--- title: "Article 40 — Measures to mitigate risks in relation to transactions with a self-hosted address" type: regulation legal_status: in_force source: "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1624" source_retrieved: 2026-09-29 shortTitle: "Article 40 — Measures to mitigate risks in relation to transactions with a self-hosted address" instrument_type: level1_regulation authority: Commission binding: true binding_character: binding mica_level2: false legal_basis: "Regulation (EU) 2024/1624" instrument: amlr celex: "32024R1624" regulation: AMLR regulation-full: "Regulation (EU) 2024/1624" article: 40 status: in_force object_id: eu.amlr.legal_text.article.40 text_version: "Regulation (EU) 2024/1624, OJ L, 2024/1624, 19.6.2024" source_url: "https://eur-lex.europa.eu/eli/reg/2024/1624/oj/eng" check_status: matched verified: true last_checked: 2026-10-26 --- *In force · applies from 10 Jul 2027 · Regulation (EU) 2024/1624, OJ L, 2024/1624, 19.6.2024 · Checked against EUR-Lex on 26 Oct 2026 · [Official source](https://eur-lex.europa.eu/eli/reg/2024/1624/oj/eng)* 1. Crypto-asset service providers shall identify and assess the risk of money laundering and financing of terrorism associated with transfers of crypto-assets directed to or originating from a self-hosted address. To that end, crypto-asset service providers shall have in place internal policies, procedures and controls. Crypto-asset service providers shall apply mitigating measures commensurate with the risks identified. Those mitigating measures shall include one or more of the following: **(a)** taking risk-based measures to identify, and verify the identity of, the originator or beneficiary of a transfer made from or to a self-hosted address or beneficial owner of such originator or beneficiary, including through reliance on third parties; **(b)** requiring additional information on the origin and destination of the crypto-assets; **(c)** conducting enhanced ongoing monitoring of transactions with a self-hosted address; **(d)** any other measure to mitigate and manage the risks of money laundering and financing of terrorism as well as the risk of non-implementation and evasion of targeted financial sanctions. 2. By 10 July 2027, AMLA shall issue guidelines to specify the mitigating measures referred to in paragraph 1, including: **(a)** the criteria and means for identification and verification of the identity of the originator or beneficiary of a transfer made from or to a self-hosted address, including through reliance on third parties, taking into account the latest technological developments; **(b)** criteria and means for the verification of whether or not the self-hosted address is owned or controlled by a customer. *** [Chapter III — Customer due diligence](../chapters/iii.md) · [← Article 39](39.md) · [Article 41 →](41.md)