EBA Sanctions Screening Guidelines for CASPs: A Checklist

Video transcript

Since December 30, 2025, EBA guidelines say CASPs should screen every crypto transfer before the assets become available. Most of the work is engineering.

These are guidelines, so firms must make every effort to comply. From July 2027, sanctions controls move under the AMLR.

Paragraph 19 is the core rule, and it covers withdrawals too. Our reading: screen them before signing, since a broadcast cannot be recalled.

The consultation draft said before completion, but incoming onchain transfers cannot be screened before they execute. So the EBA chose availability, and added the customer's own wallet address.

Our reading for deposits: received onchain, held in screening, available only once it clears. Confirmed matches are frozen in a suspense account and reported.

Each transfer screen covers originator and beneficiary information, the purpose, every provider involved including intermediaries, and both wallet addresses where official lists include them.

Screening should use fuzzy matching, calibrated per measure and documented. Only exact matching works for structured identifiers like country codes, and our reading puts normalized wallet addresses there too.

Test for bypasses. Deposit on a new chain or token, move assets internally, use the API instead of the app, retry a held withdrawal, and time rescreening after a list change.

Guardian maps each provision to its control, evidence and gap, and pentests these flows. Read the full checklist, or talk to Guardian at guardian.security.

EU law already requires CASPs to have controls that apply sanctions to crypto transfers (Transfer of Funds Regulation, Article 23).

Since December 30, 2025, the EBA's guidelines say what those controls should look like.

Most of the work is engineering: when a deposit becomes spendable, which addresses get checked, and what your records can prove.

This article explains the technical and security side of EBA/GL/2024/15. It is not legal advice; confirm how it applies to you with counsel.

Status and Scope

One EBA final report holds two sets of guidelines:

• EBA/GL/2024/14: banks, payment and e-money institutions. Governance, exposure assessment, training.
• EBA/GL/2024/15: payment service providers (PSPs) and CASPs performing transfers under the TFR.

GL/2024/15 tells CASPs to follow GL/2024/14 too (paragraph 1). Paragraph numbers below are from GL/2024/15 unless marked.

They are EBA guidelines: firms "must make every effort to comply", and the text says "should" throughout.

The EBA says it will amend the guidelines after July 2027, once the AMLR (Regulation (EU) 2024/1624) governs these controls.

For AMLA's draft screening rules under the AMLR, see AMLA's CDD RTS for CASPs.

Screen Before Release

The core rule is paragraph 19. CASPs "should screen all transfers of crypto-assets before making the crypto-assets available to the beneficiary".

The consultation draft said "before completion". Two respondents explained that an incoming onchain transfer cannot be screened before it executes.

The EBA agreed there are technical limitations and replaced "completion" with "making the funds available".

Those respondents expected the sector to segregate assets until it can screen all parties.

Deposits

Our reading: a deposit can confirm onchain, but the balance should not become spendable, tradable or withdrawable until screening clears.

That turns crediting into states: received, screening, available or frozen.

Withdrawals and late data

Paragraph 19 covers all transfers, and paragraph 20 all parties to them. Outgoing transfers are in scope too.

Our reading: screen a withdrawal before it is signed. Once broadcast, it cannot be recalled.

Information that arrives later, before or after execution, should also be screened (paragraph 22).

What to Screen

Customers

Screen the whole customer base regularly, at a frequency set by your exposure assessment (paragraph 15). Screening should always run on these triggers (paragraph 16):

• New designations, or changes to any restrictive measure.
• Onboarding, before the business relationship starts.
• Significant due diligence changes, such as name, residence or nationality.
• Grounds to suspect the customer is trying to circumvent sanctions.

At minimum, screen names (original or transliterated) and dates of birth for individuals, and legal names for entities.

Add aliases, trade names and wallet addresses where the lists include them (paragraph 17). Skipping available data needs a justification in your exposure assessment.

Screen beneficial owners and anyone acting for the customer too, where that information is available (paragraph 18).

Transfers

Paragraph 21 sets the minimum data for each transfer:

• Originator and beneficiary information under TFR Article 14.
• The transfer's purpose, plus free-text fields where available and your exposure assessment calls for it.
• Every PSP and CASP involved, including intermediaries.
• Originator and beneficiary wallet addresses, to the extent official lists include them.

The consultation draft named only the beneficiary's address. After feedback, the EBA added the customer's own address.

Where volumes justify it, CASPs should consider adding blockchain analysis to transaction monitoring (paragraph 23).

Lists

Detect new, updated and lifted measures. Update your screening dataset "immediately" after each takes effect (paragraph 9).

You may whitelist people who keep producing false alerts. Document why, and review the whitelist immediately after every list change or customer data change (paragraph 13).

Fuzzy Matching and Alerts

Paragraph 24 asks for fuzzy matching: alerts on near matches in spelling, pattern or sound, not only exact hits.

Calibration should be neither so sensitive that it floods analysts nor so loose that designated persons slip through.

Set parameters per measure from tested true positive rates. Recalibrate periodically and document the rationale (paragraph 25).

The EBA also said only exact matching can apply to structured identifiers, such as country codes, BICs and LEIs.

Our reading: treat wallet addresses the same way, after normalizing their format.

Handling alerts

• Start investigating every potential match without delay (paragraph 32).
• Document each decision under your record-keeping policy.
• Use two-person review for higher-exposure situations.
• Refrain from serving a party until an unresolved match is decided (paragraph 35).

Once a match is confirmed, CASPs should immediately freeze the assets in a suspense account (paragraph 49).

They stay there until the national sanctions authority gives instructions. Report the action without delay, or within any set deadline (paragraph 50).

Testing and Records

Review the screening system at least once a year, and at once if you doubt it is fit for purpose (paragraph 6).

Under DORA Article 8, understand and document what the system can and cannot do (paragraph 7).

What testing should check

Paragraph 56 lists the tests:

• Calibration of the matching settings.
• Accuracy of list management against current measures.
• Whether every customer and transfer is screened when required.
• Whether the right transfers and fields feed the system.
• How quickly automatic suspension happens.
• Whether alert handling allows prompt reporting.

Report significant weaknesses to the management body and fix them without delay (paragraph 57).

What to keep

The guidelines do not list log fields. They do expect these records:

Our reading: per transfer, also log the list version, screening time, fields screened, result and release time. Together they show screening came before release.

CASP Control Checklist

Each control maps to a section above, our readings included.

• Hold every deposit as unavailable until both parties clear screening.
• Screen withdrawals before signing, with no path around the check.
• Load listed wallet addresses for every chain and asset you support.
• Update the dataset immediately after each list change, then rescreen customers.
• Calibrate fuzzy matching per measure, and write down why.
• Freeze confirmed matches in a suspense account, then report.
• Review the system yearly and test it against paragraph 56.

Next, bypass tests: our reading of paragraph 56(c) and (d).

• Deposit on a newly added chain or token. Is it screened?
• Move assets between two customers internally. Does screening run?
• Withdraw through the API instead of the app. Same checks?
• Retry a held withdrawal. Can it skip the queue?
• Publish a list change. How long until customers are rescreened?

For the wider MiCA control set, see the MiCA compliance checklist.

How Guardian Helps

Guardian's Regulatory & Compliance readiness assessment lists each provision by citation, with the control that meets it, the evidence that proves it and the gap.

Guardian's web app pentests attack value-moving flows, such as a withdrawal waiting on screening: step ordering, replay, race conditions and the confirmations guarding each.

Its API pentests check multi-step flows that can be interrupted, replayed or driven out of order.

Frequently Asked Questions

When do the EBA sanctions screening guidelines apply?

Both sets, EBA/GL/2024/14 and EBA/GL/2024/15, apply from December 30, 2025. From July 10, 2027, targeted financial sanctions controls fall under the AMLR, and the EBA will amend the guidelines.

Do CASPs have to screen crypto deposits before crediting them?

CASPs should screen all transfers before making the assets available to the beneficiary. The EBA agreed there are technical limits to screening incoming transfers before they execute onchain, so the control point is availability, not receipt.

Must CASPs screen wallet addresses?

They should, to the extent that official lists linked to restrictive measures include them. That covers customers' addresses and the originator and beneficiary addresses on each transfer (paragraphs 17 and 21).

Are the guidelines binding?

They are EBA guidelines under Article 16 of the EBA Regulation: authorities and firms must make every effort to comply. The duty to have sanctions controls is binding law (TFR Article 23).

Sources

• EBA: Final Report on Guidelines on internal policies, procedures and controls to ensure the implementation of Union and national restrictive measures, EBA/GL/2024/14 and EBA/GL/2024/15 (November 14, 2024)
• EUR-Lex: Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets (TFR), OJ L 150 (June 9, 2023)
• Guardian: AMLA's CDD RTS for CASPs: Wallet and Sanctions Screening
• Guardian: Regulatory & Compliance Assessments
• Guardian: WebApp Pentest
• Guardian: API Pentest