+Measures

Measures

21.11. CASPs should ensure that the systems they use to identify and tackle ML/TF risks comply with the criteria set out in Title I of these Guidelines. In particular, due to their business models, CASPs should ensure that they have suitable and effective monitoring tools in place, including transaction monitoring tools and advanced analytics tools. The extent of such tools is determined by the nature and volume of the CASP’s activities, including the type of crypto-assets made available for trading or exchange. CASPs should also en-sure that relevant employees receive specialised training to have a good understanding of crypto-assets and ML/TF risks to which they may expose the CASP.

Enhanced customer due diligence

21.12. Where the risk associated with a business relationship or occasional transaction is in-creased, CASPs have to apply enhanced CDD measures pursuant to Article 18 of Di-rective (EU) 2015/849 and as set out in Title I of these Guidelines. In addition, CASPs should apply relevant enhanced CDD measures enumerated in the list below, as neces-sary, depending on the risk exposure of the business relationship:

  • a) V erify the customer’s and the beneficial owner’s identity on the basis of more than one reliable and independent source.
  • b) Identify and verify the identity of majority shareholders that do not meet the definition of beneficial owners in accordance with Article 3 of Directive (EU) 2015/849 or any natural persons who have authority to operate a crypto-asset account or distributed ledger address on behalf of the customer or give
29

instructions on the transfer or exchange of crypto-assets or other services relating to those crypto-assets.

  • c) Obtain more information about the customer and the nature and purpose of the business relationship to build a more complete customer profile, for example by carrying out open source or adverse media searches or commis-sioning a third-party intelligence report. Examples of the type of information CASPs may seek include:
i. ii. iii. iv. v. vi.the nature of the customer’s business or employment; the source of the cust omer’s wealth and the source of the cus-tomer’s funds that are exchanged for crypto-assets to be reasonably satisfied that these are legitimate; the source of the customer’s crypto-assets that are being exchanged for official currencies, including when and where they were pur-chased; the purpose of the transaction, including, where appropriate, the destination of the crypto-asset transfer; information on any associations the customer might have with other jurisdictions (headquarters, operating facilities, branches, etc.) or in-dividuals who are known to exercise a significant influence on the customer’s operations; to request or obtain data about the customer’s crypto-asset transac-tions and, where the customer is a CASP, its trading history from within the CASP’s system .
  • d) Obtain evidence about the source of funds, the source of wealth or the source of crypto-assets in respect of those transactions that present a higher risk.
  • e) Increase the frequency of monitoring crypto-asset transactions. All transac-tions should be monitored for unexpected behaviours, patterns and indica-tors of suspicious activity and should also include consideration of the par-ties with which the customer is transacting.
  • f) Review and, where necessary, update information, data and documentation held more frequently and, in particular, in the case of a trigger event.
  • g) Where the risk associated with the relationship is particularly high, CASPs should review the business relationship more regularly.
  • h) Assess more frequently or in more depth the activities performed through the customer ’ s crypto-asset accounts by using crypto-assets investigation
30

tools.

  • i) Where a customer has multiple distributed ledger addresses or blockchain networks, the CASP should link these addresses to the customer.
  • j) Increase the frequency of monitoring of the customer’s IP addresses and checking them against the IP addresses used by other customers.
  • k) O btain confirmation about the customer’s level of knowledge and under-standing of crypto-assets to achieve a level of assurance that the customer is not used as a money mule.
  • l) Where a pattern of withdrawals or redemptions is not in line with the cus-tomer’s profile or the nature and purpose of the business relationship, the CASP should add additional measures to ensure that a withdrawal or re-demption is requested by the customer and not by a third party. This is par-ticularly relevant for high-risk or elderly or more vulnerable customers.
  • m) Obtain confirmation that a self-hosted address, from which a transfer is re-ceived, is under the control or ownership of the CASP’s customer.

21.13. CASPs should apply advanced analytics tools to transactions on a risk-sensitive basis, as a supplement to the standard transaction monitoring tools. CASPs should apply ad-vanced analytics tools to assess the risk associated with transactions, particularly trans-actions involving self-hosted addresses, as it allows the CASP to trace the history of transactions and to identify potential links with criminal activities, persons or entities.

21.14. In respect of business relationships or transactions involving high-risk non-EU countries, CASPs should follow the guidance in Title I of these Guidelines.

Simplified customer due diligence

21.15. In low-risk situations, which have been classified as such as a result of the ML/TF risk assessment carried out by the CASP in keeping with these Guidelines, and to the extent permitted by national legislation, CASPs may apply SDD measures, which may include:

  • a) for customers subject to a statutory licensing and regulatory regime in the EU or in a non-EU country, verifying identity based on evidence of the cus-tomer being subject to that regime, for example through a search of the reg-ulator’s public register;
  • b) updating CDD information, data or documentation only if there are specific trigger events, such as the customer requesting a new or higher risk product, or changes in the customer’s behaviour or transaction profile that suggest
31

that the risk associated with the relationship is no longer low, while observ-ing any update periods set out in the national legislation;

  • c) lowering the frequency of transaction monitoring for products involving re-curring transactions.

Record keeping

21.16. Where the information on customers and transactions is available on the distributed ledger, CASPs should not place reliance on the distributed ledger for recordkeeping but should take steps to fulfil their recordkeeping responsibilities in accordance with Di-rective (EU) 2015/849 and Guidelines 5.1 and 5.2 above. CASPs should put in place pro-cedures that allow them to associate the distributed ledger address to a private key controlled by a natural or legal person.

32

1. Overview

,

1.1 References

1.2 Identified Requirements

1.3 Related Standards

2. Identified Requirements

Requirements

3. Related Standards

Standards
  • EBA - Published by the European Banking Authority at https://www.eba.europa.eu/