EU extends AML contact rules to crypto

TLDR

The European Union has moved to extend its anti-money laundering central contact person rules to crypto service providers, aligning them with traditional payment and e-money firms.

1. The European Commission adopted a delegated act that requires many crypto firms serving EU customers to appoint a local AML contact person once certain activity thresholds are met.
2. The measure tightens oversight of cross-border exchanges and platforms, especially those operating mainly online, and increases operational and compliance costs for crypto businesses.
3. The act still needs European Parliament and Council scrutiny before it becomes binding, so firms have a short window to prepare governance, staffing and reporting structures.

Deep Dive

1. What Changed In EU AML Rules

According to a recent European Commission delegated act, the EU has extended the "central contact" requirement to crypto asset service providers.

This rule was previously applied only to electronic money issuers and payment institutions. It now captures exchanges and similar platforms operating across EU borders, requiring them to designate a local representative who interfaces with national regulators on anti-money laundering (AML) and counter-terrorist financing (CTF) compliance.

The legal basis is Article 45 of the EU AML framework, updated after AML rules were broadened in 2023 to formally include digital asset providers.

2. How It Impacts Crypto Firms

The framework introduces a dual trigger for appointing a central contact person:

1. A firm must appoint a local representative when its cumulative annual activity in a host EU country exceeds about 3 million euros.
2. Supervisors can demand a representative even below this threshold if they believe money laundering or terrorist financing risk is elevated.

The definition of "establishment" is widened to cover firms that serve customers mainly online with limited or no physical presence. In practice, this means:

• Non-EU exchanges and wallets targeting EU users may need an in-country compliance contact.
• Crypto businesses must formalize AML governance, reporting and liaison processes similar to banks and payment providers.

3. Timeline And What To Watch Next

The delegated act is not yet binding law. It must pass scrutiny by the European Parliament and the Council, then be published in the Official Journal.

Once published, the rules become directly applicable across all member states after 20 days, with no need for separate national legislation. Key things to monitor:

1. Whether Parliament or Council seek amendments that raise or lower the thresholds or narrow the scope.
2. How national regulators interpret "online establishment", especially for non-EU platforms.
3. How this interacts with MiCA licensing, for example whether MiCA-authorized firms leverage the same contacts for both prudential and AML supervision.

Conclusion

The EU is tightening the link between crypto and traditional financial regulation by requiring crypto firms to appoint local AML contacts once they cross modest activity thresholds. This increases accountability and oversight for platforms serving EU users, but raises compliance demands, especially for offshore or primarily online providers. Crypto businesses that plan to serve the EU at scale will need to treat AML and local regulatory engagement as core infrastructure rather than an add-on.