A virtual-asset service provider operating across the EU discovers that one of its wallet-address clusters maps to an entity appearing on the EU Consolidated Sanctions List. Transactions are flowing. The clock is ticking. Does the firm have an immediate freeze obligation? Who must be notified? Does the same position apply to the underlying beneficial owner if the listed entity owns the VASP itself? These questions do not wait for a compliance review cycle to complete.
Crypto and VASP sanctions compliance under EU legal support covers the full range of obligations arising where virtual-asset activity intersects EU financial-sanctions regulations. EU Council regulations impose an immediate asset-freeze obligation on all EU persons and entities – including crypto-asset service providers – when a counterparty, wallet, or beneficial owner is designated. As of mid-2026, the EU's Markets in Crypto-Assets Regulation (MiCA) reinforces that crypto-asset service providers are subject to the same sanctions obligations as traditional financial institutions, with no carve-out for decentralised or pseudonymous activity.
This page sets out the governing regime, the compliance tests that apply to VASPs, how EU requirements diverge from the OFAC and OFSI positions, and what a business should do before a screening alert becomes a regulatory incident.
What legal regime governs EU sanctions compliance for crypto and virtual-asset service providers?
EU financial-sanctions obligations for crypto-asset businesses flow from the relevant EU Council Regulations – the binding instruments that impose asset-freeze and prohibition requirements on all persons and entities within the EU's jurisdiction. These instruments apply to EU-incorporated entities, EU-resident individuals, and any transaction conducted in whole or in part within the EU, regardless of whether the underlying asset is a tokenised security, a stablecoin, or a utility token. MiCA, which entered into application in stages through 2024 and 2025, created a unified authorisation regime for crypto-asset service providers (CASPs – the EU term for VASPs under the Financial Action Task Force vocabulary) and embedded sanctions compliance within the supervisory expectations for that authorisation.
The competent authority for sanctions enforcement varies by member state. In practice, national competent authorities – the same bodies that supervise financial institutions under the Anti-Money Laundering Directive – carry responsibility for monitoring and enforcing sanctions obligations against CASPs. The European Banking Authority plays a coordinating role under MiCA but enforcement action is initiated at member-state level. That decentralised enforcement architecture creates a practical complexity: a CASP with passporting rights across multiple member states faces the possibility of simultaneous supervisory attention from more than one national authority.
The EU Consolidated Sanctions List is the primary screening reference. CASPs are expected to screen all customers, beneficial owners, wallet counterparties, and transaction counterparties against that list, and against any UN Security Council Consolidated List designations that have been implemented through EU Regulations. A designation at UN level is typically incorporated into EU law by a Council Regulation, making the UN list effectively a floor rather than an alternative.
The position above is the standard case. Your facts – the structure of the CASP, the member states in which it is authorised, the nature of the assets it handles, and the identity of its beneficial owners – change the analysis materially.
To assess how the EU sanctions regime applies to your virtual-asset business, contact Calder & Vance at info@caldervance.com.
What is the EU ownership-and-control test, and how does it differ from the OFAC 50 percent rule?
The EU ownership-and-control test asks whether a non-listed entity is owned or controlled by a designated person, and applies a qualitative control analysis that goes beyond a simple percentage threshold. Under EU Council Regulations, an entity that is majority-owned by a designated person is caught. But so is an entity that is controlled by a designated person through other means – through rights to appoint management, through blocking rights in governance documents, or through de facto economic direction. That control limb is what distinguishes the EU position from OFAC's approach.
OFAC applies the 50 percent rule (the rule treating entities owned 50 percent or more by one or more blocked persons in the aggregate as themselves blocked) as a mechanical, ownership-only trigger. If the aggregate holding falls below 50 percent, OFAC's bright-line test does not automatically block the entity, although OFAC's guidance notes that control through means other than ownership remains a factor in its overall analysis. The EU instrument adds the control question as a parallel, independent test. In practice this means that a CASP with a designated beneficial owner holding, say, 40 percent alongside negative-control governance rights may be caught by the EU rule but not by the OFAC rule – or may be in a grey zone requiring legal assessment under both.
The UK position under OFSI broadly mirrors the EU approach: the relevant thematic regulations extend to entities owned or controlled by a designated person. We regularly advise on transactions where the ownership percentage is clear but the control question is genuinely contested – governance arrangements, nominee relationships, and side-agreements are often where the exposure sits in virtual-asset structures.
For a CASP operating across the EU, UK, and US simultaneously – a common pattern for crypto businesses incorporated in one jurisdiction but serving customers in all three – a single counterparty can be blocked under EU rules without being blocked under OFAC, or vice versa. The compliance programme must reflect each regime's test, applied in parallel. The stricter prohibition governs the decision on whether to freeze or decline the transaction.
How should a CASP structure its sanctions screening programme to meet EU expectations?
Effective EU sanctions screening for a CASP covers five distinct layers, each of which creates a separate point of exposure if left unaddressed. The first layer is customer screening at onboarding: the CASP must screen the customer, the customer's ultimate beneficial owners (applying the ownership-and-control test), and any connected parties presented at account opening. The second layer is periodic re-screening of the existing customer book, because a person can be designated after the relationship is opened. The third layer is transaction screening: wallet addresses presented for transfer must be checked against available blockchain analytics and against the Consolidated List. The fourth layer is transaction monitoring for patterns consistent with sanctions evasion by unlisted parties – this is distinct from designation screening and draws on AML-methodology. The fifth layer is escalation and freeze: when a hit is identified, the CASP must freeze the relevant funds or crypto-assets immediately, without awaiting instruction, and must report to the relevant national competent authority within the applicable reporting window.
What does "immediately" mean in practice? EU sanctions regulations do not specify a number of hours. They impose an obligation that takes effect upon designation or upon the CASP becoming aware of the hit. In our experience, best-practice programmes treat any confirmed hit as requiring a freeze within the same business day and a notification filing within a short subsequent window – verify the current position for the relevant member state before relying on it, because national implementing rules vary.
Two common programme deficiencies deserve particular attention. First, many CASPs screen customers against a list of named persons but do not apply the control test to corporate customers' governance structures. A screening tool that returns no direct name matches does not discharge the obligation to assess whether the customer is controlled by a designated person. Second, the blockchain analytics layer is sometimes treated as a separate AML tool rather than a sanctions-screening tool. Wallet addresses associated with designated persons or with entities controlled by them are a sanctions matter, not only an AML matter, and the freeze obligation applies the moment the link is identified.
What are the cross-border and extraterritorial dimensions of EU VASP sanctions obligations?
EU sanctions apply to all EU persons and entities wherever they are located, and to all persons and entities within the EU – including non-EU nationals and non-EU-incorporated businesses that conduct activity within EU territory. For a CASP, the practical question is whether any part of its activity touches the EU: EU-resident customers, EU-incorporated counterparties, transactions routed through EU infrastructure, or euro-denominated settlements. Any of those connections is sufficient to engage EU obligations.
The US position adds a further layer. OFAC's regulations have extraterritorial reach through the secondary-sanctions architecture that applies in specific programmes. A non-EU CASP that routes transactions through US correspondent infrastructure, or that clears in US dollars, is also subject to OFAC's reach – and the two regimes do not always identify the same parties. A CASP compliant with EU rules is not automatically compliant with OFAC, and a CASP that has obtained an OFAC specific licence for a transaction is not thereby authorised under EU law.
The UK regime, administered by OFSI, adds a third dimension. Post-2021, UK designations diverge from EU designations in a growing number of cases. A counterparty that is listed under EU law may not be listed under UK law, and vice versa. For a CASP with UK and EU business, both lists must be screened, and the more restrictive prohibition governs each transaction.
Switzerland, through SECO, maintains its own sanctions ordinances, which broadly follow the EU Consolidated List but are implemented separately. A Swiss-incorporated CASP – or an EU CASP with Swiss customers – must screen against the SECO list as well. In our cross-border practice, the cumulative effect of EU, UK, US, and Swiss obligations is that a comprehensive multi-regime screening programme is not optional for any CASP with meaningful cross-border exposure.
If a transaction has already been flagged, or a notification has been missed, an early review can preserve options that narrow with time. To discuss a potential breach or a notification filing, contact Calder & Vance at info@caldervance.com.
What are the principal risk flags that signal a CASP needs specialist legal advice?
Six patterns consistently signal heightened regulatory risk for CASPs operating under EU sanctions obligations, and each warrants prompt legal assessment. First, a customer or beneficial owner whose name generates a partial or phonetic match on the Consolidated List – name-matching in virtual-asset contexts is complicated by transliteration and pseudonymous identifiers, and a decision to clear a partial match without legal review is a documented risk. Second, a corporate customer whose ownership structure includes entities in high-risk jurisdictions with indirect connections to designated persons – the control test means the chain must be traced beyond the first corporate layer. Third, a wallet address that blockchain analytics associate with a cluster linked to sanctioned activity, even where no direct designation exists – the classification of that association as a sanctions matter versus an AML matter is itself a legal question. Fourth, a notification to a national competent authority that was not made within the expected window, whether through system failure, staff error, or uncertainty about the trigger – late notification is an enforcement matter, and voluntary self-disclosure presented thoughtfully is a mitigating factor in most EU member-state enforcement regimes. Fifth, a licensing question: in some circumstances, EU law permits a specific licence authorising a transaction that would otherwise be prohibited, and assessing eligibility is a specialist task. Sixth, a corporate restructuring, acquisition, or token issuance that brings new shareholders, new governance rights, or new asset types into scope without a prior sanctions analysis.
Consider also the myth that decentralised protocols are outside the scope of EU sanctions obligations. The decentralised nature of a protocol does not affect the obligations that apply to the CASP facilitating access to it. If a CASP's smart-contract interface routes transactions to or from a designated entity's wallet, the CASP's freeze obligation is engaged. The technology architecture of the underlying protocol is not a defence.
How does Calder & Vance support EU crypto and VASP sanctions compliance?
Our practice covers the full lifecycle of EU sanctions compliance for virtual-asset businesses, from programme design through to enforcement response. We do not offer generic compliance templates; we assess the specific regulatory position of the CASP against the EU regime, map the ownership-and-control exposure across its customer book, and produce a structured programme that addresses each of the five screening layers.
In a recent matter, a European CASP onboarding institutional clients identified a beneficial-owner match at the third corporate layer of a customer group. The customer itself was not listed. We assessed the control question under the relevant EU Council Regulation, advised on the freeze obligation, prepared the notification filing to the national competent authority, and assisted with the licensing enquiry for the portions of the business relationship that were potentially licensable. The matter was resolved without enforcement action, though no outcome is guaranteed in any engagement.
We also assist with the cross-regime dimension that most EU-focused compliance programmes underserve. A CASP with EU, UK, and US exposure needs a screening architecture that applies all three ownership-and-control tests and resolves the conflicts between them. We assess eligibility, prepare and submit licence applications under the relevant EU procedures, and manage regulator queries throughout the process. For enforcement matters, we scope the apparent violation, advise on voluntary self-disclosure (VSD – the process of proactively informing the regulator of a potential breach before it is identified externally), and prepare the penalty defence.
Our work is fixed-fee at entry points for defined tasks – initial assessment, programme review, and single-transaction analysis – so a business can understand its exposure before committing to a full engagement.
Related practices
- Compliance audit and testing – Australia – sanctions programme testing and gap analysis under the Australian regime
- Crypto and VASP sanctions compliance – Japan – VASP obligations and screening requirements under Japanese sanctions rules
- Crypto and VASP sanctions compliance – OFAC – US sanctions obligations for virtual-asset businesses, including the 50 percent rule and OFAC licensing
Frequently asked questions: EU crypto and VASP sanctions compliance
How long does managing crypto sanctions exposure take under EU?
There is no single timeline: the duration depends on whether the matter is a programme review, a specific transaction assessment, or an enforcement response. A programme gap analysis for a mid-sized CASP typically runs across several weeks. A single-transaction analysis against the EU Consolidated List and the control test can be completed within days. An enforcement response – including a VSD filing and penalty defence – follows the timetable set by the national competent authority, which varies by member state. Early instruction consistently shortens the overall resolution period and preserves options that are not available once a formal investigation is opened. Verify current timelines with the relevant authority before relying on any stated period.
What are the main risks in crypto and VASP sanctions compliance under EU?
The principal risks are: failing to apply the ownership-and-control test beyond direct name matching, leaving the blockchain analytics layer disconnected from the formal sanctions-screening programme, missing the notification window after identifying a hit, and operating without a multi-regime screening architecture where EU, UK, and OFAC designations diverge. A second-order risk is regulatory equivalence: a CASP that meets AML screening standards does not automatically meet EU sanctions-screening standards, because the two obligations have different triggers, different freeze obligations, and different reporting chains. Conflating them is one of the most common programme deficiencies we encounter.
Do we need specialist counsel for crypto and VASP sanctions compliance?
For a CASP operating across multiple EU member states, or with UK or US exposure alongside EU obligations, specialist counsel adds material value. The ownership-and-control analysis under EU Council Regulations requires legal judgment, not just list-checking. The interaction between MiCA authorisation conditions and sanctions obligations is still being interpreted by national competent authorities, and the answer is not always obvious from the face of the regulation. Where a hit has been identified, or where a VASP is assessing a licensing route for a transaction that would otherwise be prohibited, legal advice determines the options available and the risk of the path chosen.
About the author
Renata Costa advises banks, payment firms, and virtual-asset businesses on sanctions screening, compliance-programme design, and financial-crime controls. She works regularly on EU CASP obligations, multi-regime screening architecture, and enforcement responses involving national competent authorities across member states. Calder & Vance – International Sanctions & Export Control Counsel.
About Calder & Vance
Calder & Vance is an independent international sanctions and export-control boutique. We advise multinationals, financial institutions, exporters, and individuals on the major regimes – OFAC and BIS in the United States, OFSI and ECJU in the United Kingdom, the EU Council regulations and the EU General Court, the United Nations Consolidated List, and the regimes of Switzerland, Canada, Australia, the UAE, Singapore, and Japan. Our work is limited to lawful compliance, licensing, delisting, enforcement defence, and due diligence. To discuss a matter, contact info@caldervance.com.
Disclaimer: This material is general information, not legal advice, and is not a substitute for advice on your specific facts. Sanctions and export-control rules change frequently and differ by regime; verify the current position before relying on anything stated here. Calder & Vance does not advise on circumventing or evading sanctions. For advice on your situation, contact info@caldervance.com.