EBA publishes guidelines for crypto providers

The EBA issued guidelines that underline what payment service providers (PSPs) and crypto-asset service providers (CASPs) must adhere to in order to comply with the European Union’s and national restrictive measures regimes when conducting transfers for funds or crypto. As per the details provided by the regulator, the guidelines ensure the implementation of EU and national sanctions, with the EBA mentioning that the procedures clarify how restrictive measures policies and processes interact with financial institutions’ governance and risk management frameworks, to side-step operational and legal risks and guarantee an effective application.

EBA’s focus on PSPs and CASPs

The current guidelines come shortly after the EBA released a series of recommendations to support PSPs address the requirements of the Instant Payments Regulation for Euro-denominated instant payments containing currency conversion. Developed by 18 account-servicing payment service providers from 11 countries, the recommendations centred around how foreign exchange specialists and payment practitioners interpret the regulations affecting real-time transactions that operate 24/7/365. The document delivered practical advice for managing these transactions under the new rules.

When it comes to the current announcement, the EBA underlined that weaknesses in controls, internal policies, and procedures can lead to legal and reputational risks for financial institutions, including PSPs and CASPs. Also, they can undermine the effectiveness of the EU’s restrictive measures regimes, with the regulator stating that this could cause circumvention of the rules, altering the stability of the EU’s financial landscape. The guidelines include that PSPs and CASPs that conduct fund or crypto transfers are required to pick a reliable screening system that can enable them to comply with their restriction obligations. At the same time, the EBA obliges providers to screen information to manage the risks of entities or individuals violating the EU’s restrictive measures, as well as to administrate the hazards of users potentially circumventing the restrictive procedures by the EU regulators.

Furthermore, the guidelines are based on the European Commission's legislative package from 2021, with the regulator reforming the EU’s Anti-Money Laundering (AML) and Countering the Financing of Terrorism (CFT) framework. The laws were adopted in June 2023 and are set to apply as of 30 December 2024.