EU Ban on Anonymous Crypto Accounts from July 2027

From 10 July 2027, crypto-asset service providers in the EU may not keep anonymous crypto accounts or any account that allows transactions to be anonymised, including through privacy coins. The rule is in Article 79 of the EU Anti-Money Laundering Regulation, (EU) 2024/1624. At the same time a new EU authority, AMLA, is preparing to supervise a group of high-risk financial firms directly from 2028.

The new EU AML rulebook

The EU adopted a package of anti-money laundering laws in 2024. The European Commission lists three main texts: the AML Regulation (EU) 2024/1624, the sixth AML Directive (EU) 2024/1640 and the AMLA Regulation (EU) 2024/1620. The Commission says the package was adopted by the Council on 30 May 2024 and published in the Official Journal on 19 June 2024.^[1]

The AML Regulation is a regulation, not a directive. Article 90 says it is "directly applicable in all Member States". The same article says it applies from 10 July 2027, with a later date, 10 July 2029, only for football agents and professional football clubs.^[2]

What Article 79 bans

Article 79(1) of Regulation 2024/1624 covers banks, financial institutions and crypto-asset service providers (CASPs). It prohibits them from keeping anonymous crypto-asset accounts. It also prohibits any account that otherwise allows the anonymisation of the account holder, or the "anonymisation or increased obfuscation of transactions, including through anonymity-enhancing coins".^[2]

The regulation defines anonymity-enhancing coins in Article 2(1), point (25). They are crypto-assets with built-in features designed to make transfer information anonymous, "either systematically or optionally".^[2] The text does not list any coin by name. The word "optionally" matters: a coin does not need to be private by default to fall inside the definition.

Article 79(1) also deals with existing accounts. Owners and beneficiaries of existing crypto-asset accounts must go through customer due diligence before those accounts are used in any way.^[2]

Who is not covered

The ban targets the firm that holds the account. A "crypto-asset account" is defined by reference to Regulation (EU) 2023/1113: an account held by a CASP in the name of one or more persons and used to execute crypto transfers.^[3]

Recital 160 of the AML Regulation says the prohibition does not apply to providers of hardware, software or self-hosted wallets, as long as they have no access to or control over those wallets.^[2] So the law does not ban owning a privacy coin or using your own wallet. It bans regulated firms from offering accounts that hide who is transacting or where funds go.

This is our reading of the legal text. It is not legal advice.

Identity checks for smaller crypto transactions

Article 19(3) sets special rules for CASPs. They must apply full customer due diligence to occasional transactions of at least EUR 1,000, including linked transactions. Below EUR 1,000 they must still at least identify the customer and verify their identity.^[2]

This sits on top of the EU transfer rules that already apply. Regulation (EU) 2023/1113 has applied since 30 December 2024. Under its Article 14, the sending CASP must make sure crypto transfers carry the sender's name, wallet address and address or date and place of birth, plus the recipient's name and wallet address.^[3] Our Travel Rule guide explains how that works in practice.

AMLA: the new EU supervisor

Regulation (EU) 2024/1620 created the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA). Article 4 sets its seat in Frankfurt am Main.^[4] AMLA says it has existed legally since 26 June 2024.^[5]

Direct supervision works through selection:

• AMLA periodically assesses credit and financial institutions that operate in at least six Member States, including the home state (Article 12(1)).^[4]
• CASPs are one of the categories for which AMLA must build a separate risk methodology (Article 12(4), point (j)).^[4]
• Entities whose residual risk is classified as high become "selected obliged entities". If more than 40 qualify, AMLA may limit the list to a number greater than 40 (Article 13(1) and (2)).^[4]
• The first selection must start by 1 July 2027. Direct supervision starts six months after the list is published (Article 13(4)).^[4]

AMLA's own timeline shows 40 entities selected in 2027 and the start of direct supervision in 2028.^[5] Which CASPs, if any, end up on the first list is not public yet.

What this means for AML checks

The rule will make EU exchanges more careful about where deposits come from. A firm that may not offer accounts that obfuscate transactions has a reason to look hard at coins with mixer or privacy-tool history. Expect more questions about mixer exposure and more source-of-funds requests.

It may also mean some EU platforms stop supporting certain privacy-focused assets or features before July 2027. That is a business decision for each platform. The regulation does not publish a delisting list. For a related case, see our post on Litecoin MWEB and AML checks.

What to do

1. Check your exchange's notices. If you hold privacy-focused assets on an EU platform, watch for support changes ahead of 10 July 2027.
2. Do not wait for a deadline. If a platform announces a withdrawal window, move your coins to a wallet you control in good time.
3. Keep your identity data current. Article 79 requires due diligence on existing accounts before use, so expect KYC refresh requests.
4. Check incoming coins. Run an AML check before receiving USDT or other assets, especially from P2P deals.
5. Be ready to explain mixer links. Keep records of where your coins came from. If a deposit is held, see what to do when an exchange freezes funds.
6. Get advice if you run a business. If you operate a crypto service in the EU, talk to a lawyer about Article 79. This post is not legal advice.

To compare tools that flag mixer and privacy-tool exposure, see our service comparison.