The European anti-money laundering agreement for crypto assets reinforces due diligence

On January 18, 2024, the Council of the European Union and the European Parliament reached a provisional agreement on central pieces of the new anti-money laundering package. The European anti-money laundering agreement for crypto assets brought most of the sector into a common code and strengthened diligence on customers and cross-border relationships.

What happened

The negotiators agreed on the political content of the single normative code regulation and a new directive. The package aimed to harmonize obligations that until then depended largely on national transposition and close differences that could be exploited by cross-border structures.

Crypto asset service providers, or CASPs, would be among the obligated entities. They had to apply due diligence to their clients and reinforced controls in certain cross-border correspondent relationships. The agreement also included measures on operations with self-custodied portfolios according to risk.

The news was not yet the final adoption. The text needed formal approval by Parliament and Council, legal review and publication. In January it had to be described as a provisional agreement, although normally this type of pact anticipates the final content.

Legal and regulatory keys

The regulation sought a set of rules directly applicable in the EU, while the directive organized national mechanisms and powers of authorities. Added to this was the creation of the European Authority against Money Laundering and the Financing of Terrorism, known as AMLA.

For CASPs, the package complemented MiCA and the reporting standards accompanying transfers. MiCA regulates authorization, governance and conduct; The AML framework focuses on identity, beneficial ownership, purpose, surveillance and reporting of suspicions.

The treatment of self-custodied portfolios required precision. The EU did not agree on a general prohibition on a person controlling their passwords. Regulated providers were required to assess and mitigate risk when interacting with these directorates, applying information and controls as appropriate.

Cross-border relationships received attention because a CASP may depend on another provider in a third country for transfers or liquidity. Knowing your oversight, controls, and geographic exposure helps prevent a chain of intermediaries from hiding the originator and beneficial owner.

Why it was relevant for the sector

Harmonization reduced the possibility of choosing a Member State solely because of less demanding controls. A MiCA license allows you to provide services in the EU, but the provider must also apply a consistent AML standard and be accountable to its authority.

For companies, the agreement anticipated investments in identity systems, operations analysis, documentation and responsible personnel. The integration had to be done before the application, because adapting databases and alert rules cannot be improvised at the end of the period.

For customers, the framework meant more comparable requests across platforms, although not identical in each case. The risk-based approach allows for enhanced controls where concrete signals exist and requires avoiding automatic, unfounded discrimination.

Outlook from 2026

Parliament approved the package in April 2024 and the Council completed the adoption on 30 May. The single code regulation was published as Regulation (EU) 2024/1624, along with the directive and standard that created AMLA. The provisional agreement thus became formal legislation.

However, the core of the regulation will begin to apply on July 10, 2027. In August 2026, companies already know the text and must prepare systems, but it is not correct to say that all its provisions have been in force since January 2024. The journey – agreement, adoption, publication and deferred application – shows why each legislative phase must be dated separately.