EBA Consultation Paper on Amendments to ML/TF Guidelines to Include Crypto-Asset Service Providers

TO : Regulated Entities i. Cyprus Investment Firms (‘CIFs’) ii. Administrative Service Providers (‘ASPs’) iii. UCITS Management Companies (‘UCITS MC’) iv. Self-Managed UCITS (‘SM UCITS’) v. Alternative Investment Fund Managers (‘AIFMs’) vi. Self-Managed Alternative Investment Funds (‘SM AIFs’) vii. Self-Managed Alternative Investment Funds with Limited Number of Persons (‘SM AIFLNP’) viii. Companies with sole purpose the management of AIFLNPs ix. Small Alternative Investment Fund Managers (‘Small AIFMs’) x. Crypto Asset Service Providers FROM : Cyprus Securities and Exchange Commission DATE : 06 June 2023 CIRCULAR NO. : C577 SUBJECT : European Banking Authority (‘EBA’) public Consultation Paper on amendments to EBA’s Guidelines on money laundering and terrorist financing risk factors, to include crypto-asset service providers The Cyprus Securities and Exchange Commission (‘CySEC’) wishes with this Circular to inform the Regulated Entities of the following: On 31st May 2023, the EBA launched a public consultation on amendments to its Guidelines on money laundering and terrorist financing (ML/TF) risk factors (‘Guidelines’). The proposed changes extend the scope of these Guidelines to crypto-asset service providers (‘CASPs’). CASPs as well as other credit and financial institutions are exposed to ML/TF risks. For CASPs, these risks can be increased, due to, for example, the use of innovative technologies, instant transfers of crypto assets across the world and services that contain privacy-enhancing features. Thus, the EBA is proposing to amend its ML/TF risk factors guidelines to set common, regulatory expectations of the steps CASPs should take to identify and mitigate these risks effectively. The amendments introduce new sector-specific guidance for CASPs, which highlights factors that may indicate the CASP’s exposure to the higher or lower ML/TF risk. CASPs should consider these factors when carrying out the ML/TF risk assessments of their business and customers at the outset

2 and during the business relationship. The Guidelines also explain how they should adjust their customer due diligence (CDD) in line with those risks. Furthermore, the amendments include guidance to other credit and financial institutions on risks to consider when engaging in a business relationship with a CASP or when they are otherwise exposed to crypto assets. Regulated Entities may respond to the abovementioned public consultation by submitting their comments through the EBA's consultation page. The deadline for the submission of comments is 31 August 2023. The CySEC encourages the Regulated Entities to respond to the said consultation paper. Sincerely, Dr George Theocharides Chairman, Cyprus Securities and Exchange Commission