+Risk factors

Risk factors

Product, services and transaction risk factors

21.3. The following factors may contribute to increasing risk :

a) the products or services provided by a CASP offer a higher degree of ano-nymity;

b) the product allows payments from third parties that are neither associated with the product nor identified and verified upfront, where such payments have no apparent economic rationale;
c) the product places no upfront restrictions on the overall volume or value of transactions;
d) the product allows transactions between the customer’s account and:

i. ii. iii. iv. v.

self-hosted crypto-asset provider which that 2015/849; a peer-to-peer decentralised controlled to as platforms ity such hardware vice electronic Directive and

addresses; accounts or distributed ledger addresses managed by of crypto-assets services as defined in Guideline 9.20 or is subject to the AML/CFT regulatory and supervisory regime is less robust than the regime envisaged in Directive (EU) cryptocurrency exchange platform or another type of or distributed crypto-assets application, which is not or influenced by a legal or natural person (often referred ‘decentralised finance’ (DeFi) ); that aim to obfuscate transactions and facilitate anonym-as mixer or tumbler platforms; used to exchange crypto-assets to official currencies or versa (such as crypto-ATMs), that involves the use of cash or money, that benefits from exemptions under Article 12 of (EU) 2015/849 or that does not fall within the regulatory supervisory regime in the EU.

e) products involving new business practices, including new delivery channels, and the use of technologies where the level of the ML/TF risk cannot be re-liably assessed by the CASP in accordance with Guideline 1.7, point (d) due to the lack of information;
f) where the wholesale CASP exercises a weak control over the nested service provided by another CASP;
g) the results of an analysis ran by advanced analytics tools indicate an in-creased level of risk.

21.4. The following factors may contribute to reducing risk:

a) products with reduced functionality, such as low transaction volumes or values;

b) the

product i. ii. iii.

crypto-asset tomer’s a crypto-asset tomer’s other which that which that a bank subject Directive the 2015/849;

allows transactions between the customer’s account and accounts or distributed ledger addresses in the cus-name held by a CASP; account or distributed ledger address in the cus-name, that is held by a provider of crypto-assets services, than a CASP regulated under Regulation (EU) 2023/1114⁶ is regulated outside the EU under the regulatory framework, is as robust as that envisaged in Regulation (EU) 2023/1114and is subject to AML/CTF regulatory and supervisory framework is as robust as the one provided for in Directive (EU) 2015/849; account in the customer’s name at a credit institution that is to AML/CFT regulatory and supervisory framework set out in (EU) 2015/849 or another legislative framework outside EU that is as robust as the one provided for in Directive (EU) or

21 ,

c) the nature and scope of the payment channels or systems used by the CASP is limited to closed-loop systems or systems intended to facilitate micro-pay-ments or government-to-person or person-to-government payments;
d) the product is available only to a limited and defined group of customers, like employees of a company that has issued a crypto-asset;

Customer risk factors

21.5. The following factors may contribute to increasing risk:

a) regarding the nature of the customer in particular:

i. ii. iii. iv.

a non-profit ble or terrorist conduct cases; an undertaking, Directive a company, large a legally

organisation that has been linked, on the basis of relia- and independent sources, to extremism, extremist propaganda sympathies and activities, or has been involved in mis- or criminal activities, including ML/TF or corruption related which is a shell bank, as defined in Article 3(17) of (EU) 2015/849, or another type of shell company; that has been recently established and is processing volumes of transactions; registered company that is processing large volumes of

6 Regulation (EU) 2023/1114 on markets in crypto-assets, and amending Regulations (EU) No 1093/2010 and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/1937

vii.

v. vi.

transactions an undertaking, dertaking(s) (EU) assets; an undertaking with including and a vulnerable cal knowledge nology, ness/knowledge tomer, value used

after a period of inactivity since it was established; which is in a business relationship with another un-within the group as defined in Article 3(15) of Directive 2015/849 that provides products and services related to crypto- or a person who is using an IP address associated a darknet or a software that allows anonymous communication, encrypted emails, anonymous or temporary email services VPNs; person, meaning a person who is not likely to be a typi-customer of a CASP, or a person who displays very little and understanding of crypto-assets or the related tech-which may be evidenced by the results of an appropriate-test or through other engagements with the cus- and who nevertheless chooses to make frequent or high-transactions, may increase the risk that the customer is being as a money mule.

b) Regarding the customer’s behaviour, situations where the customer:

vii.	i. ii. iii. iv. v. vi.	Tries apparent or the the out a) b) c) Uses ers, linked crypto-asset any Provides tomer’s customer, accordance 2023/1113, business tionship the with Is using accounts multiple Frequently ments Frequently from threshold 2023/1113 nator.	to open multiple crypto-asset accounts with the CASP with no economic rationale or business purpose. customer’s beneficial owner is unable or unwilling to provide necessary CDD information, when requested by the CASP, with-any legitimate reason for it, by: deliberately avoiding direct contact with a CASP, either in per-son or remotely; trying to obscure the beneficial owner of the funds through the engagement of agents or associates, such as providers or trust services or corporate services, in the business relationship or transactions; remaining silent or trying to mislead the CASP about the source of funds or the source of crypto-assets used to obtain crypto-assets or the purpose of the transactions. an IP address or mobile device that is linked to multiple custom-without any apparent economic reason, or that is known to be to potentially illegal or criminal activities; or the customer’s account is accessed from multiple IP addresses without evident link to the customer. information that is inconsistent, including when the cus-IP address is inconsistent with other information about the like the information necessary to accompany a transfer in with Article 14(1) and 14(2) of Regulation (EU) or the customer’s habitual residence, registration or activities (both at the time of entry into the business rela- and at the time of the transaction), the information about sources of funds or the source of crypto-assets is inconsistent other CDD information or the customer’s overall profile . an address, a location or an IP address linked to crypto-asset registered to different users held with a single CASP or with CASPs. changes its personal information or its payment instru-without obvious reason. receiving or transferring such amounts of crypto-assets self-hosted addresses, which are just below the EUR 1 000 defined in Article 14(5) and Article 16(2) of Regulation (EU) triggering the verification of the beneficiary or the origi-	23
viii.	ix. x.	Indicates tokens high high paper Displays that which tomer business a) b) c) Displays volve	that the purpose is to invest in an initial public offering of or in a crypto-asset or product that offers a disproportionately return and is based in a high-risk jurisdiction or is associated with fraud-related indications or which is not supported by a white required under the Regulation (EU) 2023/1114⁷ . behaviour or transaction patterns which are not in line with expected from the type of customer or the risk category to it belongs, or is unexpected based on the information the cus-has provided to the CASP, either at the start or throughout the relationship. Such circumstances include the customer: unexpectedly and without obvious reason significantly increas-ing the volume or value of a crypto-asset transfer or combined transfers after a period of dormancy; transacting with an unusually high frequency and volume of crypto-assets, which is inconsistent with the purpose and nature of the business relationship and without an apparent economic purpose; increasing the transaction limit to an extent that is not commen-surate with the customer’s declared income or it otherwise ex-ceeds the expected volume of activity. behaviour and patterns, which are unusual because they in-unexplained transfers to/from distributed ledger addresses or

7 Regulation (EU) 2023/1114 on markets in crypto-assets, and amending Regulations (EU) No 1093/2010 and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/1937.

xii.	xi.	crypto-assets business When the a) b) c) d) e) f) g) h) Is investing peer-to-peer scope ulatory decentralised son	accounts in multiple jurisdictions with no apparent or lawful purpose. exchanging crypto-assets to official currencies and vice versa, customer: uses multiple bank or payment accounts, credit cards or prepaid cards to fund the crypto-assets account; uses a bank or payment account, credit card in the name of a different person than the customer without having evident links to that person; uses a bank or payment account located in a jurisdiction, which is inconsistent with the customer’s given address or location; uses multiple providers of payment services; repeatedly requests an exchange of crypto-assets to or from cash or anonymous electronic money; uses protocols that connect two blockchains, to exchange crypto-assets to other crypto-assets on a different network, such as Monero, Zcash or similar; uses Crypto-ATMs in different locations to repeatedly transfer funds to a bank account; withdraws crypto-assets from a CASP to a self-hosted address immediately after depositing crypto-assets or exchanging for different crypto-assets in a CASP. or exchanging crypto-assets, which it has borrowed via or other lending platform that does not fall within the of Regulation (EU) 2023/1114 or under any other relevant reg-framework within or outside the EU and, which is notably a or distributed application with no legal or natural per-with control or influence over it.	24 a
xiii.		Directly ated	or indirectly receives or sends crypto-assets that are associ-with the darknet or that are the result of illegal activities.
xiv.		Is investing higher which ticular, technology point	or exchanging crypto-assets, which themselves offer degree of anonymity or the customer receives crypto-assets have been subject to anonymity-enhancing activities, in par-processes which obfuscate the transaction on the ledger or contain other characteristics similar to those listed in a) of Guideline 21.5.	a
xv.		Repeatedly a) b) c) d) e) f) g)	receives crypto-assets from or sends crypto-assets to: a crypto-asset account through an intermediary crypto-asset service provider, which does not fall within the scope of Regula-tion (EU) 2023/1114 or under any other relevant regulatory framework within or outside the EU; or which is subject to AML/CTF regulatory and supervisory framework that is less ro-bust than the one provided for in Directive (EU) 2015/849; multiple self-hosted addresses or multiple crypto-asset ac-counts held by the same or different CASPs without an apparent economic rationale for it; a newly created or previously inactive crypto-asset account or distributed ledger address held by a third party; self-hosted addresses on decentralised platforms, which involve the use of mixers, tumblers and other privacy-enhancing tech-nologies that may obfuscate the financial history associated with the distributed ledger address and the source of funds for the transaction, therefore undermining the CASP’s ability to know its customers and implement effective AML/CTF systems and controls; a crypto-asset account shortly after being onboarded by the CASP, which is then followed by a withdrawal or a transfer from such an account in a short period of time without an apparent economic rationale for it; a crypto-asset account frequently below a defined threshold or, in case of transfers to a self-hosted address, below the threshold of EUR 1 000 as defined in Article 14(5) and Article 16(2) of the Regulation (EU) 2023/1113; a crypto-asset account by splitting the transactions into multiple transactions which are sent to multiple distributed ledger ad-dresses by using smurfing techniques.	25 a
xvi.		The their	customer appears to exploit technological glitches or failures to advantage.
xvii.		The have rewards erated	customer explains that the crypto-assets transferred to the CASP been obtained through mining or staking rewards, but these do not appear to be proportionate to the crypto-assets gen-through such activities.

21.6. The following factors may contribute to reducing risk where:

a) the customer has complied with the information requirements provided for in Regulation (EU) 2023/1113 and as further specified in Section 4 of the EBA’s Travel Rule Guidelines⁸ , during previous transactions in crypto-assets and has provided information that enables the identification of a customer or the ability to check it if there is doubt or suspicion;

8 Guidelines on preventing the abuse of funds and certain crypto-assets transfers for money laundering and terrorist financing purposes under Regulation (EU) 2023/1113, […. p lease insert here the number of these GL once adopted', at present under consultation (EBA/CP/2023/35)] (‘The Travel Rule Guidelines’)

b) the customer’s previous transactions in crypto-assets have not given rise to suspicion or concern, and the product or service sought is in line with the customer’s risk profile ;
c) the customer requests an exchange to/from official currency and either the source or destination of funds is the customer’s own bank account with a credit institution in a jurisdiction assessed by the CASP as low risk;
d) the customer requests an exchange and either the source or destination of the crypto- asset is the customer’s own crypto -asset account or a distributed ledger address, which is hosted either by a CASP regulated under Regulation (EU) 2023/1114 or by a provider of crypto-assets services, other than a CASP, regulated under Regulation (EU) 2023/1114, which is regulated and super-vised outside the EU under the regulatory framework that is as robust as that envisaged in Regulation (EU) 2023/1114 and, which is subject to AML/CFT requirements as robust as those envisaged in Directive (EU) 2015/849, that has been whitelisted or otherwise determined by the CASP as low risk;
e) the customer requests an exchange and either the source or destination of the crypto-asset relates to low value payments for goods and services to/from a crypto-asset account or a distributed ledger address on which there is no adverse information available;
f) the customer transfers between two CASPs or a CASP and a crypto-asset service provider, other than a CASP, regulated under Regulation (EU) 2023/1114, which is either subject to regulation and supervision within the EU or is otherwise subject to a regulatory framework that is as robust as that envisaged in Regulation (EU) 2023/1114 and, which is subject to AML/CFT requirements as robust as those envisaged in Directive (EU) 2015/849.

Country or geographical risk factors

21.7. The following factors may contribute to increasing risk:

a) T he customer’s funds that are exchanged to crypto -assets are derived from personal or business relationships involving jurisdictions associated with higher ML/TF risk.
b) The originating or the beneficiary crypto-asset account or a distributed ledger address is linked to a jurisdiction associated with higher ML/TF risk or jurisdictions/regions known to provide funding or support for terrorist activ-

ities or where groups committing terrorist offences are known to be operat-ing, and jurisdictions subject to financial sanctions, embargoes or measures that are related to terrorism, financing of terrorism or proliferation.

c) The customer or the customer’s beneficial owner is a resident, is established, operates in or has personal or business relationships involving a jurisdiction associated with an increased ML or TF risk.
d) The business relationship is established through a CASP or a crypto-ATM, which is located in a region or a jurisdiction that is associated with high levels of the ML/TF risk.
e) The customer is involved in crypto-asset mining operations, either directly or indirectly through relationships with third parties, that take place in a high-risk jurisdiction, identified by the European Commission in accordance with Article 9 of Directive (EU) 2015/849, or in a jurisdiction that is subject to restrictive measures or targeted financial sanctions.

21.8. The factor that may contribute to reducing risk:

a) where the transfer comes from or is sent to a crypto-asset account or a dis-tributed ledger address that is hosted by a CASP or a crypto-assets services provider other than a CASP, regulated under Regulation (EU) 2023/1114, in a jurisdiction associated with low levels of the ML/TF risk.

Distribution channel risk factors

21.9. The following factors may contribute to increasing risk:

a) The business relationship is established by using remote customer on-board-ing solutions that are not compliant with the EBA’s Guidelines on Remote Customer Onboarding⁹ .
b) There are no restrictions on the funding instrument, for example in the case of cash, cheques or electronic money products that benefit from the exemp-tion under Article 12 of Directive (EU) 2015/849.
c) The business relationship between the CASP and the customer is established through an intermediary crypto-assets service provider defined in Guideline 9.20 above.

9 EBA’s Guidelines on the use of Remote Customer Onboarding Solutions under Article 13(1) of Directive (EU) 2015/849 (EBA/GL/2022/15).

d) The identification and verification of a customer is carried out by a crypto-assets service provider located in a high-risk jurisdiction on the basis of an outsourcing agreement, in accordance with Article 29 of Directive (EU) 2015/849.
e) New distribution channels or new technology used to distribute crypto-as-sets, that have not yet been fully tested or that present an increased level of ML/TF risk.
f) The business relationship is established via crypto-ATMs, which increases risk due to the use of cash.

21.10. The factor that may contribute to reducing risk :

a) Where the CASP places reliance on CDD measures applied by a third party in accordance with Article 26 of Directive (EU) 2015/849 and where that third party is located in the EU.

1. Overview

Summary	Regulation

1.1 References

1.2 Identified Requirements

1.3 Related Standards

2. Identified Requirements

Requirements
Source	Requirement

3. Related Standards

Standards
Source	Requirement

EBA - Published by the European Banking Authority at https://www.eba.europa.eu/