{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2024-06-19","gaps":[],"covered":["AMLR L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/amlr/articles/40","url":"https://www.headlesslaw.com/amlr/articles/40","title":"Article 40 — Measures to mitigate risks in relation to transactions with a self-hosted address","family":"l1_generated","work_id":"amlr","status":"not_yet_applicable","force_status":"in_force","date_state":"not_yet_applicable","requested_date":null,"as_of":"2026-11-02","applies_from":"2027-07-10","application":{"state":"not_yet_applicable","next":"2027-07-10","dates":[{"at":"2027-07-10","note":"Article 90"}]},"version_label":"Regulation (EU) 2024/1624, OJ L, 2024/1624, 19.6.2024","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/eli/reg/2024/1624/oj/eng","valid_from":"2024-06-19","valid_until":"2027-07-10","revision":1,"content_id":"6625654eec586c6d","change_date":null,"nearest_versions":["2024-06-19"],"first_text_date":"2024-05-31","correction_applies":false,"versions":["2024-06-19"],"version_url":"https://www.headlesslaw.com/amlr/articles/40/versions/2024-06-19","revision_url":"https://www.headlesslaw.com/amlr/articles/40/versions/2024-06-19/rev/6625654eec586c6d","versions_url":"https://www.headlesslaw.com/amlr/articles/40/versions","relations_url":"https://www.headlesslaw.com/amlr/articles/40/relations","source_line":null,"attribution":null},"provenance":{"official_url":"https://eur-lex.europa.eu/eli/reg/2024/1624/oj/eng","check":{"result":"matched","checked_at":"2026-10-26","against":"EUR-Lex"},"repo_path":"spaces/amlr/articles/40.md","body_sha256":"b0bb029888ec473a60860063451cf8665555e9fc9f4e4898fe425688eb411078"},"units":[{"locator":"amlr/art/40","kind":"article","status":"in_force","label":null,"heading":"Measures to mitigate risks in relation to transactions with a self-hosted address","text":"","marks":[],"revision":1,"text_hash":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","reason":null},{"locator":"amlr/art/40/para/1","kind":"paragraph","status":"in_force","label":"1.","heading":null,"text":"Crypto-asset service providers shall identify and assess the risk of money laundering and financing of terrorism associated with transfers of crypto-assets directed to or originating from a self-hosted address. To that end, crypto-asset service providers shall have in place internal policies, procedures and controls.","marks":[],"revision":1,"text_hash":"c178beb280e5caf47d865e835d0f4af91cff9e287c5b37dda265b395e5e759af","reason":null},{"locator":"amlr/art/40/para/1/cont/1","kind":"continuation","status":"in_force","label":null,"heading":null,"text":"Crypto-asset service providers shall apply mitigating measures commensurate with the risks identified. Those mitigating measures shall include one or more of the following:","marks":[],"revision":1,"text_hash":"371191debce037f767d45c9bbd1b2046d5cee3b826f05337cd0cedc09d013f45","reason":null},{"locator":"amlr/art/40/para/1/pt/a","kind":"point","status":"in_force","label":"(a)","heading":null,"text":"taking risk-based measures to identify, and verify the identity of, the originator or beneficiary of a transfer made from or to a self-hosted address or beneficial owner of such originator or beneficiary, including through reliance on third parties;","marks":[],"revision":1,"text_hash":"2ec4e833d4f4ba443fa875756e4dc3337d7b0c197b3cd765fdaaf5dd0a68b7b4","reason":null},{"locator":"amlr/art/40/para/1/pt/b","kind":"point","status":"in_force","label":"(b)","heading":null,"text":"requiring additional information on the origin and destination of the crypto-assets;","marks":[],"revision":1,"text_hash":"08020677b6fd6e236c01b170dd4867b873445860c022474b25f9b91e16515036","reason":null},{"locator":"amlr/art/40/para/1/pt/c","kind":"point","status":"in_force","label":"(c)","heading":null,"text":"conducting enhanced ongoing monitoring of transactions with a self-hosted address;","marks":[],"revision":1,"text_hash":"0222ef87e4780bce5e4d031ebcee9d5dbeb4b04003d9ea1d2d64d0416fc2d857","reason":null},{"locator":"amlr/art/40/para/1/pt/d","kind":"point","status":"in_force","label":"(d)","heading":null,"text":"any other measure to mitigate and manage the risks of money laundering and financing of terrorism as well as the risk of non-implementation and evasion of targeted financial sanctions.","marks":[],"revision":1,"text_hash":"2ddc17673cf8f698daa8a36f3b2ddf5ab71f6ea8f8d8e698d91b76c3d58eef85","reason":null},{"locator":"amlr/art/40/para/2","kind":"paragraph","status":"in_force","label":"2.","heading":null,"text":"By 10 July 2027, AMLA shall issue guidelines to specify the mitigating measures referred to in paragraph 1, including:","marks":[],"revision":1,"text_hash":"8cf6894a536052c4b3004edf0858a4c90a69c436421a1823204078827b1bae90","reason":null},{"locator":"amlr/art/40/para/2/pt/a","kind":"point","status":"in_force","label":"(a)","heading":null,"text":"the criteria and means for identification and verification of the identity of the originator or beneficiary of a transfer made from or to a self-hosted address, including through reliance on third parties, taking into account the latest technological developments;","marks":[],"revision":1,"text_hash":"27f87fcb87e23802a18dacef6681cb5dd255e5c3b0179c7b740e1d4b415517c1","reason":null},{"locator":"amlr/art/40/para/2/pt/b","kind":"point","status":"in_force","label":"(b)","heading":null,"text":"criteria and means for the verification of whether or not the self-hosted address is owned or controlled by a customer.","marks":[],"revision":1,"text_hash":"bbc64502e4ca6306a74335076ff77539ee8bc524bc15f2a7ebc3bb9358da2dc6","reason":null}],"markdown":"---\ntitle: \"Article 40 — Measures to mitigate risks in relation to transactions with a self-hosted address\"\ntype: regulation\nlegal_status: in_force\nsource: \"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1624\"\nsource_retrieved: 2026-09-29\nshortTitle: \"Article 40 — Measures to mitigate risks in relation to transactions with a self-hosted address\"\ninstrument_type: level1_regulation\nauthority: Commission\nbinding: true\nbinding_character: binding\nmica_level2: false\nlegal_basis: \"Regulation (EU) 2024/1624\"\ninstrument: amlr\ncelex: \"32024R1624\"\nregulation: AMLR\nregulation-full: \"Regulation (EU) 2024/1624\"\narticle: 40\nstatus: in_force\nobject_id: eu.amlr.legal_text.article.40\ntext_version: \"Regulation (EU) 2024/1624, OJ L, 2024/1624, 19.6.2024\"\nsource_url: \"https://eur-lex.europa.eu/eli/reg/2024/1624/oj/eng\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\n---\n\n*In force · Regulation (EU) 2024/1624, OJ L, 2024/1624, 19.6.2024 · Checked against EUR-Lex on 26 Oct 2026 · [Official source](https://eur-lex.europa.eu/eli/reg/2024/1624/oj/eng)*\n\n1. <a id=\"p-1\"></a>Crypto-asset service providers shall identify and assess the risk of money laundering and financing of terrorism associated with transfers of crypto-assets directed to or originating from a self-hosted address. To that end, crypto-asset service providers shall have in place internal policies, procedures and controls.\n\n    Crypto-asset service providers shall apply mitigating measures commensurate with the risks identified. Those mitigating measures shall include one or more of the following:\n\n    <a id=\"p-1-a\"></a>**(a)** taking risk-based measures to identify, and verify the identity of, the originator or beneficiary of a transfer made from or to a self-hosted address or beneficial owner of such originator or beneficiary, including through reliance on third parties;\n\n    <a id=\"p-1-b\"></a>**(b)** requiring additional information on the origin and destination of the crypto-assets;\n\n    <a id=\"p-1-c\"></a>**(c)** conducting enhanced ongoing monitoring of transactions with a self-hosted address;\n\n    <a id=\"p-1-d\"></a>**(d)** any other measure to mitigate and manage the risks of money laundering and financing of terrorism as well as the risk of non-implementation and evasion of targeted financial sanctions.\n2. <a id=\"p-2\"></a>By 10 July 2027, AMLA shall issue guidelines to specify the mitigating measures referred to in paragraph 1, including:\n\n    <a id=\"p-2-a\"></a>**(a)** the criteria and means for identification and verification of the identity of the originator or beneficiary of a transfer made from or to a self-hosted address, including through reliance on third parties, taking into account the latest technological developments;\n\n    <a id=\"p-2-b\"></a>**(b)** criteria and means for the verification of whether or not the self-hosted address is owned or controlled by a customer.\n\n***\n\n[Chapter III — Customer due diligence](../chapters/iii.md) · [← Article 39](39.md) · [Article 41 →](41.md)\n"}