{"id":100578,"date":"2025-10-22T08:41:53","date_gmt":"2025-10-22T07:41:53","guid":{"rendered":"https:\/\/www.ictrechtswijzer.be\/?p=100578"},"modified":"2025-10-22T08:50:12","modified_gmt":"2025-10-22T07:50:12","slug":"how-crypto-companies-circumvent-anti-money-laundering-rules","status":"publish","type":"post","link":"http:\/\/www.ictrechtswijzer.be\/en\/hoe-omzeilen-crypto-bedrijven-de-anti-witwasregels\/","title":{"rendered":"How do crypto companies circumvent anti-money laundering rules?"},"content":{"rendered":"

Crypto firms have in the past taken advantage of fragmented European regulations to circumvent anti-money laundering (AML\/CFT) controls. A recent and sharp report<\/a> from the European Banking Authority (EBA<\/a>) exposes these avoidance strategies. The central message: the new European regulation on crypto asset markets (MiCAR<\/a>) is a powerful weapon, but it will only be effective if all national regulators in the EU are aligned and enforce the rules uniformly.<\/p>\n\n\n\n

The crux of the problem: fragmented oversight<\/h2>\n\n\n\n

Before the introduction of MiCAR, the regulation of crypto assets was a patchwork of national rules. Some had strict licensing requirements, while others had looser registration requirements. This fragmentation was an open invitation for rogue or negligent parties to seek loopholes.<\/p>\n\n\n\n

The EBA report identifies six core tactics that crypto firms have employed to evade AML\/CFT supervision. These strategies remain a significant risk even under the new MiCAR regime if supervision is not harmonized.<\/p>\n\n\n\n

1. Operating without a permit<\/h3>\n\n\n\n

The most direct strategy was to simply offer services in an EU member state without the required local registration or license. This often occurred from third countries (outside the EU) or even from another EU member state where they were licensed, but without the appropriate passporting rights (if any). Regulators noted that warnings and fines often had little effect, and that these entities ended their activities only after an explicit cease-and-desist order.<\/p>\n\n\n\n

Forum shopping': looking for the weakest regulator 2.<\/h3>\n\n\n\n

Entities that did seek a permit engaged in forum shopping. They submitted applications to multiple EU member states simultaneously, hoping to find a jurisdiction with a (supposedly) more lenient permitting policy or less stringent oversight<\/sup>. As soon as a regulator started asking critical questions, such as about AML controls, the company withdrew its application and tried again in another member state<\/sup>.<\/p>\n\n\n\n

3. Abuse of 'reverse solicitation'<\/h3>\n\n\n\n

A common legal fiction is the invocation of \"reverse solicitation. The crypto-provider then claims that the EU customer has contacted it himself and on his own initiative, which would make the provider (usually based in a third country) not subject to EU rules. However, the EBA found that companies were pushing the boundaries of this by, for example, offering websites in the language of specific EU member states or using other marketing techniques that clearly amounted to active solicitation.<\/p>\n\n\n\n

4. Weak internal AML\/CFT controls and outsourcing.<\/h3>\n\n\n\n

Even among licensed entities, the EBA found serious and recurring deficiencies in internal AML\/CFT procedures. A notable trend is the outsourcing of crucial compliance tasks (such as customer due diligence and transaction monitoring) to entities within the same group, but located outside the EU. These \"group policies\" were often not adapted to specific EU requirements, and in practice the local EU office had little or no control over these outsourced processes.<\/p>\n\n\n\n

In addition, there was often:<\/p>\n\n\n\n