What AML/CFT obligations apply to crypto-asset service providers?

Crypto-assets can be moved quickly across borders and through many addresses, which makes them attractive for laundering money and financing terrorism. The AML/CFT Law therefore treats CASPs as obliged entities. Since Law 96(I)/2025 a CASP is defined as in MiCA (a firm whose only service is advice on crypto-assets is not covered) and counts as a financial organisation under the Law, and CySEC supervises CASPs for AML/CFT purposes.

Being an obliged entity means the whole AML/CFT framework applies, exactly as for a bank or an investment firm: a firm-wide risk assessment and proportionate measures for each client, activity and crypto-asset; customer due diligence, with enhanced measures for higher risk; identifying beneficial owners; building an economic profile and establishing the source of clients' funds; ongoing monitoring of transactions; reporting suspicious transactions to MOKAS; keeping records; appointing a compliance officer and training staff. The purpose is preventing money laundering and terrorist financing, not protecting investors from price swings.

Due diligence applies when a business relationship starts, whenever there is a suspicion, when there are doubts about identification data obtained earlier, and for occasional transactions of €1,000 or more, whether carried out in one operation or in several that appear to be linked.

Since 30 December 2024, Regulation (EU) 2023/1113 has required CASPs to send information on the originator and the beneficiary with every transfer of crypto-assets, and to check that the information arrives with the transfers they receive. There is no minimum amount: the rule applies whenever a CASP is involved. CySEC has told CASPs to follow the EBA's travel rule guidelines, which apply from the same date.

Transfers to or from self-hosted addresses, meaning wallets not held with a CASP, need extra care. The CASP collects the information about the transfer, assesses the risks and, for transfers above €1,000 involving its own client, takes adequate measures to assess whether the self-hosted address is owned or controlled by that client. Cyprus law also requires CASPs to have policies to identify and manage the risks of such transfers, and CySEC can sanction repeated failures to send the required information.

In 2021 CySEC issued Policy Statement PS-01-2021 on the registration and operations of CASPs. It explained the national rules that applied to them: the AML/CFT Law, CySEC's Directive for the register of CASPs and CySEC's AML/CFT Directive, and it included CySEC's early guidance on sending information with crypto-asset transfers.

The statement describes a regime that ended when MiCA's transitional period finished on 1 July 2026, and its travel rule guidance has been replaced by the EU regulation. The AML/CFT duties themselves continue for CASPs authorised under MiCA, as updated by Law 96(I)/2025 and the EU travel rule.