Sanctions Screening vs. Transaction Monitoring: What Does Your EU Regulator Actually Require?

What confusion do compliance officers keep making?

If you run a small crypto-asset service provider in the EU, you've probably heard both terms thrown around interchangeably: sanctions screening and transaction monitoring. Compliance consultants bundle them. Vendors sell them together. Regulators mention them in the same breath.

But they are legally separate obligations with different legal bases, different triggers, different outputs, and different consequences when you get them wrong. Conflating the two is not just imprecise — it creates real compliance gaps that regulators will find.

This article breaks down what each obligation requires, where the legal authority comes from, and what a minimum viable compliance stack looks like for a small CASP operating in the EU as of 10 July 2026.

What are the two separate legal regimes?

The distinction matters because these obligations come from entirely different parts of EU law.

Sanctions screening

Sanctions screening is governed by EU Council sanctions regulations — the individual restrictive measures adopted under the Common Foreign and Security Policy (CFSP). The implementing guidance comes from two EBA guidelines published in 2024:

• EBA GL/2024/14 — Guidelines on internal policies, procedures and controls to ensure the implementation of Union and national restrictive measures
• EBA GL/2024/15 — Guidelines on internal policies, procedures and controls to ensure the implementation of Union and national restrictive measures under Regulation (EU) 2023/1113

These guidelines apply from 30 December 2025. EBA GL/2024/14 applies across financial institutions in the EBA's supervisory remit; EBA GL/2024/15 is specific to PSPs and CASPs carrying out transfers of funds or crypto-assets.

AML transaction monitoring

Transaction monitoring falls under the anti-money laundering framework. Current obligations come from the AML/CFT framework and national implementation, while AMLR 2024/1624 Article 26 will apply directly from 10 July 2027. The main EBA guidance for CASP ML/TF risk is:

• EBA GL/2024/01 — Guidelines amending the ML/TF Risk Factors Guidelines to add CASP-specific risk factors and mitigating measures

These are different legal instruments, drafted by different EBA working groups, with different compliance timelines.

How do sanctions screening and risk scoring compare side by side?

Here is what each obligation actually requires:

The key distinction: sanctions screening is a binary check (is this entity on a list or not?), while transaction monitoring is behavioral analysis (does this pattern look suspicious?). Both are mandatory. Neither can substitute for the other.

Does the EBA explicitly expect blockchain analytics?

"CASPs should apply advanced analytics tools to assess the risk associated with transactions, particularly transactions involving self-hosted addresses."

EBA GL/2024/01 — Guidelines amending the ML/TF Risk Factors Guidelines

The important nuance: EBA GL/2024/01 is still risk-based. It also says firms should assess whether advanced analytics tools, including distributed ledger or blockchain analytics tools, are necessary in light of their business and customer transaction risk. A small CASP can calibrate the tooling, but a decision to use no on-chain analytics should be backed by a documented ML/TF risk assessment.

Does a "risk-based approach" mean small CASPs can skip things?

The most dangerous misunderstanding in CASP compliance is the belief that the "risk-based approach" allows small firms to skip obligations entirely. It does not.

What scales with the risk-based approach

• The intensity and frequency of ongoing monitoring
• The sophistication of your monitoring tools (a 10-person CASP doesn't need the same system as Binance)
• The depth of enhanced due diligence measures

What does NOT disappear — core obligations for EU CASPs

• Sanctions screening
• Customer due diligence (CDD)
• Ongoing monitoring of the business relationship
• Travel Rule compliance
• STR filing with your national FIU
• Maintaining a designated compliance function
• Record-keeping for a minimum of 5 years

Is there a threshold for CASP-to-CASP transfers under the Travel Rule?

The Transfer of Funds Regulation (TFR, Regulation 2023/1113) has applied since 30 December 2024. The EU implementation differs from the FATF minimum in two important ways:

• No de minimis threshold for CASP-to-CASP transfers. Unlike the FATF threshold option of no higher than USD/EUR 1,000, the EU requires originator and beneficiary information for every in-scope CASP-to-CASP transfer, regardless of amount.
• Self-hosted wallet verification threshold: EUR 1,000. For transfers to or from self-hosted addresses exceeding EUR 1,000, the CASP must verify whether the address is effectively owned or controlled by the CASP's customer.

If your Travel Rule solution only sends or checks originator and beneficiary data above the FATF threshold, it is not aligned with the EU implementation.

What does the Chainalysis free oracle cover — and what doesn't it?

Many small CASPs use the Chainalysis free sanctions oracle as their screening solution. It's important to understand exactly what this covers.

This doesn't mean the free oracle is useless. It can serve as a screening layer in a multi-tool setup. But relying on a binary check without your own audit trails, escalation workflow, and list/version evidence means you may not be able to prove to your regulator what you screened, when, or against which data source.

What do regulators actually check?

The theory is one thing. Here's what primary supervisory material shows regulators are checking in practice.

CySEC (Circular C685)

CySEC published Circular C685 on 27 February 2025 to regulated entities including CASPs. It reported thematic inspections of sanctions screening systems, focused on UN and EU sanctions lists and relevant U.S. and UK screening practices. CySEC said overall effectiveness and efficiency required improvement, and pointed firms to guidance on ongoing screening, screening-system management, quality assurance, testing, tuning, and optimisation.

EBA supervisory expectations

The EBA's Travel Rule Guidelines require CASPs to have policies and procedures for detecting missing or incomplete transfer information and for managing transfers that lack required information. EBA GL/2024/01 separately points CASPs toward advanced analytics tools for assessing transaction risk, particularly where self-hosted addresses are involved.

AMLA

The EU's new Anti-Money Laundering Authority started operations in summer 2025. As of 10 July 2026, direct supervision has not yet started: AMLA says the first selection process will take place in 2027 and selected entities will transfer to EU-level supervision from 2028. CASPs can be in scope if they meet the cross-border and risk criteria.

What is the minimum viable compliance stack for a small CASP?

If you're a CASP with 5-30 employees operating under MiCA or transitional provisions, here is the minimum set of tools and processes you need:

You don't need every tool on day one, and the risk-based approach allows you to calibrate sophistication to your actual transaction volume and risk profile. But each line needs either operational coverage or a documented risk-based rationale for the chosen control level.

What is the key regulatory timeline?

Here is where things stand as of 10 July 2026, and what's still coming:

If you are reading this on 10 July 2026, the first four rows are already in effect. The AMLR is one year away, and AMLA direct supervision is scheduled to begin in 2028.

What does this mean for your compliance program?

Stop treating sanctions screening and transaction monitoring as one thing. They are two separate obligations, from two separate legal regimes, with separate EBA guidance. Your compliance program needs distinct policies, procedures, and controls for each.

The risk-based approach is not a loophole. It lets you calibrate the intensity of controls, not eliminate them. A 10-person CASP doesn't need the same transaction monitoring system as a major exchange — but it does need a system.

Free tools can be part of the stack, but they cannot be the whole stack. Even if a free tool includes data from multiple sanctions regimes, it gives you a binary result without your firm's audit trail. If you have no timestamped records, you have no durable proof of what you screened.

The regulatory environment is live, but not every future element has started. MiCA and the Travel Rule apply. EBA sanctions guidelines are in effect. AMLA is operational, with direct supervision scheduled for 2028. The question is not whether you need to comply — it's whether you can demonstrate compliance when your regulator asks.