47. PSPs, IPSPs, CASPs and ICASPs should determine the risk factors based on those set out in the …

PSPs, IPSPs, CASPs and ICASPs should determine the risk factors based on those set out in the EBA’s ML/TF Risk Factors Guidelines, as well as relevant risk factors from their business -wide risk assessment, and the sectoral or national risk assessment to the extent that this is available. The risk factors should at least include:

• a) transfers that exceed a predefined value threshold taking into account the average value of transfers they routinely process and what constitutes an unusually large trans-fer, based on their particular business model;
• b) transfers where the payer, originator, payee, beneficiary, payer’s PSP, originator’s CASP, payee’s PSP or beneficiary’s CASP are located in countries or territories that are subject to restrictive measures including targeted financial sanctions, or countries or territories that present a high risk of circumvention of restrictive measures or targeted financial sanctions;
• c) transfers where the payer, originator, payee, beneficiary, payer’s PSP, originator’s CASP, payee’s PSP or beneficiary’s CASP are based in a country associated with high ML/TF risk, including, but not limited to:
• i) countries identified as high risk by the European Commission in accordance with Article 9 of Directive (EU) 2015/849; and
• ii) countries which, on the basis of credible sources such as evaluations, mutual evalu-ations, assessment reports or published follow-up reports, have AML/CFT require-ments that are not consistent with Directive (EU) 2015/849 or the FATF Recommen-dations and countries that have not effectively implemented those requirements;
• d) transfers where the payer’s PSP, originator’s CASP, IPSP, ICASP, payee’s PSP or benefi-ciary’s CASP are located in a country that, based on publicly available information, has not yet implemented the obligation to obtain, hold and transmit information on the originator and beneficiary when conducting wire and virtual asset transfers;
• e) transfers with entities based in a third country that does not have licensing regimes or does not regulate PSP activity in the case of funds transfers and CASP activities in the case of crypto-asset transfers;
• f) transfers with self-hosted addresses;
• g) transfers from or to accounts, addresses or wallets known to be linked with suspicious activity;
• h) a negative AML/CFT compliance record of the prior PSP, IPSP, CASP or ICASP in the transfer chain, based on public information;
• i) transfers from a PSP, IPSP, CASP or ICASP identified as repeatedly failing to provide required information without a justified reason, or from a PSP, IPSP, CASP or ICASP that has previously been known to fail to provide required information on a number of oc-casions without good reason, even if it did not repeatedly fail to do so;
• j) use of other techniques to perform layering of transactions that hinders the tracing of crypto-assets by concealing the trail leading back to the originator, including, but not limited to:
• i) funds and crypto-assets received and rapidly transferred further, thus artificially ex-tending the transfer chain;
• ii) anonymity-enhancing techniques, products or services, including, but not limited to, mixers or tumblers, Internet Protocol (IP) anonymisers and stealth addresses.

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Standards

2. Identified Requirements

3. Related Standards

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/