Unveiling the new ‘Travel Rule Guidelines’: EBA’s Blueprint to Combat the Abuse of Crypto-Assets Transfers for Money Laundering

What do the Guidelines mean for impacted entities?

1. Criteria to identify transfers carried out exclusively for the payment of goods and services.
   

2. Common standards for seamless transmission of data that accompanies the transfer.

   The Guidelines define the information PSPs and CASPs should include in relevant fields in the systems when transferring crypto-assets and funds. They also set out the steps CASPs and ICASPs should take if the full information cannot be transmitted due to technical limitations.

   The draft Guidelines allow a transitional period of up to 31 July 2025 for CASPs and ICASPs to adjust the systems. The same transitional period is not foreseen for PSPs as the requirements that apply to them in Regulation (EU) 2023/1113 (‘The Regulation’) remain the same.
   
   

3. Requirements for the information that should be transmitted with the transfer.

   The Regulation outlines the information to be transmitted but lacks detailed specifications, leading to varying interpretations among different PSPs and CASPs. This variability increases the risk of unnecessary rejection of transfers even when all necessary information is provided.

   To address this, the draft Guidelines set out common standards for information to be transmitted with the transfer.
   
   

4. Process of detecting and dealing with transfers with missing or incomplete information.

   Risk-based procedures should be used when determining whether to execute, reject or suspend a transfer. The entities should consider the ML/TF risk associated with that transfer before deciding on the appropriate course of action.
   
   
   

5. Details on the steps to be taken, with respect to self-hosted addresses.

   The Guidelines cover the actions for CASPs to comply with the following requirements:

   1. obtain and hold the information on the self-hosted address,
   2. ensure that the transfer of crypto-assets can be individually identified, and
   3. assess whether that address is owned or controlled by the CASP customer where the transfer amount exceeds EUR 1,000
      
      

6. The obligations on the payer’s PSP, payee’s PSP and IPSPs where a transfer is a direct debit.

   Direct debits are payment instructions sent by the PSP of the payee to the payer’s PSP. Unlike a credit transfer, which is initiated by the payer, a direct debit is a transaction initiated by the payee. This means that the payee’s PSP holds the information that the payer’s PSP would need to comply with their obligations.

   As a result, in the direct debit context, the payer’s PSP may not be able to comply with the requirements of the Regulation if it does not have the required information. These Guidelines have outlined the actions for direct debit providers to make sure they are compliant with the Regulation.