The new EU regulation on information accompanying transfers of funds and certain crypto-assets (the AML Regulation) requires crypto-asset service providers to give public authorities information about transfer participants on request. This raises questions about permissible interference with privacy. Do the rules adequately protect participants’ privacy rights?
Participants and the information disclosed to authorities
The AML Regulation will apply alongside MiCA, the EU Markets in Crypto-Assets Regulation. Providers must attach information about the originator and beneficiary to every crypto-asset transfer and disclose it to authorities on request.
The originator is a person holding crypto-assets with a provider and authorising, ordering or initiating a transfer. The beneficiary is the intended recipient. For crypto-assets and providers, the regulation refers to MiCA’s definitions. In brief, a provider is a business supplying services such as portfolio administration and management, exchange for fiat money or other crypto-assets, or order execution. A crypto-asset is a digital representation of value or a right electronically transferable and storable using distributed ledger or similar technology. Thus information about anyone ordering or receiving a transfer will be disclosed where a provider participates.
Every transfer will include identifying information: names, distributed ledger addresses or crypto-asset account numbers and official identifiers such as LEIs. It will additionally include the originator’s address, official personal document number and customer identification number. Providers must verify accuracy using reliable, independent documents or data. They can therefore be expected to request ID scans, electronic identification such as ePUAP or a consultation. If information is unverified or incomplete, the originator’s provider may refuse execution and the beneficiary’s may reject or return the transfer. For transfers to unhosted addresses, meaning non-custodial wallets not holding clients’ private keys, providers must obtain the information and ensure individual identification of the transfer. Above EUR 1,000 they must also assess whether the originator owns or controls the address.
Authorities will therefore access extensive information. It may reveal not just transfers and participants but private life, such as shopping and leisure locations. Everyday crypto-asset use, principally bitcoin, is increasingly common: BTC Map alone lists 269 places accepting bitcoin in Poland.
Privacy and disclosure to public authorities
Privacy is a fundamental human right protected internationally and in European treaties: Article 12 of the Universal Declaration of Human Rights, the European Convention on Human Rights and the EU Charter of Fundamental Rights (the Charter). Both European instruments form part of EU law, and the Charter has treaty-equivalent status. EU legislation must comply with its rights and principles; conflicting acts should be removed from the legal order. Article 47 of Poland’s Constitution also guarantees privacy.
Privacy means freedom from public interference in personal life, including respect for private and family life, home and communications. It encompasses financial data, especially bank accounts, money, crypto-assets and transactions. Interference exists regardless of sensitivity or actual inconvenience: see the CJEU judgment of 8 April 2014, joined cases C-293/12 and C-594/12, paragraph 33, and Österreichischer Rundfunk and Others, C-465/00, C-138/01 and C-139/01, EU:C:2003:294, paragraph 75. Authorities’ access is an additional interference: the first judgment, paragraph 35 and cited case law. Access to crypto-transfer information therefore unquestionably interferes with originators’ and beneficiaries’ privacy.
Conditions for permissible authority access
Privacy is not absolute. Restrictions commonly grant state access for general-interest objectives, such as national security or combating money laundering and terrorist financing.
Article 52 of the Charter requires a legal basis—an EU regulation or directive—and necessity genuinely serving recognised general-interest objectives. CJEU case law has developed two cumulative conditions under the latter requirement.
First, access may concern persons suspected of planning, committing or having committed a serious offence. Second, it requires prior approval by a court or independent administrative body on a reasoned authority request within criminal proceedings.
Access must therefore be examined individually. The reviewing body should assess reasonable suspicion of an offence or a connection with criminal events and whether its seriousness justifies interference. This should rest primarily on evidence, rather than authorities’ assertions alone. Failure of either condition should lead to refusal.
The AML Regulation and disclosure conditions
The regulation does not establish procedural prerequisites for access. Article 25 merely requires compliance with national procedures, prompt disclosure and requests exclusively from authorities combating money laundering or terrorist financing.
This is ineffective and does not guarantee privacy. Numerous CJEU judgments under Articles 7, 8 and 52 have found national access rules incompatible with the Charter. Member States implement procedures incorrectly: common failures include no prior independent review, lack of reviewer independence, excessively broad data or no requirement for proceedings connected with the disclosure.
The rules may also create unequal privacy protection across Member States. One may provide appropriate procedures while another does not. To ensure uniform application, including privacy, the EU should establish common European access rules for information collected under the regulation.
The analysis therefore shows insufficient protection for originators’ and beneficiaries’ private lives. We can only hope Member States introduce procedures consistent with CJEU guidance. Non-compliance may lead to annulment as contrary to Articles 7 and 8 read with Article 52 of the Charter.
