

The beneficiary CASP must detect transfers arriving with missing or incomplete originator or beneficiary information and apply risk-based procedures to decide whether to execute, reject, return or suspend them (Article 17(1)):

• Execute — proceed if the risk assessment allows
• Reject — decline to make the crypto-assets available to the beneficiary
• Return — return the crypto-assets to the originator CASP
• Suspend — temporarily hold the transfer while requesting the missing information

The choice is risk-driven, not a free menu. A high-risk gap (originator name absent on a large transfer from a higher-risk jurisdiction) typically requires reject or suspend; a lower-risk gap can support execute with a documented rationale. On becoming aware of missing information, the CASP must, without undue delay, either reject or return the transfer or request the information before making the assets available. Where a counterparty CASP repeatedly fails to send the information, the beneficiary CASP warns it, then rejects its transfers or restricts or ends the relationship, and reports the failure to its AML supervisor (Article 17(2)).

What’s out of scope

The Travel Rule does not reach peer-to-peer transfers between two self-hosted wallets with no CASP on either side, intra-CASP transfers where one provider already holds both sides of the information (internal AML monitoring still applies), or the verification step for sub-EUR-1,000 self-hosted transfers (information collection still applies). The first carve-out is what lets genuine peer-to-peer use continue without CASP intermediation — the TFR is a CASP-focused regulation, not a general crypto-asset rule.

TFR outsourcing

Many CASPs outsource Travel Rule compliance to specialist providers. That is permitted under MiCA’s outsourcing rules (Article 73), subject to the usual discipline: a written arrangement, the CASP keeping full responsibility, and, where the provider is an ICT third party, an entry in the DORA register of information. Outsource the technical implementation; keep the supervisory accountability and the internal capacity to oversee what is outsourced.

Industry-protocol coverage

Cross-CASP TFR information exchange runs through industry-standard protocols. The Regulation does not prescribe one (the EBA guidelines accept any protocol that meets the security and integrity requirements), so operators need coverage across several since counterparty CASPs use different solutions:

TRISA (Travel Rule Information Sharing Alliance) — open-source protocol with substantial adoption, particularly among US and European exchanges. Public key infrastructure for CASP verification.

TRP (Travel Rule Protocol) — open-source protocol with broad industry support and strong North American adoption; TRP-compatible providers include Notabene and Sumsub Travel Rule.

TRUST (Travel Rule Universal Solution Technology) — Coinbase-led consortium framework, substantial North American adoption among large CASPs, less common in the EU.

OpenVASP — Swiss-origin protocol with European adoption, particularly among institutional CASPs.

Notabene — commercial Travel Rule platform with broad CASP coverage. Strong UI for operations teams.

Sumsub Travel Rule — bundled with broader AML/KYC infrastructure. Common choice for operators already using Sumsub for KYC.

Other regional protocols — Veriscope (Shyft Network), the 21 Travel Rule Protocol, and various exchange-specific implementations.

Many operators connect to more than one protocol, directly or through an interoperable provider, so that counterparties on other networks can still receive the information. A single-protocol setup risks transfers that arrive without data, which Article 17 then forces the beneficiary to reject, return or suspend.

The FATF Recommendation 16 global standard

The EU TFR is the EU’s implementation of FATF Recommendation 16 — the global standard for wire-transfer transparency. The recommendation requires originating financial institutions to obtain, hold, and transmit originator and beneficiary information accompanying transfers, and beneficiary institutions to monitor for incoming transfers that lack required information. The FATF Updated Guidance for a Risk-Based Approach to Virtual Assets and VASPs (June 2019, refined through October 2021 and March 2024) applied Recommendation 16 to virtual asset service providers.

By 2026 every major crypto-active jurisdiction has implementing legislation:

• European Union — Regulation (EU) 2023/1113 (TFR), operational since December 2024
• United States — FinCEN guidance under the Bank Secrecy Act, with active enforcement
• United Kingdom — Money Laundering Regulations 2017 amendments, operational September 2023
• Singapore — MAS Notice PSN02, Travel Rule provisions for Digital Payment Token service providers
• Switzerland — FINMA framework integrated with broader Swiss AML obligations
• Various Asia-Pacific, MENA, and LATAM frameworks through 2024-2026

The thresholds diverge, and that divergence is the practical trap. The EU TFR has a zero threshold for CASP-to-CASP transfers — a EUR 50 transfer carries the same information as a EUR 50,000 one. US FinCEN applies above USD 3,000. Other jurisdictions vary. A cross-border CASP faces the strictest applicable threshold for each transfer, so an operator that builds only to the US threshold fails EU compliance. US enforcement shows the reach: the actions against BitMEX (2021), Bittrex (2022) and Binance (2023) turned on Bank Secrecy Act programme and sanctions failures at platforms serving US customers.

One more angle operators underestimate is the “sunrise issue”: a counterparty in a jurisdiction without Recommendation 16 rules. That gap does not exempt the EU CASP; it has to manage the missing-information case on its side. Multi-protocol support, a verified beneficiary-identifier framework, and an explicit self-hosted-wallet workflow are what make cross-border transfers actually clear.

AMLR + AMLA — the 2027 readiness window

The EU’s new AML package, adopted together in May 2024, is the largest overhaul of EU AML supervision since the first Money Laundering Directive in 1991. Three instruments:

• AMLR (Regulation (EU) 2024/1624) — the single rulebook, applying directly from 10 July 2027. Covers customer due diligence, beneficial-ownership identification, reporting, internal controls.
• AMLA (Regulation (EU) 2024/1620) — establishes the Authority for Anti-Money Laundering and Countering the Financing of Terrorism, headquartered in Frankfurt. The Regulation has applied since 1 July 2025 and the Authority has been operating since then. It starts its first selection of directly supervised entities by 1 July 2027 and begins supervising them six months after publishing the list; for everyone else it coordinates national supervisors.
• AMLD6 (Directive (EU) 2024/1640) — the national-infrastructure piece: upgraded FIU capabilities, interconnected beneficial-ownership registers, aligned administrative cooperation. Transposition deadline 10 July 2027.

The core shift is from directive to regulation. Under the 4th, 5th, and 6th AMLDs each member state transposed the rules into national law, and they diverged on enforcement detail, beneficial-ownership thresholds, PEP definitions, and exempted activities. The AMLR closes that divergence by applying directly and identically — which is why a CASP operating across several member states moves from 27 jurisdiction-specific variants of the same programme to a single one.

What changes for the CDD programme

Several areas tighten meaningfully. PEP definitions harmonise across the EU and remove member-state discretion on domestic-PEP scope, producing a slightly broader PEP universe. Enhanced due diligence triggers become common — a single EU list of high-risk third countries replacing parallel national lists, anonymous transactions over EUR 10,000, correspondent relationships with non-EU institutions, and a residual high-risk-business trigger. Beneficial-ownership verification keeps the 25% threshold but requires independent supporting documentation rather than a self-declaration, verified against the national BO register through the interconnected EU platform. Crypto-specific rules are tighter than the fiat equivalents: CASPs apply full CDD to occasional transactions of EUR 1,000 or more and at least identification below that (Article 19(3)), and assess every self-hosted-address transfer under Article 40.

Who AMLA supervises directly

AMLA periodically assesses credit and financial institutions, CASPs included, that operate in at least six member states, through establishments or under the freedom to provide services (AMLA Regulation, Article 12(1)). It classifies their residual risk as low, medium, substantial or high using a methodology with a separate category for CASPs (Article 12(3)-(4)). Entities with a high residual risk profile qualify for direct supervision; where more than 40 qualify, AMLA selects by the number of member states covered, then by the share of transactions with third countries (Article 13). The first selection starts by 1 July 2027 and ends within six months; direct supervision begins six months after the list is published.

For selected entities, AMLA is the AML supervisor directly: on-site inspections, information requests, supervisory measures and joint teams with national supervisors.

For every other CASP, the national AML supervisor remains the counterparty. A Lithuania-authorised mid-size CASP keeps dealing with the authority it has dealt with since 5AMLD. The substance still changes: national supervisors apply AMLA methodology, share information through AMLA channels and face AMLA review of their own work, and a national supervisor can ask AMLA to take over direct supervision of a particular entity in exceptional circumstances (Article 14).

The sanctions-cumulation point

The penalty levels sit in AMLD6 (Directive (EU) 2024/1640), not the AMLR. For credit and financial institutions, which under the AMLR include CASPs, Article 55(3) requires member states to allow maximum fines of at least EUR 10 million or 10% of total annual turnover for a legal person, and at least EUR 5 million for a natural person. Member states may go higher. Where the same conduct also breaches MiCA, Article 111 MiCA fines of at least EUR 5 million or 5% of turnover can come on top. For a CASP with EUR 200 million in revenue, the two ceilings together reach at least EUR 30 million. Model the cumulative figure honestly when sizing the compliance budget.

The runway

From mid-2026 to July 2027 is roughly 12-15 months of preparation, not a deadline to back into. A workable plan: gap-analyse the current 5AMLD/6AMLD programme against the AMLR rulebook in H2 2026; rewrite policy, onboarding flows, and transaction-monitoring rules in Q1 2027; reconfigure KYC vendor settings, retrain staff, migrate beneficial-ownership verification to the interconnected register, and run a parallel-run exercise in Q2 2027; go live under the AMLR in July 2027. Two cautions worth stating plainly: do not treat the AMLR as a re-papering exercise under new article numbers (the PEP, EDD-trigger, BO-verification, and compliance-officer-independence changes are real), and mid-size CASPs operating in fewer than six member states will not be assessed for AMLA direct supervision and should not build for it.

DAC8 — crypto-asset tax reporting from 2026

DAC8 is the EU’s transposition of the OECD’s Crypto-Asset Reporting Framework (CARF) into the existing administrative-cooperation machinery, via Council Directive (EU) 2023/2226 amending Directive 2011/16/EU. Member states had until 31 December 2025 to transpose, and the rules apply from 1 January 2026. RCASPs report to their tax authority by the national deadline; the authorities exchange the information within nine months of the end of the calendar year, so the first exchange, for 2026, is due by 30 September 2027.

The thing to get right early is that this is not a tax-team project. It looks like a tax regime, but operationally it is a data-collection and reporting-systems build where data quality is the hard part, and it sits with operations, technology, and compliance. Treating it as a finance-team initiative produces the late discovery that the onboarding flow never captured the required fields.

What a RCASP is — and is not

DAC8 defines a Reporting Crypto-Asset Service Provider (RCASP) more broadly than the MiCA CASP definition. The MiCA definition captures eight enumerated services anchored in the EU regulatory perimeter; the RCASP definition is anchored in the DAC tax-cooperation perimeter and captures any entity that effectuates exchange transactions involving Reportable Crypto-Assets on behalf of customers, or operates a platform on which such transactions occur. The overlap with MiCA CASP is large (most authorised CASPs are also RCASPs) but not complete. A non-EU centralised exchange with EU tax-resident customers and no MiCA authorisation is a RCASP and must report, even though it is not a MiCA CASP. The scoping question is separate, and each regime needs its own analysis.

The data fields

For each reportable customer: name, address, jurisdiction(s) of tax residence, Tax Identification Number (TIN) in each such jurisdiction, date of birth for individuals, and place of birth where the residence jurisdiction does not issue TINs. For each reportable transaction during the calendar year, aggregated by Reportable Crypto-Asset: units received and disposed of, total fair-market value received and disposed of, transaction count, and, separately, Reportable Retail Payment Transactions: transfers in consideration of goods or services worth more than USD 50,000. The fair-market-value methodology follows the OECD CARF commentary: typically the executed price, with a documented fallback for off-exchange transactions.

That USD 50,000 retail-payment trigger is a separate flag, per transaction, not aggregated, and it sits outside the normal trading-flow reporting. A CASP running both a trading service and a merchant-payment service has to classify the flows separately and apply the trigger only to the merchant-payment side. Lump every outflow into one bucket and you miss it.

The remediation effort

Most CASPs operating before 1 January 2026 hold customers for whom they have no DAC8-compliant data, because DAC8 reports on the existing base, not just new customers. The build breaks into: a new onboarding flow capturing TIN and tax-residence self-certification from first interaction (the easy part, a sprint or two); existing-customer remediation through multi-stage outreach (email, in-app prompt, account-action gate), with escalation for customers who do not respond; data-quality and verification work including per-jurisdiction TIN validation and documented retention of self-certifications; and the reporting-system build itself — annual aggregation, fair-market-value calculation, output in the format the home tax administration accepts, electronic submission. For a large platform starting from a typical 5AMLD-baseline KYC stack, that is a project of many months, not a sprint.

The smart move is to build it alongside the AMLR architecture rather than as a parallel system. The 18-month gap between DAC8 (January 2026) and the AMLR (July 2027) is the window to design one coordinated data layer — both regimes hit the same onboarding flow and need the same self-certification and ongoing data-quality maintenance, and both feed national-authority reporting. And since CARF extends the standard internationally as more jurisdictions sign on, designing the EU build to handle CARF fields more broadly avoids rework when other jurisdictions activate.

Sanctions compliance

Before the framework, the conceptual point that the most common sanctions failure turns on: sanctions are not AML. They are a separate regime with a different logic, and conflating them builds a structural gap. AML is risk-based — a low-risk client gets lighter due diligence, discretion is built in. Sanctions are not risk-rated: there is no “low-risk designated person”. If a client, counterparty or wallet is subject to an asset freeze, processing the transaction breaches the regulation whatever the risk rating. The only defence the EU regulations give is narrow: a person is not liable if it did not know, and had no reasonable cause to suspect, that its action would infringe the measures (for example, Regulation 269/2014, Article 10(2)). Weak screening destroys that defence. A CASP that routes sanctions screening through its risk-based AML triage has applied discretion the law does not allow, and that is precisely the gap supervisors look for. The MLRO and the AML framework can share tooling with sanctions; they cannot share logic. On a confirmed match the obligation is to freeze the funds or economic resources without delay, decline to execute, and report to the competent national authority — not to assess whether the transaction is “low risk” and proceed. EU restrictive measures bind all EU operators directly, exactly as they bind a bank; crypto-assets are treated as funds or economic resources, so there is no crypto carve-out. And the reach extends past the named account holder to counterparties, beneficial owners, and entities owned or controlled by designated persons — screening only the named client misses a common evasion structure.

The framework itself expanded sharply through 2022-2026 and is supervisor-tested. It operates in layers. The EU consolidated sanctions list, maintained by the Council, covers individuals, entities, and vessels subject to EU restrictive measures, updated continuously by Council decision — CASPs screen against it at onboarding and throughout the relationship. Sectoral packages restrict specific activity, most extensively against Russia (Council Regulation 833/2014) and Belarus (765/2006), with specific crypto-asset prohibitions, plus Iran (267/2012) and North Korea (329/2007). Country embargoes cover Cuba, Syria, Venezuela (sectoral), and others. National implementing legislation sets the penalty and enforcement detail per member state, but the EU framework is binding.

The Russia and Belarus packages contain specific crypto provisions CASPs must apply: a prohibition on providing crypto-asset wallet, account or custody services to Russian nationals, natural persons residing in Russia, and legal persons established in Russia, regardless of value (Regulation 833/2014, Article 5b(2)); individual designations of Russian institutions and persons; and obligations to report frozen assets to national competent authorities. The framework has been tightened repeatedly since 2022 — operators have to monitor amendments continuously.

The OFAC overlay

Any US-touching activity triggers US OFAC sanctions compliance, and the extraterritorial reach is real. The triggers: US customers, US-dollar-denominated transactions, US payment infrastructure (US correspondent banks, US-licensed processors), substantial US ownership, or US-based vendors. Operators screen against the OFAC SDN list at onboarding and continuously, apply the OFAC 50% rule (entities 50%+ owned by sanctioned persons are themselves sanctioned even if not listed), and watch sectoral lists. OFAC settlements with crypto businesses such as BitGo (2020), BitPay (2021), Kraken (2022) and Bittrex (2022) concerned transactions by users in sanctioned jurisdictions. EU compliance does not substitute for OFAC compliance; the two run in parallel.

Operational reality

Because the only defence is having no knowledge and no reasonable cause to suspect, the build has to support real-time blocking, not just reporting. Sanctions designations change daily, which rules out onboarding-only screening: the operational standard is continuous, real-time re-screening at the transaction level, backed by blockchain-analytics integration. For self-hosted wallets specifically, designated persons sometimes route through them to evade exchange-side screening, so transfer-time screening through blockchain analytics is required. Larger operators often run two analytics providers (Chainalysis, Elliptic, TRM Labs and others) so that a gap in one provider’s coverage of a recent designation does not become a breach.

GDPR for crypto operators

GDPR (Regulation (EU) 2016/679) applies to all CASPs handling personal data of EU data subjects, extraterritorially — a CASP established outside the EU is in scope if it processes EU-resident personal data. Crypto operators inevitably process it: customer identification data, transaction history linked to identifiable customers, communication records, behavioural analytics, and marketing/CRM data. The framework runs alongside MiCA AML obligations — sometimes in alignment, sometimes in tension.

The crypto-specific wrinkle is the personal-data definition. A standalone wallet address is pseudonymous and, under Recital 26, is personal data only where linkable to an identifiable person. But CASPs map customer identity to customer wallets through KYC, so wallet activity in CASP systems is linkable — and therefore personal data. Public on-chain activity becomes personal data where third parties can link it to a known person, and blockchain-analytics intermediaries (Chainalysis, Elliptic, TRM Labs) face their own GDPR analysis for the EU persons in their databases. Treating pseudonymous data as out-of-scope is the classic mistake.

Lawful basis and the erasure tension

Most AML-required processing rests on legal obligation (Article 6(1)(c)) — MiCA, the AMLR, the FATF Travel Rule implementation, and national AML law all impose duties to collect, verify, and retain customer data. Customer service delivery rests on contract (6(1)(b)); fraud prevention and security on legitimate interest (6(1)(f)) with a balancing test; marketing and optional features on consent (6(1)(a)). The basis matters because it drives the data-subject rights.

The sharpest tension is erasure. Article 17 gives data subjects a right to erasure, but Article 17(3)(b) carves out compliance with a legal obligation. AML law requires five years’ retention after the end of the business relationship, and TFR Article 26 requires five years for transfer information; during that window the required data cannot be erased. After it expires, erasure rights apply, so operators must distinguish time-bound AML retention from indefinitely-held data and run a two-track retention model. Marketing and non-AML data follow standard erasure rules throughout. And where data has been written to a public blockchain, it cannot be erased from the chain — the framework treats that as an accepted technical limitation, which is itself the argument for minimising blockchain-resident personal data by design.

Rights, breach, and the supervisor relationship

CASPs have to operate the full rights workflow, with identity verification up front to prevent impersonation — access (Article 15, one month, extendable to three), rectification (16), erasure subject to the AML carve-out (17), restriction (18), portability for consent/contract data (20), objection (21), and human review of significant automated decisions such as automated KYC rejection (22). Breach notification runs on the Article 33-34 clock: notify the DPA within 72 hours of a breach likely to risk data subjects, notify data subjects where the risk is high, and document every breach internally regardless.

On supervision, the Article 56 one-stop-shop makes the DPA of the operator’s main establishment the lead authority, with concerned DPAs in affected member states cooperating and the EDPB coordinating EU-wide. The practical advice is to build the relationship before an incident forces it — several DPAs offer prior-consultation mechanisms, and CNIL (France), the Spanish AEPD, and the German DSK have all published crypto-relevant positions. Two design principles carry the rest: privacy-by-design from the architecture phase (Article 25 — retrofitting privacy controls costs far more than building them in), and keeping the legal-obligation retention track cleanly separate from indefinite retention so erasure works in both directions.

Operational recommendations

For operators planning this whole stack, the same few principles recur:

Map the national counterparties. For each market: the AML supervisor, the FIU and its reporting channel, the language and the penalty regime.

Run Travel Rule coverage that reaches your counterparties. Connect to the protocols they use, directly or through an interoperable provider. Build for the EU zero threshold and the strictest applicable cross-border threshold, and handle self-hosted wallets explicitly rather than treating them as out-of-scope.

Integrate blockchain analytics once, use it everywhere. Transaction-graph analytics (Chainalysis, Elliptic, TRM Labs) feed self-hosted-wallet TFR verification and AMLR enhanced due diligence from the same infrastructure that runs real-time sanctions screening.

Design one coordinated data layer. The TFR, AMLR, DAC8, and GDPR all touch the same onboarding flow and the same customer data. Coordinated data architecture is materially cheaper than parallel systems — and the 18-month gap to July 2027 is the window to build it.

Wire in FIU reporting across passport markets where the operator has a meaningful customer base, and keep a two-track GDPR retention model that distinguishes time-bound AML retention from indefinite holding.

Prepare for AMLA now. Honestly assess selection risk, benchmark the AML programme against the harmonised EU standard, harmonise across passport markets, strengthen MLRO substance, and model the cumulative AMLR and MiCA Article 111 penalty exposure.

Operators that build serious infrastructure now are well placed for both the national delivery of today’s rules and the harmonised regime from July 2027.

For corrections, updates, or counsel referrals on EU CASP financial-crime compliance, email [email protected].