30. The following Guidelines 9.20 and 9.21 are inserted: ‘9.20 When entering into a business …

The following Guidelines 9.20 and 9.21 are inserted:

‘9.20 When entering into a business relationship with a customer who is a provider of crypto-assets services, other than a CASP regulated under Regulation (EU) 2023/1114⁵ , banks may be exposed to increased risk of ML/TF. The risk may be reduced in circumstances where such a provider is regulated and supervised under a regulatory framework similar to that set out in Regulation (EU) 2023/1114 or Directive (EU) 2015/849. Banks should carry out the ML/TF risk assessment of these customers prior to establishing a business relationship with them. As part of this, banks should also consider the ML/TF risk associated with the specific type of crypto-assets that are provided or serviced by these providers. ’

‘ 9.21 To ensure that the level of ML/TF risk associated with customers described in Guideline 9.20 is mitigated, banks, as part of their CDD measures, should at least:

5 Regulation (EU) 2023/1114 on markets in crypto-assets, and amending Regulations (EU) No 1093/2010 and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/1937. 18

• a) enter into a dialogue with the customer to understand the nature of the business and the ML/TF risks to which it is exposed;
• b) in addition to verifying the identity of the customer’s beneficial owners, carry out due diligence on senior management to the extent that they are different, includ-ing consideration of any adverse information;
• c) understand the extent to which these customers apply their own CDD measures to their clients either under a legal obligation or on a voluntary basis;
• d) determine whether the customer is registered or licensed in an EU/EEA Member State or a non-EU country, and, in the case of a non-EU country, take a view on the adequacy of that non-EU country’s AML/CFT regulatory and supervisory re-gime in accordance with Guideline 2.11;
• e) determine whether the services provided by the customer fall within the scope of the registration or licence of the customer;
• f) determine whether the customer is providing services other than for which it is registered or licensed as a credit or financial institution;
• g) where the customer’s business involves issuing crypto -assets to raise funds, such as Initial Coin Offerings, banks should determine whether such business is per-formed in compliance with existing legal requirements and, where applicable, whether it is regulated for AML/CFT purposes according to internationally agreed standards, such as standards published by the Financial Action Task Force.’

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Standards

2. Identified Requirements

3. Related Standards

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/