On 27 November 2023, the European Banking Authority (EBA) published a final report containing updated guidelines on risk-based supervision. The guidelines have been amended so that they extend to anti-money laundering and countering the financing of terrorism (AML/CFT) supervisors of crypto-asset service providers (CASPs) as defined in the Regulation on markets in crypto-assets (MiCA).

Article 36 of Regulation (EU) 2023/1113 (the EU Transfer of Funds Regulation) requires the EBA to issue guidelines addressed to Member State competent authorities on the characteristics of a risk-based approach to the supervision of CASPs and the steps to be taken when conducting such supervision. Also, MiCA will bring crypto-asset services and activities within the EU regulatory scope and will ensure that CASPs become subject to EU AML/CFT obligations and supervision.

The amendments to the guidelines provide guidance on the sources of information available to Member State competent authorities when supervising CASPs and how they should determine the type of guidance needed within the sector and how to communicate this guidance in the most effective manner. It also stresses the importance of a consistent approach in setting supervisory expectations, where Multiple Member State competent authorities are responsible for the supervision of the same institutions.

The updated guidelines will be translated into the official EU languages and published on the EBA’s website. A consolidated version of the guidelines will also be published on the EBA’s website. The deadline for Member State competent authorities to report whether they comply with the updated guidelines will be two months after the publication of the translations. The updated guidelines will apply from 30 December 2024.