The European Union is tightening crypto anti-money laundering (AML) rules, including restrictions on privacy coins (often cited examples include Monero, Zcash and Dash) and stronger requirements to identify parties to certain wallet transfers, with full application expected by 1 July 2027. The goal is to reduce anonymous activity and align crypto compliance more closely with EU banking-style controls—without changing the fact that crypto remains a legal technology in the EU under regulated conditions.
EU crypto AML rules: what’s changing
As part of the EU’s broader AML package and supervision reforms, Crypto-Asset Service Providers (CASPs)—such as exchanges, brokers, and custodial wallet providers—must apply stricter controls to reduce the use of crypto for money laundering and terrorist financing. These controls focus on (1) limiting support for privacy-enhancing crypto products that block traceability and (2) improving the collection and verification of information tied to transfers.
Timeline: preparation vs full application by 2027
The rules are introduced with a runway to allow regulated firms to update onboarding, transaction monitoring, and data-sharing systems. The industry should expect compliance work to be front-loaded across 2025–2027, with full application from 1 July 2027.
- 2025–2026: implementation work by CASPs (policies, tooling, counterparty data collection, training, vendor updates).
- By 1 July 2027: the new regime is expected to apply in full across the EU for in-scope providers.
- After go-live: ongoing supervisory actions, audits, and enforcement across Member States and EU-level bodies.
Key provisions affecting privacy coins
Under the updated AML approach, EU-regulated providers are expected to stop offering services that enable anonymity where traceability is not possible. In practice, this translates into regulated platforms being required to restrict or delist privacy-focused assets and features that prevent effective AML controls.
Common compliance implications for CASPs include:
- No support for anonymity-enhancing coins/features where transaction tracing and required information cannot be reliably obtained.
- Restrictions on anonymous accounts/wallets offered by regulated providers.
- Risk-based controls to prevent circumvention (for example, screening, monitoring, and rejecting transfers that cannot be compliant).
Important nuance: the rules primarily bite at the level of regulated EU service providers (what exchanges/custodians can list and facilitate). How any specific token is treated can depend on whether the provider can meet legal traceability and due diligence requirements for that asset and its features.
Tracking and identification for wallet transfers (the “who sent what to whom” problem)
A core EU objective is to reduce “blind” transfers where a provider cannot identify the originator and/or beneficiary. In line with the global “travel rule” direction, EU CASPs must collect, verify, and retain information about the parties to certain transfers and make it available to competent authorities when lawfully required.
As described in public summaries of the reform, transfers above €1,000 are expected to trigger enhanced requirements on EU platforms—typically involving stronger verification and controls around the transfer, not merely logging a transaction hash.
- Customer due diligence (KYC): CASPs must identify and verify customers using reliable data.
- Counterparty information: providers may need to obtain/validate details about the recipient/sender depending on the transfer scenario (including when interacting with non-custodial wallets, where feasible under the rules).
- Recordkeeping and reporting: retention of transfer-related data and suspicious activity reporting, similar in purpose to traditional finance.
What this means for EU users and EU-based platforms
For exchanges and custodial wallet providers (CASPs)
EU-facing CASPs will need to ensure their listing policies, onboarding, and transfer workflows can meet the new traceability expectations by the 2027 deadline. That often includes:
- Delisting or restricting privacy coins and privacy features that prevent compliance.
- Upgrading transaction monitoring and sanctions/AML screening.
- Implementing processes to collect and validate originator/beneficiary information for relevant transfers, including those interacting with external wallets.
- Strengthening governance: audits, internal controls, staff training, and incident handling.
For EU users
For most users, the practical change is less anonymity on regulated platforms and more friction for certain transfers—especially when moving funds to or from external wallets or when transfers are large enough to require enhanced checks. Users who rely on privacy coins may find they can no longer trade or custody those assets on EU-regulated platforms well before July 2027 as firms de-risk and prepare.
This article is informational and describes regulatory direction; it is not financial advice.
Frequently Asked Questions
The EU’s AML reforms strengthen oversight of crypto transfers and restrict anonymity-enabling services on regulated platforms, with full application expected by 1 July 2027.
1) Are privacy coins “banned” in the EU from 1 July 2027?
The practical impact is that EU-regulated CASPs are expected to stop supporting privacy coins and anonymity features that prevent required traceability and due diligence. This effectively removes such assets from mainstream EU exchanges/custodians, even if peer-to-peer or non-custodial usage is a separate question from what regulated intermediaries may offer.
2) What happens to crypto wallet transfers over €1,000?
Transfers above €1,000 are expected to face stronger identification/verification and compliance checks on EU-regulated platforms, consistent with the EU’s goal of making higher-risk transfers more traceable. Exact operational steps can vary by provider and scenario, but users should expect more requests for information and potential delays or rejections if compliance data can’t be obtained.
3) What must exchanges and wallet providers do to comply by 2027?
CASPs must implement robust AML programmes: customer identity verification (KYC), transaction monitoring, suspicious activity reporting, recordkeeping, and controls that prevent them from facilitating privacy coins/anonymous accounts where legal requirements cannot be met. Non-compliance can lead to penalties, restrictions, or loss of authorisation to operate in the EU.
Key takeaways
- The EU is tightening crypto AML requirements, with full application expected by 1 July 2027.
- EU-regulated platforms are expected to restrict/delist privacy coins and anonymity-enabling features that block traceability.
- Transfers over €1,000 are expected to trigger enhanced verification and compliance checks on regulated services.
- CASPs must align crypto controls more closely with traditional finance: KYC, monitoring, reporting, and recordkeeping.
- EU users should expect less anonymity and more compliance friction on regulated exchanges and custodial wallets.
Related articles
- Crypto Firms in Spain Face Compliance Deadline as MiCA Regulation Takes Effect
- EU Data Privacy in Focus as Google Updates Cookie Policies
- EU Data Privacy Concerns Rise Amid Sports Streaming and Cookie Policies
- Crypto Payroll Compliance: Key Steps for SMEs in 2025
- EU Data Privacy Rules: What Crypto Firms Need to Know in 2024
