A market inside the European framework
MiCA governs crypto-asset issuance and crypto-asset service providers. The Transfer of Funds Regulation extends traceability requirements to crypto-asset transfers. AML/CFT controls remain an essential part of the control framework.
Two separate questions: MiCA identifies the issuer or provider and regulated service; TFR addresses the information accompanying an in-scope transfer. Neither question establishes the lawful origin of funds by itself.
Risk does not become uniform
Product, customer, access channel, geography, blockchain exposure and interaction with self-hosted wallets can create very different risk profiles. Authorisation does not make every activity automatically low risk. The EBA Travel Rule Guidelines have applied since 30 December 2024 and specify how to identify missing or incomplete information and manage in-scope funds or crypto-asset transfers under Regulation (EU) 2023/1113.
Connected controls
Proposed control design: connect KYC and transfer data, originator and beneficiary information, screening, on-chain indicators and escalation. For a self-hosted address, the TFR distinguishes transfer identification, originator/beneficiary information and, where the amount exceeds EUR 1,000, adequate measures to assess whether the address is owned or controlled by the originator or beneficiary, according to the direction of the transfer (Articles 14(5) and 16(2) of Regulation (EU) 2023/1113). The operational point is to record which requirement was triggered, which method supported verification and which limitation remains unresolved, without treating self-hosting as automatic suspicion.
Practical scenario
A customer transfers crypto to a self-hosted address after receiving assets from multiple counterparties. On-chain data alone does not explain the risk: customer, wallet, source, counterparty, geography, purpose and available Travel Rule information need to be connected.
Useful check: separate service risk, customer risk and the risk of the specific activity; then identify which evidence supports each assessment.
Three questions before the technology
Which entity and service are being assessed? Which behaviour needs to be understood? Which data is actually needed to explain the transfer? Only then does it make sense to decide which on-chain indicators, KYC data and transaction controls are relevant.
Sources and references
Informational content. It does not replace an assessment of a specific case.
EUR-Lex — MiCA RegulationEUR-Lex — Transfer of Funds RegulationEBA — Travel Rule Guidelines (applicable since 30 December 2024)