Fund transfers, crypto-assets and AML/CTF – the European Banking Authority’s take on the ‘Travel Rule’

The FTR does not apply to the transfer of funds or transfer of electronic money tokens carried out using a payment card, an electronic money instrument, a mobile phone or any other digital or IT prepaid or postpaid device with similar characteristics used exclusively for the payment of goods and services. It may be difficult to determine whether a card, instrument or device is used exclusively for this purpose and any such assessment may lead to divergent outcomes. 

For this reason, EBA now proposes that PSPs and CASPs should (a) identify the use of any merchant categorisation codes that are used to categorise the type of goods or services sold, (b) determine whether the payer or payee is engaged in an economic or professional activity and (c) analyse, where available, trends and behaviours, including transfer history and patterns to determine whether the payer makes payments for goods or services, or the payee receives payments for goods or services.

The FTR stipulates high-level requirements for data points that need to be submitted with a transfer of funds. The EBA require that PSPs and CASPs should use secure infrastructures and services for the transmission and reception of information, fully capable of transmitting and receiving the information required under the FTR. These infrastructures should be inter-operable, which is still an issue for CASPs. Traditionally, PSPs generally rely on SWIFT for complying with the Travel Rule for funds.

However, there is no similar infrastructure in place for crypto-assets, where transfers are processed on a decentralised basis The EBA Guidelines provide for broad discretion how a solution may be implemented, including a transfer on the blockchain itself (where the smart contract permits to transfer this information), or independently via direct communication between CASPs. Market-wide solutions are still to be developed. Therefore, the EBA permits that infrastructure that is not fully capable of transmitting required information and require additional technical solutions can be used by CASPs until 31 July 2025.

Self-hosted wallets are wallets where the owner has complete control over their private key. They are used in the context of P2P crypto transactions. According to the FATF, they can be used to avoid AML/CFT controls, and therefore pose specific ML/TF risks. The FTR addresses these risks with respect to transfers of crypto-assets to or from a self-hosted address, as long as there is one CASP involved. 

The FTR requires CASPs to (a) obtain and hold the information on the self-hosted address, (b) ensure that the transfer of crypto-assets can be individually identified, and (c) assess whether that address is owned or controlled by the CASP customer where the transfer amount exceeds EUR 1,000. 

To address the practical challenges arising from the application of these requirements, the draft Guidelines provide details on the steps to be taken, to identify, among others, a transfer from or to self-hosted addresses and to identify the originator and beneficiary. Most notably, CASPs will be able to rely to a large extent on blockchain analytics and third-party service provider to identify self-hosted addresses and the identity of originator and beneficiary. To the extent that the transferred amount from or to a self-hosted address exceeds EUR 1,000.00, however, more sophisticated technical measures must be used to verify that the controller of the self-hosted address is similar to the CASP’s client. If that is not the case, mitigating measures must be applied, including enhanced due diligence measures if the risk associated with that transfer is considered to be high. 

Direct debits are payment instructions sent by the PSP of the payee to the payer’s PSP. Unlike a credit transfer, which is initiated by the payer, a direct debit is a transaction initiated by the payee. This means that the payee’s PSP holds the information that the payer’s PSP would need to comply with their obligations. As a result, in the direct debit context, the payer’s PSP may not be able to fulfil the requirements set out in the FTR. 

EBA therefore clarifies that the PSP of the payee should send the required information on the payee to the PSP of the payer at the time when the direct debit mandate is established or modified