AMLA Makes Crypto a Strategic AML Priority: EU Supervisory Convergence and Blockchain Analytics Move Up the Agenda
Crypto-asset businesses are moving into a new phase of EU regulation in which obtaining a MiCA authorisation is only part of the compliance picture.
On 15 September 2026, AMLA Executive Board Member Simonas Krepšta set out the Authority’s Crypto Action Plan for 2026 and beyond, describing crypto-assets as a strategic priority for the EU’s new anti-money laundering supervisor. The plan focuses on deeper EU-wide understanding of crypto ML/TF risks, stronger supervisory convergence, improved analytical capabilities and closer cooperation with other EU authorities.
AMLA also highlighted blockchain analytics as a specific area requiring further development. According to the Authority, supervisory capabilities remain fragmented across Europe, creating a case for a more coordinated EU-level response. A separate AMLA analysis of money-laundering and terrorist-financing risks in the crypto sector is also underway, with findings expected to feed into a forthcoming report.
This does not introduce a new crypto licence or immediate standalone reporting requirement. But it signals something commercially important for CASPs: EU AML supervision is becoming more harmonised, more data-driven and more technologically capable at the same time as MiCA authorisation becomes the normal market-entry standard.
The direction is reinforced by the new EU Anti-Money Laundering Regulation, AMLA’s preparation for direct supervision from 2028, and existing Travel Rule obligations for crypto transfers.
For readers’ convenience, we have placed the key official AMLA, EU and EBA materials at the end of this article.
Publish Date
30 Sep 2026
Reading Time
13 minutes
Category
Legal News
Jurisdiction
EU
AMLA now treats crypto as a strategic supervisory priority
AMLA has focused on crypto risks since becoming operational.
In July 2025, shortly after the launch of its powers and responsibilities, the Authority publicly stated that CASPs would feature prominently in its work because of the sector’s cross-border nature, technological characteristics and exposure to anonymity-enhancing features.
The September 2026 Crypto Action Plan moves that policy into a more structured supervisory phase.
The plan focuses on four broad objectives:
- developing a stronger EU-wide understanding of crypto-related ML/TF risks;
- promoting supervisory convergence and effectiveness;
- strengthening AMLA’s analytical capabilities; and
- improving cooperation with relevant EU institutions and authorities.
For regulated businesses, the most important concept is supervisory convergence.
A CASP authorised under MiCA may still interact with different national AML supervisors depending on where the business is established and how its group is structured. AMLA’s mandate is designed in part to reduce materially different supervisory outcomes across Member States.
MiCA authorisation does not replace AML/CFT regulation
The emergence of MiCA has sometimes created an overly simplified view of EU crypto regulation.
MiCA governs matters including CASP authorisation, organisational requirements, custody, trading, conflicts, market conduct and other crypto-specific regulatory issues.
AML/CFT obligations operate alongside that framework.
Regulation (EU) 2024/1624, the new Anti-Money Laundering Regulation (AMLR), expressly treats crypto-asset service providers as obliged entities within the EU AML framework. The Regulation will become directly applicable for most purposes from 10 July 2027.
That creates two separate but connected regulatory questions:
Is the business authorised to provide the crypto service?
and
Are its customers, transactions, wallet relationships and counterparties being managed in accordance with AML/CFT requirements?
A MiCA licence answers the first question. It does not remove the second.
AMLA is moving from rule-building toward supervisory convergence
AMLA’s first multi-year plan, covering 2026–2028, describes three central priorities:
- completing the EU AML/CFT Single Rulebook;
- advancing supervisory convergence and direct supervision; and
- strengthening coordination between Financial Intelligence Units.
Crypto sits across all three.
CASPs need harmonised rules. National supervisors need a more consistent approach to assessing them. FIUs also need the ability to investigate cross-border crypto flows and emerging financial-crime typologies.
National differences are becoming a regulatory issue in their own right
A fragmented supervisory environment can create several problems.
The same risk may be interpreted differently across Member States. Supervisors may have different access to blockchain analytics. Enforcement intensity may differ. Firms may also be incentivised to choose jurisdictions based not only on business considerations but on perceived supervisory differences.
AMLA’s earlier work explicitly identified the risk that divergent approaches to CASP registration and authorisation could contribute to supervisory fragmentation and jurisdiction shopping by higher-risk actors.
The Authority’s current strategy is therefore not only to write new rules but to make application of those rules more consistent.
Blockchain analytics is becoming a supervisory capability issue
Blockchain analysis is one of the most important elements of AMLA’s September announcement.
Public blockchains can create extensive transaction records, but making those records useful for AML supervision requires technology, data and analytical capability.
AMLA says the current analytics landscape remains fragmented and requires an EU-level response.
That has several implications for CASPs.
Supervisors may become better able to test transaction-monitoring decisions
Blockchain analytics can help identify:
- exposure to sanctioned or illicit addresses;
- transaction chains connected to scams or theft;
- mixing and obfuscation patterns;
- interactions with high-risk services;
- cross-chain activity;
- exposure to darknet markets;
- links to high-risk counterparties; and
- unusual wallet behaviour.
The practical consequence is that the quality of a CASP’s own analysis can become easier for supervisors to challenge.
A firm may need to explain not only whether an alert was generated, but why particular on-chain risk indicators were accepted, escalated or dismissed.
Buying a blockchain analytics tool is not enough
Technology is only one part of the control environment.
A CASP also needs governance around:
- risk scoring;
- escalation thresholds;
- false positives;
- wallet attribution;
- manual investigations;
- sanctions screening;
- case documentation;
- staff training; and
- decisions to restrict or terminate customer activity.
If AMLA succeeds in strengthening EU-level analytical capability, firms should expect increasing supervisory attention to how analytics outputs are interpreted, rather than simply whether a vendor tool is in place.
Self-hosted wallets remain an important regulatory focus
Self-hosted addresses are another area where crypto AML compliance differs materially from conventional payments.
Under the current EU transfer-of-funds framework, CASPs already have specific obligations when transfers involve self-hosted addresses.
For transfers exceeding EUR 1,000 to a self-hosted address, the originator’s CASP must take adequate measures to assess whether the address is owned or controlled by the originator.
The EBA’s existing Travel Rule Guidelines also explain methods CASPs can use to assess ownership or control, including technical verification methods and, where appropriate, combinations of methods.
The new AMLR goes further by establishing a dedicated risk-based framework for transfers to and from self-hosted addresses.
AMLR requires self-hosted-address risk assessment
Article 40 of the AMLR requires CASPs to identify and assess ML/TF risks associated with transfers directed to or originating from self-hosted addresses.
Risk mitigation can include:
- identifying and verifying the originator or beneficiary;
- obtaining additional information about the origin or destination of crypto-assets;
- enhanced ongoing monitoring; and
- other proportionate risk-mitigation measures.
AMLA is required to issue additional Guidelines by 10 July 2027 specifying relevant mitigating measures and criteria for assessing ownership or control of self-hosted addresses.
For CASPs, self-hosted wallet compliance is therefore likely to remain a major area of supervisory development.
The Travel Rule is already part of the EU crypto AML framework
The EU’s crypto Travel Rule has applied since 30 December 2024.
Regulation (EU) 2023/1113 requires specified originator and beneficiary information to accompany transfers of crypto-assets involving CASPs.
The EBA’s Guidelines require CASPs and intermediary CASPs to establish procedures for identifying missing or incomplete information and deciding how problematic transfers should be handled. The Guidelines became applicable on the same date.
This means AMLA’s 2026 crypto agenda is not starting from an empty regulatory base.
Instead, the Authority is moving toward more consistent supervision of requirements that are already becoming operational across the EU.
The AMLR introduces a more harmonised CASP AML framework
One of the central policy changes from 10 July 2027 is that many core AML requirements will apply directly through an EU Regulation rather than depending primarily on national transposition.
For CASPs, that should reduce some differences between Member States.
CASPs are expressly treated as financial institutions
The AMLR definition of financial institution expressly includes crypto-asset service providers performing one or more crypto-asset services within the applicable definition.
This places CASPs squarely within the EU financial-sector AML architecture.
Customer due diligence thresholds are crypto-specific
The AMLR contains specific provisions for occasional crypto transactions.
CASPs must apply customer due diligence where an occasional transaction reaches at least EUR 1,000, whether conducted in one operation or through linked transactions.
For an occasional crypto transaction below EUR 1,000, CASPs must still apply at least specified identification and verification measures.
This is more targeted than simply applying the general EUR 10,000 occasional-transaction threshold used for many other obliged entities.
Cross-border crypto correspondent relationships receive dedicated rules
The AMLR also introduces specific enhanced due diligence requirements for cross-border correspondent relationships involving crypto services and third-country respondent entities.
The CASP must, among other things:
- determine whether the respondent is licensed or registered;
- understand the nature of its business;
- assess reputation and quality of supervision;
- evaluate its AML/CFT controls;
- obtain senior-management approval;
- document responsibilities; and
- apply additional safeguards for payable-through cryptoasset accounts.
AMLA must issue additional Guidelines on these assessments and mitigating measures by 10 July 2027.
For globally operating crypto groups, this could become one of the more significant new compliance workstreams.
AMLA is preparing to directly supervise selected financial institutions
AMLA’s impact will not be limited to issuing Guidelines and coordinating national supervisors.
From 2028, the Authority will begin directly supervising a group of high-risk cross-border financial institutions.
AMLA states that 40 obliged entities are expected to be selected during 2027, with direct supervision starting in 2028.
CASPs can potentially enter the direct-supervision population
Under the AMLA framework, selection is focused on high-risk credit and financial institutions or groups operating across multiple Member States.
The statutory framework requires the first selection process to begin by 1 July 2027, with direct supervision beginning six months after publication of the selected entities.
AMLA Chair Bruna Szego has also publicly stated that the 40 entities will be selected across financial institutions rather than banks alone and that the population will probably include crypto-asset service providers.
No CASP has yet been announced as directly supervised.
The relevant point for larger cross-border crypto groups is that direct AMLA supervision is now a realistic future supervisory outcome rather than a theoretical possibility.
Cross-border scale matters
Direct supervision is designed for higher-risk financial entities with substantial cross-border operations.
AMLA’s framework refers to financial institutions operating in at least six Member States when identifying entities for direct supervision.
For large CASPs, EU expansion can therefore affect more than the commercial footprint.
It can also change the supervisory architecture.
A crypto group operating under passported MiCA services across multiple Member States may remain primarily supervised for some purposes by national authorities, while its AML/CFT profile could ultimately bring it within AMLA’s direct supervisory population if the statutory risk and eligibility tests are satisfied.
AMLA is already testing its risk models
The 2028 direct-supervision regime is being built now.
In March 2026, AMLA launched a data-collection exercise designed to test and calibrate the risk models that will support:
- selection of entities for direct supervision; and
- more consistent national assessment of financial-sector ML/TF risk.
In May, AMLA published the reporting package that national supervisors will use to identify provisionally eligible entities ahead of the 2027 selection exercise.
The selection infrastructure is therefore already operationally advanced.
Large crypto groups should not wait until an entity appears on a final 2027 list before assessing whether their risk data, governance and group-wide AML arrangements could withstand AMLA-level scrutiny.
The Crypto Action Plan does not create new rules by itself
The legal status of the September announcement should remain clear.
AMLA’s Crypto Action Plan is a statement of supervisory and analytical priorities.
It does not:
- amend MiCA;
- create a new CASP authorisation;
- replace the AMLR;
- introduce a new Travel Rule;
- make blockchain analytics software mandatory by itself; or
- place all CASPs under AMLA direct supervision.
Existing obligations continue to arise from MiCA, the Transfer of Funds Regulation, current AML rules, sanctions requirements and, from July 2027, the new AMLR framework.
The importance of the Action Plan is that it indicates how those obligations are likely to be supervised more consistently and analytically across the EU.
What supervisory convergence could mean in practice
For CASPs, greater convergence should reduce the assumption that AML supervisory expectations can be managed primarily at national level.
Several areas are likely to receive closer cross-border comparison.
Business-wide risk assessments
AMLA is already developing Guidelines under the AMLR on business-wide risk assessments.
Its 2026 consultation says the framework is intended to establish minimum requirements for assessing risks arising from:
- business models;
- customers;
- products and services;
- transactions;
- distribution channels; and
- geographic exposure.
For CASPs, crypto-specific risks will need to be integrated into that wider methodology.
Transaction monitoring
Crypto transaction monitoring increasingly combines conventional customer behaviour analysis with on-chain analytics.
A harmonised supervisory approach could make it harder for firms to rely on materially weaker wallet-screening thresholds or alert treatment in one EU jurisdiction than another.
Group-wide controls
Cross-border groups should expect supervisors to look beyond the licensed entity in isolation.
Shared onboarding, global transaction-monitoring systems, central compliance teams and third-country group companies can all affect the effectiveness of the EU entity’s AML framework.
Documentation
Supervisory convergence also means that a control should be explainable.
CASPs should be able to demonstrate why a particular customer, jurisdiction, wallet, token or transaction pattern received the risk treatment applied to it.
MiCA, AMLR and AMLA need to be read together
| Framework | Main function |
|---|---|
| MiCA | CASP and crypto-asset market authorisation and conduct framework |
| Regulation (EU) 2023/1113 | Traceability and Travel Rule requirements for crypto transfers |
| AMLR | Harmonised AML/CFT obligations for CASPs and other obliged entities |
| AMLA Regulation | Creates the EU AML authority, supervisory convergence and direct supervision framework |
| National supervision | Continues for entities not directly supervised by AMLA, within the harmonised EU structure |
What CASPs should review now
1. Blockchain analytics governance
Firms should document:
- which analytics provider or methodology they use;
- how wallet-risk scores are calibrated;
- which indicators trigger escalation;
- how false positives are handled;
- how sanctions exposure is treated; and
- how analytical findings feed into customer and transaction risk.
2. Self-hosted wallet controls
CASPs should review whether current processes satisfy existing Travel Rule requirements and are capable of adapting to AMLR Article 40 and future AMLA Guidelines.
3. Cross-border correspondent relationships
Businesses interacting with third-country crypto institutions should prepare for the AMLR’s dedicated enhanced due diligence framework.
4. Business-wide risk assessment
Crypto-specific risks should be integrated into the enterprise-level AML methodology rather than sitting only inside transaction-monitoring procedures.
5. EU supervisory footprint
Large CASPs should map the Member States in which they provide services, national AML supervisory relationships and whether the group could ultimately fall into AMLA’s direct-supervision universe.
6. Data quality
More analytics-driven supervision requires reliable customer, transaction, wallet and risk data.
Poor data architecture can become an AML compliance issue even where written policies appear adequate.
Legasset assists CASPs, exchanges, custodians, stablecoin businesses and fintech groups with MiCA authorisation, AML/CFT frameworks, transaction-monitoring governance, Travel Rule implementation, self-hosted wallet controls, cross-border compliance and EU market-entry structuring.
For existing MiCA-authorised groups, we can also support gap analysis between current national AML arrangements and the harmonised AMLR/AMLA framework taking shape for 2027–2028.
AMLA Crypto Supervision FAQ
What did AMLA announce in September 2026?
On 15 September 2026, AMLA Executive Board Member Simonas Krepšta outlined AMLA’s Crypto Action Plan for 2026 and beyond.
The plan focuses on crypto ML/TF risk analysis, supervisory convergence, stronger analytical capabilities and cooperation with other EU authorities.
Does AMLA’s Crypto Action Plan introduce new legal obligations for CASPs?
No.
The Action Plan identifies AMLA’s supervisory and analytical priorities. It does not amend MiCA, AMLR or the Transfer of Funds Regulation and does not create a new licence.
Is AMLA developing a crypto risk report?
Yes.
AMLA says it is analysing ML/TF risks in the crypto sector and expects the findings to be reflected in a forthcoming report. As of the freshness check for this article, AMLA has not announced a publication date.
Why is blockchain analytics an AMLA priority?
AMLA has identified fragmentation in blockchain analytics capabilities across the EU and says the issue requires a stronger EU-level response.
The objective is to improve supervisory and analytical capacity to understand crypto-related financial crime risks.
Are CASPs obliged entities under the new AML Regulation?
Yes.
Regulation (EU) 2024/1624 expressly includes crypto-asset service providers within the definition of financial institutions subject to the EU AML/CFT framework.
When does the new AML Regulation apply?
The core AMLR framework becomes directly applicable from 10 July 2027, subject to specific provisions and transitional arrangements.
Does the EU Travel Rule already apply to crypto transfers?
Yes.
Regulation (EU) 2023/1113 and the EBA’s related Travel Rule Guidelines have applied to relevant crypto transfers since 30 December 2024.
What rules apply to transfers involving self-hosted wallets?
Current EU rules require CASPs to collect specified information and, for relevant transfers above EUR 1,000, take adequate measures to assess whether the self-hosted address is owned or controlled by the customer.
The AMLR also introduces a dedicated risk-based framework for self-hosted-address transfers.
Will AMLA issue more crypto-specific guidance?
Yes.
Under the AMLR, AMLA must issue Guidelines by 10 July 2027 on matters including risk mitigation for self-hosted addresses and enhanced due diligence for certain cross-border crypto correspondent relationships.
Will AMLA directly supervise crypto companies?
Potentially.
AMLA will select up to 40 high-risk cross-border financial institutions in 2027 for direct supervision beginning in 2028. CASPs are financial institutions under the AML framework and can potentially fall within the selection population if the applicable criteria are met.
No specific CASP has yet been announced as a selected entity.
When does AMLA begin direct supervision?
The first selection process must begin by 1 July 2027.
AMLA plans to select 40 entities during 2027, with direct supervision beginning from 2028 in accordance with the statutory timetable.
Does MiCA authorisation satisfy a CASP’s AML obligations?
No.
MiCA authorisation governs the provision of regulated cryptoasset services. AML/CFT obligations arise separately under the EU AML and transfer-of-funds frameworks.
A CASP therefore needs both an appropriate regulatory authorisation and an effective AML/CFT control environment.
AMLA Crypto Supervision: Official EU AML and Crypto Materials
AMLA’s 15 September 2026 announcement sets out its strategic priorities for crypto-assets, including EU-wide ML/TF risk analysis, supervisory convergence, stronger analytical capabilities, blockchain analytics and cooperation with other EU authorities.
II. AMLA — Strategic Priorities for 2026–2028
AMLA’s first multi-year programme explains the Authority’s work on the EU AML/CFT Single Rulebook, direct and indirect supervision, FIU cooperation and development of common risk frameworks.
III. AMLA — Preparation for the 2027 Direct Supervision Selection Exercise
This AMLA material explains the reporting framework being prepared to identify financial institutions potentially eligible for direct supervision from 2028.
IV. EUR-Lex — Regulation (EU) 2024/1624 on Anti-Money Laundering and Countering Terrorist Financing
The AML Regulation establishes the harmonised EU AML/CFT framework applicable from 2027, expressly covers CASPs and includes dedicated provisions on customer due diligence, self-hosted addresses and crypto correspondent relationships.
V. EUR-Lex — Regulation (EU) 2024/1620 Establishing AMLA
The AMLA Regulation establishes the Authority’s supervisory powers and the framework for selecting high-risk cross-border financial institutions for direct AML/CFT supervision.
VI. EUR-Lex — Regulation (EU) 2023/1113 on Transfers of Funds and Crypto-Assets
The Regulation establishes the EU crypto Travel Rule, including information requirements for transfers and specific requirements concerning transfers involving self-hosted addresses.
VII. European Banking Authority — EU Travel Rule Guidelines for Crypto-Asset Transfers
The EBA Guidelines explain how CASPs should detect and manage missing or incomplete transfer information and provide detailed guidance on transfers to and from self-hosted addresses.
VIII. AMLA — High AML/CFT Standards Expected in the Crypto Sector
AMLA’s earlier policy statement explains why CASPs are a supervisory priority and identifies cross-border activity, technological features and anonymity-related risks as important elements of the sector’s AML/CFT profile.
