No, the EU does not ban private wallets or anonymous cryptocurrencies

… but the legislative package, which has now taken another step towards adoption, comes with all sorts of harassment for Bitcoin and other cryptocurrencies. The hope of seeing Lightning or Monero on EU stock exchanges in the future is likely to fall to zero.

If you have read in the last few days that the EU would now ban its own Bitcoin wallets or privacy coins, those were gross exaggerations. Both your own wallets and privacy coins such as Monero will remain permitted.

The fact is, however, that a committee in the EU Parliament has confirmed a legislative package from the EU Commission, so that Parliament can now vote on the law on April 24th. It is also a fact that there is little chance that they will reject the law, so it will come into force from 2027.

The bill itself is more than 300 pages long. It is primarily about money laundering. Cryptocurrencies are somewhat of a side issue, and what you read about them will come as no surprise to anyone who even follows the regulatory debate out of the corner of their eye. The so-called “obliged entities” – these include crypto exchanges, payment service providers or brokers, but not the developers of software and hardware wallets – will have to do so in the future

• comply with special duties of care when accepting or paying out amounts of more than 1,000 euros,
• From the first Satoshi that flows to or comes from “self-hosted” wallets, assess risks and take measures against money laundering, such as verifying the recipient or sender, researching where the money comes from and more.

However, they are forbidden

• to use anonymous bank accounts, payment methods, mailboxes or crypto accounts,
• To use methods that anonymize customer accounts or conceal traces of their transactions, for example through mixers or privacy coins, possibly also through Lightning transactions.

NFTs are excluded. These are not yet covered by any laws, but “the evolution of these markets is being monitored.” On December 30, 2024, the commission will present a report that also takes NFTs into account and, if necessary, propose adjustments to the law.

All of this, explains Anja Hirschel, the Pirates’ top candidate in the European Parliament, “isn’t really surprising, but I wonder whether we’re overshooting the mark.”

“At what point does a legitimate fight against money laundering become mass surveillance?”

In general, the EU is reacting with this law to the fact that money laundering and terrorist financing are always taking new paths. What else should it do other than adapt its laws to reality?

As far as cryptocurrencies are concerned, the do’s and don’ts contained are an almost inevitable consequence of the EU implementing the FATF’s Travel Rule. It is not without reason that other jurisdictions also issue almost identical regulations, even Switzerland, which is actually liberal, and it is not without reason that the German Ministry of Finance dictated relatively similar regulations under Olaf Scholz.

Users themselves are not directly affected. You can continue to use private wallets, privacy coins and Lightning as much as you want. However, as soon as they transfer coins to exchanges, they are indirectly affected. You will not be able to trade privacy coins on exchanges at all – this is practically forbidden by the law – deposits via Lightning will probably not be possible, and the exchange will have to investigate more carefully when transferring money from private wallets.

Basically, an exchange only needs to know that the address to which a user pays out coins also belongs to the user. Brokers from Switzerland already do this using various methods, such as screenshots or signatures. For inconspicuous transactions, it might even be enough to confirm with a checkmark that you have a wallet.

Anja Hirschel recognizes that a law of this kind was unavoidable. “But the fact that you have to record the slightest movements of crypto transactions, for example, goes too far. A threshold amount could have been defined, as with cash, but this was deliberately omitted.”

The computer scientist also fears what will happen “if I combine the new law with others, such as the planned payment card for refugees or citizens’ benefit recipients, as well as with Europol queries. Then something can grow out of it that we don’t want. We have to be clear about where we stop and at what point a legitimate fight against money laundering turns into mass surveillance.”

In addition, the politician is concerned that the law preventively strangles useful technologies that create privacy for digital payments without the risk of misuse for money laundering, “for example with anonymous issuing and transparent receipt,” as DigiCash was planning at the time.

There is a little room for interpretation

The Pirates faction therefore did not agree to the draft. But, realistically, Anja Hirschel sees little scope to change the strong majorities before the final vote. The national parliaments will therefore soon deal with the legislation so that it can come into force in 2027.

There are likely to be some national differences. Some parts of the law leave room for interpretation. What are “due diligence measures” that crypto exchanges should take when users pay out more than 1,000 euros? Or what are “measures to mitigate risks” that are always required for payments to or from privately managed wallets?

The law does make an effort to provide some clarity through definitions: “Due diligence” includes, for example, verifying the identity of customers and the recipients of transactions, obtaining information about their business relationship, checking whether a party involved is subject to financial sanctions; They can also include a concrete examination of the employment situation, ongoing monitoring of transactions and more. What exactly is necessary and when is likely to be up to the interpretation of national legislators or supervisors.

The “Measures to mitigate risks” are also defined. They should “include one or more of the following measures,” namely the verification of the identity of the sender and recipient, the obtaining of further information about the origin and destination of the crypto transaction, the ongoing monitoring of these transactions and other measures, such as checking whether Those involved are subject to sanctions. What exactly is the difference between “due diligence” and “measures” and when what is required and to what extent remains an open question.

In this sense, the new law will initially concern the national parliaments. Nothing fundamental changes for crypto companies, as they are already preparing to meet the requirements of the Travel Rule almost everywhere. But it certainly won’t be any more pleasant, simpler, more private or more data-efficient.