Source: OJ L, 2024/1624, 19.6.2024

Current language: EN

Article 37 Specific enhanced due diligence measures for cross-border correspondent relationships for crypto-asset service providers


Summary What does Article 37 of the Anti-money laundering regulation (AMLR) say?

This article is a crypto-asset-specific counterpart to Article 36, which governs cross-border correspondent relationships for traditional credit and financial institutions.

Article 37 applies that same correspondent due diligence logic to crypto-asset service providers (CASPs) entering into cross-border correspondent relationships with respondent entities outside the Union that provide similar crypto-asset services.

Before establishing such a relationship, CASPs must carry out a structured set of checks on the respondent entity — covering its licensing status, business nature, reputation, and AML/CFT controls — and secure senior management approval.

The article also addresses ongoing obligations: due diligence information must be kept up to date, and if a relationship is terminated for AML/CFT reasons, that decision must be documented.

AMLA is tasked with issuing guidelines by 10 July 2027 to further specify how these assessments should be conducted.

Important points:

  • Verify that any non-EU respondent entity is licensed or registered, assess its AML/CFT controls, and obtain senior management approval before entering into a cross-border correspondent relationship involving crypto-asset services.
  • Use the information gathered to determine, on a risk-sensitive basis, the appropriate measures to mitigate risks associated with the respondent entity, and keep that due diligence information updated regularly or when new risks emerge.
  • AMLA is required to issue guidelines by 10 July 2027 specifying assessment criteria and risk-mitigating measures, including minimum actions where a respondent entity is found not to be registered or licensed.

Springlex's summary of the article, a reading aid, not a substitute for the legal text.

    1. By way of derogation from Article 36, with respect to cross-border correspondent relationships involving the execution of crypto-asset services, with a respondent entity not established in the Union and providing similar services, including transfers of crypto-assets, crypto-asset service providers shall, in addition to the customer due diligence measures laid down in Article 20, when entering into a business relationship, be required to:

      1. determine if the respondent entity is licensed or registered;

      2. gather sufficient information about the respondent entity to understand fully the nature of the respondent’s business and to determine from publicly available information the reputation of the entity and the quality of supervision;

      3. assess the respondent entity’s AML/CFT controls;

      4. obtain approval from senior management before establishing the new correspondent relationship;

      5. document the respective responsibilities of each party to the correspondent relationship;

      6. with respect to payable-through crypto-asset accounts, be satisfied that the respondent entity has verified the identity of, and performed ongoing due diligence on, the customers having direct access to accounts of the correspondent entity, and that it is able to provide relevant customer due diligence data to the correspondent entity, upon request.

    2. Where crypto-asset service providers decide to terminate correspondent relationships for reasons relating to AML/CFT policy, they shall document their decision.

    3. Crypto-asset service providers shall update the due diligence information for the correspondent relationship on a regular basis or when new risks emerge in relation to the respondent entity.

    1. Crypto-asset service providers shall take into account the information collected pursuant to paragraph 1 in order to determine, on a risk sensitive basis, the appropriate measures to be taken to mitigate the risks associated with the respondent entity.

    1. By 10 July 2027, AMLA shall issue guidelines to specify the criteria and elements that crypto-asset service providers shall take into account for conducting the assessment referred to in paragraph 1 and the risk mitigating measures referred to in paragraph 2, including the minimum action to be taken by crypto-asset service providers upon identification that the respondent entity is not registered or licensed.

We're continuously improving our platform to serve you better.

Your feedback matters! Let us know how we can improve.

Found a bug?

Springflod is a Swedish boutique consultancy firm specialising in cyber security within the financial services sector.

We offer professional services concerning information security governance, risk and compliance.

Crafted with ❤️ by Springflod