4.2 European Union Regulatory Framework: AMLD6, the AML Package, and MiCA

The European Union has undertaken the most comprehensive structural overhaul of its anti-money laundering and crypto-asset supervisory architecture in its history. Historically reliant on directives requiring transposition into disparate national legal codes across 27 Member States, the EU has transitioned to an integrated Single Rulebook backed by a centralized pan-European regulator and comprehensive digital asset market legislation. For compliance professionals, navigating the European landscape requires understanding the criminal harmonization of AMLD6, the institutional authority of the 2024 AML Package, the crypto Travel Rule under the Transfer of Funds Regulation (TFR), and market conduct rules under the Markets in Crypto-Assets Regulation (MiCA).

Evolution of the EU AML Architecture: From Directives to Direct Regulation

For more than three decades, European anti-money laundering legislation developed through successive European directives:

• 1st to 3rd AML Directives (1991–2005): Began by targeting the proceeds of drug trafficking, expanded to terrorism financing post-2001, and extended obligations from commercial banks to non-financial professions (lawyers, accountants, real estate agents).
• 4th & 5th AML Directives (AMLD4/AMLD5, 2015–2018): Mandated central beneficial ownership registers (in November 2022 the EU Court of Justice struck down general public access, so access now depends on a legitimate interest), broadened Politically Exposed Person (PEP) definitions to include domestic officials, and brought virtual currency exchange platforms and custodian wallet providers into the regulated AML perimeter for the first time.

Despite these advancements, the European Commission identified a critical systemic flaw: Directives require national transposition. Member States frequently enacted directives with varying definitions, disparate enforcement mechanisms, and inconsistent thresholds. This regulatory fragmentation invited regulatory arbitrage, where international financial networks and illicit actors funneled transactions through jurisdictions with less rigorous compliance oversight. High-profile cross-border banking scandals highlighted the urgent necessity of directly applicable regulations and centralized supranational supervision.

---

6th Anti-Money Laundering Directive (AMLD6 - Directive EU 2018/1673)

Adopted in October 2018, AMLD6 addresses the criminal law dimensions of anti-money laundering, harmonizing penal definitions and sanctions across the EU.

Key pillars of AMLD6 include:

1. 22 Designated Predicate Offences: AMLD6 standardized 22 specific predicate criminal activities that constitute money laundering across all Member States. These include participation in organized crime, terrorism, human trafficking, illicit arms trafficking, cybercrime, environmental crime, tax crimes, corruption, and market abuse. This eliminates cross-border legal loopholes where conduct criminalized in one Member State was not considered a predicate offence in another.
2. Criminalization of Self-Laundering & Dual Intent: AMLD6 mandates that individuals who convert, transfer, or disguise proceeds originating from their own criminal conduct ("self-laundering") face criminal prosecution distinct from the predicate offence. It also eliminates the requirement that a prior or simultaneous conviction for the predicate crime occur before prosecuting the money laundering offence.
3. Corporate Criminal Liability: Under Article 7 of AMLD6, Member States must ensure that legal persons (corporations, FinTechs, credit institutions) can be held criminally liable for money laundering committed for their benefit by any person who holds a leading position within the entity (based on a power of representation, authority to make decisions, or authority to exercise control). Furthermore, legal entities can be held criminally liable where a lack of supervision or control by senior management made the commission of the money laundering offence possible by a subordinate.
4. Aggressive Sanctions: AMLD6 mandates a maximum term of imprisonment of at least 4 years for natural persons convicted of serious money laundering. For corporate entities, sanctions include criminal or non-criminal fines, temporary or permanent disqualification from the practice of commercial activities, placing the entity under judicial supervision, judicial winding-up, and the permanent closure of establishments used to commit the offense.

---

The 2024 EU AML Package & The Single Rulebook (AMLR)

In 2024, the European Parliament and Council enacted a landmark legislative package that fundamentally transforms the EU compliance regime. At its center is the Anti-Money Laundering Regulation (AMLR, Regulation (EU) 2024/1624), which creates a directly applicable Single Rulebook across all 27 Member States. Unlike directives, the AMLR has direct legal effect: it needs no national transposition and, when it applies from 10 July 2027, it will apply in the same way to obliged entities across the Union. Until then, national laws based on the AML directives remain in force.

Expanded Scope of Obliged Entities

The AMLR significantly expands the perimeter of regulated entities subject to mandatory Customer Due Diligence (CDD), transaction monitoring, and reporting obligations:

• All Crypto-Asset Service Providers (CASPs): Full regulatory parity of crypto entities with traditional financial institutions.
• Crowdfunding Intermediaries: Platforms facilitating peer-to-peer capital formation and lending.
• Luxury Goods Traders: Merchants dealing in precious metals, precious stones, luxury motor vehicles, yachts, private aircraft, and cultural artifacts/antiques.
• Professional Football Sector: Professional football clubs and football agents handling high-value player transfers and investor transactions (with a transitional implementation window).

Universal EU Cash Payment Ceiling

To curb large-scale physical currency placement into the electronic financial system, the AMLR sets an EU-wide cap of €10,000 on cash payments for the purchase of goods or services, applying from July 2027. Member States retain the statutory discretion to maintain or enact lower domestic limits (for example, France and Spain enforce a €1,000 limit for tax residents, while Italy enforces a €5,000 ceiling), but no Member State can authorize commercial cash transactions above €10,000. Traders in goods and services must identify and verify customers making occasional cash payments between €3,000 and €10,000.

Harmonized Beneficial Ownership Standards

The AML Package unifies beneficial ownership determination across Europe:

• Standard Threshold: Codified at 25% or more of the shares, voting rights, or other ownership interests, or holding direct or indirect control over the legal entity.
• Enhanced Risk Threshold: Empowers supervisory bodies and the Commission to require a reduced 15% threshold for specific categories of legal entities associated with heightened money laundering risks.
• Interconnected Central Registers: Mandates that national beneficial ownership registers verify submitted data, perform cross-checks against identity records, and remain interconnected across borders via the European Central Platform (BORIS).

---

The European Anti-Money Laundering Authority (AMLA)

The centerpiece of the 2024 institutional reforms is the establishment of the Anti-Money Laundering Authority (AMLA), headquartered in Frankfurt am Main, Germany (under Regulation EU 2024/1620). AMLA began operating in 2025; it will select the entities it supervises directly in 2027 and start direct supervision in 2028.

                                  EUROPEAN AMLA SUPERVISORY STRUCTURE
                                                  │
                      ┌───────────────────────────┴───────────────────────────┐
                      ▼                                                       ▼
            Direct Supervision                                      Indirect Supervision
      ┌─────────────────────────────────┐                     ┌─────────────────────────────────┐
      │ • Up to 40 Selected High-Risk   │                     │ • Oversight of 27 National      │
      │   Cross-Border Credit & CASPs   │                     │   Competent Authorities (NCAs)  │
      │ • Establishments in ≥ 6 nations │                     │ • Thematic peer reviews         │
      │ • Joint Supervisory Teams (JST) │                     │ • Breach-of-Union-law powers    │
      │ • Binding instructions & fines  │                     │ • Coordination of FIU.net       │
      │   up to 10% of global turnover  │                     │ • Joint cross-border analysis   │
      └─────────────────────────────────┘                     └─────────────────────────────────┘

Direct Supervisory Powers

Unlike predecessor bodies such as the European Banking Authority (EBA)—which possessed primarily indirect, advisory coordination powers—AMLA will exercise direct supervisory authority over a selected portfolio of up to 40 high-risk credit and financial institutions (including systemic CASPs and FinTech groups) that meet specific criteria:

1. Operating establishments or subsidiaries in at least six EU Member States.
2. Classified in the highest residual risk category under harmonized European supervisory methodologies.

For these directly supervised entities, AMLA leads Joint Supervisory Teams (JSTs) comprising AMLA staff and national supervisors. AMLA conducts on-site inspections, issues binding instructions directly to entity boards, and can impose administrative pecuniary sanctions of up to 10% of total annual turnover or €10,000,000, whichever is higher.

Indirect Supervision and FIU Coordination

For entities outside its direct supervisory portfolio, AMLA oversees and coordinates National Competent Authorities (NCAs) (such as BaFin in Germany or ACPR in France), ensuring uniform application of the Single Rulebook through peer reviews and binding mediation. In addition, AMLA serves as the institutional hub for European Financial Intelligence Units (FIUs), managing the secure FIU.net communication infrastructure, coordinating joint operational analyses of cross-border illicit networks, and standardizing suspicious transaction reporting templates.

---

The Recast Transfer of Funds Regulation (TFR / Regulation EU 2023/1113)

Adopted in May 2023 alongside MiCA, the recast Transfer of Funds Regulation (TFR) implements the Financial Action Task Force (FATF) Recommendation 16 (the Travel Rule) for virtual asset transfers across the European Union.

Zero De Minimis Threshold for CASP-to-CASP Transfers

While FATF guidance allows jurisdictions to adopt a $1,000 / €1,000 de minimis threshold below which full travel rule data transmission is not strictly required, the EU TFR explicitly enacted a zero de minimis threshold for transfers between Crypto-Asset Service Providers. Every crypto-asset transfer between CASPs—regardless of the euro value of the transfer (even €1)—must be accompanied by complete, verified data transmitted securely and simultaneously with the transaction.

Mandatory transmitted data includes:

• Originator Information: Name; distributed ledger address and crypto-asset account number where used; and address (including country), official personal document number, and customer identification number, or instead date and place of birth; plus the current Legal Entity Identifier (LEI) or equivalent for legal persons where available.
• Beneficiary Information: Full legal name, crypto-asset account/wallet number, and LEI where applicable.

Unhosted (Self-Hosted) Wallet Rules

The TFR establishes specialized rules for transactions involving self-hosted (unhosted) wallets:

• When a CASP facilitates a transfer between its platform and an unhosted external wallet exceeding €1,000, the CASP is legally required to implement risk-based measures to evaluate and verify whether the unhosted wallet is owned or controlled by its customer.
• Verification techniques include message-signing challenges, micro-transactions (the "Satoshi test"), or other technical means. For transactions below €1,000 involving unhosted wallets, CASPs must still record the wallet address and assess risk, but formal ownership verification is not mandatory unless suspicious indicators arise.

---

Markets in Crypto-Assets Regulation (MiCA / Regulation EU 2023/1114)

MiCA represents the world's first comprehensive, harmonized regulatory regime for crypto-asset markets. It establishes prudential, governance, and conduct-of-business standards for issuers of crypto-assets and Crypto-Asset Service Providers (CASPs) not covered by existing EU financial legislation (such as MiFID II).

Taxonomy of Regulated Crypto-Assets

MiCA distinguishes three categories of crypto-assets:

1. Other Crypto-Assets: Crypto-assets that are neither ARTs nor EMTs, including utility tokens that give access to a good or service supplied by the issuer, and many other tokens.
2. Asset-Referenced Tokens (ARTs): Crypto-assets that purport to maintain a stable value by referencing another value or right, or a basket thereof, including one or more official fiat currencies, commodities, or other crypto-assets (commonly known as multi-asset stablecoins).
3. Electronic Money Tokens (EMTs): Crypto-assets that purport to maintain a stable value by referencing the value of a single official fiat currency (such as EUR, USD, or GBP). EMTs are legally treated as electronic money substitutes under the E-Money Directive (EMD).

CASP Authorization and EU Passporting

Under Title V of MiCA, any entity providing crypto-asset services (including custody, operation of trading platforms, exchange of crypto-assets for funds or other crypto-assets, execution of orders, and portfolio management) must obtain prior authorization as a CASP from the National Competent Authority (NCA) of its home Member State.

Once licensed, a CASP benefits from the "European Passport": it can provide crypto-asset services across all 27 Member States and EEA countries without establishing local legal entities or obtaining separate national licenses. In exchange, CASPs must meet rigorous requirements:

• Prudential Capital: Minimum regulatory capital ranging from €50,000 to €150,000, depending on the tier of services provided.
• Asset Segregation: Strict segregation of customer crypto-assets from the CASP's proprietary balance sheet, held in bankruptcy-remote custody structures.
• Operational Resilience: Compliance with the Digital Operational Resilience Act (DORA), including rigorous cybersecurity audits, ICT risk management, and business continuity safeguards.

Stablecoin Prudential Safeguards & Monetary Sovereignty

To safeguard financial stability and monetary sovereignty, MiCA imposes stringent rules on issuers of ARTs and EMTs:

• 1:1 Liquid Reserve Backing: Issuers must maintain a reserve of assets held in custody with authorized credit institutions, segregated from the issuer's assets, and invested exclusively in high-liquidity, low-risk instruments.
• Mandatory Right of Redemption at Par: Token holders have an unconditional, legally enforceable right to redeem EMTs at par value for fiat currency at any time directly against the issuer, without redemption fees.
• Transaction Limits on Non-Euro Payment Tokens: To prevent foreign-currency stablecoins (such as USD-backed stablecoins) from displacing the euro as a means of exchange within the European single market, MiCA imposes strict quarterly thresholds. If the estimated quarterly average number and value of daily transactions used as a means of exchange within a single currency area exceed 1,000,000 transactions and €200,000,000, the issuer must stop issuing the token and submit a plan to its competent authority to bring usage back below the thresholds.

---

Comparison of European Regulatory Instruments

---

Realistic Exam Scenario

A compliance director at a Berlin-headquartered FinTech platform authorized under MiCA as a Crypto-Asset Service Provider (CASP) and operating across eight EU Member States conducts a quarterly review of high-risk transactions. The platform offers e-money digital wallets, euro-denominated Electronic Money Tokens (EMTs), and cryptocurrency brokerage.

The monitoring system flags three interrelated transactions conducted by an institutional customer account:

1. A corporate customer attempts to purchase €15,000 worth of EMTs using physical cash deposited at a partner retail merchant in Munich.
2. The customer initiates an external transfer of €450 worth of Bitcoin to a peer CASP authorized in France.
3. The customer initiates a second transfer of €3,200 worth of EMTs from the platform to an external, self-hosted (unhosted) blockchain wallet.

Step-by-Step Compliance Analysis:

1. Large Cash Purchase: The AMLR's €10,000 cap on cash payments for goods and services does not apply until July 2027, so in 2026 the platform follows German national law and its own policy. A €15,000 cash purchase of EMTs is far outside a normal pattern for a digital platform. The CASP should apply full CDD and source-of-funds checks and decline the transaction if its policy or its partner does not accept cash at this level. If the explanation does not hold up, it should file a Suspicious Transaction Report (STR) with the German FIU. Exceeding a cash limit is not, on its own, proof of suspicion; the facts decide.
2. CASP-to-CASP Crypto Transfer Under TFR: The €450 Bitcoin transfer between the German CASP and the French CASP is subject to the recast Transfer of Funds Regulation (EU 2023/1113). Because the EU enforces a zero de minimis threshold on CASP-to-CASP transfers, the German CASP cannot execute the €450 transfer without transmitting complete, verified originator and beneficiary details (including legal names, wallet identifiers, physical addresses, and LEI if applicable) via an interoperable Travel Rule messaging protocol.
3. Unhosted Wallet Transfer Verification: The €3,200 transfer to an external unhosted wallet exceeds the €1,000 TFR threshold for unhosted transactions. The CASP cannot release the funds until it performs risk-based verification confirming that its customer owns or controls the destination unhosted wallet (for example, a message-signing challenge or a Satoshi test) and conducts blockchain analytics screening to ensure the external wallet is not associated with darknet markets or sanctioned counterparties.
4. AMLA Direct Supervision Evaluation: Operating in eight Member States meets AMLA's six-state criterion. If the firm also falls in the highest residual-risk category, it could be among the up to 40 entities AMLA selects in 2027 for direct supervision from 2028.

---

Common Exam Traps

• Trap 1: Assuming a €1,000 De Minimis Exemption for EU Crypto Travel Rule: Candidates frequently confuse the general FATF guidance threshold ($1,000) or traditional wire transfer rules with the EU crypto Travel Rule. Under TFR (EU 2023/1113), the threshold for CASP-to-CASP crypto transfers is zero. Every crypto transfer between CASPs must transmit Travel Rule data.
• Trap 2: Confusing MiCA and AMLR Jurisdictional Scopes: MiCA is a market structure, licensing, and prudential regulation (focusing on capital adequacy, consumer disclosures, reserve backing, and EU passporting). AMLR is an anti-money laundering regulation (focusing on CDD, cash caps, beneficial ownership, and suspicious reporting). A CASP must comply with both simultaneously.
• Trap 3: Believing AMLA Replaces National FIUs: AMLA does not replace national Financial Intelligence Units (such as Tracfin in France or FIU Germany). AMLA coordinates cross-border joint analyses, manages FIU.net, and directly supervises up to 40 selected high-risk institutions, while national FIUs retain operational authority to receive domestic STRs.
• Trap 4: Conflating EU Directives with EU Regulations: A Directive (like AMLD6) establishes binding goals but must be transposed into domestic law by national parliaments, allowing minor variations. A Regulation (like AMLR, MiCA, and TFR) is directly binding in its entirety across all Member States from its date of application, without national transposition (the AMLR applies from July 2027).