AMLA's CDD RTS for CASPs: Wallet and Sanctions Screening

By the Guardian team Updated November 2026 5 min read

Quick answer. Under AMLA's final draft, CASPs must screen customers, beneficial owners and controllers against targeted financial sanctions, including names, aliases and listed wallet addresses. Onboarding, list changes and data changes trigger screening; AMLA refused to make it risk-based.

Watch: AMLA's CDD RTS for CASPs: Wallet and Sanctions Screening 1:44

Video transcript

Under AMLA's final draft, crypto asset service providers must screen customers, owners and controllers against sanctions lists, including listed wallet addresses. And AMLA refused to make it risk-based.

AMLA published its final draft on September 30, 2026 and submitted it to the European Commission. It is not law until adopted, but the AMLR applies from July 10, 2027. Build to the draft now.

Screen customers, beneficial owners and anyone who controls a customer. Check every name and alias, plus digital wallet addresses where a sanctions list includes them.

Screen at onboarding, whenever a sanctions list changes, and whenever customer data changes, like name, residence or owners. Rescreen regularly, matched to your exposure.

AMLA said sanctions compliance cannot depend on a customer's money laundering risk. Tools may be automated or manual, but must be effective.

For self-hosted wallets, transfers above 1,000 euros require you to assess whether your customer owns or controls the address. EBA guidelines already expect every transfer screened before release.

Keep list versions, timestamps, alerts and decisions as evidence, and review the screening system at least yearly.

Guardian's readiness assessment maps each provision to its control, evidence and gap. Our pentests check that flows like a withdrawal awaiting screening cannot be replayed or driven out of order.

Read the full build list in the article, or talk to Guardian about proving your screening cannot be skipped.

From July 10, 2027, the AMLR (Regulation (EU) 2024/1624) puts the EU's anti-money laundering rules for firms in one directly applicable regulation (Article 90).

Article 28(1) asks AMLA, the EU's new anti-money laundering authority, to specify what firms collect for customer due diligence (CDD).

AMLA published its final draft on September 30, 2026 and has submitted it to the European Commission. For CASPs, the headline is wallet addresses in sanctions screening.

This article explains the technical and security side of AMLA's final draft RTS under Article 28(1) of the AMLR (Regulation (EU) 2024/1624). It is not legal advice; confirm how it applies to you with counsel.

Status and Timeline

The text is a final draft regulatory technical standard (RTS). It becomes law only once the Commission adopts it and it is published in the Official Journal.

AMLA's tracker still lists it as "Final report published" (last updated October 7, 2026).

Date	Step
March 12, 2024	Commission asks the EBA to prepare the standards
October 30, 2025	EBA delivers its advice to the Commission
December 30, 2025	EBA sanctions screening guidelines for CASPs apply
February 9 to May 8, 2026	AMLA consults on a revised draft; 325 responses
September 30, 2026	AMLA's final report
October 1, 2026	AMLA says the draft has been submitted to the Commission
July 10, 2027	The AMLR applies
Six months after entry into force	The RTS applies (Article 29)

Our reading: build to the draft now. The AMLR duties it details, including sanctions checks (Article 20(1)(d)), apply from July 10, 2027 either way.

Standard Due Diligence

The draft says what "identify" means in data fields. The core items:

Item	What the draft specifies	Article
Names	Every name on the ID; legal and trade names for entities	2
Address	Country, city and postcode, street and number	3
Nationality	Reasonable measures to find all; verify at least one	5
ID document	Names, birth data, number, expiry, photo, signature, security features	6
Remote checks	eID first; justified alternatives with holder-match and record safeguards	7
Ownership	Legal form, nominees, jurisdiction and stakes at each layer	11
Purpose	Intended use, expected amounts, source and destination of funds	16

The purpose items are a menu: collect what the risk calls for (Article 16(2)).

Two AMLR rules name CASPs directly:

Full CDD on occasional transactions from EUR 1,000; identity checks below that (Article 19(3)).
No anonymous crypto-asset accounts, including through anonymity-enhancing coins (Article 79(1)).

Simplified and Enhanced Due Diligence

The draft sets a floor for low-risk customers and a menu for high-risk ones.

Level	What to collect	Article
Simplified	Names, place and date of birth, nationality; no address needed	18
Simplified	Owners identified from one source, verified from another	19
Simplified	Intended use, expected value, occupation; may be inferred	20
Enhanced	Reputation, ownership rationale, expert opinion on complex structures	21
Enhanced	Destination of funds, expected transactions, key counterparties	22
Enhanced	Proof that source of funds and wealth is lawful	23

Article 23 accepts evidence from "reputable commercially available service providers, including analytical services". Our reading: blockchain analytics can support a crypto source-of-funds file.

Customer data must be refreshed at least yearly for higher-risk customers and every 5 years for others (AMLR Article 26(2)).

Sanctions Screening

Article 25 of the draft sets the screening rules, and they apply to every customer.

Who and what to screen

Firms must screen customers, beneficial owners, and anyone who controls or meets the ownership test for a customer (Article 25(1)). Add the person acting for the customer if you suspect evasion.

Individuals: all names, in the original alphabet and/or Latin transliteration.
Entities: the legal name and any different trade names.
Where available: other names, aliases and digital wallet addresses included in sanctions lists.

When to screen

At onboarding, or before an occasional transaction.
When a sanctions list changes.
When customer data changes: name, residence, nationality, business or owners.
Regularly, at a frequency matching your sanctions exposure.
Without undue delay once UN sanctions are public, and once updated sanctions apply.

Why it is not risk-based

Some respondents asked for a general risk-based approach. AMLA refused: compliance "cannot be made dependent on the level of ML/TF risk associated with a customer".

Tools may be automated, manual or both, chosen for your size and risks. Either way, screening must be effective, and AMLA says manual checks are not "a lower standard of compliance".

The RTS covers targeted financial sanctions only; trade sanctions and travel bans fall outside it (recital 23).

Wallets and Transfers

The draft mentions crypto wallet addresses only for screening. Transfers and self-hosted wallets sit in other texts.

Transfer data: transfers carry originator and beneficiary details, including ledger addresses (TFR Article 14).
Self-hosted: above EUR 1,000, assess whether your customer owns or controls the address (TFR Articles 14(5), 16(2)).
Restrictive measures: CASPs need controls to apply EU and national sanctions to transfers (TFR Article 23).
From 2027: AMLR Article 40 adds risk-based measures for self-hosted transfers.

The EBA guidelines under TFR Article 23 have applied since December 30, 2025 (EBA/GL/2024/15). They expect CASPs to:

screen all crypto transfers before making assets available to the beneficiary;
screen originator and beneficiary wallet addresses that appear in official lists;
calibrate and document fuzzy matching; and
review the screening system at least once a year.

From July 10, 2027, the EBA notes, controls for targeted financial sanctions fall under the AMLR. For the FATF's view of unhosted wallets, see FATF on stablecoins and unhosted wallets.

Build List for CASPs

Load every listed wallet address, name and alias into the screening dataset.
Screen each new customer, owner and controller before onboarding completes.
Rescreen customers without undue delay whenever a list changes.
Trigger rescreening on KYC changes: name, residence, nationality, ownership.
Screen both sides of every transfer before releasing assets.
Record how you assessed ownership of self-hosted addresses above EUR 1,000.
Calibrate fuzzy matching, document why, and review the system at least yearly.
Keep list versions, screening timestamps, alerts and decisions as evidence.

For where this sits beside MiCA and DORA, see What Is MiCA? and Crypto Regulatory Compliance.

How Guardian Helps

Guardian's Regulatory & Compliance readiness assessment lists each provision by citation, with the control that meets it, the evidence that proves it and the gap.

Guardian's API and web app pentests test value-moving flows, including multi-step flows that can be interrupted, replayed or driven out of order.

A withdrawal that should wait for a screening result is one of those flows.

Frequently Asked Questions

Is AMLA's CDD RTS final?

Not yet. AMLA has submitted the final draft to the Commission, which must adopt it before it is published in the Official Journal. It applies six months after entering into force; the AMLR applies from July 10, 2027.

Do CASPs have to screen wallet addresses?

Under the draft, yes, where a sanctions list includes them (Article 25). EBA guidelines have expected it since December 30, 2025.

Can sanctions screening be risk-based?

No. AMLA said sanctions compliance cannot depend on a customer's money laundering risk. Only the frequency of regular rescreening and the choice of tools scale with your exposure and size.

What applies to self-hosted wallets?

The Transfer of Funds Regulation already does: above EUR 1,000, assess whether your customer owns or controls the address. From July 10, 2027, AMLR Article 40 adds risk-based measures.

Sources

Prove your screening cannot be skipped

Guardian maps the AMLR provisions that reach you and tests the onboarding and withdrawal flows your screening depends on.

Talk to Guardian Explore regulatory compliance