{"id":"circulars/cssf-25-879","title":"Circular CSSF 25/879","type":"circular","date":"2025-04-08","kind":"circular","html":"

Circular CSSF 25/879 is a CSSF circular, published 8 April 2025. Subject: Adoption of the EBA Guidelines on information requirements in relation to transfers of funds and certain crypto-assets transfers under Regulation (EU) 2023/1113 (“Travel Rule Guidelines”).

\n

Legal basis: Law of 6 February 2025 implementing MiCA, ELTIF 2 and the green bond regulation, Law of 16 July 2019 implementing the EuVECA, EuSEF and ELTIF regulations.

\n

Relevant for: AIFMs, AISPs, Central Securities Depositories (CSDs), Credit institutions, Credit servicers, Crypto-Assets Service Providers (CASPs), E-money institutions, Investment firms, Investment fund managers, Investment funds and vehicles, Management companies - Chapter 15, Management companies - Chapter 16, Other specific authorisations, registrations and information, Part II UCIs, Payment institutions, Payment institutions/electronic money institutions/AISPs, Pension funds, Securitisation undertakings, SICARs, SIFs, Specialised PFS, Support PFS, UCITS, Virtual asset service providers (VASPs).

\n

Main topic: Financial crime. Keywords: AML/CFT, Crypto-assets.

\n

Repeals Circular CSSF 18/680.

\n

Text

\n

Circular CSSF 25/879 Adoption of the EBA Guidelines on information requirements in relation to transfers of funds and certain crypto-assets transfers under Regulation (EU) 2023/1113 (“Travel Rule Guidelines”)

\n

Circular CSSF 25/879 Adoption of the EBA Guidelines on information requirements in relation to transfers of funds and certain crypto-assets transfers under Regulation (EU) 2023/1113 (“Travel Rule Guidelines”) To all payment service providers, all intermediary payment service providers, all crypto-asset service providers and all intermediary crypto-asset service providers, as further defined in section 2.

\n

Luxembourg 7 April 2025 Ladies and Gentlemen, The purpose of this circular is to inform you that the CSSF, in its capacity as competent authority, adopts the European Banking Authority (“EBA”) Guidelines (ref. EBA/GL/2024/11) on information requirements in relation to transfers of funds and certain crypto-assets transfers under Regulation (EU) 2023/1113 (hereafter the “Guidelines”). Pursuant to the adoption of the Law of 6 February 2025, adding notably Chapters 4e and 4f into the Law of 16 July 2019 on the operationalisation of European regulations in the area of financial services and implementing Regulation (EU) 2023/1114 on markets in crypto-assets (“MiCAR”) and Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets, the CSSF has integrated the Guidelines into its administrative practice and regulatory approach with a view to promoting supervisory convergence in this field at European level.

\n
    \n
  1. The Guidelines Based on aforementioned Regulation (EU) 2023/1113, these Guidelines set out common measures that payment service providers (PSPs), intermediary payment service providers (IPSPs), cryptoasset service providers (CASPs) and intermediary crypto-asset service providers (ICASPs) should put in place to detect and manage a transfer of funds or of crypto-assets lacking the required information on the payer/originator and the payee/beneficiary, and how these procedures should be applied. In addition, these Guidelines provide for specific measures regarding the identification and assessment of the risks of money laundering and terrorist financing associated with the transfer of crypto-assets directed to or originating from a self-hosted address. Key points addressed in the Guidelines include: 1. Information Requirements: •
    2. \n
\n

Mandate that transfers include specific information about the payer/originator and the payee/beneficiary, such as notably but not limited to names, account numbers, and addresses.

\n

Require measures of verification of the accuracy and completeness of this information before the execution of transfers.

\n

Different rules may be applicable whether the transfer is made within or outside to the European Union.

\n
    \n
  1. Detection and Management of Missing Information: •
    2. \n
\n

PSPs, IPSPs, CASPs and ICASPs should implement procedures to detect and manage transfers lacking required information.

\n

Specificities are provided regarding the actions to take when information is missing or incomplete, including requesting missing data and, if necessary, rejecting or suspending the transfer and reporting to the competent authority.

\n
    \n
  1. Risk-Based Approach: •
    2. \n
\n

PSPs, IPSPs, CASPs and ICASPs should adopt a risk-based approach in implementing these requirements, considering the specific risks associated with different types of transfers and customers.

\n
    \n
  1. Self-Hosted Wallets: •
    2. \n
\n

Guidance is provided on handling transfers involving self-hosted addresses, including measures for identifying, assessing and mitigating risks associated with such transactions.

\n
    \n
  1. Direct Debits: •
    2. \n
\n

Clarification is provided regarding the application of these requirements to direct debit transactions, ensuring consistent compliance across different payment methods.

\n

The text above is the opening of the document; the PDF carries the whole.

\n

Document page, PDF. Source: Commission de Surveillance du Secteur Financier (CSSF), reproduced with the CSSF's consent. The French text prevails.

"}