Guide
EU AML rules for crypto: what applies now, and what applies in 2027
Updated
The EU is mid-transition. Getting the dates right matters more than getting the detail right, because a policy written to the wrong instrument is wrong twice.
Today: a directive, transposed nationally
The operative AML law for a crypto-asset service provider today is its member state's transposition of Directive (EU) 2015/849. Because it is a directive, the detail differs between member states, which is precisely the problem the 2024 package was written to solve. Regulation (EU) 2023/1113 amended the directive to make MiCA crypto-asset service providers obliged entities.
MiCA layers its own duty on top. Article 68(8) of Regulation (EU) 2023/1114 requires crypto-asset service providers to have mechanisms, systems and procedures, and effective arrangements for risk assessment, to comply with national law transposing Directive (EU) 2015/849, and to monitor and regularly evaluate whether they are adequate and effective. Article 62(2)(i) makes the same control framework part of the authorisation application, and Article 63(6) lets the authority consult AML authorities and financial intelligence units before granting it.
The travel rule, in force since December 2024
Regulation (EU) 2023/1113 has applied since 30 December 2024 and carries no value threshold for crypto-asset transfers. Our travel rule guide sets out the data fields, the verification duty and the EUR 1,000 self-hosted address check.
From 10 July 2027: the single rulebook
- Regulation (EU) 2024/1624 (AMLR)
- The directly applicable single rulebook. It applies from 10 July 2027, except for professional football agents and clubs, to which it applies from 10 July 2029. Article 79 prohibits crypto-asset service providers from keeping anonymous crypto-asset accounts, or any account allowing anonymisation or increased obfuscation of transactions, including through anonymity-enhancing coins.
- Directive (EU) 2024/1640 (AMLD6)
- The institutional directive covering supervisors, registers and FIUs. Member states must transpose it by 10 July 2027, with Article 74 by 10 July 2025, Articles 11, 12, 13 and 15 by 10 July 2026, and Article 18 by 10 July 2029.
- Regulation (EU) 2024/1620 (AMLA)
- Establishes the Authority for Anti-Money Laundering and Countering the Financing of Terrorism, which will directly supervise selected obliged entities and issue technical standards under the package.
What that means for a policy written today
- Write to the national law, cite the source. Until 10 July 2027 your obligations come from your member state's transposition, not from the AMLR directly.
- Do not backdate the AMLR. Requirements that only apply from 10 July 2027 should be flagged as forthcoming in the policy, not asserted as current law.
- Treat the travel rule as live. Regulation (EU) 2023/1113 is directly applicable and has been since 30 December 2024.
- Diarise the anonymity prohibition. If any part of the product tolerates anonymising instruments or privacy coins, Article 79 of the AMLR closes that on 10 July 2027.
Because national transposition varies, an AML policy for an EU CASP should be reviewed by someone qualified in the member state that supervises you. A pan-European template is a starting point, not a compliant policy.