Answer 2:
Providers of crypto services must always check whether their relationships appear on one or more sanctions lists (screening). This means that crypto service providers and the counterparty and/or payee involved in the transactions must, at a minimum, be screened. The crypto service provider can take a risk-based approach to determining the measures to establish whether the identity of a counterparty and/or payee matches the identity of natural persons, legal persons or entities referred to in the sanctions regulations. It is up to the crypto service provider to decide how to perform these checks and what is necessary to do so, provided that the purpose of the sanctions regulations is achieved.
Adequate measures to effectively screen the counterparty and/or payee
In the case of a transaction to or from an crypto address not hosted by the crypto service provider (external crypto address), the holder of that crypto address can be either the provider's customer itself or another crypto service provider, or a third-party natural person, legal person or entity. In the case of transactions to and from external crypto addresses, crypto service providers must also be able to check, by means of adequate measures, whether the counterparty and/or payee concerned appears on one or more sanctions lists.
How providers establish the identity of the counterparties and/or payees in a transaction, and whether they are actually the recipient or sender, is not prescribed by regulation. The law does not prescribe any specific measure, provided that the measure taken sufficiently mitigates the risk of non-compliance with sanctions regulations.
This implies that sufficient information about the counterparty and/or payee must be requested for the purposes of effective screening, such as name, date of birth, place of residence and business address.
Another element of this is that the crypto service provider must take adequate measures to establish that the counterparty and/or payee specified by the customer is indeed the recipient or sender, if the provider considers there to be a higher than minimal risk that the identity of a counterparty and/or payee does not match the specified identity.
This may involve identity fraud (the counterparty and/or payee uses someone else's identity), but it may also be the case that someone other than the specified counterparty and/or payee has access to the specified crypto address and the corresponding wallet.
The measures for carrying out adequate screening can be risk-based. Risk-based means that a provider must take more extensive measures for relationships that are considered higher risk in view of all relevant factors than they do for relationships that are considered low risk. Crypto service providers must make a risk analysis and implement appropriate measures on that basis. The risk-based approach is assessed in the context of the entire set of measures in place in the business, see also the Guidance on the Anti-Money Laundering and Anti-Terrorist Financing Act and the Sanctions Act. The explanatory notes to the RtSw state: “It [i.e. the relevant institution] must always ensure that the risk is minimal that a financial service or transaction will result in financial resources going to one of the natural persons, legal persons or entities listed in the sanctions regulations.”
Where a provider considers there to be a higher than minimum risk that the identity of a counterparty and/or payee is not consistent with the identity provided, it must take measures to establish the true identity of a counterparty and/or payee in order to perform effective screening. The Financial Sanctions Regulation Guideline of the Ministry of Finance states: “If no mitigating measures can be taken, if measures require too much effort or if there is too much residual risk, then the risk must not be taken. In the case of sanctions, there can be virtually no acceptable level of residual risk because the material prohibitions of the sanctions regulations must be observed.”
The crypto service provider must be aware that, while it can take a risk-based approach to screening measures, its follow-up actions such as reporting hits on sanctions lists and freezing assets constitute an obligation of result (i.e. best efforts do not suffice). For example, in incoming transactions, crypto service providers may choose to retain the cryptos in the (omnibus) wallet during the counterparty screening process before allocating them to the account of the customer who is the payee of the transaction.
