EBA Guidelines on Restrictive Measures: What Every Small CASP Must Do

1. What are the two EBA guidelines and when is the deadline?

On 14 November 2024, the European Banking Authority published two sets of final guidelines on compliance with EU restrictive measures (sanctions). These are not optional recommendations. They are binding expectations that national competent authorities—including CySEC—use to assess compliance.

The legal basis for both guidelines is Article 23 of Regulation (EU) 2023/1113, which establishes the information requirements accompanying transfers of funds and certain crypto-assets (the recast Transfer of Funds Regulation, or "TFR"). This regulation explicitly extends to CASPs the same sanctions-related obligations that have applied to traditional payment service providers.

The distinction between the two guidelines matters. EBA/GL/2024/14 sets out general internal policies, procedures, and controls that all financial institutions must have in place. EBA/GL/2024/15 adds specific requirements for transaction-level screening that apply to PSPs and CASPs. If you are a CASP, both apply to you.

2. What must CASPs screen under EBA guidelines?

The guidelines require CASPs to screen significantly more than just wallet addresses. The full scope includes:

• All parties to crypto-asset transfers—originators and beneficiaries, including any intermediaries
• Beneficial owners of the parties involved in the transfer
• Wallet addresses (both sending and receiving)
• Transaction details—amounts, currencies, patterns
• Free-text fields—any unstructured information accompanying the transfer that could identify a sanctioned party

This last point catches many small CASPs off guard. Free-text screening means parsing reference fields, notes, and descriptions for names or identifiers that appear on sanctions lists. A purely address-based screening system does not meet the standard.

The critical timing requirement: screening must occur before making crypto-assets available to the beneficiary. Post-transfer screening is insufficient. If you release assets and then discover a sanctions match, you have already violated the regulation.

3. Which sanctions lists must CASPs check?

Start with the legal baseline, then document any extra list coverage driven by your footprint, banking relationships, group policy, or risk assessment.

Legally mandatory

• Applicable Union restrictive measures—the European Commission consolidated financial sanctions data is the practical source for EU financial-sanctions screening, while the legal obligations are the underlying Council decisions and regulations.
• Applicable national restrictive measures—home Member State law and supervisor expectations determine any national measures that also apply.

Nexus- or risk-based coverage

• OFAC SDN List—not an EU-law substitute, but relevant where there is a U.S. nexus, U.S. ownership, U.S. counterparties, dollar-clearing exposure, banking-policy requirement, or risk-based reason.
• UN Security Council Consolidated List—EU law implements UN sanctions, and direct UN screening can be a documented control for timing gaps or national-supervisor expectations.
• UK Sanctions List—relevant for CASPs with a UK nexus or UK-facing counterparties. The old standalone OFSI consolidated list has been replaced by the UK Sanctions List.

4. What are the screening system requirements?

The EBA does not prescribe specific technology, but it sets a high bar for what the screening system must demonstrate:

• Adequate and reliable—the system must produce consistent, accurate results. "We use a spreadsheet" does not meet this standard.
• Tested regularly—testing must include both live sanctions data and deliberately manipulated records to verify that fuzzy matching works correctly. If a name is misspelled or transliterated differently, does your system still catch it?
• Documented capabilities and limitations—you must know and record what your system can and cannot do. No system is perfect; the EBA expects you to understand your system's blind spots.
• Minimum annual review—at least once per year, the screening system must be formally reviewed and the results documented. More frequent reviews are expected for higher-risk profiles.

For CASPs, address screening is only one part of the control. Screen names, parties, identifiers, transaction details, and wallet addresses where those data points are available. If you use supplementary blockchain-address datasets, document their source, coverage limits, update process, and how they map back to the restrictive measures that apply to your firm.

5. When must sanctions screening happen?

The guidelines establish two distinct screening cadences:

Transaction screening is non-negotiable at the point of transfer. The practical implementation requires API-level integration—manual lookups before each transaction do not scale and introduce human error risk that the EBA explicitly warns against.

Customer database screening has more flexibility, but the trend is clear: regulators expect real-time or near-real-time ongoing monitoring. A CASP that re-screens its customer base weekly may face questions about what happens when a customer is designated on a Tuesday and transacts on Wednesday.

6. What are the re-screening obligations?

Initial screening at onboarding is not enough. The guidelines require CASPs to regularly re-screen their entire customer database. The frequency must be risk-based, but specific triggers mandate immediate re-screening:

• Sanctions list updates—when any screened list is updated, affected customer records must be re-evaluated
• New products or services—launching a new offering may change your risk exposure
• Significant business changes—entering new markets, onboarding new customer segments, or changing transaction types
• Change in customer information—updated KYC data, new beneficial owners, or changes to transaction patterns

OFAC alone updates its SDN list multiple times per week. The EU Consolidated List is updated less frequently but often in large batches (particularly in response to geopolitical events). A CASP without automated re-screening will inevitably miss the window between a designation and the next manual review.

7. How should matches be handled and escalated?

Finding a potential match is where compliance frameworks are truly tested. The guidelines are specific about what must happen:

• Investigation “without delay”—a potential match triggers an immediate investigation. There is no grace period for queuing alerts.
• Four-eyes principle—high-risk matches must be reviewed by at least two independent individuals. A single compliance officer making match/no-match decisions alone does not meet the standard for elevated-risk cases.
• Confirmed match → immediate action—suspend the transaction, freeze relevant assets, and inform the competent authority (CySEC and/or the national FIU, MOKAS in Cyprus).
• Circumvention detection—the guidelines explicitly require CASPs to have procedures for identifying attempts to bypass sanctions. This includes structuring (splitting transactions), using intermediaries, or routing through non-sanctioned addresses controlled by sanctioned entities.

Documentation of every decision is critical. For each alert, you must record: the alert details, the investigation steps taken, the evidence reviewed, the decision reached, who made the decision, and when. “We reviewed it and it was a false positive” is not sufficient documentation.

8. What audit trail and record keeping is required?

The retention requirements are extensive and non-negotiable:

• Record retention period—follow applicable AML, sanctions, and national supervisory rules; five years is a common EU AML baseline, and Member States may set longer periods
• Policies and procedures—current and historical versions must be retained
• Risk assessments—every sanctions risk assessment, including methodology and conclusions
• All screening reviews—every screening event with timestamp, list version used, and result
• Alert investigations—full investigation trail for every alert generated
• Decisions—all match/no-match determinations with supporting rationale
• Reporting—copies of all reports filed with authorities

During an inspection, expect the supervisor to ask for recent screening records, alert-resolution evidence, list-version history, and proof that controls were tested. If you cannot produce timestamped, list-versioned screening logs promptly, the review starts with an evidence gap. Manual processes that require days of reconstruction are a red flag.

9. What are the penalties for non-compliance?

Do not treat sanctions failures as a MiCA-only penalty issue. MiCA is relevant to CASP authorisation and supervisory confidence, but the core sanctions penalty basis is Directive (EU) 2024/1226, the EU restrictive measures regulations themselves, and the national laws that implement and enforce them.

Directive (EU) 2024/1226 sets minimum EU rules for criminal offences and penalties. It requires Member States to criminalise defined violations and circumvention of Union restrictive measures, including making funds or economic resources available to designated persons and providing prohibited financial services, crypto-assets, or wallets. For serious core offences, Member States must make maximum prison terms of at least five years available for natural persons; for legal persons, maximum fines must be able to reach at least EUR 40 million or 5% of worldwide turnover.

The EBA guidelines do not create a separate EU fine schedule. They set supervisory expectations for internal policies, procedures, controls, screening, escalation, and records. If a weak screening framework leads to a sanctions breach, enforcement moves to the relevant EU sanctions regulation, Directive (EU) 2024/1226 as transposed into national law, and the competent authority's national powers.

Cyprus-specific enforcement

For Cyprus CASPs, the practical warning is specific: CySEC is already inspecting sanctions screening systems. Circular C685 says CySEC's April-November 2024 thematic inspections covered regulated entities including CASPs, reviewed UN and EU sanctions list screening and relevant U.S. and UK screening practices, and found that overall effectiveness and efficiency required improvement.

• Penalty basis—Cyprus law implementing EU restrictive measures and Directive (EU) 2024/1226, plus any applicable MiCA or TFR supervisory powers
• Licensing impact—weak screening controls can undermine a CASP's governance and control assessment
• Personal exposure—individual liability depends on the conduct, intent or negligence standard, and the national offence charged

10. How do the EBA guidelines relate to MiCA?

The relationship between these EBA guidelines and MiCA licensing is indirect but important: MiCA is the authorisation framework, while sanctions controls come from the TFR, the EBA guidelines, EU restrictive measures, and national law.

MiCA authorization applications require CASPs to demonstrate governance, risk management, and internal control arrangements. NCAs can assess sanctions compliance under the EBA guidelines and national sanctions framework alongside the MiCA application. A CASP that applies for MiCA authorization without a screening framework aligned to EBA/GL/2024/14 and EBA/GL/2024/15 should expect serious questions from the supervisor.

Critically, transitional CASPs are not exempt from sanctions obligations. If you are operating under a national transitional regime, the MiCA transition does not suspend EU restrictive measures, Regulation (EU) 2023/1113 obligations, or national sanctions law. CySEC Circular C685 also puts CASPs in scope of its sanctions-screening guidance.

For CASPs planning their MiCA application, the screening framework is not something to build later. It is a prerequisite that must be in place, tested, and documented before the application is submitted.

---

What does the compliance checklist look like?

The obligations under the EBA guidelines can be distilled into a practical checklist. Each item is directly traceable to the guideline text: