MiCA / Crypto AML

What MiCA requires from CASPs: the AML compliance checklist for EU registration

30 March 2026 · 10 min read

MiCA is now in force across the European Union. Crypto asset service providers applying for authorisation must demonstrate a fully documented, operationally ready AML compliance programme before the NCA will grant a licence. For many CASPs, the AML component of the application is the part that takes longest to build and the most common reason for application delays.

This article sets out every AML requirement MiCA imposes on CASPs, what the NCA actually looks for in each area, and the documentation that needs to be in place before submission.

MiCA Title VI: the AML framework for CASPs

MiCA Title VI brings crypto asset service providers within the full scope of the EU AML framework. This means all obligations under AMLD6 apply to CASPs in addition to the MiCA-specific requirements. Generic AML programmes built for EMIs or payment institutions are not sufficient for CASP applications: the crypto-specific requirements around unhosted wallets, Travel Rule compliance, on-chain monitoring and AMLCO appointment all require specific procedural design.

The legal basis for CASP AML obligations

MiCA Regulation (EU) 2023/1114, Title VI establishes specific AML and CFT obligations for CASPs. These operate alongside AMLD6 (Directive (EU) 2018/843) and the Transfer of Funds Regulation (EU) 2023/1113, which extends Travel Rule requirements to crypto asset transfers.

EBA guidelines on ML/TF risk management for CASPs (EBA/GL/2024/01) provide specific supervisory expectations for CASP AML programme quality, AMLCO credentials and on-chain monitoring requirements.

MiCA Article 68 · AMLD6 · TFR (EU) 2023/1113 · EBA CASP Guidelines

The six AML requirements: what MiCA mandates

1. Designated AMLCO

A named AML Compliance Officer with specific authority, resources and access to carry out the function independently. The AMLCO must have demonstrable AML expertise and experience relevant to crypto asset activities.

MiCA Article 68 · EBA CASP Guidelines

2. Customer Due Diligence

Full CDD for all customers, EDD for high-risk individuals, PEPs, and customers using privacy-enhancing technologies. Unhosted wallet attribution is a specific procedural requirement for most CASPs.

AMLD6 Articles 13-15 · MiCA Title VI

3. Travel Rule Compliance

Collection, verification and transmission of originator and beneficiary information for crypto transfers above EUR 1,000. Requires protocol selection, VASP counterparty screening, and documented exception handling.

TFR (EU) 2023/1113 · FATF Recommendation 16

4. On-Chain Transaction Monitoring

Monitoring of blockchain transactions for suspicious patterns: mixing, tumbling, high-risk jurisdiction exposure, darknet associations. Requires integration with a blockchain analytics tool.

AMLD6 Article 20 · EBA CASP Guidelines

5. Business-Wide Risk Assessment

A documented BWRA covering crypto-specific risk factors: asset types (privacy coins, stablecoins), customer segments (DeFi, institutional, retail), geographic exposure and transaction channels.

AMLD6 Article 8 · MiCA Title VI

6. SAR Filing and FIU Liaison

Documented escalation procedures for suspicious transaction reporting. On-chain analytics evidence must typically accompany crypto STRs to substantiate the suspicion adequately.

AMLD6 Article 33 · MiCA Title VI

The full pre-registration AML checklist

The following is the documentation set that CASPs need to have completed and available for NCA review at the point of application. Missing items are the most common reason for AML-related delays or application returns.

AMLCO Appointment

Named AMLCO with documented qualifications and relevant crypto AML experience
AMLCO appointment letter or resolution confirming the role and authority
If the AMLCO is external: written outsourcing agreement and GDPR Article 28 DPA
AMLCO reporting line: confirmed independence from commercial function, direct line to board
NCA notification of the AMLCO appointment where required by local rules

AML Programme Documentation

Business-wide risk assessment covering crypto-specific risk factors
CDD policy: customer identification, verification, beneficial ownership
EDD policy: triggers, enhanced verification procedures, approval requirements
PEP and sanctions screening policy: lists covered, alert rates, disposition procedures
Transaction monitoring policy: on-chain typologies, alert thresholds, case management
SAR policy: escalation triggers, decision documentation, FIU submission procedures
Travel Rule policy: originator/beneficiary data collection, VASP screening, exception handling
Unhosted wallet attribution procedures: risk classification, enhanced procedures for high-risk wallets
Staff AML training programme: content, frequency, completion records

Customer Due Diligence Infrastructure

KYC onboarding procedures for retail crypto customers
KYC onboarding procedures for institutional customers and VASPs
Beneficial ownership procedures for corporate customers
Customer risk scoring framework calibrated to crypto customer typologies
Blockchain analytics tool selected and integrated (Chainalysis, Elliptic, or equivalent)
Unhosted wallet risk assessment: procedure for attribution and risk scoring

Travel Rule Implementation

Travel Rule protocol selected (TRISA, TravelRule Protocol, or equivalent)
Technical implementation of originator/beneficiary data collection for transfers above EUR 1,000
VASP counterparty screening procedure: verification of counterparty VASP registration status
Exception handling procedure for unhosted wallets and non-compliant counterparties
Evidence of Travel Rule readiness for NCA application file

Governance and Oversight

AMLCO reporting structure: documented independent reporting line to board
Board AML reporting template: quarterly minimum
AML committee or governance forum: documented terms of reference
Incident and escalation log: documented procedure and test evidence
Outsourcing register: all third-party AML providers documented

What NCAs look for beyond the documentation

Having the documentation in place is necessary but not sufficient. NCAs also assess whether the programme is operationally credible. This means the AMLCO must be able to speak to the content of the policies, the rationale behind the risk scoring methodology, and the expected workflow for a suspicious transaction. A programme that reads well but that no one in the organisation can operate is a red flag.

MFSA (Malta) focuses heavily on the quality and specificity of the BWRA. They want to see that the risk assessment reflects the CASP's actual customer base and asset types, not a generic template. The AMLCO credentials and independence are also assessed in detail.

CySEC (Cyprus) applies a detailed review of the customer risk scoring methodology and the on-chain monitoring tool integration. They expect evidence of tool configuration against the CASP's specific risk profile, not default settings.

Central Bank of Ireland places particular emphasis on the independence of the AMLCO and the quality of board-level AML reporting. Their examination approach includes detailed questioning of the AMLCO directly.

Bank of Lithuania has one of the more structured pre-registration review processes for CASPs. The AML programme must be complete before submission. The Bank of Lithuania expects specific evidence of Travel Rule protocol selection, counterparty VASP screening procedures, and on-chain monitoring tool integration.

The most common reason for CASP application delays: an AML programme that is structurally complete but that lacks specificity to the CASP's actual operations. NCAs increasingly reject applications where the documentation appears generic or where the AMLCO cannot demonstrate familiarity with the programme's content and rationale.

Timeline: how long does MiCA AML programme build take?

For a CASP starting from scratch, a complete MiCA-compliant AML programme typically takes 8 to 16 weeks to build, depending on the complexity of the customer base, the asset types offered, and whether Travel Rule implementation requires significant technical work.

The BWRA is usually the first deliverable: it takes 2 to 3 weeks and drives the design of all subsequent policies. The policy suite then takes 4 to 6 weeks. Travel Rule implementation is often the longest-lead item because it has a technical integration component that depends on the CASP's own engineering resources.

MiCA AML programme build for CASP registration

Scanlex builds MiCA-compliant AML programmes for CASPs applying for authorisation with MFSA, CySEC, Central Bank of Ireland, Bank of Lithuania, and other EU NCAs. We also provide KYC/ODD teams for crypto customer onboarding and AMLCO support for post-registration operation.

View MiCA / CASP AML service →

For CASPs that also need an independent review of an existing AML programme ahead of an NCA examination, see our AML Audit and Advisory service.

Frequently asked questions

What AML obligations does MiCA impose on CASPs?+

MiCA Title VI brings CASPs within the full EU AML framework as obliged entities. This covers customer due diligence (KYC/ODD), business-wide risk assessment, a documented AML programme with policies and controls, the appointment of a dedicated AML compliance officer (AMLCO), Travel Rule compliance for crypto asset transfers, transaction monitoring and suspicious transaction reporting, and staff AML training. These obligations must be in place before NCA registration is granted, not after.

Does a CASP need a dedicated AML compliance officer?+

Yes. MiCA requires CASPs to appoint a designated AMLCO responsible for the AML programme. The AMLCO must have sufficient seniority, genuine authority over the compliance function, and the ability to report directly to the management body. The role can be held on an outsourced basis where the CASP does not have an in-house individual with the required qualifications, but the AMLCO must be genuinely embedded in the programme, not a nominal appointment.

What is the Travel Rule and how does it apply to CASPs?+

The Travel Rule, implemented in the EU by Regulation (EU) 2023/1113, requires CASPs to collect, hold and transmit information about the originator and beneficiary of crypto asset transfers above EUR 1,000. For transfers below this threshold, certain information must still be available on request.

In practice, Travel Rule compliance requires technical integration with a Travel Rule solution capable of exchanging data with counterparty VASPs and CASPs, VASP/CASP identification workflows, and a process for handling transfers where the counterparty cannot be identified or does not respond. NCAs treat Travel Rule readiness as a hard condition for registration.

What KYC and ODD requirements apply to CASP customers?+

CASPs must apply customer due diligence to all customers before onboarding, with enhanced due diligence for higher-risk profiles including PEPs, customers from high-risk jurisdictions, and customers with unusual transaction patterns. Crypto-specific risk factors include wallet type, on-chain history, mixer or privacy coin exposure, and counterparty VASP risk. ODD for existing customers must be triggered by material changes in risk profile. Automated on-chain monitoring tools are now standard practice and NCAs expect them to be in place.

When must a CASP have its AML programme ready?+

The AML programme must be in place and documented before the NCA pre-registration review. NCAs assess the programme as part of the authorisation process: a CASP that applies without a functioning AML framework in place will not receive authorisation regardless of the quality of its technology or business model. For CASPs that were operating under transitional provisions, the deadline for full MiCA compliance has passed in most EU member states. New applicants should treat AML programme readiness as a prerequisite, not a parallel workstream.

Legal references

[1] Regulation (EU) 2023/1114 on markets in crypto-assets (MiCA): Title VI sets out the AML obligations applicable to crypto asset service providers. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32023R1114

[2] Directive (EU) 2018/843 (AMLD5) and Directive (EU) 2021/2101 (AMLD6): the EU AML framework within which CASPs operate as obliged entities.

[3] Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets: the EU Transfer of Funds Regulation as extended to crypto asset transfers. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32023R1113

[4] EBA Guidelines on the application of the AML/CFT obligations to crypto asset service providers: risk-based approach expectations for CASP customer due diligence and on-chain monitoring.

This article is provided for informational purposes only and does not constitute legal advice.