86. Where the CASP is fully satisfied that the self-hosted address is owned or controlled by its …

Where the CASP is fully satisfied that the self-hosted address is owned or controlled by its customer, the CASP should document this in its systems and may not need to re-apply the measures above to subsequent transactions from/to the same address ( ‘ whitelisting ’ ). A CASP making use of whitelisting should have controls in place to identify changes in the ML/TF risk of the self-hosted address and its ownership or controllership. Should the CASP establish that the ML/TF risk of the self-hosted address has changed or that there are indications that its customer no longer owns or controls the self-hosted address, it should remove this address from its whitelist.

4.8.5. Mitigating measures to put in place regarding transfers from or to a self-hosted address

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Standards

2. Identified Requirements

3. Related Standards

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/