4.8. Transfers of crypto-assets made from or to self-hosted ad-dresses in accordance with Articles 14(5) and 16(2) of Regula-tion (EU) 2023/1113

CASPs and ICASPs should consider a transfer of a crypto-asset as individually identified when:

• a) a unique identifier for each transfer is used, such as a transfer hash or a reference num-ber; or
• b) additional information is included in the transfer to help identify the transfer.

4.8.2. Identification of a transfer from or to a self-hosted address

To determine whether or not a self-hosted address is used on the other end of a transfer, the originator’s CASP and the beneficiary’s CASP should rely on available technical means including but not limited to blockchain analytics, third-party data providers and identifiers used by mes-saging systems.

If such information cannot be retrieved via technical means, the originator’s CASP and the beneficiary ’s CASP should obtain that information directly from its customer. Where, in this case, the originator’s CASP and the beneficiary’s CASP establish that the transfer is made to or from another CASP, the originator’s CASP and the beneficiary’s CASP should take the necessary steps to accurately identify the counterparty CASP.

The originator’s CASP should do this assessment before the transfer is initiated and the infor-mation transmitted in accordance with Article 14(5) of Regulation (EU) 2023/1113; the bene-ficiary ’s CASP should do this assessment before the crypto-assets are made available to the beneficiary in accordance with Article 16(2) of that Regulation.

4.8.3. Identification of the originator and beneficiary in a transfer from or to a self-hosted address

Where a self-hosted address is used on the other end of the transfer, CASPs should collect the information on the originator or beneficiary from their customer.

4.8.4. Transfers above EUR 1 000 and proof of ownership or controllership of a self-hosted address

CASPs should determine whether a transfer involving a self-hosted address amounts to or ex-ceeds EUR 1 000:

• a) at the moment the transfer was ordered or initiated , in the case of the originator’s CASP; or
• b) at the time of the receipt, in the case of the beneficiary’s CASP.

To determine whether the value of transfers from or to self-hosted addresses is above EUR 1 000, the CASPs should use the exchange rate of the crypto-asset being transferred to deter-mine its value in euros at the time of the transfer, and regardless of any transaction fees.

In order to assess whether the self-hosted address is owned or controlled by the originator or beneficiary, respectively, CASPs should use at least one of the following verification methods:

• a) unattended verifications as specified in the Guidelines on the use of Remote Customer Onboarding Solutions under Article 13(1) of Directive (EU) 2015/849⁹ displaying the ad-dress;
• b) attended verification as specified in the Guidelines on the use of Remote Customer Onboarding Solutions under Article 13(1) of Directive (EU) 2015/849;
• c) sending of a predefined amount (preferably the smallest denomination of a given crypto-asset), set by the CASP, from and to the self- hosted address to the CASP’s ac-count;
• d) requesting the customer to digitally sign a specific message into the account and wallet software with the key corresponding to that address;
• e) other suitable technical means as long as they allow for reliable and secure assessment and the CASP is fully satisfied that it knows who owns or controls the address.

⁹ EBA/GL/2022/15.

The decision on which method(s) to choose should depend on:

• a) the technical capabilities of the self-hosted address;
• b) the robustness of the assessment each method can deliver; and
• c) the ML/TF risk.

Where one method on its own is not sufficiently reliable to reasonably ascertain the ownership or controllership of a self-hosted address, the CASP should use a combination of methods.

Where the CASP is fully satisfied that the self-hosted address is owned or controlled by its customer, the CASP should document this in its systems and may not need to re-apply the measures above to subsequent transactions from/to the same address ( ‘ whitelisting ’ ). A CASP making use of whitelisting should have controls in place to identify changes in the ML/TF risk of the self-hosted address and its ownership or controllership. Should the CASP establish that the ML/TF risk of the self-hosted address has changed or that there are indications that its customer no longer owns or controls the self-hosted address, it should remove this address from its whitelist.

4.8.5. Mitigating measures to put in place regarding transfers from or to a self-hosted address

CASPs should assess the risk associated with transfers from or to a self-hosted address as set out in Section 4.5.3. and in accordance with t he EBA’s ML/TF Risk Factors Guidelines, using all information related to originators and beneficiaries, patterns and geographies, and infor-mation from regulators, law enforcement and third parties.

CASPs should apply at least one of the risk-mitigating measures as identified in Article 19a(1) of Directive (EU) 2015/849 that are commensurate with the risks identified including where the CASP:

• a) is or becomes aware that the information on the originator or beneficiary using the self-hosted address is inaccurate; or
• b) encounters unusual or suspicious patterns of transactions or situations of higher ML/TF risk associated with transfers involving self-hosted addresses, in accordance with the EBA’s ML/TF Risk Factors Guidelines .

Where, as a result of the assessment in Section 4.8.4., it is established that the self-hosted address is owned or controlled by a third person instead of the CASP ’s customer, the verifica-tion referred to in Article 19a(1), point (a), of Directive (EU) 2015/849 can be deemed to have taken place if:

• a) the CASP collects additional data from other sources to verify the submitted infor-mation, including but not limited to blockchain analytical data, third-party data, recog-nised authorities’ data and publicly available information, as long as these are reliable and independent.
• b) the CASP uses other suitable means as long as the CASP is fully satisfied that it knows the identity of the originator or beneficiary and can demonstrate this to its competent authority.

Where such transfers raise suspicions of ML/TF, CASPs should report to the FIU in accordance with Directive (EU) 2015/849.