The identity of all relationships of crypto service providers is screened for sanctions purposes. This means that crypto service providers and the counterparty and/or beneficiary involved in the transactions are screened. The crypto service provider can take a risk-oriented approach to determining the measures needed to be able to establish whether the identity of a counterparty and/or beneficiary matches the identity of persons or (legal)entities referred to in the sanctions regulations. It is up to the crypto service provider to decide how to perform these checks and what is necessary to be able to perform the mentioned checks, as long as the purpose of the sanctions regulations is achieved.
Adequate measures to effectively screen the counterparty and/or beneficiary
In the case of a transaction to or from an (external) crypto address not managed by the crypto service provider, the holder of that crypto address can be either the provider's own customer or another crypto service provider, or a third party (legal) person or entity. In the case of transactions to and from external crypto addresses, crypto service providers should also be able, by means of adequate measures, to effectively screen the identity of the counterparty and/or beneficiary concerned against the identity of a person or entity referred to in the sanctions regulations.
This implies that sufficient information about the counterparty and/or beneficiary is requested for the purposes of effective screening, such as name, date of birth, place of residence and residence address.
Another element of this is that the crypto service provider takes adequate measures to establish that the identity of the counterparty and/or beneficiary specified by the customer is indeed the identity of the recipient or sender, if the provider considers there is a higher than minimal risk that the identity of a counterparty and/or beneficiary does not match the specified identity. This may involve identity fraud (the counterparty and/or beneficiary uses someone else's identity), but it may also be the case that someone other than the specified counterparty and/or beneficiary has access to the specified crypto address.
The measures for carrying out adequate screening can be risk-oriented. Risk-oriented means that a provider takes more extensive measures for relationships that are considered higher risk in view of all relevant factors, than they do for relationships that are considered low-risk. Crypto service providers make a risk analysis and implement appropriate measures on that basis. The risk-based approach is assessed in the context of the entire set of measures in place in the business, see also the Guidance on the Anti-Money Laundering and Anti-Terrorist Financing Act and the Sanctions Act . The explanatory notes to the RtSw state: ‘it must always ensure that the risk is minimal that a financial service or transaction will result in financial resources going to one of the individuals or legal entities listed in the Sanctions Regulations.’
Where a provider considers that there is a higher than minimum risk that the identity of a counterparty and/or beneficiary does not match the specified identity, it takes measures to establish the true identity of a counterparty and/or beneficiary in order to perform effective screening. The Financial Sanctions Regulation Guideline of the Ministry of Finance states: ‘If no mitigating measures can be taken, if measures require too much effort or if there is too much residual risk, then the risk is not taken. In the case of sanctions, there can be virtually no acceptable level of residual risk because the material prohibitions of the sanctions regulations must be observed.’
The crypto service provider must be aware that it can take a risk-based approach to measures, but that the follow-up actions (reporting hits on sanctions lists and freezing assets) constitute an obligation of result.
How providers establish the identity of the counterparties to and/or beneficiaries of a transaction, and whether it is actually the recipient or sender, is not prescribed by regulation. The law does not prescribe any specific measure, as long as the measure taken provides adequate safeguards for the screening of relationships (see below for good practices).
