AML/CFT compliance for CASP in France

A crypto-asset service provider (CASP) authorised under MiCA in France is an obliged entity under the French anti-money laundering and counter-terrorist financing (AML/CFT) framework, supervised by the ACPR.

Risk assessment, customer due diligence, monitoring of fiat and on-chain flows, the travel rule, sanctions screening, reports to Tracfin, internal control and training: ORWL Avocats designs, audits and defends that framework, from the authorisation file to the on-site inspection.

Who is subject to AML/CFT rules, and who supervises?

CASPs are listed as obliged entities in Article L. 561-2, 1° quater, of the French Monetary and Financial Code (CMF). They must apply all the due diligence and reporting obligations of Title VI of Book V of the Code, together with the directly applicable EU regulations: Regulation (EU) 2023/1113 on transfers of funds and certain crypto-assets (the travel rule), the EU regulations imposing restrictive measures and, from 10 July 2027, Regulation (EU) 2024/1624 (AMLR).

Unlike in most jurisdictions, the authority that grants the authorisation is not the one that supervises AML/CFT compliance. Three authorities are involved, each in its own role:

• the ACPR (Autorité de contrôle prudentiel et de résolution, the French Prudential Supervision and Resolution Authority) supervises CASPs’ compliance with AML/CFT obligations and restrictive measures (CMF, Articles L. 561-36 and L. 561-36-1); it may issue formal notices, take precautionary measures and refer cases to its Sanctions Committee, whose fines may reach EUR 100 million or 10% of turnover; only CASPs authorised exclusively for portfolio management or advice on crypto-assets fall under the AMF for AML/CFT purposes;
• the AMF (Autorité des marchés financiers, the French financial markets regulator) grants the MiCA authorisation and seeks the ACPR’s opinion on the AML/CFT part of the file; the commitments made in that file then bind the provider;
• Tracfin (the French financial intelligence unit) receives suspicious transaction reports, issues requests for information and calls for vigilance, and may object to the execution of a transaction for ten working days (CMF, Article L. 561-24).

The Direction générale du Trésor (the French Treasury) implements asset freezes (CMF, Article L. 562-4 et seq.). A CASP’s AML/CFT scope therefore goes beyond anti-money laundering in the strict sense: it covers terrorist financing, international sanctions and, increasingly, fraud and scams whose proceeds pass through crypto-assets.

A CASP’s AML/CFT framework, from risk assessment to internal control

The framework is built in a set order: each component feeds the next. The risk assessment sets the level of due diligence applied to each client; customer due diligence calibrates transaction monitoring; monitoring feeds the reports to Tracfin; internal control checks that the whole works. This is the sequence the ACPR examines, first in the authorisation file and then during its inspections.

Risk assessment and customer due diligence: what the ACPR expects

The risk assessment is the first document the ACPR reads. During its first inspections of crypto providers, it found risk assessments that were incomplete (risk factors from the sector-specific guidelines left out), seldom updated (geographic risk in particular) and sometimes unusable, because customer data had not been properly recorded. Every service, product and token offered must appear in it, and the ACPR is informed each year through the AML/CFT questionnaire.

On customer due diligence, the findings are similar: insufficient identity checks, including at providers that rely on an external specialist; identity theft detected during inspections; missing information on income, wealth, location or the activity of legal entities; risk profiles poorly defined and rarely updated. The Code requires at least two verification measures when the business relationship is entered into remotely (CMF, Article R. 561-5-2), which is the case for almost every CASP.

The firm’s work is to turn these expectations into documents that hold up during an inspection: a risk assessment that reflects the actual business, procedures that describe what the teams do rather than what the law says, and an explicit link between the client’s risk profile, the alert scenarios and the due diligence measures they trigger.

Monitoring fiat and on-chain flows

A CASP monitors two worlds. Fiat flows first: the ACPR points out that this monitoring is often neglected, although it reveals inconsistencies between a client’s deposits and declared income. On-chain flows next, tracked with a blockchain analytics tool that assigns risk factors to addresses and transactions.

The tool is not enough. The ACPR has found settings that reflect no risk policy, vague procedures, assets sold without being covered by the tool, and no retrospective reviews, although these are essential to detect addresses exposed to sanctioned entities or to terrorist financing. Tracfin makes the same point: most providers rely solely on on-chain analytics and pay too little attention to client profiles and distribution channels.

The firm works on the link between the tool and the law: adapting a blockchain analytics provider’s scores and scenarios to French obligations, framing the service contractually (outsourcing within the meaning of MiCA and DORA, access to data, exit arrangements), defining the blocking scenarios and prior approvals that the ACPR lists among good practices, and organising back-book reviews when a gap appears.

The travel rule: transfers, self-hosted addresses and technical provider

Since 30 December 2024, Regulation (EU) 2023/1113 has required every CASP to accompany each transfer of crypto-assets with information on the originator and the beneficiary, to verify its accuracy, to detect missing information on incoming transfers and to decide, under a risk-based procedure, whether to execute, reject or suspend the transfer. The regulation applies with no minimum amount. Ordinance No 2024-937 of 15 October 2024 aligned the CMF with it, and the EBA guidelines set out how it is to be applied.

Self-hosted addresses, often called unhosted wallets, concentrate the difficulties. Where a transfer above EUR 1,000 comes from or goes to a self-hosted address, the CASP must take adequate measures to establish that the address is owned or controlled by its client (Regulation (EU) 2023/1113, Articles 14 and 16). The acceptable methods (message signing, micro-transaction, attestation) and the level of proof required vary with the risk. The firm helps set a defensible policy: neither a blanket refusal of self-hosted addresses, which cuts the provider off from part of its client base, nor acceptance without documented controls, which the ACPR would flag.

Choosing a travel-rule technical provider raises legal questions as much as technical ones: interoperability with the protocols used by counterparties, treatment of transfers to providers not covered, retention of personal data, allocation of liability in the event of failure. The contract and the internal procedure must describe concretely what happens when information is missing, rather than restate the regulation’s obligations: that is precisely the shortcoming the ACPR flags in authorisation files.

Restrictive measures and asset freezing

International sanctions form a separate body of rules from AML/CFT but sit within the same framework. The obligation is one of result and applies without delay: identify designated persons, make no crypto-asset available to them, freeze assets and report the freeze to the Direction générale du Trésor (CMF, Article L. 562-4 et seq.). Sectoral measures come on top of individual freezes: Regulation (EU) No 833/2014, for instance, prohibits the provision of crypto-asset wallet, account and custody services to persons established or resident in Russia.

Since 30 December 2025, the EBA guidelines EBA/GL/2024/15, with which both the AMF (Position DOC-2025-02) and the ACPR have declared they comply, have required CASPs to have dedicated policies, procedures and internal controls: selection and calibration of the screening system, screening of clients and transfers, alert handling, detection of entities owned or controlled by a designated person, identification of attempts at circumvention, freezing of incoming transfers on a suspense account, regular testing of the framework and escalation of weaknesses to the management body. The firm audits these procedures and assists the provider in its dealings with the Treasury when a freeze or an exemption request arises.

Reporting to Tracfin and answering its requests

Crypto providers have become front-rank reporting entities. According to Tracfin’s 2024 annual report, they filed 3,073 suspicious transaction reports in 2024, up from 1,449 in 2023, and climbed from fifteenth place among contributors in 2022 to sixth. Tracfin sent them 875 requests for information, up 56.5%. The National Risk Assessment still rates the sector as very high risk, and reporting remains concentrated on five providers, which account for close to 72% of the flow.

Tracfin considers that the quality of the reports leaves much room for improvement: poorly structured statements of facts, raw data without analysis, suspicion not properly characterised, too few complex or network typologies, tax fraud almost never reported. The ACPR, for its part, notes shortcomings in content and filing times, often linked to a lack of resources. The typologies most reported are money laundering, scams and the purchase of child sexual abuse material, followed by terrorist financing and sanctions evasion. Since Act No 2025-532 of 13 June 2025, the use of services that anonymise or obscure crypto-asset transactions is also a statutory indication giving rise to a presumption of money laundering (French Criminal Code, Article 324-1-1).

The firm assists with the drafting of sensitive suspicious transaction reports and replies to requests for information, making sure that the suspicion is characterised and the report filed within the time limit of Article L. 561-15 of the CMF. It also steps in when Tracfin exercises its right to object to a transaction or issues a call for vigilance, and when a business relationship raises the question of whether to maintain or end it.

Internal control, governance and staff training

Internal control is, according to the ACPR, the component most often embryonic at crypto providers: permanent and periodic controls barely developed, plans that specify neither the nature of the controls, nor who performs them, nor how often. Governance suffers from the same weakness: senior management and the supervisory body lack the information that would let them satisfy themselves that the business is compliant. The ACPR expects regular reporting of indicators (average transaction size, number of alerts per scenario and conversion rate into enhanced examinations and then into reports, detection and handling times) and teams who combine product knowledge with knowledge of money laundering, tax fraud and terrorist financing schemes.

Regular staff training is a legal obligation (CMF, Article L. 561-34). ORWL Avocats runs AML/CFT training sessions designed for CASP teams: senior management, the compliance officer, client-facing and monitoring staff. The sessions start from the typologies observed by Tracfin and the ACPR’s findings, and are tailored to the provider’s services and tokens. They fit into the training plan that internal control must document.

What the ACPR finds during its inspections

At the AML/CFT workshop of the ACPR-AMF Fintech Forum on 9 October 2025, the ACPR reviewed its first cycle of supervision of crypto providers: information requests, close-supervision meetings, visits and on-site inspections for a significant share of the riskiest or most active providers. Depending on the seriousness of the findings, these inspections led to follow-up letters, administrative enforcement measures and, in some cases, deregistration. The table summarises the weaknesses found and the corresponding expectations.

Faced with an inspection, the provider is better off preparing the mission than enduring it: a data request received several weeks before the investigations, which presupposes usable data; interviews between the inspection team and staff; a reply to the report; then, where applicable, proceedings before the Sanctions Committee. The firm is present at each stage and builds, from the first exchanges, the position that will be defended to the end.

What changes with the AMLR and AMLA

The EU package adopted in 2024 replaces the logic of directives with a single regulation, Regulation (EU) 2024/1624 (AMLR), applicable from 10 July 2027, supplemented by Directive (EU) 2024/1640 and by Regulation (EU) 2024/1620 establishing the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA), operating since 1 January 2025 in Frankfurt. For a CASP, three changes matter:

• harmonised due diligence rules across the Union, which narrow the gap between national practices and tighten the scrutiny of beneficial owners and politically exposed persons;
• an express prohibition on keeping anonymous accounts and on offering any service that anonymises or obscures transactions, including anonymity-enhancing tokens (AMLR, Article 79), which the ACPR has already pointed out to crypto providers;
• direct supervision by AMLA of certain high-risk cross-border financial institutions, including crypto-asset service providers, and the obligation under Article 9 of the AMLR to have internal policies and controls that ensure restrictive measures are implemented.

Frameworks built today should anticipate this: a risk assessment and procedures written along the AMLR’s categories will avoid a rebuild in 2027.

How ORWL Avocats works with CASPs

CASPs instruct the firm at four moments. At the authorisation stage, to design a framework suited to a business that deals in crypto-assets: the AML/CFT part of a CASP file is more demanding than under the former French PSAN registration, with detailed measures on politically exposed persons, the travel rule and the internal control plan. When the ACPR or the AMF sends an information request or opens an inspection. When the business changes: new service, new token, new countries. And on a specific question about the framework’s compliance with the texts.

Depending on the need, the firm drafts or reviews: it writes the risk assessment and the procedures, or advises the compliance officer and the consultant who write them. It signs the deliverables that carry weight: an opinion on a qualification, the analysis of a structure, a reply to the regulator. It does not replace the provider’s compliance function, which remains responsible for applying the framework day to day.

The requests it receives most often concern adapting blockchain analytics tools to French rules, structures that use a business introducer specific to crypto-assets, AML/CFT governance and contracts with technical providers. Where needed, the firm draws on its network of experts: blockchain analytics providers, identity verification specialists, compliance consultants and chartered accountants.

Why work with ORWL Avocats?

ORWL Avocats has assisted crypto-financial services before the AMF and the ACPR since the first French PSAN registrations. The firm recently advised a payment institution on its combined payment and CASP authorisation, and a foreign provider on its inbound CASP authorisation with the AMF. The practice is ranked in Chambers FinTech and recognised by Leaders League in fintech law.

A consultant or a software vendor installs the framework; the lawyer answers for its compliance and defends it. Qualifying a business, a flow or a relationship under the CMF, MiCA and the EU regulations is legal work, and it is on that qualification that the ACPR bases its findings. The analysis of a sensitive business relationship, of a suspicious transaction report or of a response to an inspection is covered by the French lawyer’s professional secrecy (secret professionnel) and cannot be used against the provider. The lawyer bears professional liability for what they write.

A partner leads every matter: they set the strategy, run the key calls and decision meetings, and sign the deliverables that carry weight. The team is adjusted to each assignment so that the right expertise is on the file, from the first exchange with the regulator to proceedings before the Sanctions Committee.