Introduction: What is EU Regulation 2023/1113 and Why Compliance Matters
EU Regulation 2023/1113 is the EU’s framework for combating money laundering and terrorist financing by setting harmonized rules for transfers of funds and certain crypto-assets, and compliance matters because it ensures transparency, reduces financial crime risks, and protects organizations from legal penalties and reputational harm. The Regulation (EU) 2023/1113 applies from 30 December 2024. It was published 9 June 2023 and entered into force 29 June 2023, and is part of broader EU anti-money laundering legislation. This comprehensive regulation represents a significant shift in how financial institutions, crypto asset service providers, and payment service providers must handle transfer information and comply with anti money laundering obligations across the European Union. The new regime established an EU Single Rulebook, ensuring consistent application of anti-money laundering and counter-terrorist financing measures across all Member States. However, the majority of the provisions in the new EU AML/CFT regime do not come into force immediately.
This guide covers the essential compliance requirements, implementation deadlines, and practical steps for payment service providers (PSPs), crypto asset service providers (CASPs), and intermediary CASPs operating in EU markets. The European Commission initiated the legislative proposals that resulted in Regulation EU 2023/1113. You’ll learn exactly what the regulation requires, who must comply, and how to implement the necessary procedures.
Immediate clarification of scope: All payment service providers, crypto asset service providers, and intermediary CASPs operating in the EU must comply with these new rules. Unlike previous regulations, EU 2023/1113 provides no transitional period, making immediate preparation essential for continued market access. Organizations must implement and maintain internal policies, procedures, and controls to mitigate and manage money laundering and terrorist financing risks according to Regulation 2023/1113. An organization must appoint a compliance manager to oversee adherence to Regulation 2023/1113 and related AML regulations.
Understanding EU 2023/1113: Key Compliance Requirements and Definitions
Core Regulatory Definitions
Transfer of Funds Regulation (TFR) refers to the comprehensive framework under Regulation EU 2023/1113 that governs information accompanying transfers for both traditional funds and crypto assets. The regulation defines which entities are subject to its requirements as obliged entities, specifying three critical entity types. Member States are required to maintain accurate beneficial ownership registers to support these obligations. Public access to beneficial ownership registers is limited but available to those with legitimate interest.
- Payment Service Providers (PSPs): Financial institutions providing payment services under the Payment Services Directive, including credit institutions and investment firms as examples of obliged entities subject to the regulation
- Crypto Asset Service Providers (CASPs): Entities offering crypto asset services as defined under MiCAR licensing requirements
- Intermediary CASPs (ICASPs): Service providers facilitating crypto asset transfers between other CASPs
Obliged entities also include certain non-financial entities like lawyers and accountants, who are subject to the regulation's requirements. Member States must publish annual reports on money laundering risks associated with granting residence rights for investments, ensuring transparency and accountability in this area.
The regulation significantly expands upon its predecessor Regulation EU 2015/847, extending coverage to crypto asset transfers and introducing specific requirements for self hosted wallets exceeding EUR 1,000 in value.
Regulatory Framework Connections
EU 2023/1113 directly implements FATF Recommendations 15 and 16 on wire transfers and virtual assets, creating harmonized rules across member states. The regulation connects seamlessly with the Anti-Money Laundering Directive (AMLD) framework and MiCAR licensing requirements, ensuring comprehensive coverage of the financial system. Mutual recognition of compliance measures and information sharing between member states is essential to facilitate cross-border cooperation and improve transparency. The AML Regulation harmonises customer due diligence processes across the EU, further standardizing anti-money laundering practices. By 10 July 2026, the AMLA will develop standards for AML/CFT supervisory colleges, further enhancing the consistency of supervision across Member States.
The European Anti-Money Laundering Authority (AMLA) acts as the central authority responsible for supervising and coordinating AML/CFT activities across the EU, including direct supervision of certain entities and oversight of cross-border cooperation and data systems. The AMLA is responsible for direct supervision of high-risk financial institutions across multiple Member States, ensuring consistent enforcement of anti-money laundering measures. By the time it reaches full capacity, the AMLA is expected to have over 430 staff members, reflecting its critical role in the EU's AML/CFT framework. The first selection of obligated entities supervised by the AMLA will occur in 2027.
The European Banking Authority (EBA) Guidelines, effective November 14, 2024, provide additional implementation guidance for obliged entities across the European Union. These guidelines establish consistent interpretation of the regulation’s requirements at the EU level, with a need to respect EU-level supervisory frameworks. To achieve compliance, businesses should invest in automated systems for transaction monitoring and conduct regular employee training to stay informed about AML and CTF risks and best practices.
Why EU 2023/1113 Compliance is Critical for Financial Institutions
Legal obligations make compliance mandatory. Financial institutions face immediate regulatory scrutiny under the enhanced supervision framework, with national authorities empowered to impose significant sanctions for non-compliance.
Financial penalties include comprehensive sanctions and investigatory powers under the Anti-Money Laundering Authority (AMLA) supervision framework. These measures are intended to ensure robust enforcement across all member states, making compliance essential for operational continuity.
Operational benefits extend beyond mere regulatory compliance. The regulation is intended to enhance transparency and is focused on preventing money laundering by improving transaction traceability, anti money laundering and counter-terrorist financing risk management, and strengthening the overall integrity of the financial sector. Enhanced monitoring capabilities help identify suspicious transactions more effectively, including by understanding the relation between originators and beneficiaries.
Market access requirements make compliance non-negotiable for continued operation in EU crypto asset and payment markets. Non-compliant service providers risk losing their authorization to operate, effectively cutting off access to one of the world’s largest financial markets.
Compliance Requirements Comparison Table
Step-by-Step Compliance Implementation Guide
Step 1: Assess Current Compliance Status
Conduct a comprehensive gap analysis against current anti money laundering and counter-terrorist financing policies and procedures. This assessment should identify areas where existing systems fall short of the new requirements under Regulation EU 2023/1113.
Review existing systems for collecting and storing payer and payee information, ensuring they can handle the expanded requirements for crypto asset transfers. Evaluate technical capabilities for monitoring such transfers and identifying transactions involving self hosted wallets.
Key assessment areas include:
- Current information collection procedures
- System capabilities for crypto asset monitoring
- Staff training requirements
- Internal policies alignment with new obligations
Step 2: Implement Required Policies and Procedures
Establish robust internal controls for compliance with national restrictive measures and EU-level sanctions. These controls must address both traditional payment services and crypto asset services, ensuring comprehensive coverage across all business lines. The AML Regulation prohibits the use of anonymous crypto-asset accounts by service providers, further strengthening measures to prevent illicit activities. Additionally, non-EU entities tied to the EU are now required to disclose beneficial ownership, further enhancing transparency and compliance.
Develop specific procedures for verifying self hosted wallets ownership when transfers exceed EUR 1,000, including documentation requirements and verification timelines. Create streamlined processes for handling missing or incomplete information, with clear escalation procedures to competent authorities.
Implementation priorities:
- Risk assessment frameworks for crypto asset transfers
- Internal policies for restrictive measures compliance
- Procedures for incomplete information handling
- Training programs for identifying suspicious transactions
Step 3: Establish Reporting and Monitoring Systems
Set up comprehensive reporting procedures to competent authorities such as the Financial Market Authority (FMA) for Austria or equivalent authorities in other member states. These systems must handle both routine reporting and exceptional circumstances involving missing information.
Implement advanced monitoring systems capable of identifying suspicious transactions requiring Financial Intelligence Unit (FIU) reporting. Establish specific monitoring protocols for transfers involving self hosted wallets over EUR 1,000, ensuring compliance with the enhanced due diligence requirements. Organizations should use blockchain analytics and automated monitoring systems to trace illicit flows effectively.
Technical requirements include:
- Automated transaction monitoring systems
- Reporting templates for competent authorities
- Database systems for transfer information storage
- Alert mechanisms for suspicious activity detection
Common Compliance Mistakes to Avoid
Mistake 1: Assuming transitional periods apply - EU 2023/1113 has no grace period from December 30, 2024. Many financial institutions incorrectly assume they have additional time to implement compliance measures, risking immediate regulatory sanctions.
Mistake 2: Incomplete self hosted wallets verification for transfers over EUR 1,000 threshold. Crypto asset service providers often underestimate the complexity of wallet ownership verification, leading to compliance gaps that regulators actively monitor.
Mistake 3: Failing to report repeated missing information to competent authorities within required timeframes. The regulation mandates specific reporting procedures when information accompanying transfers is consistently incomplete, and delays can result in regulatory action.
Pro tip: Regular compliance monitoring and comprehensive staff training prevent most implementation failures. Establish monthly review procedures and ensure all relevant personnel understand their obligations under the new rules.
Frequently Asked Questions About EU 2023/1113 Compliance
Q: When did EU 2023/1113 become fully applicable? A: December 30, 2024, with no transitional period for most obligations. All covered entities must ensure immediate compliance to avoid regulatory sanctions.
Q: What is the EUR 1,000 threshold for self hosted wallets?A: Crypto asset service providers must verify wallet ownership for transfers to or from self hosted wallets exceeding this amount. This verification includes identifying beneficial owners and maintaining records of such transfers.
Q: How do I report missing transfer information?A: Use designated reporting forms submitted to competent authorities like the Financial Market Authority. The regulation requires specific procedures for reporting incomplete information within defined timeframes. Ensure all relevant information is included in your reports to meet compliance standards.
Q: Does the regulation apply to all crypto asset transfers?A: Yes, if at least one crypto asset service provider involved is established or registered in the European Union. The regulation covers transfers between CASPs, transfers to self hosted wallets, and certain cross-border transactions.
Q: What are the main obligations for payment service providers?A: Payment service providers must ensure information accompanying transfers meets enhanced requirements, implement robust monitoring systems, and report suspicious transactions to relevant authorities while complying with national restrictive measures.
Q: How do national laws interact with EU 2023/1113?A: National laws may affect the implementation details of EU 2023/1113, especially regarding beneficial ownership transparency, residence rights, and how Member States meet EU mandates. These laws can influence requirements for investment-based residence programs and the scope of cross-border cooperation.
Q: Where can I find the official text of the regulation?A: The official text of EU 2023/1113 is published in the Official Journal of the European Union, which serves as the formal record of EU legislation.
Conclusion: Key Compliance Takeaways
Immediate action is required as EU 2023/1113 compliance became mandatory from December 30, 2024. Financial institutions and service providers cannot afford delays in implementing the necessary procedures and systems to meet these obligations.
Focus on critical areas: Self hosted wallets verification, comprehensive information reporting, and national restrictive measures implementation form the core of successful compliance. These areas require immediate attention and ongoing monitoring to maintain regulatory compliance.
Establish ongoing obligations including regular monitoring systems, timely reporting to competent authorities, and continuous staff training programs. Sustained compliance requires systematic approaches rather than one-time implementation efforts.
Next steps for immediate implementation:
- Conduct comprehensive compliance assessment against current procedures
- Implement required policies for crypto asset service providers and payment service providers
- Establish robust monitoring and reporting systems
- Engage regulatory compliance specialists for complex implementation requirements
If operating across EU Member States, organizations must notify the relevant national supervisor before operating in a new country for the first time.
- Conduct comprehensive compliance assessment against current procedures
- Implement required policies for crypto asset service providers and payment service providers
- Establish robust monitoring and reporting systems
- Engage regulatory compliance specialists for complex implementation requirements
The regulation represents a fundamental shift in how the financial sector approaches anti money laundering and counter-terrorist financing obligations. Success requires proactive implementation, continuous monitoring, and commitment to maintaining the highest compliance standards across all relevant business operations. If you face any implementation challenges, monitoring challenges or maintaining the highest compliance standards, Pingwire can help. Contact us today.