Final Report Draft RTS on criteria for appointment of CCP for CASPs and rules on their functions — EBA — EU

EBA/RTS/2025/01
25/04/2025
Final Report
Draft Regulatory Technical Standards amending Commission Delegated Regulation (EU) 2018/1108 on the criteria for the appointment of central contact points for electronic money issuers and payment service providers and with rules on their functions under Article 45(10) of Directive (EU) 2015/849

Executive Summary
Payment service providers (PSPs), electronic money issuers (EMIs), and crypto-asset service providers (CASPs) that are authorised in an EU Member State can operate establishments in other, host, Member States. Once established, PSPs, EMIs and CASPs have to comply with local AML/CFT (AntiMoney Laundering/Countering the Financing of Terrorism) obligations. This is the case even if their establishments are not ‘obliged entities’ themselves. To facilitate AML/CFT supervision in such cases, host Member States may require PSPs, EMIs or CASPs to appoint a central contact point in their territory. A central contact point acts on behalf of the appointing institution and ensures compliance with local AML/CFT obligations.
Article 45(10) of Directive (EU) 2015/849 requires the EBA to develop draft regulatory technical
standards (RTS) setting out:

the criteria for determining the circumstances in which the appointment of a central contact
point is appropriate, and
the functions of central contact points.
A first version of the draft RTS was issued in 2017 1 . They were published in the Official Journal of the EU in 2018 2 . Since their scope was limited to PSPs and EMIs, the co-legislator amended Article 45(9) of Directive (EU) 2015/849 on 9 June 2023 to extend it to CASPs. To deliver its updated mandate in
Article 45(10) of this Directive, the EBA decided to update and amend the Commission Delegated
Regulation (EU) 2018/1108 in this regard.
Next steps
The draft RTS will be submitted to the Commission for endorsement, following which they will be subject to scrutiny by the European Parliament and the Council, before being published in the Official Journal of the European Union. 1 https://www.eba.europa.eu/publications-and-media/press-releases/esas-publish-central-contact-point-standards-fight-against 2 Commission Delegated Regulation (EU) 2018/1108 of 7 May 2018 supplementing Directive (EU) 2015/849 of the European Parliament and of the Council with regulatory technical standards on the criteria for the appointment of central contact points for electronic money issuers and payment service providers and with rules on their functions (Text with EEA relevance.), C/2018/2716, OJ L 203, 10.8.2018, p. 2–6, ELI: http://data.europa.eu/eli/reg_del/2018/1108/oj.

the criteria for determining the circumstances in which the appointment of a central contact
point is appropriate, and
the functions of the central contact points.
The mandate in Article 45(10) of Directive (EU) 2015/849 does not extend to the EBA specifying the form a central contact point must take or determining when PSPs, EMIs, and CASPs can provide services in another Member State through establishments. As per Recital 8 of Commission Delegated Regulation (EU) 2018/1108, it is for each Member State to determine whether central contact points should take a particular form. A first version of the draft RTS was issued in 2017. This Commission Delegated Regulation (EU) 2018/1108 3 was published in the Official Journal of the EU in 2018. The scope was limited to PSPs and EMIs. Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets applies from 30 December 2024. It amends Directive (EU) 2015/849, inter alia, by extending its scope to CASPs. Consequently, Article 45(9) of this Directive extends provisions that Member States may require EMIs and PSPs established on their territory in forms other than a branch, and whose head office is situated in another Member State, to appoint a central contact point in their territory to CASPs. This means that the EBA must update the Commission Delegated Regulation (EU) 2018/1108. Rationale As is the case for EMIs and PSPs, CASPs can provide services in other Member States through establishments other than branches. This can make the AML/CFT supervision of services provided through these establishments difficult. 3 Commission Delegated Regulation (EU) 2018/1108 of 7 May 2018 supplementing Directive (EU) 2015/849 of the European Parliament and of the Council with regulatory technical standards on the criteria for the appointment of central contact points for electronic money issuers and payment service providers and with rules on their functions (Text with EEA relevance), C/2018/2716.

FINAL REPORT REGULATORY TECHNICAL STANDARDS AMENDING COMMISSION DELEGATED REGULATION (EU) 2018/1108 ON THE CRITERIA FOR THE APPOINTMENT OF CENTRAL CONTACT POINTS FOR ELECTRONIC MONEY ISSUERS AND PAYMENT SERVICE PROVIDERS AND WITH RULES ON THEIR FUNCTIONS UNDER
ARTICLE 45(10) OF DIRECTIVE (EU) 2015/849
5
Since the same considerations apply to EMIs and PSPs as they do to CASPs, and to keep disruption to a minimum, the EBA decided to:
a. retain the structure and approach set out in Commission Delegated Regulation (EU) 2018/1108 and leave the provisions that apply to PSPs and EMIs unchanged; b. extend existing provisions to CASPs, while introducing new provisions for CASPs where this is necessary considering their business model and operation. Specifically, the EBA decided to:
a. include a definition of CASPs (reflecting the definition in Article 3(2) of Directive (EU) 2015/849) in Article 2; b. extend the existing definitions of 'competent authority' and 'host Member State' to include references to CASPs;
c. extend other provisions in Articles 3 (1), (2), and (4), Article 4, Article 5 point (a) and
(c), and Article 6 (1) and (2) to CASPs; d. include in Article 3 paragraph (1) point (b), specific criteria for determining the circumstances in which CASPs should be required to appoint a central contact point. These criteria follow the same logic as that applied to EMIs and PSPs by focusing on the size and scale of the activities carried out by the entity in the host Member State but are adapted to fit the distinct nature of crypto-assets services, in line with Recital 27 of Regulation (EU) 2024/1624. The calculation should consider the aggregated value of all services and activities (measured in EUR) at the time of the provision of the respective service or activity. A central contact point can only be mandated if certain criteria set in this RTS is met. The RTS requires that the appointment of a central contact point be determined based on the principle of proportionality within a risk-based approach. As is the case for EMIs and PSPs, where this is proportionate and justified by the level of money laundering or terrorist financing risk associated with the operation of a CASP, Member States may require the CASP to appoint a central contact point even if the criteria in Article 3(1)(b) are not met. In addition, the nature of some crypto-assets services makes the notion of ‘establishment’ challenging from a practical perspective. Therefore, the EBA decided that the concept of establishment should follow that set out in Recital 27 of Regulation (EU) 2024/1624, where activities with limited physical equipment needed for operators that mainly service their customers through the internet also constitute an establishment. Equally, the requirement to appoint a central contact point should be irrespective of whether these establishments are regarded as obliged entities under national law. The EBA consulted on a version of these amendments between 4 December 2024 and 4 February 2025. Nine respondents provided comments. The EBA revised the draft RTS on this basis.

FINAL REPORT REGULATORY TECHNICAL STANDARDS AMENDING COMMISSION DELEGATED REGULATION (EU) 2018/1108 ON THE CRITERIA FOR THE APPOINTMENT OF CENTRAL CONTACT POINTS FOR ELECTRONIC MONEY ISSUERS AND PAYMENT SERVICE PROVIDERS AND WITH RULES ON THEIR FUNCTIONS UNDER
ARTICLE 45(10) OF DIRECTIVE (EU) 2015/849
8
(3) To extend the scope of these regulatory technical standards to crypto-asset service providers and their competent authorities, the definitions of ‘competent authority’ and 'host Member State' should be amended to include references to crypto-asset services. (4) Amendments should also include the introduction of criteria for determining the circumstances in which host Member States may require crypto-asset service providers to appoint a central contact point. These criteria follow the same logic as that applied to EMIs and PSPs by focusing on the size and scale of the activities carried out by the entity in the host Member State but are adapted to fit the distinct nature of crypto-assets services, in line with Recital 27 of Regulation (EU) 2024/1624. (5) As is the case for electronic money issuers and payment institutions, host Member States should be able to require crypto-asset service providers to appoint a central contact point in all cases where this is commensurate with the level of money laundering or terrorist financing risk associated with the operation of crypto-asset service providers. (6) Commission Delegated Regulation (EU) 2018/1108 should therefore be amended accordingly. (7) This Regulation is based on the draft regulatory technical standards submitted to the Commission by the European Banking Authority. (8) The European Banking Authority has conducted open public consultations on the draft regulatory technical standards on which this Regulation is based, analysed the potential related costs and benefits and requested the advice of the Banking Stakeholder Group established in accordance with Article 37 of Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 6 , HAS ADOPTED THIS REGULATION:
Article 1
Amendments to Delegated Regulation (EU) 2018/1108 Delegated Regulation (EU) 2018/1108 is amended as follows:
(1) in Article 2, paragraph (1) is amended as follows:
‘(1) “competent authority” means the authority of a Member State competent for ensuring compliance of electronic money issuers, payment service providers, and crypto-asset service providers that are established in their territory in forms other than a branch and whose head office is situated in another Member State with the requirements of Directive (EU) 2015/849 as transposed by national legislation;’ 6 Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC (OJ L 331, 15.12.2010, p. 12, ELI: http://data.europa.eu/eli/reg/2010/1093/oj).

FINAL REPORT REGULATORY TECHNICAL STANDARDS AMENDING COMMISSION DELEGATED REGULATION (EU) 2018/1108 ON THE CRITERIA FOR THE APPOINTMENT OF CENTRAL CONTACT POINTS FOR ELECTRONIC MONEY ISSUERS AND PAYMENT SERVICE PROVIDERS AND WITH RULES ON THEIR FUNCTIONS UNDER
ARTICLE 45(10) OF DIRECTIVE (EU) 2015/849
9
(2) in Article 2, paragraph (2) is amended as follows:
‘(2) “host Member State” means the Member State in whose territory electronic money issuers, payment service providers, and crypto-asset service providers whose head office is situated in another Member State are established in forms other than a branch;’ (3) in Article 2, the following paragraph (4) is inserted:
‘(4) “crypto-asset service providers” means a crypto-asset service provider as defined in Article 3(1), paragraph (15), of Regulation (EU) 2023/1114, where performing one or more crypto-asset services as defined in Article 3(1), paragraph (16), of that Regulation ( 7 ), with the exception of providing advice on crypto-assets as referred to in Article 3(1), paragraph (16)(h), of that Regulation.’ (4) in Article 3, paragraph (1) is amended as follows:
‘1. Host Member States may require electronic money issuers, payment service providers, and crypto-asset service providers that have establishments in their territory in forms other than a branch, and whose head office is situated in another Member State, to appoint a central contact point where any of the following criteria is met:’ (5) in Article 3, paragraph (1) point (b) is amended as follows:
‘(b) the cumulative amount of the electronic money distributed and redeemed, the cumulative value of the payment transactions executed, or the cumulative value of the services and activities carried out by the CASP’s establishments is expected to exceed EUR 3 million per financial year or has exceeded EUR 3 million in the previous financial year.’ (6) in Article 3, paragraph (2) is amended as follows:
‘2. Without prejudice to the criteria set out in paragraph 1, host Member States may require categories of electronic money issuers, payment service providers, and crypto-asset service providers that have establishments in their territory in forms other than a branch, and whose head office is situated in another Member State, to appoint a central contact point where this requirement is commensurate to the level of money laundering or terrorist financing risk associated with the operation of those establishments.’ (7) in Article 3, paragraph (4) is amended as follows:
‘4. Without prejudice to the criteria set out in paragraphs 1 and 2, a host Member State may, in exceptional cases, empower the host Member State's competent authority to require an electronic money issuer, payment service provider, or crypto-asset service provider that has establishments in its territory in forms other than a branch, 7 Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023 on markets in crypto-assets, and amending Regulations (EU) No 1093/2010 and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/1937 (OJ L 150, 9.6.2023, p. 40, ELI:
http://data.europa.eu/eli/reg/2023/1114/oj).

FINAL REPORT REGULATORY TECHNICAL STANDARDS AMENDING COMMISSION DELEGATED REGULATION (EU) 2018/1108 ON THE CRITERIA FOR THE APPOINTMENT OF CENTRAL CONTACT POINTS FOR ELECTRONIC MONEY ISSUERS AND PAYMENT SERVICE PROVIDERS AND WITH RULES ON THEIR FUNCTIONS UNDER
ARTICLE 45(10) OF DIRECTIVE (EU) 2015/849
10 and whose head office is situated in another Member State, to appoint a central contact point providing that the host Member State has reasonable grounds to believe that the operation of establishments of that electronic money issuer, payment service provider or crypto-asset service provider presents a high risk of money laundering and terrorist financing.’ (8) Article 4 is amended as follows:
‘The central contact point shall ensure that electronic money issuers, payment services providers and crypto-asset service providers that operate establishments specified in
Article 45(9) of Directive (EU) 2015/849 comply with the AML/CFT rules of the host
Member State. To this end, the central contact point shall:
(a) facilitate the development and implementation of AML/CFT policies and procedures pursuant to Article 8(3) and (4) of Directive (EU) 2015/849 by informing the appointing electronic money issuer, payment service provider, or crypto-asset service provider of AML/CFT requirements applicable in the host Member State; (b) oversee, on behalf of the appointing electronic money issuer, payment service provider, or crypto-asset service provider, the effective compliance by those establishments with AML/CFT requirements applicable in the host Member State and the appointing electronic money issuer's, payment services provider's, or crypto-asset service provider’s policies, controls and procedures adopted pursuant to Article 8(3) and (4) of Directive (EU) 2015/849; (c) inform the head office of the appointing electronic money issuer, payment service provider, or crypto-asset service provider of any breaches or compliance issues encountered in those establishments, including any information that may affect the establishment's ability to comply effectively with the appointing electronic money issuer's, payment services provider's, or crypto-asset service provider’s AML/CFT policies and procedures or that may otherwise affect the appointing electronic money issuer, payment service provider, or crypto-asset service provider's risk assessment; (d) ensure, on behalf of the appointing electronic money issuer, payment service provider, or crypto-asset service provider, that corrective action is taken in cases where those establishments do not comply, or are at risk of not complying, with applicable AML/CFT rules; (e) ensure, on behalf of the appointing electronic money issuer, payment service provider, or crypto-asset service provider, that those establishments and their staff participate in training programmes referred to in Article 46(1) of Directive (EU) 2015/849; (f) represent the appointing electronic money issuer, payment service provider, or crypto-asset service provider in its communications with the competent authorities and the FIU of the host Member State.’ (9) Article 5 is amended as follows:
‘The central contact point shall facilitate the supervision by competent authorities of the host Member State of establishments specified in Article 45(9) of Directive (EU) 2015/849 to comply with AML/CFT rules of the host Member State. To this end, the central contact point shall, on behalf of the appointing electronic money issuer, payment services provider, or crypto-asset service provider:’

FINAL REPORT REGULATORY TECHNICAL STANDARDS AMENDING COMMISSION DELEGATED REGULATION (EU) 2018/1108 ON THE CRITERIA FOR THE APPOINTMENT OF CENTRAL CONTACT POINTS FOR ELECTRONIC MONEY ISSUERS AND PAYMENT SERVICE PROVIDERS AND WITH RULES ON THEIR FUNCTIONS UNDER
ARTICLE 45(10) OF DIRECTIVE (EU) 2015/849
12
4. Accompanying documents
4.1. Cost-benefit analysis / impact assessment
Article 10(1) of the EBA Regulation provides that when any regulatory technical standards developed
by the EBA are submitted to the Commission for adoption, they should be accompanied by an analysis of ‘the potential related costs and benefits’. This analysis should provide an overview of the findings regarding the problem to be dealt with, the solutions proposed and the potential impact of these options. This analysis presents the IA of the main policy options the EBA considered when preparing the draft RTS amending Commission Delegated Regulation (EU) 2018/1108 on the criteria for the appointment of central contact points for EMIs and PSPs and with rules on their functions under Article 45(10) of Directive (EU) 2015/849 (‘the draft RTS’). The analysis provides an overview of the identified problem, the proposed options to address this problem as well as the potential impact of these options. The IA is high level and qualitative in nature. A. Problem identification In 2023, Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets was published. It amends Directive (EU) 2015/849 to extend its scope to CASPs as defined in Article 3(1), paragraph (15), of Regulation (EU) 2023/1114 and applies from 30 December 2024.
Article 45(9) of this Directive provides that Member States may require EMIs, PSPs, and CASPs
established on their territory in forms other than a branch, and whose head office is situated in another Member State, to appoint a central contact point in their territory. This is because, in line with the principle of territoriality, the operation of such establishments means that the appointing PSP, EMI or CASP will have to comply with the host Member State’s laws. Article 45(10) of the AntiMoney Laundering Directive (AMLD) mandates the EBA to issue a draft RTS on the criteria for determining the circumstances regarding the appointment of a central contact point, and what the functions of that central contact point should be. In 2018, Commission Delegated Regulation (EU) 2018/1108 was adopted 8 , which was based on an RTS the European Supervisory Authorities (ESAs) prepared under Article 45(10) of the AMLD5, as originally drafted. Consequently, it applies only to EMIs and PSPs. Therefore, the EBA had to consider whether to issue new RTS, or to amend Commission Delegated Regulation (EU) 2018/1108 to extend it to CASPs. 8 Commission Delegated Regulation (EU) 2018/1108 of 7 May 2018 supplementing Directive (EU) 2015/849 of the European Parliament and of the Council with regulatory technical standards on the criteria for the appointment of central contact points for electronic money issuers and payment service providers and with rules on their functions (Text with EEA relevance), C/2018/2716.

FINAL REPORT REGULATORY TECHNICAL STANDARDS AMENDING COMMISSION DELEGATED REGULATION (EU) 2018/1108 ON THE CRITERIA FOR THE APPOINTMENT OF CENTRAL CONTACT POINTS FOR ELECTRONIC MONEY ISSUERS AND PAYMENT SERVICE PROVIDERS AND WITH RULES ON THEIR FUNCTIONS UNDER
ARTICLE 45(10) OF DIRECTIVE (EU) 2015/849
13
B. Policy objectives
The draft RTS sets proportionate and risk-sensitive criteria that Member States must use when deciding whether foreign PSPs, EMIs and CASPs that operate establishments in forms other than a branch in the host Member State’s territory should appoint a central contact point and what the functions of that central contact point should be.
C. Baseline scenario
Section C. presents the main policy options discussed, and the decisions made by the EBA during the
development of the draft RTS. Advantages and disadvantages, as well as potential costs and benefits from the qualitative perspective of the policy options and the preferred options resulting from this analysis, are provided. Amendment of the Commission Delegated Regulation 2018/1108 versus entirely new Regulation The EBA was required to draft an RTS on the criteria to be used when deciding whether CASPs (in addition to PSPs and EMIs) that operate establishments in the host Member State’s territory in forms other than a branch should appoint a central contact point and what the functions of that central contact point should be. Commission Delegated Regulation 2018/1108 already covers the criteria and functions of central contact point for PSPs and EMIs. In this regard, the EBA considered two options:
Option 1a: Amending Commission Delegated Regulation 2018/1108 to extend it to CASPs. Option 1b: Repealing Commission Delegated Regulation 2018/1108 and replacing it with new draft RTS. Repealing Commission Delegated Regulation 2018/1108 and replacing it with new draft RTS would allow a wholesale review of the existing approach, but amending Commission Delegated Regulation 2018/1108 would minimise the impact and costs on PSPs and EMIs since the existing approach, which feedback from competent authorities suggests works well, would be preserved. What is more, repealing Commission Delegated Regulation 2018/1108 might not be efficient, because the new AML Authority (AMLA) has a similar mandate under Article 41(2) of the Directive (EU) 2024/1640 (AMLD6), which it must discharge by 10 July 2026. Given the above, option 1a has been chosen as the preferred option and the draft RTS will keep the structure and framework of Commission Delegated Regulation 2018/1108 while amending specific points for extension to CASPs. Provisions applicable to EMIs and PSPs will therefore remain unchanged. Criteria to be used when deciding whether foreign CASPs that operate establishments in forms other than branches in the host Member State’s territory should appoint a central contact point and what the functions of that central contact point should be

FINAL REPORT REGULATORY TECHNICAL STANDARDS AMENDING COMMISSION DELEGATED REGULATION (EU) 2018/1108 ON THE CRITERIA FOR THE APPOINTMENT OF CENTRAL CONTACT POINTS FOR ELECTRONIC MONEY ISSUERS AND PAYMENT SERVICE PROVIDERS AND WITH RULES ON THEIR FUNCTIONS UNDER
ARTICLE 45(10) OF DIRECTIVE (EU) 2015/849
14
Commission Delegated Regulation 2018/1108 already details the criteria to be used when deciding whether foreign PSPs or EMIs that operate establishments in forms other than branches in the host Member State’s territory should appoint a central contact point and what the functions of that central contact point should be. With regards to the criteria to be used for CASPs, the EBA considered two options:
Option 2a: Align the criteria with the existing criteria for EMIs and PSPs, while only customising the substance of Article 3(1)(b) to make it relevant for CASPs. Option 2b: Aligning the criteria with the existing one applicable to EMIs and PSPs, together with introducing additional criteria for CASPs that would be also applicable to EMIs and PSPs. Introducing additional criteria for CASPs would also impact EMIs and PSPs and offer more precision. This would require a data analysis across all three sectors and would result in more extensive amendments to the RTS. However, this data analysis would incur costs for competent authorities while its outcomes could also trigger costs for entities that would have to deal with additional criteria to the existing ones (PSPs and EMIs). As mentioned above, the costs of tailoring the criteria are not justified, as a review will be performed shortly by AMLA. Besides, the EBA mandate does not include changes to the criteria for appointing a central contact point regarding EMIs and PSPs. It is also important to highlight that aligning the criteria between PSPs, EMIs, and CASPs would ensure consistency across sectors. Regarding the introduction of a monetary threshold that triggers the appointment of a central contact point, the EBA considered different approaches and proposed a threshold that mirrored that set for PSPs and EMIs. Following the public consultation, the EBA reassessed these options but decided to maintain the threshold as proposed. This was because a) the high level of Money Laundering/Terrorist Financing (ML/TF) risk associated with the most common form of ‘establishment’ of a CASP in another Member State than that in which it is based, i.e. crypto ATMs; b) the need to ensure a comprehensive approach that includes all types of crypto services; and c) the lack of evidence provided by respondents regarding the adverse impact the proposed threshold would have. Option 2a has therefore been chosen as the preferred option and the draft RTS will align the criteria with the existing criteria for EMIs and PSPs, while only customising the substance of Article 3(1)(b) to make it relevant for CASPs. D. Options considered The draft RTS amending Commission Delegated Regulation (EU) 2018/1108 on the criteria for the appointment of central contact points for EMIs and PSPs, including rules on their functions under
Article 45(10) of Directive (EU) 2015/849, will set the criteria to be used when deciding whether
foreign PSPs, EMIs, and CASPs that operate establishments in the host Member State’s territory should appoint a central contact point and what the functions of that central contact point should be. For the concerned entities and competent authorities, the draft RTS is not expected to trigger significant additional costs, as amendments to the existing Commission Delegated Regulation (EU)

The scope of the RTS: It was suggested that the RTS revision be used to enhance standards
for EMIs and PSPs.
As set out in the rationale and IA part of this report, a comprehensive review of Commission Delegated Regulation (EU) 2018/1108 was not conducted because AMLA has to deliver a comparable mandate under Article 41(2) of the new Directive (EU) 2024/1640 (AMLD6), and any adjustments to the overall approach could be made at that stage.
The form of the central contact point: It was argued that a central contact point’s tasks can
be handled virtually, with the contact point potentially based in the firm’s home Member State. Proponents of this approach believed that this approach aligned with how CASPs operate in host Member States. Access to AML/CFT expertise would be ensured while costs would be kept low. Periodic travel to the host Member State would be possible when necessary. The mandate in Article 45(10) of Directive (EU) 2015/849 does not extend to the EBA specifying the form a central contact point must take or where a central contact point must be based.

Central contact point appointment as a last resort: It was suggested that appointing a central
contact point should not be necessary in low-risk financial crime contexts. The RTS introduces a two-step approach to appointing a central contact point. Specifically, a central contact point may have to be appointed if an entity’s operations in a host Member State exceed certain thresholds, or if the ML/TF risk is increased. This means that most CASPs that do not carry out material business in the host Member State and do not present high ML/TF risk will not have to appoint a central contact point.
Definition of 'Establishment': Respondents were concerned about ambiguity in the concept
of ‘establishment’ - particularly for non-ATM service providers.
The term ‘establishment’ is defined in Article 2(1) of AMLR (Anti-Money-Laundering Regulation). The definition applies to service providers, including crypto-asset services, and should be assessed based on the actual pursuit of activities through stable infrastructure in the relevant Member State. This Article and Recital 27 correctly provide clarification of what could be considered an establishment.
Role of AMLA: It was argued that AMLA’s pan-European coverage will reduce the need for
central contact points.
AMLA’s creation is a significant step towards a consistent approach to AML/CFT supervision in the EU. It does not replace the need for a central contact point, as national AML/CFT supervisors remain responsible for the AML/CFT supervision of most establishments operating within their territory.
Unclear criteria and terminology: Several concerns were raised about unclear criteria for ‘Size
and scale of activities’ in Recital 4, ‘Size and complexity’ in Article 6(1)(c), and how Member States assess the need for a central contact point. It was also suggested that the terms ‘high risk’ and ‘commensurate with ML/TF risk’ are subjective across the EU and that predefined examples (e.g. Financial Action Task Force (FATF) Red Flag Indicators) be provided to ensure consistency. These concepts are intended to allow for a proportionate application of the requirements, tailored to the specific characteristics of CASPs and other entities. However, the EBA clarified in the compliance table below some of these concepts and enhanced the background of the report, where applicable.
Proportionality of the central contact point threshold: There were concerns that the
threshold in Article 3(1)(b) may be disproportionate and difficult to assess because CASPs provide multiple services, making it easier for them to exceed limits faster than traditional firms. Equally, it was argued that the EUR 3 million turnover threshold was too low for CASPs to sustain compliance costs, with a proposal to raise it to EUR 50 M–100 M to ensure feasibility.

FINAL REPORT ON REGULATORY TECHNICAL STANDARDS AMENDING COMMISSION DELEGATED REGULATION (EU) 2018/1108 ON THE CRITERIA FOR THE APPOINTMENT OF CENTRAL CONTACT POINTS FOR ELECTRONIC MONEY ISSUERS AND PAYMENT SERVICE PROVIDERS AND WITH RULES ON THEIR FUNCTIONS UNDER ARTICLE 45(10) OF DIRECTIVE (EU) 2015/849 20 Summary of responses to the consultation and the EBA’s analysis Comments Summary of responses received EBA analysis Amendments to the proposals Responses to questions in Consultation Paper EBA/CP/2024/23 Question 1. Do you have any comments on the recitals? Recital 4,
Article 6,
paragraph
1
One respondent noted that the notion of ‘size and scale of the activities’ in Recital 4 is not clear and it is not immediately evident what can trigger such a requirement. Furthermore, the respondent does not consider it to be a quantitative criterion. One respondent is of the view that the notion of ‘size and complexity’ in Article 6(1)(c) is neither clear nor objective, and that it is not entirely clear what could trigger this requirement. Size generally refers to quantitative factors, such as the volume of transactions, number of customers, or market share within the host Member State. Scale or complexity captures the broader operational footprint, including factors like the range of services offered, the complexity of the business model, or the reliance on local infrastructure (e.g. local offices, partnerships, or reliance on local service providers). This wording follows the approach already applied to EMIs and PSPs, ensuring consistency across different sectors. The reference to ‘size and scale’ or ‘size and complexity’ allows for a proportionate and risk-based application of the requirement, recognising that the impact of an entity’s activities in a host Member State may vary. Additionally, the criteria have been adapted to reflect the specific nature of crypto-asset services, as outlined in Recital 27 of Regulation (EU) 2024/1624. No change. Recital 5 One respondent requested that the EBA clarify Recital 5 to confirm that Member States should assess the specific criteria within their own jurisdiction, rather than cumulatively across all other Member States, when determining whether a CASP is required to appoint a central contact point. This is linked to the nature of the requirement in Article 45, paragraph 9 of Directive (EU) 2015/849. However, the EBA will amend the text for clarity. Recital 4 of the draft RTS has been amended as follows:
‘Amendments should also include the introduction of criteria for determining the circumstances in which host Member States might may require crypto-asset service

FINAL REPORT ON REGULATORY TECHNICAL STANDARDS AMENDING COMMISSION DELEGATED REGULATION (EU) 2018/1108 ON THE CRITERIA FOR THE APPOINTMENT OF CENTRAL CONTACT POINTS FOR ELECTRONIC MONEY ISSUERS AND PAYMENT SERVICE PROVIDERS AND WITH RULES ON THEIR FUNCTIONS UNDER ARTICLE 45(10) OF DIRECTIVE (EU) 2015/849 21 Comments Summary of responses received EBA analysis Amendments to the proposals providers must to appoint a central contact point.’ Recital 5 of the draft RTS has been amended as follows:
‘As is the case for electronic money issuers and payment institutions, host Member States should …’ Question 2. Do you have any comment on the amendments proposed in Article 2, paragraph (1)? No responses were received regarding this question in the consultation paper. Question 3. Do you have any comments on the amendments proposed in Article 2, paragraph (2)? No responses were received regarding this question in the consultation paper. Question 4. Do you have any comments on the amendments proposed in Article 2, the following paragraph (4)? No responses were received regarding this question in the consultation paper. Question 5. Do you have any comments on the amendments proposed in Article 3, paragraph (1)? No responses were received regarding this question in the consultation paper. Question 6. Do you have any comments on the amendments proposed in Article 3, paragraph (1) point (b)? Particularly, do you agree with the specific criteria introduced for CASPs in Article 3, paragraph (1) point (b)? If not, please (i) explain why, (ii) provide data or other evidence to support your position, and (iii) describe an alternative drafting proposal
Article 3,
paragraph
Two respondents noted that small-scale businesses may not generate enough revenue to cover the costs of appointing a central contact point, suggesting a Regarding the point about proportionality, the requirement to appoint a central contact point should not create barriers to market entry or result in compliance costs that exceed what is
Article 3, paragraph (1) point
(b) was amended as follows:

It does not account for CASP's operational realities, as they often provide multiple services simultaneously, making it easier to exceed the
threshold compared to other financial entities.
Aggregating all services under one threshold
overlooks varying ML/TF risks, leading to disproportionate compliance obligations.
Some services, such as portfolio management,
cannot be quantified like transaction-based services, creating uncertainty about when the threshold is exceeded and how to calculate volumes transversally (quantity or number of transactions/services vs their monetary value). necessary to achieve the objective of Article 45(9) of Directive (EU) 2015/849. The €3 million threshold was established in the original RTS and set at the point where an appointing institution's operations in the host Member State are considered by competent authorities to be sufficiently complex to warrant specific AML/CFT oversight by the host Member State’s competent authorities. Furthermore, the cost of appointing and maintaining a central contact point will vary based on a range of factors, including the complexity of the appointing institution's operations in the host Member State, the cost of labour and office space in the host Member State, the way the institution structures its compliance functions, and, importantly, the host Member State's requirements regarding the form the central contact point should take (which may include a stand-alone position or not), among other factors. However, based on information provided by respondents regarding the potential impact of the proposed threshold on their business, the proposed approach has been retained for two reasons: (a) focus on volumes of transactions would exclude certain services listed in Article 3(16), for instance, ‘placing’; and (b) the high level of ML/TF risk associated with most forms of ‘establishments’ by CASPs, i.e. Crypto ATMs, justifies alignment with the thresholds applicable to PSPs and EMI. The EBA acknowledges the diverse range of services provided by CASPs, the varying levels of ML/TF risk associated therewith, and the difficulties in calculating and assessing volumes to match the €3 million. For this reason, the draft has been amended to refer to value instead. The term ‘value’ refers to the total value of the services or activities provided. The calculation should consider the aggregated value of all services and activities (measured in EUR) at the time of the provision of the respective service or activity. ‘(b) the cumulative amount of the electronic money distributed and redeemed, or the cumulative value of the payment transactions executed, or the cumulative volume value of the services and activities carried out by the CASP’s establishments is expected to exceed EUR 3 million per financial year or has exceeded EUR 3 million in the previous financial year.’

FINAL REPORT ON REGULATORY TECHNICAL STANDARDS AMENDING COMMISSION DELEGATED REGULATION (EU) 2018/1108 ON THE CRITERIA FOR THE APPOINTMENT OF CENTRAL CONTACT POINTS FOR ELECTRONIC MONEY ISSUERS AND PAYMENT SERVICE PROVIDERS AND WITH RULES ON THEIR FUNCTIONS UNDER ARTICLE 45(10) OF DIRECTIVE (EU) 2015/849 23 Comments Summary of responses received EBA analysis Amendments to the proposals Question 7. Do you have any comments on the amendments proposed in Article 3, paragraph (2)? and Question 14. Do you have any comments on the amendments proposed in Article 6, paragraph 2?
Article 3,
paragraph
(2), Article
6, paragraph
2
Two respondents noted that the notion of
‘commensurate with the level of money laundering or terrorist financing risk’ is not clear and do not consider it to be a quantitative criterion. As it would be difficult to understand this aspect without further clarification, further clarification of this element was requested. The phrase ‘commensurate with the level of money laundering or terrorist financing risk’ is fundamental to the risk-based approach. It means that the intensity and nature of AML/CFT measures should be proportionate to the level of risk identified. In this context, Member States can require central contact points where this is necessary in light of, and commensurate with, the ML/TF risk associated with the operation of foreign institutions’ establishments in their territory. This means that Member States are required to assess and tailor their central contact point framework based on the specific risks they identify in their domestic markets. The RTS does not prescribe the form a risk assessment should take. No change. Question 8. Do you have any comments on the amendments proposed in Article 3, paragraph (4)?
Article 3,
paragraph
(4)
One respondent stated that, since the notions of ‘reasonable grounds’ and ‘high risk’ seem to be somewhat subjective, the assessment of this requirement may vary across the EU. Therefore, the respondent suggests that providing defined examples of indicators of ‘high risk,’ akin to the Red Flag Indicators of the FATF, would help establish a standardised approach among Member States, as interpretations of this concept might otherwise differ. The respondent also noted that if Member States were required to explain the criteria used in their assessments and evaluations of ‘high risk’, and if these criteria were accessible to CASPs, it would assist CASPs The EBA Risk-based supervision guidelines set out how competent authorities should assess ML/TF risk. Equally, going forward, supervisors’ risk assessment methodologies will be further aligned based on a common approach under Article 40 of the AMLD6. No change.

FINAL REPORT ON REGULATORY TECHNICAL STANDARDS AMENDING COMMISSION DELEGATED REGULATION (EU) 2018/1108 ON THE CRITERIA FOR THE APPOINTMENT OF CENTRAL CONTACT POINTS FOR ELECTRONIC MONEY ISSUERS AND PAYMENT SERVICE PROVIDERS AND WITH RULES ON THEIR FUNCTIONS UNDER ARTICLE 45(10) OF DIRECTIVE (EU) 2015/849 25 Comments Summary of responses received EBA analysis Amendments to the proposals This means that the EBA's mandate is restricted to updating the Commission Delegated Regulation (EU) 2018/1108 to include CASPs. In addition, AMLA has a comparable mandate under Article 41(2) of the new Directive (EU) 2024/1640 (AMLD6), and any adjustments to the overall approach could be made at that stage. General comment Three respondents believe a central contact point’s tasks can be managed remotely with minimal need for a physical presence in the host Member State. They suggest that appointing a central contact point at the firm’s home Member State offices should be possible. The mandate in Article 45(10) of Directive (EU) 2015/849 does not extend to the EBA specifying the form a central contact point must take or determining when PSPs, EMIs, and CASPs provide services in another Member State through establishments. On the basis of Recital 8 of Commission Delegated Regulation (EU) 2018/1108, ‘It is for each Member State to determine whether central contact points should take a particular form. Where the form is prescribed, Member States should ensure that the requirements are proportionate and do not go beyond what is necessary to achieve the aim of compliance with AML/CFT rules and facilitate supervision.’ It therefore falls to Member States to determine where a central contact point may be based. No change. General comment One respondent requested that the EBA refrain from using the acronym CCP when referring to a ‘central contact point’, as this term is widely recognised globally as referring to ‘central counterparties’. In the interest of clarity, the EBA has replaced the acronym in the report. Throughout the document amendments have been made to remove references to the CCP acronym. General comment Two respondents suggested that the requirement to appoint a central contact point should be an option of last resort and not an appointment that is triggered when there is low financial crime risk. The appointment of a central contact point is not always mandated, nor is it always linked to the ML/TF risk, as it serves to facilitate supervision by competent authorities of establishments' compliance with local AML/CFT requirements and to ensure compliance by the establishment, on behalf of their appointing institution. It rather depends on (a) whether the size and scale of activities meets or exceeds certain thresholds, or (b) whether a Member State considers that the risk of ML/TF associated with the The rationale section of this report has been amended for clarity.

FINAL REPORT ON REGULATORY TECHNICAL STANDARDS AMENDING COMMISSION DELEGATED REGULATION (EU) 2018/1108 ON THE CRITERIA FOR THE APPOINTMENT OF CENTRAL CONTACT POINTS FOR ELECTRONIC MONEY ISSUERS AND PAYMENT SERVICE PROVIDERS AND WITH RULES ON THEIR FUNCTIONS UNDER ARTICLE 45(10) OF DIRECTIVE (EU) 2015/849 26 Comments Summary of responses received EBA analysis Amendments to the proposals operation of such establishments is increased according to specific evidence. The rationale section of this report has been amended for clarity. General comment One respondent noted that the concept of ‘establishment’ is not defined, so it is challenging to understand which types of activities it relates to. Because provision of crypto-assets through ATMs is merely an example of one activity that constitutes an establishment, as a result of the use of the words ‘such as’ in Recital 27 of the AMLR, this is particularly relevant for service providers who provide services other than ATMs. The EBA notes that the term ‘establishment’ is defined in Article 2(18) of AMLR as ‘the actual pursuit by an obliged entity of an economic activity covered by Article 3 in a Member State or third country other than the country where its head office is located for an indefinite period and through a stable infrastructure’. In addition, because the nature of some crypto-assets services makes the notion of ‘establishment’ challenging from a practical perspective, the concept of establishment should follow that set out in Recital 27 of Regulation (EU) 2024/1624, where activities with limited physical equipment needed for operators that mainly service their customer through internet also constitute an establishment. No change. General comment One respondent is of the view that, given the panEuropean coverage that AMLA will provide, the need for establishing central contact points will be vastly diminished. The existence of AMLA does not replace the need for a central contact point. This is because national competent authorities will remain responsible for the AML/CFT supervision of most entities. No change.