EBA issues guidance on “travel rules”.

The guidelines specify what information should accompany a transfer of funds or crypto assets and also list the steps that payment service providers (PSPs), intermediary PSPs (IPSPs), crypto asset service providers (CASPs) and intermediary CASPs should take (ICASPs) companies should identify missing or incomplete information and what they should do if required information is missing during a fund transfer or crypto asset transfer.

The aim is to establish a consistent and effective approach to the implementation of travel rules across the EU, allowing competent authorities to fully trace such transfers when necessary to prevent, detect or investigate money laundering and terrorist financing.

background
In June 2023, Regulation (EU) 2023/1113 came into force. The Regulation recasts Regulation (EU) 2015/847 and aligns the EU legal framework with the Financial Action Task Force (FATF) standards by extending the obligation to provide information on the originator and beneficiary to CASPs – the so-called “travel rule”. It also amends Directive (EU) 2015/849 to subject CASPs authorized under Regulation (EU) 2023/1114 to the same AML/CFT requirements and supervision as credit and financial institutions.

The deadline for reporting by the competent authorities on compliance with the guidelines is two months after the publication of the translations into the official EU languages. The changed guidelines are effective from December 30, 2024.

The EBA also published guidance for risk-based AML/CFT supervisors of crypto-asset service providers (CASPs) and guidance for crypto-asset service providers on how to effectively manage their exposure to ML/TF risks. She is currently completing work on guidance for internal policies, procedures and controls to comply with restrictive measures applicable to CASPs and other financial institutions.

Legal basis
Article 36 (first and second subparagraphs) of Regulation (EU) 2023/1113 and Article 19a(2) of Directive (EU) 2015/849 mandate the EBA to issue guidance to competent authorities, payment service providers and CASPs on: (a) the Measures by these providers should comply with certain articles of Regulation (EU) 2023/1113; (b) the technical aspects of the application of this Regulation to direct debits; and (c) the measures, including the criteria and means, for identifying and verifying the identity of the sender or recipient of a transmission to or from a self-hosted address.

These guidelines establish, with effect from 30 December 2024, the “Common guidelines referred to in Article 25 of Regulation (EU) 2015/847 on the measures that payment service providers should take to detect missing or incomplete payer or payee information and on the procedures they should take.