AML Requirements for Crypto Businesses in EU: MiCA, Travel Rule & AMLA Guide

Running a crypto business in Europe used to feel like playing whack-a-mole. One week you were compliant in Malta, the next your Estonian license got flagged by German regulators. That chaos is over. As of late 2025, the European Union has tightened the screws with a unified framework that leaves little room for interpretation. If you are operating a Crypto-Asset Service Provider (CASP) or planning to launch one, you need to understand the new reality: a harmonized set of Anti-Money Laundering (AML) rules enforced by a centralized authority.

The stakes have never been higher. The Anti-Money Laundering Authority (AMLA), established in 2025, is no longer just a concept on paper. It is actively coordinating national supervisors and preparing for its first major coordinated review in 2026. For businesses, this means the era of "forum shopping"-picking the laxest country for your license-is ending. You face stricter checks, mandatory data sharing via the Travel Rule, and significant fines if you slip up. But here’s the good news: clarity brings confidence. Institutional money is flowing into regulated CASPs at record rates because they know the regulatory risk is managed.

The Core Regulatory Framework: MiCA and AMLR

You can’t talk about AML without talking about the Markets in Crypto-Assets Regulation (MiCA). While MiCA primarily focuses on market integrity and consumer protection, it acts as the gatekeeper for AML compliance. To get a MiCA license, which allows you to operate across all 27 member states, you must prove you have robust AML controls in place. This is not optional. Without a MiCA license, you cannot legally offer services to EU clients.

Alongside MiCA sits the upcoming Anti-Money Laundering Regulation (AMLR). Set to take full effect on July 1, 2027, this regulation replaces previous directives with a single rulebook. Why does this matter? Because previously, each country had slight variations in how they interpreted EU directives. Now, the rules are identical everywhere. If you comply in France, you comply in Finland. This reduces operational complexity but raises the baseline standard for everyone.

The Travel Rule: No More Hiding Places

If there is one technical hurdle that keeps compliance officers awake at night, it is the Travel Rule. Unlike the US version, which has a $3,000 threshold, the EU applies this rule to all crypto transfers regardless of size. There is no minimum amount below which you can skip the paperwork. Every time a customer sends Bitcoin from your exchange to another platform, you must collect and share specific data points.

What exactly do you need to collect? The list is precise:

• Name of the originator (sender).
• Account number or unique transaction identifier.
• Physical address, date of birth, or national ID number of the sender.
• Name of the beneficiary (receiver).
• Account number or unique transaction identifier for the receiver.
• Physical address, date of birth, or national ID number of the receiver.

This gets tricky when dealing with self-hosted wallets (like MetaMask or Ledger). Since these wallets don't inherently store personal data, you must verify the ownership. For transfers exceeding €1,000 involving self-hosted wallets, you are required to verify that the wallet belongs to the customer. Failure to do so can result in the transaction being rejected or flagged as suspicious.

Integrating this system is expensive. Major players like Kraken reported spending over €2 million just to connect their systems with the 28 different national Financial Intelligence Units (FIUs). Smaller startups often struggle with this burden, leading many to use middleware solutions like Traveler or Notabene to automate the data exchange.

Risk-Based Customer Due Diligence (KYC)

Know Your Customer (KYC) is the backbone of any AML program, but the EU demands a tiered approach. You don't treat every user the same way. The EBA guidelines specify three levels of verification based on transaction volume and risk profile.

Tier 1: Basic Verification
For transactions under €1,000, you need basic identification. This usually means confirming the name and physical address. This is common for small retail users buying minor amounts of crypto.

Tier 2: Enhanced Verification
For transactions between €1,000 and €10,000, you step it up. You must verify official identity documents (passport, driver's license) and confirm the document's authenticity. Biometric checks are becoming standard here to prevent spoofing.

Tier 3: Strict Enhanced Due Diligence (EDD)
Anything over €10,000 triggers strict EDD. You need to verify the source of funds. Where did this money come from? Is it from a salary, a property sale, or a previous crypto trade? Senior management approval is often required for high-risk accounts. This level is critical for preventing layering, where criminals move illicit funds through multiple transactions to obscure their origin.

Supervision by AMLA and National Authorities

The creation of the Anti-Money Laundering Authority (AMLA) marks a shift from decentralized to centralized oversight. While national authorities still handle day-to-day supervision, AMLA coordinates them. They set the standards, conduct peer reviews, and can intervene if a national supervisor fails to act.

Bruna Szego, the Chair of AMLA, emphasized that while innovation is welcome, protection against financial crime is non-negotiable. Her stance signals that AMLA will prioritize combating privacy-enhancing technologies (PETs) like Monero or Zcash, which make tracing difficult. Expect specific guidance on PETs in early 2026.

Businesses should prepare for the first coordinated supervisory review in Q2 2026. AMLA will likely focus on two areas: Travel Rule implementation quality and beneficial ownership verification. If your records show gaps in who actually owns the company behind a trading account, you could face scrutiny.

Challenges for Decentralized Finance (DeFi)

Traditional AML rules assume there is a central entity-a bank or an exchange-that holds the keys. DeFi protocols don't work that way. There is often no CEO, no headquarters, and no single point of failure. This creates a regulatory gray area that criminals exploit.

The EBA acknowledges this gap. In 2025, they documented cases where decentralized exchanges (DEXs) were used to launder money because traditional CASP definitions didn't apply cleanly. However, the EU is closing this net. If a DeFi protocol has a front-end interface controlled by a legal entity, that entity may be considered a CASP. The German Federal Financial Supervisory Authority (BaFin) has already taken action against such setups, arguing that the operator of the interface bears responsibility for AML compliance.

Professor Angela Walch argues that this prescriptive approach might stifle innovation. She suggests that forcing DeFi to adopt traditional banking-style KYC kills the permissionless nature of blockchain. Yet, for now, the regulator's view prevails: if you touch fiat currency or serve EU residents, you are subject to AML rules, regardless of how decentralized your backend is.

Costs and Operational Burden

Compliance isn't free. For a startup, getting a MiCA license and setting up AML infrastructure costs between €350,000 and €500,000. This includes legal fees, technology integration, and hiring compliance staff. According to ESMA guidelines, you need 3-5 full-time compliance staff during the application phase alone.

Ongoing costs include annual training. Staff must undergo 40 hours of AML training per year. This isn't just watching a video; it involves quarterly assessments to ensure knowledge retention. Plus, you need a designated Money Laundering Reporting Officer (MLRO). This person is personally liable for failures in reporting suspicious activities.

Many smaller firms are choosing to exit the EU market rather than bear these costs. The Deloitte 2025 Regulatory Outlook notes that 31% of startups considered moving to Switzerland or Singapore. These jurisdictions offer clearer, sometimes lighter, regulatory paths. However, losing access to the EU's 68 million crypto-holding adults is a steep price to pay.

Future Outlook: What Changes in 2027?

Mark your calendars for July 1, 2027. That is when the full AMLR kicks in. Key changes include:

• Cash Cap: A Europe-wide limit of €10,000 for cash payments in business transactions. Cash payments over €3,000 require mandatory verification.
• Response Times: FIU requests must be answered within five working days. Currently, timelines vary by country.
• Expanded Scope: Obliged entities will include crowdfunding platforms and traders of high-value goods, bringing more indirect crypto exposure into the fold.

These changes aim to close the remaining loopholes. The goal is to reduce illicit crypto transactions by another 40-55% by 2028. For legitimate businesses, this means a cleaner reputation and easier access to banking partners, who are increasingly wary of crypto exposure.

Checklist for Compliance Readiness

Before you launch or expand in the EU, run through this checklist:

• Do you have a valid MiCA license or passporting rights?
• Is your Travel Rule software integrated with all relevant FIUs?
• Can you verify self-hosted wallet ownership for transfers >€1,000?
• Do you have a named MLRO with senior management backing?
• Are your staff trained annually (40 hours) and assessed quarterly?
• Do you have a procedure for handling privacy coins or PETs?
• Is your ICT infrastructure resilient enough to meet DORA standards?